Function at 0x14000cfc0
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
sub rsp, 0x60
xor ebp, ebp
mov r9d, edx
mov r12d, edx
xorps xmm0, xmm0
mov eax, 0xd27
mov r13, rcx
mov word [rsp + 0x98], ax
mov ebx, ebp
lea r10d, [rbp + 1]
movzx r8d, bp
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
test edx, edx
jle 0x14000d03d
mov edx, r12d
nop word [rax + rax]
cmp r10w, r8w
lea rcx, [rcx + 1]
mov eax, ebp
cmovne ax, r8w
movzx r8d, ax
movzx eax, byte [rcx - 1]
add al, 9
xor al, byte [rsp + r8*2 + 0x98]
inc r8w
mov byte [rcx - 1], al
sub rdx, r10
jne 0x14000d010
movsxd rax, dword [r13 + 0x3c]
mov ecx, 0x5a4d
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
lea rsi, [rax + r13]
cmp word [r13], cx
jne 0x14000d42e
cmp dword [rsi], 0x4550
jne 0x14000d42e
cmp r9d, 0x40
jb 0x14000d427
cmp r9d, dword [rsi + 0x54]
jb 0x14000d427
add rax, 0x108
cmp r12, rax
jb 0x14000d427
mov eax, 0x8664
cmp word [rsi + 4], ax
jne 0x14000d42e
movzx ecx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rcx, 0x24
cmp bp, ax
jae 0x14000d0e2
add rcx, rsi
mov r8d, eax
nop dword [rax]
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x14000d0cc
mov eax, dword [rsi + 0x38]
add rax, rdx
cmp rax, rbx
cmovbe rax, rbx
add rcx, 0x28
mov rbx, rax
sub r8, r10
jne 0x14000d0c0
lea rcx, [rsp + 0x20]
call qword [0x141870f10]
mov edx, dword [rsp + 0x24]
lea r8d, [rdx - 1]
lea edi, [rdx - 1]
not r8d
add edi, dword [rsi + 0x50]
lea rcx, [rdx - 1]
add rcx, rbx
and rdi, r8
and rcx, r8
cmp rdi, rcx
jne 0x14000d42e
mov rcx, qword [rsi + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
call qword [0x141870f18]
mov qword [rsp + 0x90], rax
mov r15, rax
test rax, rax
jne 0x14000d16a
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [0x141870f18]
mov qword [rsp + 0x90], rax
mov r15, rax
test rax, rax
jne 0x14000d16a
lea ecx, [rax + 0xe]
jmp 0x14000d433
call qword [0x141870f48]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [0x141870f20]
mov r14, rax
test rax, rax
je 0x14000d3e6
mov qword [rax + 8], r15
mov r9d, 4
mov eax, dword [rsp + 0x24]
mov r8d, 0x1000
mov dword [r14 + 0x24], eax
mov rcx, r15
mov edx, dword [rsi + 0x54]
call qword [0x141870f18]
mov rbx, rax
test rax, rax
je 0x14000d3e6
mov r8d, dword [rsi + 0x54]
mov rdx, r13
mov rcx, rax
call fcn.140199cd0
movsxd rax, dword [r13 + 0x3c]
xor ecx, ecx
add rax, rbx
mov qword [r14], rax
mov qword [rax + 0x30], r15
mov rax, qword [r14]
mov r15, qword [r14 + 8]
movzx edi, word [rax + 0x14]
add rdi, 0x24
cmp cx, word [rax + 6]
jae 0x14000d2b0
add rdi, rax
nop dword [rax]
mov eax, dword [rdi + 4]
test eax, eax
jne 0x14000d24d
movsxd rax, dword [rsi + 0x38]
test eax, eax
jle 0x14000d299
mov ecx, dword [rdi]
mov r9d, 4
add rcx, r15
mov r8d, 0x1000
mov rdx, rax
mov rbx, rax
