Function at 0x14002ea14
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [r9]
xor r14d, r14d
mov rcx, r8
cmp word [rax + 2], r14w
lea edi, [r14 + 0x7c]
mov r13, r8
mov edx, edi
setne byte [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrChrW]
lea r15d, [r14 + 0x2b]
mov rbx, rax
mov qword [rsp + 0x60], rax
cmp rax, r14
jne 0x14002eaab
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.140058920
lea rcx, [rsp + 0x48]
call fcn.140054620
cmp al, r14b
jle 0x14002ea9c
mov edx, r15d
mov rcx, r13
mov di, r15w
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x48]
call fcn.140044f24
mov rbx, qword [rsp + 0x60]
or rsi, 0xffffffffffffffff
mov rbp, r14
mov r12, rsi
cmp rbx, r14
je 0x14002eb0f
mov word [rbx], r14w
add qword [rsp + 0x60], 2
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], r14
call fcn.140051edc
mov rax, qword [rsp + 0x60]
movsxd rbp, dword [rsp + 0x48]
mov rcx, r14
mov qword [rsp + 0x48], rcx
cmp di, word [rax]
jne 0x14002eb0c
add rax, 2
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
call fcn.140051edc
mov rcx, qword [rsp + 0x48]
movsxd r12, ecx
lea rcx, [rsp + 0x68]
mov rdx, r13
call fcn.140058920
cmp rbx, r14
je 0x14002eb25
mov word [rbx], r15w
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x58], r14d
call fcn.140062f5c
mov r15d, dword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
lea rdx, [rsp + 0x68]
xor r8d, r8d
sar r15d, 0x10
mov dil, al
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x78], r14d
mov dword [rsp + 0x7c], r14d
call fcn.1400035d0
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
lea rcx, [rsp + 0x48]
mov r9d, 7
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x20], r14
call fcn.1400034e0
mov rbx, qword [rsp + 0x48]
cmp rbx, r14
je 0x14002ef8f
mov rcx, rbx
cmp dil, r14b
je 0x14002ebc6
mov dl, dil
call fcn.14004a0b4
mov rdi, rax
jmp 0x14002ebdb
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rdi, qword [rsp + 0x48]
cmp rdi, r14
jle 0x14002ef81
cmp rdi, rbp
jl 0x14002ef81
cmp rbp, r14
jle 0x14002ebf5
sub rdi, rbp
mov eax, 0x10000000
cmp rdi, rax
cmovg rdi, rax
cmp r12, r14
jle 0x14002ec0d
cmp rdi, r12
cmovg rdi, r12
lea r12d, [rdi + 0x10]
lea rcx, [rsp + 0x70]
mov edx, r12d
call fcn.14004bd00
mov r14, qword [rsp + 0x70]
xor eax, eax
cmp r14, rax
jne 0x14002ec44
cmp rbx, rsi
je 0x14002ec38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0xe8]
jmp 0x14002ef8f
mov dword [rsp + 0x7c], r12d
xor r12d, r12d
mov dword [rsp + 0x78], edi
cmp rbp, r12
jle 0x14002ec67
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, r14
mov rcx, rbx
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [rsp + 0x48]
cmp edi, r12d
cmovl edi, r12d
xor edx, edx
movsxd r12, edi
lea r8d, [rdx + 0x10]
lea rcx, [r12 + r14]
call fcn.1400b93b0
cmp rbx, rsi
je 0x14002ecb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xd8]
mov rdx, r13
mov rcx, rbx
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x7c], edi
call fcn.14004bfa8
lea rdx, [0x1400d9870]
mov rcx, rbx
call fcn.14004bfa8
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
mov edx, edi
call fcn.140048624
movzx ebp, r15w
movzx ecx, bpl
mov sil, al
xor eax, eax
mov ebx, ecx
lea r13d, [rax + 1]
shl ebx, 8
or ebx, ecx
mov rcx, qword [rsp + 0x70]
cmp sil, al
je 0x14002ed87
xor r12d, r12d
mov qword [rsp + 0x48], rcx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
mov r8d, ebp
mov dword [rsp + 0x54], edi
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], r12d
mov dword [rsp + 0x7c], r12d
mov dword [rsp + 0x50], edi
call fcn.14005062c
mov rcx, qword [rsp + 0x48]
call fcn.140044ed8
mov edx, dword [rsp + 0xe8]
movzx eax, r15w
movsx ecx, sil
mov r11d, 0xfeff
xor ax, r11w
cmp ax, word [r14]
movzx eax, dx
cmove ebx, ebp
mov edi, ebx
shl edi, 0x10
or edi, eax
or edi, ecx
or ecx, edx
mov dword [rsp + 0xe8], ecx
lea rcx, [rsp + 0x48]
call fcn.140044f24
jmp 0x14002edc3
movzx eax, r15w
mov r11d, 0xfeff
xor ax, r11w
cmp ax, word [rcx]
lea rax, [r12 + 1]
cmove ebx, ebp
shr rax, 1
jmp 0x14002edac
xor word [rcx], bx
add rcx, 2
sub eax, r13d
jns 0x14002eda5
movzx eax, word [rsp + 0xe8]
mov edi, ebx
shl edi, 0x10
or edi, eax
xor r12d, r12d
or edi, 3
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.1400aa188
mov r8, qword [rsp + 0x70]
movzx edx, bx
mov rcx, r8
call fcn.14001554c
movsxd rdi, eax
lea esi, [rdi + rdi]
cmp ebx, ebp
je 0x14002ee0a
lea eax, [rdi - 1]
xor bx, r15w
cmp eax, r12d
jl 0x14002ee0a
xor word [r8], bx
add r8, 2
sub eax, r13d
jns 0x14002edf8
mov r8, qword [rsp + 0x70]
mov r14, qword [rsp + 0xe0]
lea edx, [rsi + 0x23]
mov rcx, r8
movzx r13d, word [r14 + 0x88]
mov dword [rsp + 0x7c], edi
mov dword [rsp + 0x78], edi
call fcn.14004baf4
movsxd rcx, esi
add rcx, rax
mov qword [rsp + 0x70], rax
mov eax, 0xf
mov word [rcx + 0x20], r12w
mov word [rcx + rax*2], r15w
sub rax, 1
jns 0x14002ee42
mov rbp, qword [rsp + 0x70]
mov r8b, byte [rsp + 0x40]
mov rcx, r14
mov rdx, rbp
call fcn.140020498
cmp word [rbp], r13w
jne 0x14002ee71
mov esi, r12d
jmp 0x14002ef8f
mov r15, qword [rsp + 0xc0]
cmp qword [r15], r12
je 0x14002ee8e
mov rcx, qword [r15]
movzx edx, r13w
call fcn.14001554c
mov ebx, eax
jmp 0x14002ee91
mov ebx, r12d
mov rcx, qword [r15]
xor eax, eax
mov esi, eax
movzx eax, word [r14 + 0x90]
cmp word [rbp + rdi*2 - 2], ax
mov eax, 1
cmovne esi, eax
lea edx, [rsi + rbx]
add edx, edi
lea edx, [rdx + rdx + 0x22]
call fcn.14004baf4
mov qword [r15], rax
mov r15d, dword [rsp + 0xc8]
cmp r15d, ebx
cmovg r15d, ebx
cmp ebx, r15d
movsxd rcx, r15d
lea r10, [rax + rcx*2]
jle 0x14002eef5
mov eax, ebx
mov rdx, r10
sub eax, r15d
add eax, eax
movsxd r8, eax
movsxd rax, esi
add rax, rdi
lea rcx, [r10 + rax*2]
call fcn.1400177b0
xor eax, eax
cmp esi, eax
je 0x14002ef08
movzx eax, word [r14 + 0x90]
mov word [r10 + rdi*2], ax
lea r8, [rdi + rdi]
mov rdx, rbp
mov rcx, r10
call fcn.1400177f8
movsxd rcx, esi
movsxd r8, ebx
mov rbx, qword [rsp + 0xc0]
lea rax, [rdi + rcx]
add r8, rax
mov rax, qword [rbx]
mov word [rax + r8*2], r13w
mov rcx, qword [rsp + 0x70]
call fcn.140044ed8
mov esi, dword [rsp + 0xe8]
mov r9, qword [rsp + 0xd8]
mov r8d, edi
mov edx, r15d
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
call fcn.14002e670
movzx ebx, ax
lea rcx, [rsp + 0x70]
or ebx, esi
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
mov eax, ebx
jmp 0x14002efa5
cmp rbx, rsi
je 0x14002ef8f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
mov eax, esi
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret