Function at 0x14026ea60
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x17], rax
movups xmm0, xmmword [rdx + 0x28]
mov rsi, qword [rdx + 0x20]
xor ebx, ebx
mov rdi, rcx
mov qword [rbp - 0x11], rdx
mov r15d, ebx
mov qword [rbp - 0x39], rsi
movdqu xmmword [rbp - 9], xmm0
cmp byte [rcx + 0x70], bl
je 0x14026eaf2
mov al, byte [rcx + 0x103]
cmp byte [rcx + 0x104], bl
je 0x14026eac8
test al, al
je 0x14026ead6
mov r14, qword [rcx + 0x40]
mov rdx, qword [rcx + 0x68]
jmp 0x14026eade
test al, al
jne 0x14026ead6
mov r14, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x60]
jmp 0x14026eade
mov r14, qword [rcx + 0x50]
mov rdx, qword [rcx + 0x58]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop dword [rax + rax]
mov r15, rax
jmp 0x14026eb03
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColorBrush]
nop dword [rax + rax]
mov r14, rax
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop dword [rax + rax]
mov ecx, dword [rbp + 3]
mov r14, rax
mov r9d, dword [rbp - 1]
mov r8d, dword [rbp - 5]
mov edx, dword [rbp - 9]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_Rectangle]
nop dword [rax + rax]
test r14, r14
je 0x14026eb50
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop dword [rax + rax]
test r15, r15
je 0x14026eb67
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop dword [rax + rax]
mov r13d, 1
mov rcx, rsi
mov edx, r13d
call qword [0x1403ad480]
nop dword [rax + rax]
mov cl, byte [rdi + 0x103]
mov dword [rbp - 0x3d], eax
cmp byte [rdi + 0x104], bl
je 0x14026eb9b
test cl, cl
je 0x14026eba4
mov ecx, 0x3ff
jmp 0x14026eba9
test cl, cl
mov ecx, 0x3fd
je 0x14026eba9
mov ecx, 0x3fe
call fcn.1400551f0
and eax, 0xffffff
mov rcx, rsi
mov edx, eax
call qword [sym.imp.GDI32.dll_SetTextColor]
nop dword [rax + rax]
mov dword [rbp - 0x59], eax
mov eax, dword [rdi + 0x80]
neg eax
mov rax, qword [rdi + 0xb0]
sbb r12d, r12d
mov qword [rbp - 0x21], rax
mov rax, qword [rdi + 0x98]
and r12d, 0x20000
add r12d, 0x25
mov qword [rbp - 0x19], rax
mov dword [rbp - 0x65], r12d
xor eax, eax
lock cmpxchg dword [0x14038b0f0], r13d
jne 0x14026ebf7
mov eax, dword [0x140389de8]
mov r14d, 4
test eax, eax
jne 0x14026f17f
mov ecx, 0x338
mov dword [rbp - 0x61], ebx
mov dword [rbp - 0x5d], ebx
mov rdi, rbx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x29], rbx
mov dword [rbp - 0x55], ebx
call fcn.140091688
mov qword [rbp - 0x31], rax
test rax, rax
je 0x14026f0e8
or dword [rbp - 0x41], 0xffffffff
lea r14, [rax + 7]
mov r15d, dword [rbp - 0x41]
lea rdi, [0x140319602]
mov ecx, ebx
mov r12d, ebx
mov esi, ebx
mov r13d, 0x67
movzx eax, byte [rdi - 1]
movzx r11d, byte [rdi - 2]
movzx r10d, byte [rdi + 2]
shl r11d, 8
or r11d, eax
shl r10d, 8
movzx eax, byte [rdi]
lea rdi, [rdi + 8]
shl r11d, 8
or r11d, eax
movzx eax, byte [rdi - 7]
shl r11d, 8
or r11d, eax
movzx eax, byte [rdi - 5]
or r10d, eax
xor esi, r11d
movzx eax, byte [rdi - 4]
mov r9d, esi
shl r10d, 8
or r10d, eax
movzx eax, byte [rdi - 3]
shl r10d, 8
or r10d, eax
xor r12d, r10d
xor r9d, r12d
xor r9d, 0xac987321
lea eax, [r9 + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, r9d
rol eax, 0xa
add edx, eax
xor esi, edx
lea eax, [rsi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, esi
rol eax, 2
sub edx, eax
xor r9d, edx
imul edx, r9d, 0x605e
mov eax, r9d
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor r9d, edx
mov edx, r9d
xor edx, 0xab69605e
sub eax, edx
xor esi, eax
mov eax, esi
mov r8d, esi
