Function at 0x140001d50
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, rcx
xor ecx, ecx
mov r13d, r8d
mov edi, edx
call fcn.1400c2a40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, ebx
mov ecx, eax
call fcn.1400c2a90
movsxd rsi, dword [r14 + 0x3c]
add rsi, r14
mov qword [rsp + 0x38], rsi
cmp word [rsi + 4], 0x8664
je 0x1400026cc
mov eax, dword [rsi + 0x3c]
mov r15d, dword [rsi + 0x38]
movzx ebp, word [rsi + 0x14]
sub eax, 1
sub r15d, 1
cmp dword [rsi + 0xa0], 0
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], r15d
je 0x140002639
cmp dword [rsi + 0xa4], 0
je 0x140002639
cmp edi, 0xffffffff
jne 0x140001ded
call fcn.1400c2ab0
cdq
and edx, 0xf
lea edi, [rdx + rax]
and edi, 0xf
sub edi, edx
mov eax, 1
lea ecx, [r15 + 1]
cmp edi, eax
cmovb edi, eax
imul ecx, edi
mov dword [rsp + 0xa8], ecx
mov rcx, r14
call fcn.140001030
xor r12d, r12d
cmp r13d, 0xffffffff
mov ebx, eax
jne 0x140001e2d
test eax, eax
je 0x140001e2a
call fcn.1400c2ab0
xor edx, edx
div ebx
mov r13d, edx
jmp 0x140001e2d
mov r13d, r12d
and r13d, 0xfffffffc
cmp r13d, ebx
ja 0x140002459
mov eax, dword [rsi + 0x50]
mov edi, dword [rsp + 0xa8]
mov edx, r15d
not edx
add r13d, edi
lea ecx, [r15 + r13]
mov qword [rsp + 0x48], rdx
and rcx, rdx
lea rbx, [rcx + rax + 0x1000]
mov rcx, rbx
call fcn.14008c4a0
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.1400c2840
mov r8d, dword [rsi + 0x54]
mov rdx, r14
mov rcx, r15
call fcn.1400c1a10
movsxd r8, dword [r14 + 0x3c]
mov rdx, r12
add r8, r15
mov qword [rsp + 0x28], r8
movzx ecx, word [r8 + 0x14]
add dword [r8 + 0x28], r13d
lea r14, [r8 + 0x78]
lea r9, [rcx + r8 + 0x18]
mov qword [rsp + 0x40], r14
mov rcx, r14
mov qword [rsp + 0x30], r9
mov eax, dword [rcx]
test eax, eax
je 0x140001edc
cmp dword [rcx + 4], r12d
je 0x140001edc
cmp eax, dword [r8 + 0x54]
jb 0x140001edc
cmp rdx, 2
je 0x140001ed8
cmp rdx, 5
je 0x140001ed8
add eax, r13d
jmp 0x140001eda
add eax, edi
mov dword [rcx], eax
add rdx, 1
add rcx, 8
cmp rdx, 0x10
jb 0x140001eb5
mov edi, dword [r9 + 0xc]
add rdi, r15
call fcn.1400c2ab0
mov r10d, dword [rsp + 0xa8]
mov r11d, eax
mov rax, qword [rsp + 0x90]
mov rbx, r12
and r11d, 0xff0
test r10d, r10d
mov r12, r10
lea rsi, [r11 + rax + 0x1000]
je 0x140001f44
call fcn.1400c2ab0
add rbx, 1
add rdi, 1
xor al, byte [rsi + rbx - 1]
cmp rbx, r12
mov byte [rdi - 1], al
jb 0x140001f23
mov r10d, dword [rsp + 0xa8]
mov rax, qword [rsp + 0x28]
xor esi, esi
cmp word [rax + 6], si
jbe 0x140002037
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x90]
lea rdi, [rax + rbp + 0x24]
mov rbp, qword [rsp + 0x28]
add rbx, 0x10
nop
nop
nop
add dword [rbx - 4], r10d
cmp dword [rbx + 4], 0
je 0x140002017
lea rdx, str..rsrc
lea rcx, [rbx - 0x10]
call fcn.1400c1f80
test eax, eax
je 0x140001ff7
lea rdx, str..reloc
lea rcx, [rbx - 0x10]
call fcn.1400c1f80
test eax, eax
je 0x140001ff7
mov eax, dword [rbx - 4]
mov edx, dword [rdi]
mov r8d, dword [rbx]
sub rax, r12
mov ecx, r13d
add rdx, r14
add rax, r15
add rcx, rax
call fcn.1400c1a10
mov edx, dword [rsp + 0x20]
mov r10d, dword [rsp + 0xa8]
mov r11d, r13d
mov eax, edx
sub r11d, r10d
not eax
add dword [rbx - 8], r11d
mov ecx, dword [rbx - 8]
add ecx, edx
and ecx, eax
mov dword [rbx], ecx
jmp 0x140002012
mov edx, dword [rdi]
mov ecx, dword [rbx - 4]
mov r8d, dword [rbx]
add rdx, r14
add rcx, r15
call fcn.1400c1a10
mov r10d, dword [rsp + 0xa8]
mov rbp, qword [rsp + 0x28]
movzx eax, word [rbp + 6]
add rsi, 1
add rdi, 0x28
add rbx, 0x28
cmp rsi, rax
jb 0x140001f80
mov r14, qword [rsp + 0x40]
jmp 0x14000203a
mov rbp, rax
mov rdi, qword [rsp + 0x30]
mov eax, dword [rsp + 0x20]
xor esi, esi
add dword [rdi + 8], r10d
sub dword [rdi + 0xc], r10d
mov r12d, eax
add eax, r10d
not r12d
add eax, dword [rdi + 0x10]
and eax, r12d
mov dword [rdi + 0x10], eax
mov eax, dword [rbp + 0xa0]
test eax, eax
je 0x140002117
cmp dword [rbp + 0xa4], esi
je 0x140002117
cmp dword [r15 + rax], esi
lea r11, [r15 + rax]
movsxd rbx, r13d
je 0x140002117
nop
nop
mov r10d, dword [r11 + 4]
lea r9, [r11 + 8]
mov r8d, esi
sub r10, 8
shr r10, 1
test r10d, r10d
je 0x1400020fe
nop
nop
nop
mov cx, word [r9]
mov edx, dword [r11]
mov rax, rcx
and eax, 0xfff
add rax, rbx
add rdx, rax
movzx eax, cx
shr eax, 0xc
je 0x1400020f1
cmp eax, 3
jne 0x140002451
mov rdi, qword [rsp + 0x38]
mov ecx, dword [rdx + r15]
mov eax, dword [rdi + 0x34]
add eax, dword [rdi + 0x54]
cmp ecx, eax
jb 0x1400020f1
lea eax, [rcx + r13]
mov dword [rdx + r15], eax
add r8d, 1
add r9, 2
cmp r8d, r10d
jb 0x1400020b0
mov eax, dword [r11 + 4]
add r11, rax
cmp dword [r11], esi
jne 0x140002090
mov r10d, dword [rsp + 0xa8]
mov rdi, qword [rsp + 0x30]
mov eax, dword [r14]
test eax, eax
je 0x1400021a1
cmp dword [rbp + 0x7c], 0
je 0x1400021a1
add dword [r15 + rax + 0x1c], r13d
mov ecx, dword [r15 + rax + 0x1c]
add dword [r15 + rax + 0xc], r13d
add dword [r15 + rax + 0x24], r13d
lea rdx, [r15 + rax]
add rcx, r15
cmp dword [rdx + 0x14], 0
mov r8, rsi
jbe 0x14000216b
nop
mov eax, dword [rcx]
test eax, eax
je 0x14000215b
add eax, r13d
mov dword [rcx], eax
mov eax, dword [rdx + 0x14]
add r8, 1
add rcx, 4
cmp r8, rax
jb 0x140002150
mov eax, dword [rdx + 0x20]
test eax, eax
je 0x1400021a1
add eax, r13d
mov r8, rsi
mov ecx, eax
mov dword [rdx + 0x20], eax
add rcx, r15
cmp dword [rdx + 0x14], 0
jbe 0x1400021a1
mov eax, dword [rcx]
test eax, eax
je 0x140002191
add eax, r13d
mov dword [rcx], eax
mov eax, dword [rdx + 0x14]
add r8, 1
add rcx, 4
cmp r8, rax
jb 0x140002186
mov eax, dword [rbp + 0x80]
test eax, eax
je 0x14000220f
cmp dword [rbp + 0x84], 0
je 0x14000220f
cmp dword [r15 + rax + 0xc], 0
lea rdx, [r15 + rax]
je 0x14000220f
add dword [rdx], r13d
mov ecx, dword [rdx]
add dword [rdx + 0xc], r13d
add rcx, r15
cmp dword [rcx], 0
je 0x1400021e7
mov eax, dword [rcx]
bt eax, 0x1f
jb 0x1400021de
add eax, r13d
mov dword [rcx], eax
add rcx, 4
cmp dword [rcx], 0
jne 0x1400021d1
add dword [rdx + 0x10], r13d
cmp dword [rdx + 4], 0
jne 0x140002205
mov eax, dword [rdx + 0x10]
add rax, r15
cmp dword [rax], 0
je 0x140002205
add rax, 4
cmp dword [rax], 0
jne 0x1400021fc
add rdx, 0x14
cmp dword [rdx + 0xc], 0
jne 0x1400021c0
mov eax, dword [rbp + 0xd8]
test eax, eax
je 0x140002246
cmp dword [rbp + 0xdc], 0
je 0x140002246
cmp dword [r15 + rax], 0
lea rcx, [r15 + rax]
je 0x140002246
nop
mov eax, dword [rcx]
bt eax, 0x1f
jb 0x14000223d
add eax, r13d
mov dword [rcx], eax
add rcx, 4
cmp dword [rcx], 0
jne 0x140002230
mov eax, dword [rbp + 0xc8]
test eax, eax
je 0x1400022a2
cmp dword [rbp + 0xcc], 0
je 0x1400022a2
cmp dword [r15 + rax], 0x48
lea r8, [r15 + rax]
jb 0x1400022a2
mov ecx, dword [r8 + 0x40]
test ecx, ecx
je 0x1400022a2
mov r9d, dword [r8 + 0x44]
test r9d, r9d
je 0x1400022a2
mov eax, dword [rbp + 0x34]
mov rdx, rsi
sub rcx, rax
add rcx, r15
test r9d, r9d
je 0x1400022a2
mov eax, dword [rcx]
test eax, eax
je 0x140002291
add eax, r13d
mov dword [rcx], eax
mov eax, dword [r8 + 0x44]
add rdx, 1
add rcx, 4
cmp rdx, rax
jb 0x140002286
mov eax, dword [rbp + 0x88]
test eax, eax
je 0x1400022c4
cmp dword [rbp + 0x8c], 0
je 0x1400022c4
lea rcx, [r15 + rax]
mov r8d, r10d
mov rdx, rcx
call fcn.140001be0
mov eax, dword [rbp + 0xa0]
test eax, eax
je 0x140002460
mov ecx, dword [rbp + 0xa4]
test ecx, ecx
je 0x140002460
mov r8, rcx
lea rcx, [r15 + rax]
xor edx, edx
call fcn.1400c2840
mov ebx, dword [rbp + 0xa0]
mov r14, qword [rsp + 0x90]
xor eax, eax
add rbx, r15
mov dword [rbx], eax
mov dword [rbx + 4], eax
mov rax, qword [rsp + 0x38]
mov r10d, dword [rax + 0xa0]
add r10, r14
cmp dword [r10], 0
je 0x1400023dd
nop
mov eax, dword [r10 + 4]
lea r8, [r10 + 8]
sub rax, 8
shr rax, 1
test eax, eax
je 0x1400023cc
mov r9d, eax
nop
nop
mov dx, word [r8]
movzx eax, dx
and ax, 0xf000
cmp ax, 0x3000
jne 0x1400023be
mov eax, dword [r10]
and edx, 0xfff
add rdx, rax
mov eax, r13d
add rdx, rax
mov eax, dword [rbx]
mov rcx, rdx
sub rcx, rax
cmp rcx, 0xfff
jbe 0x1400023a5
mov eax, dword [rbx + 4]
test eax, eax
je 0x140002397
test al, 1
je 0x14000238a
mov word [rbx + rax*2 + 8], 0
add dword [rbx + 4], 1
mov eax, dword [rbx + 4]
lea eax, [rax + rax + 8]
mov dword [rbx + 4], eax
add rbx, rax
xor eax, eax
mov dword [rbx + 4], eax
mov eax, edx
and eax, 0xfffff000
mov dword [rbx], eax
mov eax, dword [rbx + 4]
sub dx, word [rbx]
mov word [rbx + rax*2 + 8], dx
mov eax, dword [rbx + 4]
or word [rbx + rax*2 + 8], 0x3000
add dword [rbx + 4], 1
add r8, 2
sub r9, 1
jne 0x140002340
mov eax, dword [r10 + 4]
add r10, rax
cmp dword [r10], 0
jne 0x140002320
mov eax, dword [rbx + 4]
test eax, eax
je 0x140002400
test al, 1
je 0x1400023f3
mov word [rbx + rax*2 + 8], 0
add dword [rbx + 4], 1
mov eax, dword [rbx + 4]
lea eax, [rax + rax + 8]
mov dword [rbx + 4], eax
add rbx, rax
xor eax, eax
lea rdx, str..reloc
mov dword [rbx], eax
mov dword [rbx + 4], eax
mov eax, dword [rbp + 0xa0]
add rax, r15
sub ebx, eax
movzx eax, word [rbp + 6]
sub eax, 1
mov dword [rbp + 0xa4], ebx
movsxd rcx, eax
lea rax, [rcx + rcx*4]
lea rdi, [rdi + rax*8]
mov rcx, rdi
call fcn.1400c1f80
test eax, eax
jne 0x140002468
mov ecx, dword [rsp + 0x20]
lea eax, [rbx + 8]
add ecx, eax
mov dword [rdi + 8], eax
and ecx, r12d
mov dword [rdi + 0x10], ecx
jmp 0x140002468
mov rcx, r15
call fcn.14008c4f0
xor eax, eax
jmp 0x1400027b8
mov r14, qword [rsp + 0x90]
movzx edx, word [rbp + 6]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x24]
lea eax, [rdx - 1]
movsxd rcx, eax
lea rax, [rcx + rcx*4]
mov ecx, dword [r9 + rax*8 + 0xc]
add ecx, dword [r9 + rax*8 + 8]
mov eax, dword [rbp + 0x1c]
add eax, ebx
add ecx, ebx
add eax, r13d
and ecx, r8d
and eax, r8d
test dx, dx
mov dword [rbp + 0x50], ecx
mov dword [rbp + 0x1c], eax
mov rax, qword [rsp + 0x38]
mov r8d, dword [rax + 0x54]
je 0x1400024d5
lea rcx, [r9 + 0x14]
cmp dword [rcx], 0
je 0x1400024c4
mov eax, dword [rcx - 4]
mov dword [rcx], r8d
add r8, rax
movzx eax, word [rbp + 6]
add rsi, 1
add rcx, 0x28
cmp rsi, rax
jb 0x1400024b6
call fcn.1400c2ab0
mov ecx, dword [rsp + 0xa8]
mov esi, dword [rbp + 0x54]
xor edx, edx
div ecx
mov rax, rbx
shr rax, 2
mov ecx, edx
shr rcx, 1
cmp rcx, rax
cmovb rcx, rax
add rsi, r15
add rsi, rcx
call fcn.1400c2ab0
mov r13d, 0x80000000
cdq
mov byte [rsi], 0x60
lea rbx, [rsi + 1]
and edx, 0x1f
add eax, edx
and eax, 0x1f
sub eax, edx
movsxd rdi, eax
add rdi, 0x10
test r13, rdi
jne 0x140002618
lea r12, [0x140000000]
call fcn.1400c2ab0
mov r11d, eax
mov eax, 0x66666667
imul r11d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r11d, ecx
cmp r11d, 0x13
ja case.default.0x140002570
movsxd rax, r11d
mov ecx, dword [r12 + rax*4 + 0x27d0]
add rcx, r12
jmp rcx
mov byte [rbx], 0xb8
call fcn.1400c2ab0
add rbx, 5
sub rdi, 5
mov dword [rbx - 4], eax
jmp 0x14000260f
mov byte [rbx], 0xbb
jmp 0x140002575
mov byte [rbx], 0xb9
jmp 0x140002575
mov byte [rbx], 0xba
jmp 0x140002575
mov byte [rbx + 1], 0xc0
mov byte [rbx], 0x83
call fcn.1400c2ab0
add rbx, 3
mov byte [rbx - 1], al
sub rdi, 3
jmp 0x14000260f
mov byte [rbx + 1], 0xc3
jmp 0x14000259d
mov byte [rbx + 1], 0xc1