call qword [0x141870f18]
test rax, rax
je 0x14000d3f1
mov ecx, dword [rdi]
mov r8, rbx
add rcx, r15
xor edx, edx
mov dword [rdi - 4], ecx
call fcn.14019a380
jmp 0x14000d299
mov rdx, rax
mov eax, dword [rdi + 8]
add rax, rdx
cmp r12, rax
jb 0x14000d3f1
mov ecx, dword [rdi]
mov r9d, 4
add rcx, r15
mov r8d, 0x1000
call qword [0x141870f18]
test rax, rax
je 0x14000d3f1
mov ebx, dword [rdi]
mov edx, dword [rdi + 8]
add rbx, r15
mov r8d, dword [rdi + 4]
mov rcx, rbx
add rdx, r13
call fcn.140199cd0
mov dword [rdi - 4], ebx
mov rax, qword [r14]
inc ebp
add rdi, 0x28
movzx ecx, word [rax + 6]
cmp ebp, ecx
jl 0x14000d200
xor ecx, ecx
mov rax, qword [r14]
mov rbx, qword [rax + 0x30]
sub rbx, qword [rsi + 0x30]
je 0x14000d35b
cmp dword [rax + 0xb4], 0
jne 0x14000d2d4
mov edi, 1
jmp 0x14000d362
mov r11d, dword [rax + 0xb0]
mov rdi, qword [r14 + 8]
add r11, rdi
mov eax, dword [r11]
test eax, eax
je 0x14000d35b
nop dword [rax]
mov r9d, dword [r11 + 4]
lea rdx, [r11 + 8]
mov r10d, eax
mov r8d, ecx
add r10, rdi
lea rax, [r9 - 8]
test rax, 0xfffffffffffffffe
jbe 0x14000d34e
nop dword [rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x14000d32e
cmp eax, 0xa
jne 0x14000d332
add qword [rcx + r10], rbx
jmp 0x14000d332
add dword [rcx + r10], ebx
mov r9d, dword [r11 + 4]
inc r8d
add rdx, 2
mov eax, r8d
lea rcx, [r9 - 8]
shr rcx, 1
cmp rax, rcx
jb 0x14000d310
xor ecx, ecx
mov eax, r9d
add r11, rax
mov eax, dword [r11]
test eax, eax
jne 0x14000d2f0
mov edi, 1
mov ecx, edi
mov dword [r14 + 0x20], ecx
mov rcx, r14
call fcn.14000bd80
test eax, eax
je 0x14000d3f1
mov rcx, r14
call fcn.14000cc20
test eax, eax
je 0x14000d3f1
mov rax, qword [r14]
mov ecx, dword [rax + 0xd0]
test ecx, ecx
je 0x14000d3b9
mov rax, qword [r14 + 8]
mov rbx, qword [rcx + rax + 0x18]
test rbx, rbx
je 0x14000d3b9
mov rax, qword [rbx]
test rax, rax
je 0x14000d3b9
mov rcx, qword [r14 + 8]
xor r8d, r8d
mov edx, edi
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x14000d3a1
mov rax, qword [r14]
mov edx, dword [rax + 0x28]
test edx, edx
je 0x14000d3e1
mov rcx, qword [r14 + 8]
xor r8d, r8d
lea rax, [rcx + rdx]
mov edx, edi
call rax
test eax, eax
jne 0x14000d3dd
mov ecx, 0x45a
jmp 0x14000d3eb
mov dword [r14 + 0x1c], edi
mov rax, r14
jmp 0x14000d43b
mov ecx, ntohs
call qword [0x141870f08]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14000d40c
xor edx, edx
mov r8d, 0x8000
call qword [0x141870f30]
test r14, r14
je 0x14000d439
call qword [0x141870f48]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [0x141870f40]
jmp 0x14000d439
mov ecx, ntohs
jmp 0x14000d433
mov ecx, 0xc1
call qword [0x141870f08]
xor eax, eax
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0xa0]
add rsp, 0x60
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret