Function at 0x14002aaf0
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Resolve function by parsing pe exports
Terminate process

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x2470]
mov eax, 0x2570
call fcn.14006a800
sub rsp, rax
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp + 0x2450], rax
mov dword [rbp + 0x2008], 0x4524c810
mov dl, 8
mov dword [rbp + 0x200c], 0x9076e670
xor sil, sil
mov dword [rbp + 0x2010], 0x96988cff
mov word [rbp + 0x2014], 0x5f00
mov dword [rbp + 0x2018], 0xdc23ca11
mov dword [rbp + 0x201c], 0xbd90ba1
mov dword [rbp + 0x2020], 0xfc797358
mov word [rbp + 0x2024], 0x4d00
nop dword [rax]
xor dil, dil
nop dword [rax]
nop word [rax + rax]
movzx ecx, dl
movzx eax, dil
shl cl, 5
inc dil
xor cl, dl
shr dl, 1
and cl, 0xe0
shl cl, 2
or dl, cl
xor byte [rbp + rax + 0x2018], dl
cmp dil, 0xc
jb 0x14002ab80
add sil, cl
cmp sil, dl
jb 0x14002ab70
mov dl, 5
xor sil, sil
nop dword [rax]
nop word [rax + rax]
xor dil, dil
nop dword [rax]
nop word [rax + rax]
movzx ecx, dl
movzx eax, dil
shl cl, 5
inc dil
xor cl, dl
shr dl, 1
and cl, 0xe0
shl cl, 2
or dl, cl
xor byte [rbp + rax + 0x2008], dl
cmp dil, 0xc
jb 0x14002abd0
add sil, cl
cmp sil, dl
jb 0x14002abc0
mov dword [rbp + 0x1fd0], 0x34a7af9e
mov dl, 3
mov dword [rbp + 0x1fd4], 0x251c12f8
xor sil, sil
mov dword [rbp + 0x1fd8], 0xbdae81a5
mov word [rbp + 0x1fdc], 0xb700
mov dword [rbp + 0x1fe0], 0xdf178297
mov dword [rbp + 0x1fe4], 0x99b5c711
mov dword [rbp + 0x1fe8], 0x8fe44814
mov word [rbp + 0x1fec], 0x6c00
mov byte [rbp + 0x1fee], 0xb4
mov dword [rbp + 0x1ff0], 0xd8654601
mov dword [rbp + 0x1ff4], 0x89f24d36
mov dword [rbp + 0x1ff8], 0x89abd600
mov dword [rbp + 0x1ffc], 0xa7008885
mov dword [rbp + 0x2000], 0xd50b75e3
mov byte [rbp + 0x2004], 0xd3
nop dword [rax]
nop word [rax + rax]
xor dil, dil
nop dword [rax]
nop word [rax + rax]
movzx ecx, dl
movzx eax, dil
shl cl, 5
inc dil
xor cl, dl
shr dl, 1
and cl, 0xe0
shl cl, 2
or dl, cl
xor byte [rbp + rax + 0x1fd0], dl
cmp dil, 0xc
jb 0x14002acb0
add sil, cl
cmp sil, dl
jb 0x14002aca0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x2590], rbx
mov qword [rsp + 0x2598], r12
mov qword [rsp + 0x25a0], r13
mov qword [rsp + 0x2568], r14
mov qword [rsp + 0x2560], r15
test rax, rax
je 0x14002c23b
mov r10, qword [rax + 0x18]
test r10, r10
je 0x14002c23b
mov r10, qword [r10 + 0x10]
test r10, r10
je 0x14002c23b
xor ebx, ebx
mov ecx, ebx
cmp byte [rbp + 0x1fd0], bl
je 0x14002ad4b
nop
inc ecx
cmp byte [rbp + rcx + 0x1fd0], bl
jne 0x14002ad40
mov r14, qword [r10 + 0x30]
inc ecx
test r14, r14
je 0x14002aea3
mov r9d, ecx
nop dword [rax]
mov r11, qword [r10 + 0x60]
mov rdi, rbx