jmp 0x14000259d
mov byte [rbx + 1], 0xc2
jmp 0x14000259d
mov byte [rbx + 1], 0xe8
jmp 0x14000259d
mov byte [rbx + 1], 0xeb
jmp 0x14000259d
mov byte [rbx + 1], 0xe9
jmp 0x14000259d
mov byte [rbx + 1], 0xea
jmp 0x14000259d
mov byte [rbx], 0x40
jmp 0x140002607
mov byte [rbx], 0x43
jmp 0x140002607
mov byte [rbx], 0x41
jmp 0x140002607
mov byte [rbx], 0x42
jmp 0x140002607
mov byte [rbx], 0x48
jmp 0x140002607
mov byte [rbx], 0x4b
jmp 0x140002607
mov byte [rbx], 0x49
jmp 0x140002607
mov byte [rbx], 0x4a
jmp 0x140002607
mov byte [rbx], 0x90
add rbx, 1
sub rdi, 1
test r13, rdi
je 0x140002535
mov byte [rbx], 0x61
mov byte [rbx + 1], 0xe9
mov eax, dword [rbp + 0x28]
add rbx, 2
mov ecx, r15d
sub ecx, ebx
sub esi, r15d
lea ecx, [rcx + rax - 4]
mov dword [rbx], ecx
mov dword [rbp + 0x28], esi
jmp 0x140002653
mov ecx, dword [rsi + 0x50]
call fcn.14008c4a0
mov r8d, dword [rsi + 0x50]
mov rdx, r14
mov rcx, rax
mov r15, rax
call fcn.1400c1a10
movsxd rax, dword [r14 + 0x3c]
mov ecx, dword [rax + r15 + 0x78]
test ecx, ecx
je 0x14000274b
cmp dword [rax + r15 + 0x7c], 0
je 0x14000274b
mov ecx, dword [rcx + r15 + 0xc]
test ecx, ecx
je 0x14000274b
cmp byte [r15 + rcx], 0
lea rbx, [r15 + rcx]
je 0x14000274b
nop
cmp byte [rbx], 0x2e
je 0x14000274b
call fcn.1400c2ab0
add rbx, 1
mov r11d, eax
mov eax, 0x4ec4ec4f
imul r11d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1a
sub r11d, edx
add r11b, 0x61
mov byte [rbx - 1], r11b
cmp byte [rbx], 0
jne 0x140002690
jmp 0x14000274b
mov ecx, dword [rsi + 0x50]
call fcn.14008c4a0
mov r8d, dword [rsi + 0x50]
mov rdx, r14
mov rcx, rax
mov r15, rax
call fcn.1400c1a10
movsxd r11, dword [r14 + 0x3c]
mov eax, dword [r11 + r15 + 0x88]
test eax, eax
je 0x14000274b
cmp dword [r11 + r15 + 0x8c], 0
je 0x14000274b
mov ecx, dword [rax + r15 + 0xc]
test ecx, ecx
je 0x14000274b
cmp byte [r15 + rcx], 0
lea rbx, [r15 + rcx]
je 0x14000274b
cmp byte [rbx], 0x2e
je 0x14000274b
call fcn.1400c2ab0
add rbx, 1
mov r11d, eax
mov eax, 0x4ec4ec4f
imul r11d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1a
sub r11d, edx
add r11b, 0x61
mov byte [rbx - 1], r11b
cmp byte [rbx], 0
jne 0x140002715
movsxd rax, dword [r15 + 0x3c]
lea r9, [r15 + 0x40]
add rax, r15
mov rcx, r9
cmp r9, rax
jae 0x1400027b5
nop
cmp dword [rcx], 0x68636952
je 0x140002773
add rcx, 4
cmp rcx, rax
jb 0x140002760
jmp 0x1400027b5
cmp r9, rcx
jae 0x1400027b5
mov edx, dword [rcx + 4]
lea r8, [rcx + 4]
nop
mov eax, dword [r9]
xor eax, edx
cmp eax, 0x536e6144
je 0x140002797
add r9, 4
cmp r9, rcx
jb 0x140002780
jmp 0x1400027b5
cmp r9, r8
ja 0x1400027b5
sub r8, r9
xor edx, edx
mov rcx, r9
shr r8, 2
add r8, 1
shl r8, 2
call fcn.1400c2840
mov rax, r15
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret