Function at 0x140006ae0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rsi, rcx
mov rcx, r8
mov rdi, rdx
mov rbx, r8
call sym.strlen
mov ecx, 7
mov edx, 4
mov rbp, rax
call sym.calloc
mov rcx, rax
test rbp, rbp
je 0x140007203
mov r12, rbx
lea r14, [rbx + rbp]
mov r13, rbx
lea r10, [0x1400741ff]
movzx r8d, byte [r13]
mov eax, 1
xor r9d, r9d
cmp r8b, 0x31
je 0x140006cb0
nop word [rax + rax]
mov r9, rax
add rax, 1
movzx edx, byte [r10 + rax]
cmp dl, r8b
je 0x140006cb0
test dl, dl
jne 0x140006b50
call sym.free
lea rax, [rbp - 8]
cmp rax, 0x52
ja 0x140006f51
lea r8, [rbp - 1]
xor eax, eax
cmp byte [rbx + r8], 0x31
mov r10, rax
lea rax, [rax + 1]
je 0x140006bab
sub r8, 1
cmp rbp, rax
je 0x140006f51
cmp byte [rbx + r8], 0x31
mov r10, rax
lea rax, [rax + 1]
jne 0x140006b90
cmp rax, rbp
jae 0x140006f51
cmp r10, 5
jbe 0x140006f51
test r8, r8
je 0x1400073e8
xor eax, eax
xor r11d, r11d
mov ecx, 1
xor r13d, r13d
jmp 0x140006c80
lea r14d, [r9 - 0x41]
cmp r14d, 0x19
ja 0x140006bf6
add r9d, 0x20
mov eax, 1
mov edx, r9d
mov byte [rsp + r13 + 0xd0], dl
mov edx, ecx
shl ecx, 5
add r13, 1
shr edx, 0x19
and ecx, 0x3fffffe0
sar r9d, 5
mov r14d, edx
and r14d, 1
neg r14d
and r14d, 0x3b6a57b2
xor ecx, r14d
mov r14d, edx
shr r14d, 4
neg r14d
and r14d, 0x2a1462b3
xor ecx, r14d
mov r14d, edx
shl r14d, 0x1e
sar r14d, 0x1f
and r14d, 0x26508e6d
xor ecx, r14d
mov r14d, edx
shl edx, 0x1c
shl r14d, 0x1d
sar edx, 0x1f
sar r14d, 0x1f
and edx, 0x3d4233dd
and r14d, 0x1ea119fa
xor ecx, r14d
xor ecx, edx
xor ecx, r9d
cmp r13, r8
je 0x140006fa8
movsx r9d, byte [rbx + r13]
lea r14d, [r9 - 0x21]
mov edx, r9d
cmp r14d, 0x5d
ja 0x140006f51
lea r14d, [r9 - 0x61]
cmp r14d, 0x19
ja 0x140006be0
mov r11d, 1
jmp 0x140006bf6
mov eax, dword [rcx + 0x18]
imul rax, rax, 0x3a
add rax, r9
mov rdx, rax
mov dword [rcx + 0x18], eax
mov eax, dword [rcx + 0x14]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 0x14], eax
mov eax, dword [rcx + 0x10]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 0x10], eax
mov eax, dword [rcx + 0xc]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 0xc], eax
mov eax, dword [rcx + 8]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 8], eax
mov eax, dword [rcx + 4]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 4], eax
mov eax, dword [rcx]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx], eax
mov r11d, eax
shr rdx, 0x20
jne 0x140006b69
cmp eax, 0xff
ja 0x140006b69
add r13, 1
cmp r13, r14
jne 0x140006b33
mov r9d, dword [rcx + 0xc]
mov r8d, dword [rcx + 8]
movzx r11d, r11b
mov ebp, dword [rcx + 0x10]
mov r10d, dword [rcx + 4]
mov r15d, r9d
mov eax, r8d
mov r14d, r8d
mov edx, r9d
shr r15d, 0x10
shr eax, 0x10
mov dword [rsp + 0x20], ebp
mov r12d, r10d
mov dword [rsp + 0x38], r15d
mov r15d, r8d
movzx eax, al
shr r14d, 0x18
shr edx, 0x18
movzx r14d, r14b
mov r13d, r10d
shr r12d, 0x18
mov dword [rsp + 0x34], edx
mov edx, ebp
and r15d, 0xff00
shr ebp, 0x10
or rax, r15
shr edx, 0x18
movzx r15d, r10b
movzx ebp, bpl
shl rax, 8
mov dword [rsp + 0x3c], edx
mov edx, r10d
shr r13d, 0x10
or rax, r14
movzx edx, dh
movzx r13d, r13b
movzx r12d, r12b
shl rax, 8
movzx r8d, r8b
or rax, r15
mov r15d, dword [rsp + 0x20]
shl rax, 8
or rax, rdx
mov edx, r9d
shl rax, 8
movzx edx, dh
mov r10, rax
mov eax, r15d
and eax, 0xff00
or r10, r13
or rax, rbp
movzx ebp, byte [rsp + 0x3c]
shl r10, 8
shl rax, 8
or r10, r12
or rax, rbp
movzx ebp, r9b
movzx r9d, byte [rsp + 0x38]
shl r10, 8
shl rax, 8
or rax, rbp
shl rax, 8
or rax, rdx
shl rax, 8
or rax, r9
movzx r9d, byte [rsp + 0x34]
shl rax, 8
or rax, r9
or r10, r11
shl rax, 8
mov qword [rsp + 0x20], r10
mov r10d, dword [rcx + 0x14]
or rax, r8
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x18]
mov edx, r10d
mov r9d, r10d
movzx edx, dh
shr r9d, 0x10
mov r8d, r10d
movdqu xmm0, xmmword [rsp + 0x20]
mov ebp, eax
mov byte [rsp + 0x88], al
mov r11d, eax
movzx r9d, r9b
shr ebp, 0x10
and eax, 0xff00
shr r11d, 0x18
movups xmmword [rsp + 0x70], xmm0
movzx ebp, bpl
movzx r11d, r11b
shr r8d, 0x18
or rax, rbp
movzx r8d, r8b
lea rbp, [rsp + 0x70]
shl rax, 8
or rax, r11
movzx r11d, r10b
shl rax, 8
or rax, r11
shl rax, 8
or rax, rdx
shl rax, 8
or rax, r9
shl rax, 8
or rax, r8
movzx r8d, r15b
shl rax, 8
mov rdx, rax
or rdx, r8
mov qword [rsp + 0x80], rdx
call sym.free
lea rcx, [rsp + 0xd0]
mov r8d, 0x15
mov rdx, rbp
call sym.sha256d
mov eax, dword [rsp + 0xd0]
cmp dword [rsp + 0x85], eax
jne 0x140006f51
movzx edx, byte [rsp + 0x70]
movzx ecx, byte [rbx]
xor eax, eax
test dl, dl
je 0x140006f4b
jmp 0x1400071bc
add rax, 1
cmp byte [rbp + rax], 0
jne 0x140006f58
cmp byte [rbx + rax], 0x31
je 0x140006f40
xor eax, eax
jmp 0x140006f69
cmp byte [rbx + rax], 0x31
je 0x140006f51
cmp rdi, 0x18
ja 0x140006f7d
mov eax, 0x19
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 0xffffa976
movdqu xmm2, xmmword [rsp + 0x71]
mov edx, 0xffffac88
mov byte [rsi + 2], 0x14
mov word [rsi], ax
mov eax, dword [rsp + 0x81]
mov word [rsi + 0x17], dx
mov dword [rsi + 0x13], eax
movups xmmword [rsi + 3], xmm2
jmp 0x140006f64
mov byte [rsp + r8 + 0xd0], 0
mov r9d, ecx
shl ecx, 5
shr r9d, 0x19
mov edx, ecx
mov ecx, r9d
and edx, 0x3fffffe0
and ecx, 1
neg ecx
and ecx, 0x3b6a57b2
xor edx, ecx
mov ecx, r9d
shr ecx, 4
neg ecx
and ecx, 0x2a1462b3
xor edx, ecx
mov ecx, r9d
shl ecx, 0x1e
sar ecx, 0x1f
and ecx, 0x26508e6d
xor edx, ecx
mov ecx, r9d
shl ecx, 0x1d
sar ecx, 0x1f
and ecx, 0x1ea119fa
xor edx, ecx
mov ecx, r9d
lea r9, [rbx + r8]
shl ecx, 0x1c
sar ecx, 0x1f
and ecx, 0x3d4233dd
xor edx, ecx
nop word [rax + rax]
mov ecx, edx
shl edx, 5
add r12, 1
shr ecx, 0x19
and edx, 0x3fffffe0
mov r13d, ecx
and r13d, 1
neg r13d
and r13d, 0x3b6a57b2
xor edx, r13d
movzx r13d, byte [r12 - 1]
and r13d, 0x1f
xor edx, r13d
mov r13d, ecx
shr r13d, 4
neg r13d
and r13d, 0x2a1462b3
xor edx, r13d
mov r13d, ecx
shl r13d, 0x1e
sar r13d, 0x1f
and r13d, 0x26508e6d
xor edx, r13d
mov r13d, ecx
shl ecx, 0x1c
shl r13d, 0x1d
sar ecx, 0x1f
sar r13d, 0x1f
and ecx, 0x3d4233dd
and r13d, 0x1ea119fa
xor edx, r13d
xor edx, ecx
cmp r12, r9
jne 0x140007020
lea rcx, [r8 + 1]
cmp rcx, rbp
jae 0x14000720b
mov r8, r10
add rcx, 6
lea r12, [rbp + 6]
sub r8, rbp
lea r13, [0x140074180]
lea r14, [rsp + r8 + 0x70]
jmp 0x14000718f
movsx r9, r8b
lea r15d, [r8 - 0x61]
movzx r9d, byte [r13 + r9]
cmp r15b, 0x19
ja 0x1400071a5
mov r11d, 1
cmp r9b, 0xff
je 0x140006f51
mov r8d, edx
shl edx, 5
shr r8d, 0x19
and edx, 0x3fffffe0
mov r15d, r8d
and r15d, 1
neg r15d
and r15d, 0x3b6a57b2
xor edx, r15d
movsx r15d, r9b
xor edx, r15d
mov r15d, r8d
shl r15d, 0x1e
sar r15d, 0x1f
and r15d, 0x26508e6d
xor edx, r15d
mov r15d, r8d
shl r15d, 0x1d
sar r15d, 0x1f
and r15d, 0x1ea119fa
xor edx, r15d
mov r15d, r8d
shl r8d, 0x1b
shl r15d, 0x1c
sar r8d, 0x1f
sar r15d, 0x1f
and r8d, 0x2a1462b3
and r15d, 0x3d4233dd
xor edx, r15d
xor edx, r8d
cmp rcx, rbp
jae 0x140007186
mov byte [r14 + rcx - 6], r9b
add rcx, 1
cmp r12, rcx
je 0x14000720b
movzx r8d, byte [rbx + rcx - 6]
test r8b, r8b
jns 0x1400070d8
xor eax, eax
jmp 0x140006f69
sub r8d, 0x41
cmp r8b, 0x19
mov r8d, 1
cmovbe eax, r8d
jmp 0x1400070f6
cmp cl, 0x31
je 0x140006f51
cmp dl, 5
je 0x1400071d3
cmp dl, 0xc4
jne 0x140006f5e
cmp rdi, 0x16
jbe 0x1400071f9
mov eax, dword [rsp + 0x81]
mov ecx, 0x14a9
movdqu xmm1, xmmword [rsp + 0x71]
mov byte [rsi + 0x16], 0x87
mov word [rsi], cx
mov dword [rsi + 0x12], eax
movups xmmword [rsi + 2], xmm1
mov eax, 0x17
jmp 0x140006f69
mov r11d, dword [rax]
jmp 0x140006d5b
and eax, r11d
jne 0x140006f51
cmp edx, 1
jne 0x140006f51
lea rdx, [r10 - 7]
cmp rdx, 0x40
ja 0x140006f51
movzx r11d, byte [rsp + 0x70]
cmp r11b, 0x10
ja 0x140006f51
test rdx, rdx
je 0x140006f51
lea rbx, [rsp + r10 + 0x6a]
xor edx, edx
lea r10, [rsp + 0x71]
xor r8d, r8d
mov ecx, eax
jmp 0x140007263
mov rdx, r9
movzx eax, byte [r10]
shl r8d, 5
add r10, 1
or r8d, eax
lea eax, [rcx + 5]
cmp eax, 7
jle 0x140007395
sub ecx, 3
mov eax, r8d
lea r9, [rdx + 1]
shr eax, cl
mov byte [rsp + rdx + 0x40], al
cmp r10, rbx
jne 0x140007260
mov eax, ecx
mov ecx, 8
sub ecx, eax
shl r8d, cl
test r8b, r8b
jne 0x140006f51
cmp eax, 4
jg 0x140006f51
lea rax, [r9 - 2]
cmp rax, 0x26
ja 0x140006f51
test r11b, r11b
jne 0x14000739f
cmp r9, 0x14
je 0x1400073cf
cmp r9, 0x20
jne 0x140006f51
mov edx, 0x20
mov eax, 0x22
cmp rdi, 0x21
jbe 0x140006f51
mov byte [rsi + 1], dl
lea r8, [rsi + 2]
lea rcx, [rsp + 0x40]
mov edx, r9d
mov byte [rsi], r11b
cmp r9d, 8
jae 0x140007340
and r9d, 4
jne 0x1400073b8
test edx, edx
je 0x140006f69
movzx r9d, byte [rsp + 0x40]
mov byte [rsi + 2], r9b
test dl, 2
je 0x140006f69
movzx ecx, word [rcx + rdx - 2]
mov word [r8 + rdx - 2], cx
jmp 0x140006f69
mov rdx, qword [rsp + 0x40]
add rsi, 0xa
mov qword [rsi - 8], rdx
mov edx, r9d
and rsi, 0xfffffffffffffff8
mov r10, qword [rcx + rdx - 8]
mov qword [r8 + rdx - 8], r10
mov rdx, r8
sub rdx, rsi
sub rcx, rdx
add edx, r9d
and edx, 0xfffffff8
mov r8, rcx
cmp edx, 8
jb 0x140006f69
and edx, 0xfffffff8
xor ecx, ecx
mov r9d, ecx
add ecx, 8
mov r10, qword [r8 + r9]
mov qword [rsi + r9], r10
cmp ecx, edx
jb 0x14000737e
jmp 0x140006f69
mov r9, rdx
mov ecx, eax
jmp 0x14000728e
lea rax, [r9 + 2]
cmp rdi, rax
jb 0x140006f51
add r11d, 0x50
mov edx, r9d
jmp 0x1400072f0
mov r9d, dword [rsp + 0x40]
mov dword [rsi + 2], r9d
mov ecx, dword [rcx + rdx - 4]
mov dword [r8 + rdx - 4], ecx
jmp 0x140006f69
cmp rdi, 0x15
jbe 0x140006f51
mov edx, 0x14
mov eax, 0x16
jmp 0x1400072f0
xor r11d, r11d
xor eax, eax
mov ecx, 1
mov edx, 0x20
mov byte [rsp + 0xd0], 0
jmp 0x1400070b5