Function at 0x14000ce60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xad8
movaps xmmword [rsp + 0xa90], xmm6
movaps xmmword [rsp + 0xaa0], xmm7
movaps xmmword [rsp + 0xab0], xmm8
movaps xmmword [rsp + 0xac0], xmm9
cmp qword [0x1400c5a20], 0xffffffffffffffff
mov r10, rcx
mov qword [rsp + 0xb28], rdx
mov qword [rsp + 0xb30], r8
mov qword [rsp + 0xb38], r9
je 0x14000d766
lea rax, [rsp + 0xb28]
mov ecx, 0x800
lea rbp, [rsp + 0x290]
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rdi, rbp
rep stosb byte [rdi], al
mov r8, qword [rsp + 0xa0]
mov rdx, r10
mov rcx, rbp
call qword [sym.imp.USER32.dll_wvsprintfW]
test eax, eax
mov esi, eax
jle 0x14000d766
movzx eax, word [0x1400c89c6]
mov r9d, 0xb
xor r10d, r10d
mov dword [rsp + 0xb4], 0x150018
mov word [rsp + 0xb8], r9w
lea rdi, [rsp + 0x190]
mov word [rsp + 0xbe], r10w
mov rcx, rdi
lea edx, [rax + 0xb]
movzx eax, word [0x1400c89c8]
mov word [rsp + 0xba], dx
add eax, 0xb
mov word [rsp + 0xbc], ax
mov rax, qword [rsp + 0xb4]
mov qword [rsp + 0x190], rax
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0x198], eax
movzx eax, word [rsp + 0x190]
sub eax, 0xb
mov word [rsp + 0x190], ax
movzx eax, word [rsp + 0x192]
sub eax, 0xb
mov word [rsp + 0x192], ax
movzx eax, word [rsp + 0x194]
sub eax, 0xb
mov word [rsp + 0x194], ax
movzx eax, word [rsp + 0x196]
sub eax, 0xb
mov word [rsp + 0x196], ax
movzx eax, word [rsp + 0x198]
sub eax, 0xb
mov word [rsp + 0x198], ax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xd0], rax
call sub.msvcrt.dll_wcslen
lea r12, [rax + rax]
mov r13, r12
sar r13, 1
cmp r12, 0xe
mov rdx, r13
mov qword [rsp + 0x140], r13
ja 0x14000d841
cmp r13, 1
mov rcx, qword [rsp + 0xd0]
jne 0x14000d79c
movzx eax, word [rsp + 0x190]
lea rbx, [rsp + 0x140]
mov word [rcx], ax
mov eax, 2
movdqa xmm0, xmmword [0x1400c8a30]
xor r8d, r8d
mov qword [rsp + 0xd8], rdx
mov rdx, rdi
movd xmm9, dword [0x1400c8a40]
mov word [rcx + rax], r8w
mov rcx, rbx
movd xmm6, dword [0x1400c8a10]
movaps xmmword [rsp + 0x190], xmm0
movq xmm7, qword [0x1400c8a08]
mov byte [rsp + 0x1a4], 0
movd dword [rsp + 0x1a0], xmm9
mov byte [rsp + 0x14c], 0
movq qword [rsp + 0x140], xmm7
movd dword [rsp + 0x148], xmm6
call fcn.140003370
lea rcx, [0x1400ed0a0]
call rax
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0xcc]
xor edx, edx
mov dword [rsp + 0x140], 0x3e
mov word [rsp + 0x136], dx
mov r14d, dword [rsp + 0x140]
mov r13d, dword [rsp + 0x140]
mov r15d, dword [rsp + 0x140]
mov dword [rsp + 0x34], eax
movzx eax, word [rsp + 0xca]
mov dword [rsp + 0x38], eax
movzx eax, word [rsp + 0xc8]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x140]
mov ecx, dword [rsp + 0x140]
mov edx, dword [rsp + 0x140]
mov r11d, dword [rsp + 0x140]
mov dword [rsp + 0x7c], eax
mov r10d, dword [rsp + 0x140]
mov dword [rsp + 0x78], ecx
mov r9d, dword [rsp + 0x140]
mov dword [rsp + 0x74], edx
mov r8d, dword [rsp + 0x140]
mov r12d, dword [rsp + 0x140]
mov dword [rsp + 0x70], r11d
mov eax, dword [rsp + 0x140]
mov dword [rsp + 0x6c], r10d
mov ecx, dword [rsp + 0x140]
mov dword [rsp + 0x68], r9d
mov edx, dword [rsp + 0x140]
mov dword [rsp + 0x64], r8d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x54], edx
mov r11d, dword [rsp + 0x140]
mov r10d, dword [rsp + 0x140]
mov r9d, dword [rsp + 0x140]
mov eax, dword [rsp + 0x140]
mov dword [rsp + 0x50], r11d
mov r12d, dword [rsp + 0x140]
mov dword [rsp + 0x4c], r10d
mov r8d, dword [rsp + 0x140]
mov r11d, dword [rsp + 0x140]
mov dword [rsp + 0x48], r9d
mov edx, dword [rsp + 0x140]
add eax, 0x11
mov r10d, dword [rsp + 0x140]
movd xmm1, eax
add r12d, 0x12
mov ecx, dword [rsp + 0x140]
add r8d, 0x13
xor r8w, word [0x1400c89ee]
add r11d, 0x14
add edx, 0x15
xor dx, word [0x1400c89f2]
mov r9d, dword [rsp + 0x140]
add r10d, 0x16
add ecx, 0x17
xor cx, word [0x1400c89f6]
movd xmm3, r8d
xor r10w, word [0x1400c89f4]
movd xmm0, edx
mov edx, dword [rsp + 0x140]
xor r12w, word [0x1400c89ec]
add r9d, 0x18
movd xmm2, ecx
mov ecx, dword [rsp + 0x140]
mov r8d, dword [rsp + 0x140]
pinsrw xmm0, r10d, 1
mov eax, dword [rsp + 0x140]
movzx edx, dx
xor r11w, word [str.InitializeCriticalSectiokernel32.dll]
pinsrw xmm1, r12d, 1
movzx ecx, cx
xor r9w, word [0x1400c89f8]
movzx r8d, r8w
mov r10d, dword [rsp + 0x140]
movzx eax, ax
shl rax, 0x10
pinsrw xmm3, r11d, 1
punpckldq xmm1, xmm3
movq xmm3, qword [0x1400c8a48]
or rax, r8
pinsrw xmm2, r9d, 1
punpckldq xmm0, xmm2
punpcklqdq xmm1, xmm0
shl rax, 0x10
add r10d, 0x1d
xor r10w, word [0x1400c8a02]
movd xmm0, r14d
or rax, rcx
movzx ecx, word [0x1400c89fe]
shl rax, 0x10
or rax, rdx
movzx edx, word [0x1400c8a00]
movq xmm4, rax
paddw xmm3, xmm4
shl rdx, 0x10
or rdx, rcx
movzx ecx, word [0x1400c89fc]
shl rdx, 0x10
or rdx, rcx
movzx ecx, word [0x1400c89fa]
shl rdx, 0x10
mov r9d, dword [rsp + 0x140]
movzx r11d, word [0x1400c8a0c]
movzx r14d, word [rsp + 0x68]
or rdx, rcx
movzx ecx, word [0x1400c8a0a]
movq xmm5, rdx
mov edx, dword [rsp + 0x140]
add r9d, 0x1e
mov eax, dword [rsp + 0x140]
pxor xmm3, xmm5
xor r9w, word [0x1400c8a04]
add edx, 0x1f
xor dx, word [0x1400c8a06]
add r13d, 1
add eax, 0x20
xor ax, word [0x1400c8a08]
pinsrw xmm0, r13d, 1
movzx r13d, word [rsp + 0x5c]
mov word [rsp + 0x40], dx
mov word [rsp + 0x42], ax
mov eax, dword [rsp + 0x140]
add r13d, 0xb
add eax, 0x21
xor ecx, eax
mov eax, dword [rsp + 0x140]
mov word [rsp + 0x44], cx
lea ecx, [r15 + 2]
movzx r15d, word [rsp + 0x7c]
movd xmm5, ecx
movzx ecx, word [rsp + 0x50]
add eax, 0x22
lea r12d, [r15 + 3]
movzx r15d, word [rsp + 0x78]
xor r11d, eax
mov word [rsp + 0x46], r11w
pinsrw xmm5, r12d, 1
punpckldq xmm0, xmm5
movzx r12d, word [rsp + 0x58]
add ecx, 0xe
lea eax, [r15 + 4]
movzx r15d, word [rsp + 0x74]
movd xmm2, eax
lea eax, [r14 + 8]
movzx r14d, word [rsp + 0x64]
lea r11d, [r15 + 5]
movzx r15d, word [rsp + 0x70]
pinsrw xmm2, r11d, 1
movzx r11d, word [rsp + 0x4c]
add r14d, 9
lea edx, [r15 + 6]
movzx r15d, word [rsp + 0x6c]
movd xmm4, edx
add r11d, 0xf
lea edx, [r12 + 0xc]
movzx r12d, word [rsp + 0x54]
lea r8d, [r15 + 7]
pinsrw xmm4, r8d, 1
punpckldq xmm2, xmm4
punpcklqdq xmm0, xmm2
movd xmm4, ecx
pxor xmm0, xmmword [str.__02d:_02d:_02d_]
movq r15, xmm0
movzx r8d, word [rsp + 0x60]
add r12d, 0xd
movaps xmmword [rsp + 0xf0], xmm0
movd xmm0, eax
movd xmm2, edx
pinsrw xmm4, r11d, 1
pinsrw xmm0, r14d, 1
movzx r14d, word [rsp + 0x48]
pinsrw xmm2, r12d, 1
punpckldq xmm2, xmm4
add r8d, 0xa
movd xmm5, r8d
lea eax, [r14 + 0x10]
pinsrw xmm5, r13d, 1
punpckldq xmm0, xmm5
punpcklqdq xmm0, xmm2
xor eax, 0x20
pxor xmm0, xmmword [0x1400c8a60]
movaps xmmword [rsp + 0x100], xmm0
mov word [rsp + 0x110], ax
movzx eax, word [rsp + 0x40]
mov qword [rsp + 0x144], r15
movzx ecx, word [rsp + 0x44]
movups xmmword [rsp + 0x112], xmm1
movzx r11d, word [rsp + 0x46]
movq qword [rsp + 0x122], xmm3
mov word [rsp + 0x12e], ax
movzx eax, word [rsp + 0x42]
mov word [rsp + 0x12a], r10w
mov word [rsp + 0x12c], r9w
mov word [rsp + 0x132], cx
mov word [rsp + 0x130], ax
mov rax, qword [rsp + 0xf8]
mov word [rsp + 0x134], r11w
mov qword [rsp + 0x14c], rax
mov rax, qword [rsp + 0x108]
movq qword [rsp + 0x154], xmm0
mov qword [rsp + 0x15c], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x164], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x16c], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x174], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x17c], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x184], rax
xor eax, eax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x144]
mov edx, dword [rsp + 0x140]
add edx, eax
xor edx, ecx
mov word [rsp + rax*2 + 0x144], dx
add rax, 1
cmp rax, 0x23
jne 0x14000d5b0
xor eax, eax
mov r9d, dword [rsp + 0x38]
mov rcx, rdi
mov word [rsp + 0x18a], ax
mov eax, dword [rsp + 0x34]
lea rdx, [rsp + 0x144]
mov r8d, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
mov r15, qword [0x1400c5a20]
mov r14d, eax
movq xmm8, qword [0x1400c8a70]
jne 0x14000d7d0
movzx r13d, word [0x1400c8a78]
lea r12, [rsp + 0xa8]
nop dword [rax]
mov rdx, r12
mov rcx, rbx
movq qword [rsp + 0xa8], xmm8
mov word [rsp + 0xb0], r13w
mov byte [rsp + 0x14c], 0
movq qword [rsp + 0x140], xmm7
movd dword [rsp + 0x148], xmm6
call fcn.140003370
lea r14, [rsp + 0x9c]
mov rdx, rbp
mov rcx, r15
mov qword [rsp + 0x20], 0
lea r8d, [rsi + rsi]
mov r9, r14
call rax
mov rdx, r12
mov rcx, rbx
mov r15, qword [rsp + 0xd8]
movq qword [rsp + 0xa8], xmm8
mov rbp, qword [rsp + 0xd0]
mov byte [rsp + 0x14c], 0
mov word [rsp + 0xb0], r13w
mov rsi, qword [0x1400c5a20]
movq qword [rsp + 0x140], xmm7
movd dword [rsp + 0x148], xmm6
call fcn.140003370
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8d, r15d
mov rdx, rbp
mov rcx, rsi
call rax
movdqa xmm0, xmmword [str.LeaveCriticalSecGetLogicalDriveStringsW]
mov rdx, rdi
mov rcx, rbx
mov byte [rsp + 0x1a4], 0
movd dword [rsp + 0x1a0], xmm9
movaps xmmword [rsp + 0x190], xmm0
mov byte [rsp + 0x14c], 0
movq qword [rsp + 0x140], xmm7
movd dword [rsp + 0x148], xmm6
call fcn.140003370
lea rcx, [0x1400ed0a0]
call rax
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
je 0x14000d766
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + rax + 2]
call fcn.1400c2ab0
nop
movaps xmm6, xmmword [rsp + 0xa90]
movaps xmm7, xmmword [rsp + 0xaa0]
movaps xmm8, xmmword [rsp + 0xab0]
movaps xmm9, xmmword [rsp + 0xac0]
add rsp, 0xad8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x140]
test r13, r13
je 0x14000d7c4
mov rdx, rdi
mov r8, r12
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0xd0]
lea rax, [rdx + rdx]
jmp 0x14000d048
movzx r13d, word [0x1400c8a78]
mov rcx, rbx
movq qword [rsp + 0xa8], xmm8
lea r12, [rsp + 0xa8]
mov byte [rsp + 0x14c], 0
movq qword [rsp + 0x140], xmm7
mov rdx, r12
movd dword [rsp + 0x148], xmm6
mov word [rsp + 0xb0], r13w
call fcn.140003370
mov qword [rsp + 0x20], 0
lea r8d, [r14 + r14]
mov rdx, rdi
mov rcx, r15
lea r9, [rsp + 0x9c]
call rax
mov r15, qword [0x1400c5a20]
jmp 0x14000d630
mov rcx, qword [rsp + 0x88]
lea rbx, [rsp + 0x140]
xor r8d, r8d
mov rdx, rbx
call fcn.1400b92b0
mov rdx, qword [rsp + 0x140]
mov rcx, rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xe0], rdx
jmp 0x14000d7a4