Function at 0x140001dd0
Capabilities:
Check os version
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movdqa xmmword [rsp + 0x170], xmm7
movdqa xmmword [rsp + 0x160], xmm6
mov rax, qword [str.1___]
movzx eax, byte [rax]
mov ecx, 0x1ff600
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x1400027a2
mov rsi, rax
lea rdx, [0x14009e166]
mov r8d, 0x1ff600
mov rcx, rax
call sym.memcpy
movdqa xmm0, xmmword [0x14009e060]
mov eax, 0x10
movdqa xmm1, xmmword [0x14009e070]
movdqa xmm2, xmmword [str.UUUUUUUUUUUUUUUU]
movdqa xmm3, xmmword [0x14009e090]
nop word cs:[rax + rax]
movdqa xmm4, xmm0
pand xmm4, xmm1
movdqu xmm5, xmmword [rsi + rax - 0x10]
movdqu xmm6, xmmword [rsi + rax]
pxor xmm5, xmm2
pxor xmm5, xmm4
movdqu xmmword [rsi + rax - 0x10], xmm5
pxor xmm6, xmm2
pxor xmm6, xmm4
movdqu xmmword [rsi + rax], xmm6
paddb xmm0, xmm3
add rax, 0x20
cmp rax, 0x1ff610
jne 0x140001e60
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x140002747
movsxd r15, dword [rsi + 0x3c]
cmp dword [r15 + rsi], 0x4550
jne 0x140002747
add r15, rsi
lea rax, [r15 + 0x108]
mov qword [rsp + 0x90], rax
mov eax, dword [r15 + 0x90]
mov qword [rsp + 0x58], rax
mov ebx, dword [r15 + 0x94]
mov r12d, dword [r15 + 0xb0]
mov eax, dword [r15 + 0xd0]
mov qword [rsp + 0xe0], rax
mov eax, dword [r15 + 0xd4]
mov dword [rsp + 0x68], eax
mov eax, dword [r15 + 0xa0]
mov qword [rsp + 0xe8], rax
mov eax, dword [r15 + 0xa4]
mov dword [rsp + 0x6c], eax
movzx r13d, word [r15 + 0x16]
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 1
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 1
mov qword [rsp + 0x128], 0
mov edx, dword [r15 + 0x50]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call sub.kernel32.dll_VirtualAlloc
mov rbp, rax
movzx edi, word [r15 + 6]
test di, di
je 0x140001fd0
mov r14, qword [rsp + 0x90]
nop word [rax + rax]
mov r8d, dword [r14 + 0x10]
mov edx, dword [r14 + 0x14]
lea rax, [r8 + rdx]
cmp rax, 0x1ff600
ja 0x1400021e8
mov ecx, dword [r14 + 0xc]
add rdx, rsi
add rcx, rbp
call sym.memcpy
add r14, 0x28
dec di
jne 0x140001fa0
mov dword [rsp + 0x64], r13d
mov qword [rsp + 0xd8], r15
cmp ebx, 0x14
mov rdx, qword [rsp + 0x58]
jae 0x140002099
cmp dword [rbp + r12], 0
mov r15, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0x90]
je 0x140002258
mov rax, rbp
sub rax, qword [r15 + 0x30]
add r12, rbp
mov ecx, eax
shr ecx, 0x10
lea rdx, [0x14009e0c0]
jmp 0x14000202d
cmp dword [r8], 0
mov r12, r8
je 0x140002258
lea r8, [r12 + 8]
mov r9d, dword [r12 + 4]
cmp r9, 9
jb 0x140002020
add r9, r12
jmp 0x140002059
add word [rbp + r10], cx
nop dword [rax + rax]
add r8, 2
cmp r8, r9
jae 0x140002020
movzx r10d, word [r8]
mov r11d, r10d
shr r11d, 0xc
cmp r11d, 0xa
ja case.0x140002080.4
and r10d, 0xfff
add r10d, dword [r12]
movsxd r11, dword [rdx + r11*4]
add r11, rdx
jmp r11
add word [rbp + r10], ax
jmp case.0x140002080.0
add dword [rbp + r10], eax
jmp case.0x140002080.0
add qword [rbp + r10], rax
jmp case.0x140002080.0
add rdx, rbp
mov eax, ebx
mov ecx, 0xcccccccd
imul rcx, rax
shr rcx, 0x24
mov qword [rsp + 0xc8], rcx
lea r13, [rbp + 2]
xor edi, edi
mov qword [rsp + 0x58], rdx
lea rax, [rdi + rdi*4]
mov ebx, dword [rdx + rax*4]
mov r15d, dword [rdx + rax*4 + 0x10]
mov ecx, r15d
or ecx, ebx
je 0x140001feb
lea rax, [rdx + rax*4]
mov ecx, dword [rax + 0xc]
add rcx, rbp
call sub.kernel32.dll_LoadLibraryA
test rax, rax
je 0x1400027c0
mov r14, rax
inc rdi
mov qword [rsp + 0xd0], rdi
mov rdi, rbp
mov rdx, qword [rdi + rbx]
test rdx, rdx
je 0x140002130
nop word [rax + rax]
jns 0x140002137
movzx edx, dx
mov rcx, r14
call sub.kernel32.dll_GetProcAddress
test rax, rax
jne 0x140002147
jmp 0x14000217a
cmp qword [rdi + r15], 0
je 0x14000215a
add rdx, r13
mov rcx, r14
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14000217a
mov qword [rdi + r15], rax
add rdi, 8
mov rdx, qword [rdi + rbx]
test rdx, rdx
jne 0x140002110
jmp 0x140002130
mov rdi, qword [rsp + 0xd0]
cmp rdi, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0x58]
jne 0x1400020be
jmp 0x140001feb
mov rax, qword [str.1___]
movzx eax, byte [rax]
mov ebx, 0x27
mov ecx, 0x27
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x1400027b1
mov rdi, rax
movups xmm0, xmmword [0x14029d828]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.____The_expected_function_was_not_foundError_when_calling_VirtualProtect_]
movups xmmword [rax], xmm0
movabs rax, 0x646e756f6620746f
mov qword [rdi + 0x1f], rax
lea rax, [rsp + 0x98]
mov r12d, 0x27
xor ebx, ebx
mov rdx, qword [rax]
test rdx, rdx
jne 0x140002651
jmp 0x140002660
mov rax, qword [str.1___]
movzx eax, byte [rax]
mov ebx, 0x25
mov ecx, 0x25
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x1400027b1
mov rdi, rax
movups xmm0, xmmword [0x14029d7b6]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x14029d7a6]
movdqu xmmword [rax], xmm0
movabs rax, 0x7374696d696c2072
mov qword [rdi + 0x1d], rax
lea rax, [rsp + 0x98]
mov r12d, 0x25
xor ebx, ebx
mov rdx, qword [rax]
test rdx, rdx
jne 0x140002651
jmp 0x140002660
movzx r12d, word [r15 + 6]
test r12w, r12w
je 0x14000233b
movdqa xmm6, xmmword [0x14009e0a0]
movdqa xmm7, xmmword [0x14009e0b0]
mov ebx, 0x20
mov r13d, 0x40
lea r14, [rsp + 0x70]
jmp 0x14000229a
dec r12w
je 0x14000233b
mov edx, dword [rdi + 0x10]
test rdx, rdx
je 0x140002290
mov ecx, dword [rdi + 0xc]
test rcx, rcx
je 0x140002290
mov eax, dword [rdi + 0x24]
movd xmm0, eax
pshufd xmm0, xmm0, 0
pand xmm0, xmm6
pcmpeqd xmm0, xmm7
movmskps r9d, xmm0
test r9b, 8
jne 0x1400022d0
mov r8d, 2
jmp 0x1400022db
mov r8d, eax
shr r8d, 0x1c
and r8d, 0xfffffff8
cmp eax, 0xc0000000
mov r10d, 4
cmovae r8d, r10d
test r9b, 4
mov r10d, 0x10
cmove r8d, r10d
test r9b, 2
mov r10d, pe_nt_image_headers64
cmovne r8d, r10d
test r9b, 1
cmovne r8d, ebx
cmp eax, 0xe0000000
cmovae r8d, r13d
mov dword [rsp + 0x70], 0
add rcx, rbp
mov r9, r14
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x140002766
add rdi, 0x28
jmp 0x140002290
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x14000236d
mov rcx, qword [rsp + 0xe8]
add rcx, rbp
mov eax, eax
mov edx, 0xaaaaaaab
