Function at 0x1002d01a0
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1004946a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov eax, dword [0x1002f3aa4]
mov ebp, 0xfffffff
lea r13, [rcx + 0x18]
mov qword [rsp + 0x78], rdx
mov r15, qword [r13]
mov qword [rsp + 0x98], rcx
mov rcx, rax
mov r12d, dword [r15 + 1]
mov edx, dword [r15 + 5]
mov qword [rsp + 0xa0], r13
lea r14, [0x100000000]
and rdx, rbp
shr r12, 1
lea rsi, [rax + rdx - 1]
xor edx, edx
mov rax, rsi
and r12, rbp
add r12, r14
div rcx
lea r11, [0x100000000]
mov eax, dword [0x1002f3aa4]
sub rsi, rdx
mov qword [rsp + 0x88], r12
mov eax, dword [0x1002f3aa4]
mov r10d, dword [0x10005e244]
mov eax, dword [0x10005e244]
test eax, eax
je 0x1002d02e0
xor r8d, r8d
mov edi, dword [0x10005e244]
xor eax, eax
add edi, 0xffffffff
add rdi, 1
mov r9, rdi
je 0x1002d0299
mov rcx, qword [0x100495210]
imul rcx, rcx, 0x343fd
shl rax, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
shr r9, 0x10
jne 0x1002d026d
mov qword [0x100495210], rcx
xor edx, edx
div rdi
test r10, r10
je 0x1002d02d5
mov ecx, 0xffffc428
mov eax, 0x3bd7
add r8, 1
lock cmpxchg dword [r11 + rdx*4 + 0x478cb0], ecx
je 0x1002d054d
mov ecx, dword [0x10005e244]
lea rax, [rdx + 1]
xor edx, edx
div rcx
cmp r8, r10
jb 0x1002d02a3
xor ebx, ebx
test rbx, rbx
jne 0x1002d0409
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov ebp, eax
mov rcx, qword [0x10047b438]
mov r8, rcx
mov r9, rcx
add rdi, 1
xor eax, eax
test rcx, rcx
je 0x1002d0335
mov rcx, qword [0x100495210]
imul rcx, rcx, 0x343fd
shl rax, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
shr r9, 0x10
jne 0x1002d0309
mov qword [0x100495210], rcx
xor edx, edx
mov r9d, 0x40
div r8
mov r8d, 0x3000
mov rcx, rdx
mov rdx, rsi
shl rcx, 0x10
add rcx, qword [0x100493ee0]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1002d03a0
lea r9, [0x1003c433c]
and qword [rsp + 0x28], 0
mov rdx, rax
mov r8d, esi
mov rcx, rax
and qword [rsp + 0x20], 0
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlInstallFunctionTableCallback]
test al, al
jne 0x1002d03b4
xor edx, edx
mov rcx, rbx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rdi, 0x11
jb 0x1002d02ea
xor ebx, ebx
cmp rbx, 0x10000
jb 0x1002d03c2
test bl, 3
je 0x1002d03e7
test rbx, rbx
je 0x1002d03e5
mov rcx, rbx
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlDeleteFunctionTable]
mov r8d, 0x8000
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
lea r11, [0x100000000]
je 0x1002d0234
mov rcx, rsi
xor eax, eax
mov rdi, rbx
rep stosb byte [rdi], al
mov eax, 0x1f0c098
mov ebp, 0xfffffff
add qword [r13], 9
mov esi, r12d
mov r15d, dword [r15 + 5]
mov edi, dword [0x1002f3aa4]
and r15, rbp
sub esi, r14d
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x58], esi
xor eax, eax
sub rdi, r15
add rdi, 1
mov r8, rdi
je 0x1002d0478
mov rcx, qword [0x100495210]
imul rcx, rcx, 0x343fd
shl rax, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
shr r8, 0x10
jne 0x1002d044c
mov qword [0x100495210], rcx
xor edx, edx
mov ecx, esi
div rdi
add rbx, rdx
mov qword [rsp + 0x80], rbx
mov r8, rbx
mov rdx, r15
mov eax, 0x5b25d9d1
lea rcx, [rsp + 0x70]
xor dil, dil
mov rdx, qword [r12 + r15]
mov qword [rsp + 0x70], rdx
mov eax, 0x5c22b8f1
mov r9d, dword [rsp + 0x74]
mov rcx, r14
mov r10, qword [rsp + 0x70]
mov rax, qword [0x1003f4900]
and qword [rsp + 0x48], 0
and r10, rbp
and r9, rbp
add r10, r14
sub rcx, rax
mov qword [rsp + 0x40], rcx
mov ebp, 4
jne 0x1002d0564
xor r8d, r8d
test r9, r9
je 0x1002d084d
mov edx, dword [rsp + 0x48]
mov r11d, 0x83010f63
mov ecx, dword [rsp + 0x4c]
movzx eax, byte [r10 + r8]
add r8, 1
sub eax, 0x7cfef09d
add edx, eax
add eax, ecx
mov ecx, eax
imul ecx, ecx, 0x2cfc
rol ecx, 3
ror eax, 3
xor eax, ecx
imul eax, eax, 0x83010f63
ror eax, 0x1c
imul rax, r11
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x30]
shr rax, 0x20
add ecx, eax
add edx, ecx
cmp r8, r9
jb 0x1002d04fb
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x48], edx
jmp 0x1002d084d
mov ecx, dword [0x1002f3aa4]
imul rcx, rdx
lea rbx, [rcx + r11 + 0x425000]
jmp 0x1002d02d7
invalid
invalid