Function at 0x140006cb0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rsi, rcx
mov rcx, r8
mov rdi, rdx
mov rbx, r8
call sym.strlen
mov ecx, 7
mov edx, 4
mov rbp, rax
call sym.calloc
mov rcx, rax
test rbp, rbp
je 0x1400073d3
mov r12, rbx
lea r14, [rbx + rbp]
mov r13, rbx
lea r10, [0x14007423f]
movzx r8d, byte [r13]
mov eax, 1
xor r9d, r9d
cmp r8b, 0x31
je 0x140006e80
nop word [rax + rax]
mov r9, rax
add rax, 1
movzx edx, byte [r10 + rax]
cmp dl, r8b
je 0x140006e80
test dl, dl
jne 0x140006d20
call sym.free
lea rax, [rbp - 8]
cmp rax, 0x52
ja 0x140007121
lea r8, [rbp - 1]
xor eax, eax
cmp byte [rbx + r8], 0x31
mov r10, rax
lea rax, [rax + 1]
je 0x140006d7b
sub r8, 1
cmp rbp, rax
je 0x140007121
cmp byte [rbx + r8], 0x31
mov r10, rax
lea rax, [rax + 1]
jne 0x140006d60
cmp rax, rbp
jae 0x140007121
cmp r10, 5
jbe 0x140007121
test r8, r8
je 0x1400075b8
xor eax, eax
xor r11d, r11d
mov ecx, 1
xor r13d, r13d
jmp 0x140006e50
lea r14d, [r9 - 0x41]
cmp r14d, 0x19
ja 0x140006dc6
add r9d, 0x20
mov eax, 1
mov edx, r9d
mov byte [rsp + r13 + 0xd0], dl
mov edx, ecx
shl ecx, 5
add r13, 1
shr edx, 0x19
and ecx, 0x3fffffe0
sar r9d, 5
mov r14d, edx
and r14d, 1
neg r14d
and r14d, 0x3b6a57b2
xor ecx, r14d
mov r14d, edx
shr r14d, 4
neg r14d
and r14d, 0x2a1462b3
xor ecx, r14d
mov r14d, edx
shl r14d, 0x1e
sar r14d, 0x1f
and r14d, 0x26508e6d
xor ecx, r14d
mov r14d, edx
shl edx, 0x1c
shl r14d, 0x1d
sar edx, 0x1f
sar r14d, 0x1f
and edx, 0x3d4233dd
and r14d, 0x1ea119fa
xor ecx, r14d
xor ecx, edx
xor ecx, r9d
cmp r13, r8
je 0x140007178
movsx r9d, byte [rbx + r13]
lea r14d, [r9 - 0x21]
mov edx, r9d
cmp r14d, 0x5d
ja 0x140007121
lea r14d, [r9 - 0x61]
cmp r14d, 0x19
ja 0x140006db0
mov r11d, 1
jmp 0x140006dc6
mov eax, dword [rcx + 0x18]
imul rax, rax, 0x3a
add rax, r9
mov rdx, rax
mov dword [rcx + 0x18], eax
mov eax, dword [rcx + 0x14]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 0x14], eax
mov eax, dword [rcx + 0x10]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 0x10], eax
mov eax, dword [rcx + 0xc]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 0xc], eax
mov eax, dword [rcx + 8]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 8], eax
mov eax, dword [rcx + 4]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx + 4], eax
mov eax, dword [rcx]
shr rdx, 0x20
imul rax, rax, 0x3a
add rax, rdx
mov rdx, rax
mov dword [rcx], eax
mov r11d, eax
shr rdx, 0x20
jne 0x140006d39
cmp eax, 0xff
ja 0x140006d39
add r13, 1
cmp r13, r14
jne 0x140006d03
mov r9d, dword [rcx + 0xc]
mov r8d, dword [rcx + 8]
movzx r11d, r11b
mov ebp, dword [rcx + 0x10]
mov r10d, dword [rcx + 4]
mov r15d, r9d
mov eax, r8d
mov r14d, r8d
mov edx, r9d
shr r15d, 0x10
shr eax, 0x10
mov dword [rsp + 0x20], ebp
mov r12d, r10d
mov dword [rsp + 0x38], r15d
mov r15d, r8d
movzx eax, al
shr r14d, 0x18
shr edx, 0x18
movzx r14d, r14b
mov r13d, r10d
shr r12d, 0x18
mov dword [rsp + 0x34], edx
mov edx, ebp
and r15d, 0xff00
shr ebp, 0x10
or rax, r15
shr edx, 0x18
movzx r15d, r10b
movzx ebp, bpl
shl rax, 8
mov dword [rsp + 0x3c], edx
mov edx, r10d
shr r13d, 0x10
or rax, r14
movzx edx, dh
movzx r13d, r13b
movzx r12d, r12b
shl rax, 8
movzx r8d, r8b
or rax, r15
mov r15d, dword [rsp + 0x20]
shl rax, 8
or rax, rdx
mov edx, r9d
shl rax, 8
movzx edx, dh
mov r10, rax
mov eax, r15d
and eax, 0xff00
or r10, r13
or rax, rbp
movzx ebp, byte [rsp + 0x3c]
shl r10, 8
shl rax, 8
or r10, r12
or rax, rbp
movzx ebp, r9b
movzx r9d, byte [rsp + 0x38]
shl r10, 8
shl rax, 8
or rax, rbp
shl rax, 8
or rax, rdx
shl rax, 8
or rax, r9
movzx r9d, byte [rsp + 0x34]
shl rax, 8
or rax, r9
or r10, r11
shl rax, 8
mov qword [rsp + 0x20], r10
mov r10d, dword [rcx + 0x14]
or rax, r8
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x18]
mov edx, r10d
mov r9d, r10d
movzx edx, dh
shr r9d, 0x10
mov r8d, r10d
movdqu xmm0, xmmword [rsp + 0x20]
mov ebp, eax
mov byte [rsp + 0x88], al
mov r11d, eax
movzx r9d, r9b
shr ebp, 0x10
and eax, 0xff00
shr r11d, 0x18
movups xmmword [rsp + 0x70], xmm0
movzx ebp, bpl
movzx r11d, r11b
shr r8d, 0x18
or rax, rbp
movzx r8d, r8b
lea rbp, [rsp + 0x70]
shl rax, 8
or rax, r11
movzx r11d, r10b
shl rax, 8
or rax, r11
shl rax, 8
or rax, rdx
shl rax, 8
or rax, r9
shl rax, 8
or rax, r8
movzx r8d, r15b
shl rax, 8
mov rdx, rax
or rdx, r8
mov qword [rsp + 0x80], rdx
call sym.free
lea rcx, [rsp + 0xd0]
mov r8d, 0x15
mov rdx, rbp
call sym.sha256d
mov eax, dword [rsp + 0xd0]
cmp dword [rsp + 0x85], eax
jne 0x140007121
movzx edx, byte [rsp + 0x70]
movzx ecx, byte [rbx]
xor eax, eax
test dl, dl
je 0x14000711b
jmp 0x14000738c
add rax, 1
cmp byte [rbp + rax], 0
jne 0x140007128
cmp byte [rbx + rax], 0x31
je 0x140007110
xor eax, eax
jmp 0x140007139
cmp byte [rbx + rax], 0x31
je 0x140007121
cmp rdi, 0x18
ja 0x14000714d
mov eax, 0x19
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 0xffffa976
movdqu xmm2, xmmword [rsp + 0x71]
mov edx, 0xffffac88
mov byte [rsi + 2], 0x14
mov word [rsi], ax
mov eax, dword [rsp + 0x81]
mov word [rsi + 0x17], dx
mov dword [rsi + 0x13], eax
movups xmmword [rsi + 3], xmm2
jmp 0x140007134
mov byte [rsp + r8 + 0xd0], 0
mov r9d, ecx
shl ecx, 5
shr r9d, 0x19
mov edx, ecx
mov ecx, r9d
and edx, 0x3fffffe0
and ecx, 1
neg ecx
and ecx, 0x3b6a57b2
xor edx, ecx
mov ecx, r9d
shr ecx, 4
neg ecx
and ecx, 0x2a1462b3
xor edx, ecx
mov ecx, r9d
shl ecx, 0x1e
sar ecx, 0x1f
and ecx, 0x26508e6d
xor edx, ecx
mov ecx, r9d
shl ecx, 0x1d
sar ecx, 0x1f
and ecx, 0x1ea119fa
xor edx, ecx
mov ecx, r9d
lea r9, [rbx + r8]
shl ecx, 0x1c
sar ecx, 0x1f
and ecx, 0x3d4233dd
xor edx, ecx
nop word [rax + rax]
mov ecx, edx
shl edx, 5
add r12, 1
shr ecx, 0x19
and edx, 0x3fffffe0
mov r13d, ecx
and r13d, 1
neg r13d
and r13d, 0x3b6a57b2
xor edx, r13d
movzx r13d, byte [r12 - 1]
and r13d, 0x1f
xor edx, r13d
mov r13d, ecx
shr r13d, 4
neg r13d
and r13d, 0x2a1462b3
xor edx, r13d
mov r13d, ecx
shl r13d, 0x1e
sar r13d, 0x1f
and r13d, 0x26508e6d
xor edx, r13d
mov r13d, ecx
shl ecx, 0x1c
shl r13d, 0x1d
sar ecx, 0x1f
sar r13d, 0x1f
and ecx, 0x3d4233dd
and r13d, 0x1ea119fa
xor edx, r13d
xor edx, ecx
cmp r12, r9
jne 0x1400071f0
lea rcx, [r8 + 1]
cmp rcx, rbp
jae 0x1400073db
mov r8, r10
add rcx, 6
lea r12, [rbp + 6]
sub r8, rbp
lea r13, [0x1400741c0]
lea r14, [rsp + r8 + 0x70]
jmp 0x14000735f
movsx r9, r8b
lea r15d, [r8 - 0x61]
movzx r9d, byte [r13 + r9]
cmp r15b, 0x19
ja 0x140007375
mov r11d, 1
cmp r9b, 0xff
je 0x140007121
mov r8d, edx
shl edx, 5
shr r8d, 0x19
and edx, 0x3fffffe0
mov r15d, r8d
and r15d, 1
neg r15d
and r15d, 0x3b6a57b2
xor edx, r15d
movsx r15d, r9b
xor edx, r15d
mov r15d, r8d
shl r15d, 0x1e
sar r15d, 0x1f
and r15d, 0x26508e6d
xor edx, r15d
mov r15d, r8d
shl r15d, 0x1d
sar r15d, 0x1f
and r15d, 0x1ea119fa
xor edx, r15d
mov r15d, r8d
shl r8d, 0x1b
shl r15d, 0x1c
sar r8d, 0x1f
sar r15d, 0x1f
and r8d, 0x2a1462b3
and r15d, 0x3d4233dd
xor edx, r15d
xor edx, r8d
cmp rcx, rbp
jae 0x140007356
mov byte [r14 + rcx - 6], r9b
add rcx, 1
cmp r12, rcx
je 0x1400073db
movzx r8d, byte [rbx + rcx - 6]
test r8b, r8b
jns 0x1400072a8
xor eax, eax
jmp 0x140007139
sub r8d, 0x41
cmp r8b, 0x19
mov r8d, 1
cmovbe eax, r8d
jmp 0x1400072c6
cmp cl, 0x31
je 0x140007121