xor eax, 0x137f
ror r8d, 6
imul edx, eax, 0xab69
xor r8d, edx
xor r9d, r8d
lea eax, [r9 + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, r9d
rol eax, 2
add edx, eax
xor esi, edx
lea eax, [rsi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 8
sub edx, eax
xor r9d, edx
mov eax, r9d
mov r8d, 0xab69605e
xor eax, r8d
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, r9d
ror eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, esi
shr eax, 0xa
xor edx, eax
xor edx, r9d
mov r9d, 0x605e
mov eax, edx
not eax
ror eax, 5
add eax, r9d
imul eax, eax, 0x7f1
xor esi, eax
lea r12d, [rsi - 0x7f1]
xor r12d, edx
xor r12d, r8d
mov eax, r12d
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, r12d
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [rsi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor r12d, edx
mov eax, r12d
mov r8d, r12d
xor eax, 0x137f
ror r8d, 9
imul edx, eax, 0x605e
add r8d, edx
xor esi, r8d
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor r12d, edx
xor esi, r12d
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul edx, eax, 0x137f
sub edx, 0xd0dd417
xor r12d, edx
lea eax, [r12 - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, r12d
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [rsi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor r12d, edx
lea eax, [r12 - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, r12d
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, r9d
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor r12d, edx
mov eax, r12d
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, r12d
xor r12d, r15d
rol eax, 2
mov byte [r14], r12b
mov r15d, r10d
ror r12d, 8
mov byte [r14 - 1], r12b
lea r14, [r14 + 8]
ror r12d, 8
xor edx, eax
xor edx, ecx
mov byte [r14 - 0xa], r12b
xor esi, edx
ror r12d, 8
mov byte [r14 - 0xc], sil
mov ecx, r11d
ror esi, 8
mov byte [r14 - 0xd], sil
ror esi, 8
mov byte [r14 - 0xe], sil
ror esi, 8
mov byte [r14 - 0xf], sil
mov byte [r14 - 0xb], r12b
ror esi, 8
ror r12d, 8
sub r13, 1
jne 0x14026ec63
mov rsi, qword [rbp - 0x39]
mov rax, rbx
mov r15, qword [rbp - 0x31]
mov cl, bl
mov r12d, dword [rbp - 0x65]
mov rdi, rbx
mov r14d, ebx
mov r13, rbx
mov edx, 0x338
xor cl, byte [rax + r15]
inc rax
cmp rax, rdx
jb 0x14026ef5a
movzx eax, cl
cmp rax, qword [0x140319938]
je 0x14026ef7b
mov dword [rbp - 0x55], 0xc004d501
jmp 0x14026ef8c
mov rdi, r15
mov qword [rbp - 0x49], r15
mov r15, rbx
mov qword [rbp - 0x29], rdx
mov r13, rdx
test r15, r15
je 0x14026ef99
mov rcx, r15
call fcn.14009447c
cmp dword [rbp - 0x55], ebx
jl 0x14026f0e8
xor edx, edx
mov byte [rdi + r13 - 1], bl
lea r15, [0x14038a340]
mov rcx, r15
lea r8d, [rdx + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
cmp byte [rdi], bl
je 0x14026f0f5
mov r13d, 0xc000007b
mov rdx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], bx
jne 0x14026efd1
lea rdi, [rdi + rax*2]
mov eax, dword [rbp - 0x5d]
lea rcx, [rax + rax*2]
lea r15, [r15 + rcx*8]
xor ecx, ecx
mov r8, r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
nop dword [rax + rax]
test eax, eax
je 0x14026f0e4
mov rax, qword [r15]
mov ecx, 0x5a4d
mov r14d, ebx
cmp word [rax], cx
je 0x14026f017
mov r14d, r13d
jmp 0x14026f063
movsxd rcx, dword [rax + 0x3c]
cmp ecx, 0x10000000
jae 0x14026f012
add rcx, qword [r15]
cmp rcx, qword [r15]
jb 0x14026f012
cmp dword [rcx], 0x4550
jne 0x14026f012
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
sub ax, dx
mov edx, 0xfeff
test dx, ax
je 0x14026f051
mov r14d, 0xc000000d
jmp 0x14026f063
mov rax, qword [rcx + 0x88]
mov qword [r15 + 0xc], rax
mov eax, dword [rcx + 0x50]
mov dword [r15 + 8], eax
mov eax, dword [rdi + 2]
mov r13d, ebx
add rdi, 6
mov dword [rbp - 0x65], eax
test eax, eax
je 0x14026f0c6
mov rdx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], bl
jne 0x14026f07b
inc rdi
add rdi, rax
test r14d, r14d
js 0x14026f0b5
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
je 0x14026f0de
mov eax, dword [rbp - 0x61]
lea r8, section..data
mov qword [r8 + rax*8], rdx
jmp 0x14026f0b8
mov eax, dword [rbp - 0x61]
inc eax
inc r13d
mov dword [rbp - 0x61], eax
cmp r13d, dword [rbp - 0x65]
jb 0x14026f074
inc dword [rbp - 0x5d]
lea r15, [0x14038a340]
cmp byte [rdi], bl
jne 0x14026efc4
mov rdi, qword [rbp - 0x49]
jmp 0x14026f0f5
mov rdi, qword [rbp - 0x49]
jmp 0x14026f0ee
mov rdi, qword [rbp - 0x49]
mov r14d, 0xc000007a
lea r15, [0x14038a340]
test rdi, rdi
je 0x14026f11a
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov r13d, 1
test r14d, r14d
lea r14d, [r13 + 3]
jns 0x14026f179
mov rdi, r15
mov r15d, r14d
cmp qword [rdi], rbx
je 0x14026f143
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
add rdi, 0x18
sub r15, r13
jne 0x14026f12f
xor edx, edx
lea r8d, [r15 + 0x60]
lea rcx, [0x14038a340]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x170
lea rdx, [0x1402fbd30]
lea rcx, section..data
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
jmp 0x14026f188
mov eax, dword [0x140389de8]
add eax, r13d
mov dword [0x140389de8], eax
mov rdx, qword [rbp - 0x21]
mov eax, ebx
xchg dword [0x14038b0f0], eax
mov rax, qword [0x140386078]
mov rcx, rsi
call qword [case.0x14006b68f.0]
mov rdx, qword [rbp - 0x19]
lea r9, [rbp - 9]
mov rdi, rax
mov qword [rsp + 0x28], rbx
mov rax, qword [method.4.virtual_56]
or r8d, 0xffffffff
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call qword [case.0x14006b68f.0]
mov r15d, ebx
mov ecx, 0x80004005
test eax, eax
cmove r15d, ecx
test rdi, rdi
je 0x14026f1f3
mov rax, qword [0x140386078]
mov rdx, rdi
mov rcx, rsi
call qword [case.0x14006b68f.0]
xor eax, eax
lock cmpxchg dword [0x14038b0f0], r13d
jne 0x14026f1f3
mov eax, dword [0x140389de8]
test eax, eax
jle 0x14026f264
sub eax, r13d
mov dword [0x140389de8], eax
jne 0x14026f264
lea rdi, [0x14038a340]
cmp qword [rdi], rbx
je 0x14026f230
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
add rdi, 0x18
sub r14, r13
jne 0x14026f21c
xor edx, edx
lea r8d, [r14 + 0x60]
lea rcx, [0x14038a340]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x170
lea rdx, [0x1402fbd30]
lea rcx, section..data
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [rbp - 0x59]
xchg dword [0x14038b0f0], ebx
cmp eax, 0xffffffff
je 0x14026f283
mov edx, eax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SetTextColor]
nop dword [rax + rax]
mov edx, dword [rbp - 0x3d]
mov rcx, rsi
call qword [0x1403ad480]
nop dword [rax + rax]
mov rax, qword [rbp - 0x11]
test byte [rax + 0x10], 0x10
je 0x14026f2d3
movaps xmm0, xmmword [rbp - 9]
lea rcx, [rbp + 7]
mov edx, 0xfffffffc
movdqa xmmword [rbp + 7], xmm0
mov r8d, edx
call qword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_InflateRect]
nop dword [rax + rax]
lea rdx, [rbp + 7]
mov rcx, rsi
call qword [0x1403ad510]
nop dword [rax + rax]
mov eax, r15d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400a15a0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret