Function at 0x5560f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x110], rcx
sarx r8d, eax, r8d
mov r10d, edx
mov edx, r8d
neg edx
mov rcx, qword [rcx + 0x20]
mov rbx, qword [rsp + 0x110]
and edx, r10d
or edx, r8d
mov byte [rbx + rcx], dl
lea rax, [rcx + 1]
mov rcx, rax
mov r8d, 0x20
add rcx, rbx
sub r8, rax
xor edx, edx
mov qword [rsp + 0x128], r9
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x94], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x4c]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x110]
mov r13d, dword [rax + 0x60]
mov r12d, dword [rax + 0x5c]
mov eax, dword [rax + 0x64]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x110]
mov ebx, dword [rax + 0x68]
mov eax, dword [rax + 0x6c]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x74]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x110]
mov edi, dword [rax + 0x78]
mov eax, dword [rax + 0x7c]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x110]
mov r8d, dword [rax]
mov dword [rsp + 0xbc], 2
mov dword [rsp + 0xa4], r13d
mov dword [rsp + 0x40], edi
mov ecx, r8d
bswap ecx
mov eax, dword [rax + 4]
mov r8d, eax
bswap r8d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 8]
mov esi, eax
bswap esi
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0xc]
mov r10d, eax
bswap r10d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x10]
mov r15d, eax
bswap r15d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x14]
mov r13d, eax
bswap r13d
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0x50], r13d
mov eax, dword [rax + 0x18]
bswap eax
mov rdi, qword [rsp + 0x110]
mov edi, dword [rdi + 0x1c]
mov r11d, edi
bswap r11d
mov edx, dword [rsp + 0x68]
mov r14d, dword [rsp + 0x6c]
xor edx, dword [rsp + 0x60]
xor r14d, dword [rsp + 0x70]
mov dword [rsp + 0x44], edx
mov r13d, dword [rsp + 0x90]
mov edx, r14d
mov r14d, dword [rsp + 0x84]
xor r13d, r12d
xor r14d, dword [rsp + 0x88]
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x4c], r13d
mov r13d, dword [rsp + 0x44]
mov r14d, dword [rsp + 0x94]
xor r13d, dword [rsp + 0x28]
mov dword [rsp + 0xb4], r13d
mov r13d, dword [rsp + 0x48]
xor r14d, dword [rsp + 0xa4]
xor r13d, dword [rsp + 0x40]
mov dword [rsp + 0xa8], r14d
mov dword [rsp + 0x44], r13d
mov r13d, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x80]
xor r13d, dword [rsp + 0x2c]
mov dword [rsp + 0x48], r13d
mov r14d, dword [rsp + 0xa0]
mov r13d, dword [rsp + 0xa8]
mov ebp, dword [rsp + 0x54]
xor r13d, dword [rsp + 0x34]
xor r14d, dword [rsp + 0x98]
xor r9d, dword [rsp + 0x78]
xor r14d, dword [rsp + 0x3c]
xor ebp, dword [rsp + 0x58]
mov dword [rsp + 0xa8], r13d
xor r9d, dword [rsp + 0x38]
xor r9d, r14d
xor edx, dword [rsp + 0x30]
mov dword [rsp + 0x4c], r9d
mov r9d, edx
mov edx, dword [rsp + 0x54]
xor r9d, r14d
xor ebp, ebx
xor edx, ecx
mov dword [rsp + 0xac], r9d
mov dword [rsp + 0xb0], edx
mov r9d, ebp
mov edx, dword [rsp + 0x68]
mov ebp, dword [rsp + 0x80]
xor edx, r8d
xor ebp, r10d
mov dword [rsp + 0x54], edx
mov edx, dword [rsp + 0x6c]
mov dword [rsp + 0x6c], ebp
mov ebp, dword [rsp + 0x84]
mov r13d, dword [rsp + 0x50]
xor ebp, r15d
mov dword [rsp + 0x80], ebp
mov ebp, dword [rsp + 0x90]
xor edx, esi
xor ebp, r13d
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x84], ebp
mov edx, dword [rsp + 0xa0]
mov ebp, dword [rsp + 0x94]
mov edi, dword [rsp + 0x58]
xor ebp, eax
xor edx, r11d
xor r10d, r11d
xor edi, r11d
mov dword [rsp + 0x90], ebp
mov dword [rsp + 0x94], edx
mov ebp, edi
mov edx, r10d
mov edi, dword [rsp + 0x70]
mov r10d, esi
mov esi, dword [rsp + 0x60]
xor ecx, r11d
xor r9d, r14d
xor r10d, r11d
xor esi, ecx
xor edi, r8d
mov dword [rsp + 0xb8], esi
mov dword [rsp + 0xa0], edi
mov esi, dword [rsp + 0x78]
mov edi, dword [rsp + 0x88]
xor esi, r10d
xor edi, edx
mov dword [rsp + 0x70], esi
mov esi, edi
mov edi, dword [rsp + 0x98]
xor esi, dword [rsp + 0x4c]
xor edi, eax
xor r13d, dword [rsp + 0xa4]
mov dword [rsp + 0x60], esi
xor edi, dword [rsp + 0xa8]
mov dword [rsp + 0x58], edi
mov edi, dword [rsp + 0x28]
xor ecx, dword [rsp + 0x30]
xor edi, eax
xor r11d, edi
xor r11d, r9d
mov dword [rsp + 0x28], r11d
mov r11d, dword [rsp + 0xb4]
mov esi, dword [rsp + 0x50]
xor ecx, r11d
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x38]
xor esi, dword [rsp + 0x3c]
xor ecx, r8d
mov r8d, dword [rsp + 0xac]
xor ecx, eax
xor r8d, ecx
mov ecx, dword [rsp + 0x40]
xor edx, dword [rsp + 0x2c]
xor ecx, eax
mov dword [rsp + 0x2c], esi
mov edi, ecx
xor edi, r10d
mov r10d, dword [rsp + 0x4c]
mov dword [rsp + 0x38], r8d
xor r10d, edi
mov r8d, dword [rsp + 0x2c]
mov edi, dword [rsp + 0xa8]
xor r12d, r15d
xor r15d, dword [rsp + 0x34]
xor r15d, dword [rsp + 0x48]
xor r8d, edi
xor edx, dword [rsp + 0x44]
xor ebp, r14d
rorx r10d, r10d, 0x1e
mov dword [rsp + 0x40], r10d
rorx r10d, edx, 0x1e
mov dword [rsp + 0x2c], r10d
rorx r10d, r15d, 0x1e
mov dword [rsp + 0x34], r10d
rorx r10d, r8d, 0x1e
mov r8d, dword [rsp + 0xb0]
mov dword [rsp + 0x3c], r10d
mov r10, rbp
xor ebx, eax
xor r8d, r14d
shl r10, 0x20
xor r12d, dword [rsp + 0x44]
xor r13d, dword [rsp + 0x48]
xor ebx, r14d
or r10, r8
mov r8d, dword [rsp + 0xb8]
rorx r12d, r12d, 0x1f
xor r8d, r9d
mov rbp, r8
mov r8d, dword [rsp + 0xa0]
xor r9d, dword [rsp + 0x54]
xor r8d, r11d
mov rcx, r8
mov r8d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x70]
mov r15d, dword [rsp + 0x84]
xor r8d, r11d
shl rbp, 0x20
mov r11d, dword [rsp + 0xac]
shl rcx, 0x20
or rbp, r9
or rcx, r8
xor r15d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x6c]
mov r9d, dword [rsp + 0x80]
shl r12, 0x20
xor edx, r11d
mov eax, dword [rsp + 0x94]
or r12, r15
mov r15d, dword [rsp + 0x90]
xor r8d, r11d
shl rdx, 0x20
xor r9d, dword [rsp + 0x4c]
rorx esi, dword [rsp + 0x60], 0x1f
shl rsi, 0x20
xor r15d, dword [rsp + 0x48]
xor eax, edi
or rdx, r8
or r9, rsi
rorx r13d, r13d, 0x1f
rorx r8d, dword [rsp + 0x58], 0x1f
shl r13, 0x20
shl r8, 0x20
mov edi, dword [rsp + 0x40]
or r13, r15
mov r11, rcx
or r8, rax
mov rcx, rbp
lea r14, [0x0072c740]
lea r15, [0x0072c700]
mov rbp, r9
nop word [rax + rax]
mov rax, r10
or rax, rcx
xor r11, rdx
xor rax, rdx
and rdx, r10
xor rcx, rdx
mov rsi, rdx
xor rsi, r11
not rcx
and r11, rax
xor r11, rcx
or rcx, rsi
xor r10, rcx
xor rsi, r11
xor rax, rcx
and r11, rcx
mov rdx, r12
mov rcx, rbp
and rcx, r12
or rdx, r13
xor rdx, rbp
xor r8, rbp
xor r13, rcx
not r13
xor rcx, r8
and r8, rdx
xor r8, r13
or r13, rcx
xor rcx, r8
xor rcx, r10
mov r9, r10
mov rbp, rcx
shr rbp, 0x20
shr r9, 0x20
rorx r9d, r9d, 0x1e
xor r9d, ebp
rorx r10d, r10d, 0x1e
rorx ebp, ebp, 0x12
xor r10d, ecx
xor ebp, r9d
not rax
xor r12, r13
and r8, r13
rorx ecx, ecx, 0x12
rorx r9d, r9d, 0x16
xor ecx, r10d
xor r9d, ebp
shl r9, 0x20
xor r12, rax
rorx r10d, r10d, 0x16
xor r10d, ecx
or r10, r9
rorx r9d, ebp, 0x1f
mov rbp, r12
shl r9, 0x20
shr rbp, 0x20
rorx ecx, ecx, 0x1f
or r9, rcx
rorx ecx, eax, 0x1e
shr rax, 0x20
rorx eax, eax, 0x1e
xor eax, ebp
xor ecx, r12d
xor r13, rdx
rorx ebp, ebp, 0x12
xor ebp, eax
xor r13, r11
rorx r12d, r12d, 0x12
rorx eax, eax, 0x16
xor r12d, ecx
xor eax, ebp
not r13
shl rax, 0x20
rorx ecx, ecx, 0x16
xor ecx, r12d
or rcx, rax
rorx ebp, ebp, 0x1f
rorx eax, r11d, 0x1e
shl rbp, 0x20
xor eax, r13d
rorx edx, r13d, 0x12
rorx r12d, r12d, 0x1f
xor edx, eax
or r12, rbp
mov rbp, r13
rorx r13d, eax, 0x16
mov rax, r11
shr rbp, 0x20
shr rax, 0x20
rorx eax, eax, 0x1e
xor eax, ebp
rorx ebp, ebp, 0x12
xor ebp, eax
rorx r11d, eax, 0x16
mov eax, r13d
xor r11d, ebp
xor eax, edx
shl r11, 0x20
rorx r13d, ebp, 0x1f
shl r13, 0x20
or r11, rax
rorx edx, edx, 0x1f
or r13, rdx
xor r8, rsi
mov rdx, r8
shr rdx, 0x20
rorx ebp, esi, 0x1e
shr rsi, 0x20
rorx esi, esi, 0x1e
xor esi, edx
xor ebp, r8d
rorx eax, r8d, 0x12
rorx r8d, edx, 0x12
xor r8d, esi
xor eax, ebp
rorx edx, esi, 0x16
xor edx, r8d
rorx r8d, r8d, 0x1f
shl r8, 0x20
xor r9, qword [r15]
shl rdx, 0x20
xor r10, qword [r14]
rorx ebp, ebp, 0x16
add r14, 8
xor ebp, eax
rorx eax, eax, 0x1f
or r8, rax
lea rax, [0x0072c780]
or rdx, rbp
add r15, 8
mov rbp, r9
cmp r14, rax
jne 0x5566c0
mov rbp, rcx
mov dword [rsp + 0x68], ebp
mov rcx, r11
shr rbp, 0x20
shr rcx, 0x20
mov dword [rsp + 0x54], r10d
mov dword [rsp + 0x84], r9d
shr r10, 0x20
shr r9, 0x20
mov dword [rsp + 0xa0], r8d
mov qword [rsp + 0x60], rbp
shr r8, 0x20
mov qword [rsp + 0x58], r10
mov dword [rsp + 0x6c], r11d
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x80], edx
mov qword [rsp + 0x88], r9
shr rdx, 0x20
mov qword [rsp + 0x98], r8
mov r11d, dword [rsp + 0x28]
mov r10d, dword [rsp + 0x2c]
mov r9d, dword [rsp + 0x30]
mov esi, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x90], r12d
mov dword [rsp + 0x94], r13d
shr r12, 0x20
shr r13, 0x20
lea rax, [0x0072c6e0]
lea rdx, [0x0072c6c0]
nop word [rax + rax]
mov ebp, ebx
or ebp, r11d
xor ebp, ecx
xor r9d, ecx
and ecx, ebx
xor r11d, ecx
not r11d
xor ecx, r9d
and r9d, ebp
xor r9d, r11d
or r11d, ecx
xor ebx, r11d
xor ecx, r9d
and r9d, r11d
xor r11d, ebp
mov ebp, r10d
or ebp, esi
xor r8d, edi
xor ebp, edi
and edi, r10d
xor esi, edi
not esi
xor edi, r8d
and r8d, ebp
xor r8d, esi
or esi, edi
xor r10d, esi
xor edi, r8d
not r11d
xor edi, ebx
xor r10d, r11d
rorx ebx, ebx, 0x1e
rorx r11d, r11d, 0x1e
xor ebx, edi
xor r11d, r10d
rorx edi, edi, 0x12
rorx r10d, r10d, 0x12
xor edi, ebx
xor r10d, r11d
and r8d, esi
rorx ebx, ebx, 0x16
rorx r11d, r11d, 0x16
xor ebx, edi
xor r11d, r10d
xor esi, ebp
xor esi, r9d
xor r8d, ecx
not esi
rorx r9d, r9d, 0x1e
rorx ecx, ecx, 0x1e
xor r9d, esi
xor ecx, r8d
xor ebx, dword [rax]
rorx esi, esi, 0x12
rorx r8d, r8d, 0x12
xor esi, r9d
xor r8d, ecx
add rax, 4
lea r15, [0x0072c700]
rorx edi, edi, 0x1f
rorx r9d, r9d, 0x16
xor edi, dword [rdx]
xor r9d, esi
rorx ecx, ecx, 0x16
add rdx, 4
xor ecx, r8d
rorx r10d, r10d, 0x1f
rorx esi, esi, 0x1f
rorx r8d, r8d, 0x1f
cmp rax, r15
jne 0x556970
mov dword [rsp + 0x40], edi
mov r14d, edi
mov rdi, qword [rsp + 0x110]
mov dword [rsp + 0x38], ecx
mov edx, ecx
xor ecx, ecx
cmp dword [rsp + 0xbc], 1
mov dword [rsp + 0xa4], r13d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x2c], r10d
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x3c], r8d
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
mov ebp, r10d
mov eax, r9d
jne 0x556bb8
mov r9d, dword [rsp + 0x58]
mov ecx, r13d
xor r9d, ebx
mov edi, r14d
xor r9d, dword [rsp + 0x54]
bswap r9d
mov r15d, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x128]
xor r15d, r11d
mov dword [rbx], r9d
xor r15d, dword [rsp + 0x68]
bswap r15d
mov r14d, dword [rsp + 0x70]
mov dword [rbx + 4], r15d
xor r14d, eax
xor r14d, dword [rsp + 0x6c]
bswap r14d
mov r11d, dword [rsp + 0x78]
mov dword [rbx + 8], r14d
xor r11d, edx
xor r11d, dword [rsp + 0x80]
bswap r11d
mov r10d, dword [rsp + 0x88]
mov dword [rbx + 0xc], r11d
xor r10d, edi
xor r10d, dword [rsp + 0x84]
bswap r10d
mov eax, dword [rsp + 0x90]
xor r12d, ebp
xor eax, r12d
mov dword [rbx + 0x10], r10d
mov r13d, eax
bswap r13d
mov r12d, dword [rsp + 0x94]
xor ecx, esi
mov dword [rbx + 0x14], r13d
xor r12d, ecx
bswap r12d
cmp dword [rsp + 0x130], 8
mov dword [rbx + 0x18], r12d
jne 0x556b9d
mov ecx, dword [rsp + 0x98]
xor ecx, r8d
xor ecx, dword [rsp + 0xa0]
bswap ecx
mov dword [rbx + 0x1c], ecx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0xbc], 1
mov rax, rdi
jmp 0x5562ce