cmp dl, 5
je 0x1400073a3
cmp dl, 0xc4
jne 0x14000712e
cmp rdi, 0x16
jbe 0x1400073c9
mov eax, dword [rsp + 0x81]
mov ecx, 0x14a9
movdqu xmm1, xmmword [rsp + 0x71]
mov byte [rsi + 0x16], 0x87
mov word [rsi], cx
mov dword [rsi + 0x12], eax
movups xmmword [rsi + 2], xmm1
mov eax, 0x17
jmp 0x140007139
mov r11d, dword [rax]
jmp 0x140006f2b
and eax, r11d
jne 0x140007121
cmp edx, 1
jne 0x140007121
lea rdx, [r10 - 7]
cmp rdx, 0x40
ja 0x140007121
movzx r11d, byte [rsp + 0x70]
cmp r11b, 0x10
ja 0x140007121
test rdx, rdx
je 0x140007121
lea rbx, [rsp + r10 + 0x6a]
xor edx, edx
lea r10, [rsp + 0x71]
xor r8d, r8d
mov ecx, eax
jmp 0x140007433
mov rdx, r9
movzx eax, byte [r10]
shl r8d, 5
add r10, 1
or r8d, eax
lea eax, [rcx + 5]
cmp eax, 7
jle 0x140007565
sub ecx, 3
mov eax, r8d
lea r9, [rdx + 1]
shr eax, cl
mov byte [rsp + rdx + 0x40], al
cmp r10, rbx
jne 0x140007430
mov eax, ecx
mov ecx, 8
sub ecx, eax
shl r8d, cl
test r8b, r8b
jne 0x140007121
cmp eax, 4
jg 0x140007121
lea rax, [r9 - 2]
cmp rax, 0x26
ja 0x140007121
test r11b, r11b
jne 0x14000756f
cmp r9, 0x14
je 0x14000759f
cmp r9, 0x20
jne 0x140007121
mov edx, 0x20
mov eax, 0x22
cmp rdi, 0x21
jbe 0x140007121
mov byte [rsi + 1], dl
lea r8, [rsi + 2]
lea rcx, [rsp + 0x40]
mov edx, r9d
mov byte [rsi], r11b
cmp r9d, 8
jae 0x140007510
and r9d, 4
jne 0x140007588
test edx, edx
je 0x140007139
movzx r9d, byte [rsp + 0x40]
mov byte [rsi + 2], r9b
test dl, 2
je 0x140007139
movzx ecx, word [rcx + rdx - 2]
mov word [r8 + rdx - 2], cx
jmp 0x140007139
mov rdx, qword [rsp + 0x40]
add rsi, 0xa
mov qword [rsi - 8], rdx
mov edx, r9d
and rsi, 0xfffffffffffffff8
mov r10, qword [rcx + rdx - 8]
mov qword [r8 + rdx - 8], r10
mov rdx, r8
sub rdx, rsi
sub rcx, rdx
add edx, r9d
and edx, 0xfffffff8
mov r8, rcx
cmp edx, 8
jb 0x140007139
and edx, 0xfffffff8
xor ecx, ecx
mov r9d, ecx
add ecx, 8
mov r10, qword [r8 + r9]
mov qword [rsi + r9], r10
cmp ecx, edx
jb 0x14000754e
jmp 0x140007139
mov r9, rdx
mov ecx, eax
jmp 0x14000745e
lea rax, [r9 + 2]
cmp rdi, rax
jb 0x140007121
add r11d, 0x50
mov edx, r9d
jmp 0x1400074c0
mov r9d, dword [rsp + 0x40]
mov dword [rsi + 2], r9d
mov ecx, dword [rcx + rdx - 4]
mov dword [r8 + rdx - 4], ecx
jmp 0x140007139
cmp rdi, 0x15
jbe 0x140007121
mov edx, 0x14
mov eax, 0x16
jmp 0x1400074c0
xor r11d, r11d
xor eax, eax
mov ecx, 1
mov edx, 0x20
mov byte [rsp + 0xd0], 0
jmp 0x140007285