test r9, r9
je 0x14002adaa
nop dword [rax]
movzx edx, byte [rbp + rdi + 0x1fd0]
movzx esi, byte [r11 + rdi*2]
lea eax, [rdx + 0x20]
movzx r8d, al
lea ecx, [rdx - 0x41]
cmp cl, 0x19
lea eax, [rsi - 0x41]
cmova r8d, edx
cmp al, 0x19
ja 0x14002ad99
add sil, 0x20
cmp r8b, sil
jne 0x14002ae93
inc rdi
cmp rdi, r9
jb 0x14002ad70
mov ecx, ebx
nop dword [rax]
mov eax, ecx
cmp byte [rbp + rax + 0x1fd0], bl
je 0x14002adc2
inc ecx
cmp ecx, 0xffffffff
jb 0x14002adb0
mov edx, ecx
mov rax, rbx
test ecx, ecx
je 0x14002add8
nop dword [rax + rax]
inc rax
cmp rax, rdx
jb 0x14002add0
test r14, r14
je 0x14002c260
mov dl, 2
xor sil, sil
nop word [rax + rax]
xor dil, dil
nop dword [rax]
nop word [rax + rax]
movzx ecx, dl
movzx eax, dil
shl cl, 5
inc dil
xor cl, dl
shr dl, 1
and cl, 0xe0
shl cl, 2
or dl, cl
xor byte [rbp + rax + 0x1fe0], dl
cmp dil, 0xc
jb 0x14002ae00
add sil, cl
cmp sil, dl
jb 0x14002adf0
movsxd r15, dword [r14 + 0x3c]
lea rax, [rbp + 0x1fe0]
lea rcx, [rbp + 0x1fe0]
mov r13, rbx
mov r9d, dword [r15 + r14 + 0x88]
add r9, r14
mov r11d, dword [r9 + 0x24]
mov esi, dword [r9 + 0x20]
add r11, r14
add rsi, r14
cmp rax, 0x10000
jae 0x14002aece
mov edi, dword [r9 + 0x10]
movzx edx, cx
cmp edx, edi
jb 0x14002c260
mov ecx, dword [r9 + 0x14]
add ecx, edi
cmp edx, ecx
jae 0x14002c260
mov ecx, dword [r9 + 0x1c]
sub edx, edi
add rcx, r14
mov r13, qword [rcx + rdx*8]
jmp 0x14002af27
mov r10, qword [r10]
mov r14, qword [r10 + 0x30]
test r14, r14
jne 0x14002ad60
mov ecx, ebx
mov eax, ecx
cmp byte [rbp + rax + 0x1fd0], bl
je 0x14002aeb7
inc ecx
cmp ecx, 0xffffffff
jb 0x14002aea5
mov eax, ecx
test ecx, ecx
je 0x14002c260
inc rbx
cmp rbx, rax
jb 0x14002aec1
jmp 0x14002c260
mov r10d, dword [r9 + 0x18]
mov r8d, ebx
test r10d, r10d
je 0x14002af2a
nop word [rax + rax]
mov edi, dword [rsi]
lea rax, [rbp + 0x1fe0]
add rdi, r14
sub rdi, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x14002af02
inc rax
test ecx, ecx
jne 0x14002aef0
test edx, edx
je 0x14002af14
inc r8d
add rsi, 4
cmp r8d, r10d
jb 0x14002aee0
jmp 0x14002af2a
mov ecx, dword [r9 + 0x1c]
mov eax, r8d
add rcx, r14
movzx edx, word [r11 + rax*2]
mov r13d, dword [rcx + rdx*4]
add r13, r14
cmp r13, r9
jb 0x14002b1d3
mov eax, dword [r15 + r14 + 0x8c]
add rax, r9
cmp r13, rax
jae 0x14002b1d3
mov rcx, r13
call fcn.14005d7b4
mov r12, rax
test rax, rax
je 0x14002c260
mov dl, 0x2e
mov rcx, rax
call fcn.1400433b0
mov r13, rax
mov dword [rbp + 0x1fb0], 0x34a7af9e
mov dword [rbp + 0x1fb4], 0x251c12f8
mov dl, 3
mov dword [rbp + 0x1fb8], 0xbdae81a5
xor sil, sil
mov byte [rax], bl
mov dword [rbp + 0x2028], 0xdf178297
mov dword [rbp + 0x202c], 0x99b5c711
mov dword [rbp + 0x2030], 0x8fe44814
mov word [rbp + 0x2034], 0x6c00
mov byte [rbp + 0x2036], 0xb4
mov word [rbp + 0x1fbc], 0xb700
nop dword [rax]
nop dword [rax + rax]
xor dil, dil
nop dword [rax]
nop word [rax + rax]
movzx ecx, dl
movzx eax, dil
shl cl, 5
inc dil
xor cl, dl
shr dl, 1
and cl, 0xe0
shl cl, 2
or dl, cl
xor byte [rbp + rax + 0x1fb0], dl
cmp dil, 0xc
jb 0x14002afe0
add sil, cl
cmp sil, dl
jb 0x14002afd0
mov rax, qword gs:[0x60]
test rax, rax
je 0x14002b11a
mov r10, qword [rax + 0x18]
test r10, r10
je 0x14002b11a
mov r10, qword [r10 + 0x10]
test r10, r10
je 0x14002b11a
mov ecx, ebx
cmp byte [rbp + 0x1fb0], bl
je 0x14002b04f
inc ecx
cmp byte [rbp + rcx + 0x1fb0], bl
jne 0x14002b044
mov r15, qword [r10 + 0x30]
inc ecx
test r15, r15
je 0x14002b0ea
mov r9d, ecx
mov r11, qword [r10 + 0x60]
mov rdi, rbx
test r9, r9
je 0x14002b0a6
nop dword [rax]
movzx edx, byte [rbp + rdi + 0x1fb0]
movzx esi, byte [r11 + rdi*2]
lea eax, [rdx + 0x20]
movzx r8d, al
lea ecx, [rdx - 0x41]
cmp cl, 0x19
lea eax, [rsi - 0x41]
cmova r8d, edx
cmp al, 0x19
ja 0x14002b099
add sil, 0x20
cmp r8b, sil
jne 0x14002b0da
inc rdi
cmp rdi, r9
jb 0x14002b070
mov ecx, ebx
nop dword [rax + rax]
mov eax, ecx
cmp byte [rbp + rax + 0x1fb0], bl
je 0x14002b0c2
inc ecx
cmp ecx, 0xffffffff
jb 0x14002b0b0
mov edx, ecx
mov rax, rbx
test ecx, ecx
je 0x14002b14b
nop
inc rax
cmp rax, rdx
jb 0x14002b0d0
jmp 0x14002b14b
mov r10, qword [r10]
mov r15, qword [r10 + 0x30]
test r15, r15
jne 0x14002b061
mov ecx, ebx
nop dword [rax]
mov eax, ecx
cmp byte [rbp + rax + 0x1fb0], bl
je 0x14002b102
inc ecx
cmp ecx, 0xffffffff
jb 0x14002b0f0
mov edx, ecx
mov rax, rbx
test ecx, ecx
je 0x14002b148
nop dword [rax + rax]
inc rax
cmp rax, rdx
jb 0x14002b110
jmp 0x14002b148
mov ecx, ebx
nop dword [rax]
mov eax, ecx
cmp byte [rbp + rax + 0x1fb0], bl
je 0x14002b132
inc ecx
cmp ecx, 0xffffffff
jb 0x14002b120
mov edx, ecx
mov rax, rbx
test ecx, ecx
je 0x14002b148
nop dword [rax + rax]
inc rax
cmp rax, rdx
jb 0x14002b140
mov r15, rbx
mov dil, 2
xor r8b, r8b
xor sil, sil
nop dword [rax]
nop dword [rax + rax]
movzx edx, dil
movzx eax, sil
shl dl, 5
inc sil
xor dl, dil
shr dil, 1
and dl, 0xe0
shl dl, 2
or dil, dl
xor byte [rbp + rax + 0x2028], dil
cmp sil, 0xc
jb 0x14002b160
add r8b, dl
cmp r8b, dil
jb 0x14002b151
lea rdx, [rbp + 0x2028]
mov rcx, r15
call fcn.140043af0
test rax, rax
je 0x14002c260
mov rcx, r12
call rax
mov rcx, r12
mov rdi, rax
call fcn.14005d82c
test rdi, rdi
je 0x14002c260
lea rdx, [r13 + 1]
mov rcx, rdi
call fcn.140043af0
mov r13, rax
mov ecx, ebx
mov eax, ecx
cmp byte [rbp + rax + 0x1fe0], bl
je 0x14002b1e7
inc ecx
cmp ecx, 0xffffffff
jb 0x14002b1d5
mov edx, ecx
invalid
invalid