imul rdx, rax
shr rdx, 0x23
mov r8, rbp
call sub.kernel32.dll_RtlAddFunctionTable
test al, al
je 0x1400026d7
cmp dword [rsp + 0x68], 0
je 0x1400023a9
mov rax, qword [rsp + 0xe0]
mov rdi, qword [rbp + rax + 0x18]
mov rax, qword [rdi]
test rax, rax
je 0x1400023a9
add rdi, 8
nop dword [rax]
mov rcx, rbp
mov edx, 1
xor r8d, r8d
call rax
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x140002390
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc0], rax
movdqu xmm0, xmmword [rsp + 0x98]
movdqa xmmword [rsp + 0xb0], xmm0
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov r13, qword [rax + 0x20]
mov rcx, qword [r13 + 0x78]
movzx r8d, word [r13 + 0x70]
add r8d, r8d
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x28]
call sym.std::env::current_exe::h5bb19af129e11d54
movabs r12, 0x8000000000000000
cmp qword [rsp + 0x28], r12
je 0x1400027f9
movdqu xmm0, xmmword [rsp + 0x28]
movdqu xmm1, xmmword [rsp + 0x38]
movdqa xmmword [rsp + 0x100], xmm1
movdqa xmmword [rsp + 0xf0], xmm0
lea rcx, [rsp + 0xf0]
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h30fe6b7321b7e128
mov r8, rdx
lea rbx, [rsp + 0x130]
mov rcx, rbx
mov rdx, rax
call sym.std::sys::os_str::wtf8::Slice::to_string_lossy::h4fb026203452ada6
mov qword [rsp + 0x70], rbx
lea rax, [sym.__alloc::borrow::Cow_B__as_core::fmt::Display_::fmt::hbcdea33fd75408f9]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x80], rax
lea rax, [fcn.140001db0]
mov qword [rsp + 0x88], rax
lea rax, [0x14029d898]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 3
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 2
lea rcx, [rsp + 0x148]
lea rdx, [rsp + 0x28]
call sym.alloc::fmt::format::format_inner::h5a493f368b54610e
mov rdx, qword [rsp + 0x130]
cmp rdx, r12
je 0x1400024e8
test rdx, rdx
je 0x1400024e8
mov rcx, qword [rsp + 0x138]
mov r8d, 1
call sym.__rust_dealloc
mov rbx, qword [rsp + 0x148]
mov r14, qword [rsp + 0x150]
mov rax, qword [rsp + 0x158]
add rax, r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], 0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x28]
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17habc82855a9
test rbx, rbx
je 0x140002539
mov r8d, 1
mov rcx, r14
mov rdx, rbx
call sym.__rust_dealloc
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [r13 + 0x78]
lea r8, [rdi + rdi]
mov rdx, rbx
call sym.memcpy
add edi, edi
mov word [r13 + 0x70], di
mov word [r13 + 0x72], di
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14000257d
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call sym.__rust_dealloc
mov rdx, qword [rsp + 0xf0]
test rdx, rdx
mov edi, dword [rsp + 0x64]
je 0x1400025a1
mov rcx, qword [rsp + 0xf8]
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x1400025c1
mov rcx, qword [rsp + 0xb8]
mov r8d, 1
call sym.__rust_dealloc
mov ecx, dword [r15 + 0x28]
mov rax, rbp
add rax, rcx
test edi, 0x2000
jne 0x140002632
call rax
jmp 0x14000263f
mov rax, qword [str.1___]
movzx eax, byte [rax]
mov ebx, 0x1b
mov ecx, 0x1b
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x1400027b1
mov rdi, rax
movups xmm0, xmmword [0x14029d7d6]
movups xmmword [rax + 0xb], xmm0
movdqu xmm0, xmmword [0x14029d7cb]
movdqu xmmword [rax], xmm0
lea rax, [rsp + 0x98]
mov r12d, 0x1b
xor ebx, ebx
mov rdx, qword [rax]
test rdx, rdx
jne 0x140002651
jmp 0x140002660
mov rcx, rbp
mov edx, 1
xor r8d, r8d
call rax
lea rax, [rsp + 0x118]
mov bl, 1
mov rdx, qword [rax]
test rdx, rdx
je 0x140002660
mov rcx, qword [rax + 8]
mov r8d, 1
call sym.__rust_dealloc
test bl, bl
je 0x14000267b
mov edx, 0x1ff600
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
xor eax, eax
jmp 0x1400026b0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x28]
call sym._ZN120__LT_alloc..boxed..Box_LT_dyn_u20_core..error..Error_GT__u20_as_u20_core..convert..From_LT_alloc..string..String_GT__GT_
mov rbx, rax
mov rdi, rdx
mov edx, 0x1ff600
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
mov rax, rbx
mov rdx, rdi
movaps xmm6, xmmword [rsp + 0x160]
movaps xmm7, xmmword [rsp + 0x170]
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [str.1___]
movzx eax, byte [rax]
mov ebx, 0x26
mov ecx, 0x26
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x1400027b1
mov rdi, rax
movups xmm0, xmmword [0x14029d790]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.____Failed_to_call_RtlAddFunctionTable____Section_outside_the_buffer_limits____Unknown_relocation_type____Error_loading_library]
movdqu xmmword [rax], xmm0
movabs rax, 0x656c6261546e6f69
mov qword [rdi + 0x1e], rax
lea rax, [rsp + 0x98]
mov r12d, 0x26
xor ebx, ebx
mov rdx, qword [rax]
test rdx, rdx
jne 0x140002651
jmp 0x140002660
mov edx, 0x1ff600
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
lea rcx, [0x14029d768]
call sym.core::option::unwrap_failed::h38ae581b954ce070
call sym.windows_result::error::Error::from_win32::h90450e6a3429fca4
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], edx
lea rax, [0x14029d860]
mov qword [rsp + 0x20], rax
lea rcx, [0x14029d83f]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::h58c9d6524129b65a
lea r8, [rsp + 0x28]
mov edx, 0x21
call sym.core::result::unwrap_failed::h8f275d6668207d54
jmp 0x14000282c
mov ecx, 1
mov edx, 0x1ff600
call sym.alloc::raw_vec::handle_error::hd43ffb3afada7951
mov ecx, 1
mov rdx, rbx
call sym.alloc::raw_vec::handle_error::hd43ffb3afada7951
jmp 0x14000282c
call sym.windows_result::error::Error::from_win32::h90450e6a3429fca4
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], edx
lea rax, [0x14029d800]
mov qword [rsp + 0x20], rax
lea rcx, [0x14029d7e6]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::h58c9d6524129b65a
lea r8, [rsp + 0x28]
mov edx, 0x19
call sym.core::result::unwrap_failed::h8f275d6668207d54
jmp 0x14000282c
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
lea rax, [0x14029d878]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__valuesrc_main.rs
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::h7bc1150fe8923d42
lea r8, [rsp + 0x70]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h8f275d6668207d54
ud2