Function at 0x4e4620
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x110], rcx
mov r10d, edx
mov qword [rsp + 0x128], r9
mov r9, qword [rcx + 0x20]
mov ecx, r8d
mov r8d, 0x20
sar eax, cl
mov edx, eax
neg edx
lea rcx, [r9 + 1]
and edx, r10d
or edx, eax
mov rax, qword [rsp + 0x110]
sub r8, rcx
mov byte [rax + r9], dl
mov r9, rcx
xor edx, edx
add r9, rax
mov rcx, r9
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x9c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x4c]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x5c]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x64]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x110]
mov ebx, dword [rax + 0x68]
mov eax, dword [rax + 0x6c]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x74]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x110]
mov edi, dword [rax + 0x78]
mov eax, dword [rax + 0x7c]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0xbc], 2
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x110]
mov ecx, dword [rax]
mov edx, ecx
mov r12d, edx
bswap r12d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 4]
mov r14d, eax
bswap r14d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 8]
mov r15d, eax
bswap r15d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0xc]
mov r10d, eax
bswap r10d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x10]
mov r8d, eax
bswap r8d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x14]
mov r9d, eax
bswap r9d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x18]
mov r13d, eax
bswap r13d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x1c]
mov r11d, eax
bswap r11d
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x80]
xor eax, dword [rsp + 0x58]
xor ecx, dword [rsp + 0x78]
xor eax, dword [rsp + 0x28]
mov esi, dword [rsp + 0x6c]
xor esi, dword [rsp + 0x70]
mov dword [rsp + 0x3c], ecx
mov ecx, dword [rsp + 0x84]
mov dword [rsp + 0xa8], eax
xor ecx, dword [rsp + 0x88]
mov eax, dword [rsp + 0x3c]
xor esi, dword [rsp + 0x38]
mov ebp, dword [rsp + 0x50]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rsp + 0x98]
xor eax, edi
xor ecx, dword [rsp + 0x90]
mov dword [rsp + 0xac], eax
mov eax, dword [rsp + 0x40]
xor eax, dword [rsp + 0x2c]
xor ebp, dword [rsp + 0x48]
mov dword [rsp + 0x44], ecx
mov ecx, dword [rsp + 0x9c]
xor ecx, dword [rsp + 0xa0]
xor ecx, dword [rsp + 0x24]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x44]
xor ebp, ebx
xor eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x68]
xor esi, ecx
xor edx, dword [rsp + 0x60]
xor ebp, ecx
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x40], eax
xor edx, dword [rsp + 0x30]
mov esi, dword [rsp + 0x54]
mov dword [rsp + 0xb0], ebp
mov ebp, dword [rsp + 0x50]
xor edx, ecx
xor esi, r14d
mov dword [rsp + 0xb8], edx
mov edx, dword [rsp + 0x68]
mov dword [rsp + 0x50], esi
mov esi, dword [rsp + 0x6c]
xor ebp, r12d
mov dword [rsp + 0xb4], ebp
mov ebp, dword [rsp + 0x98]
xor edx, r15d
xor r15d, r11d
xor esi, r10d
mov dword [rsp + 0x54], edx
mov edx, dword [rsp + 0x84]
mov dword [rsp + 0x68], esi
mov esi, dword [rsp + 0x80]
xor ebp, r13d
mov dword [rsp + 0x84], ebp
mov ebp, r10d
mov r10d, dword [rsp + 0x90]
xor ebp, r11d
xor edx, r9d
mov eax, ebp
xor esi, r8d
mov dword [rsp + 0x80], edx
mov edx, dword [rsp + 0x9c]
mov dword [rsp + 0x6c], esi
mov esi, r15d
mov r15d, r12d
mov r12d, dword [rsp + 0x48]
xor r15d, r11d
xor edx, r11d
xor r12d, r11d
mov dword [rsp + 0x98], edx
mov edx, r15d
mov r15d, dword [rsp + 0x58]
mov ebp, r12d
mov r12d, dword [rsp + 0x60]
mov dword [rsp + 0x58], esi
xor r15d, edx
xor r12d, r14d
xor r10d, r9d
xor edi, r13d
mov dword [rsp + 0x9c], r12d
mov r12d, dword [rsp + 0x70]
xor ebx, r13d
mov dword [rsp + 0x60], r10d
mov r10d, dword [rsp + 0xa0]
xor ebx, ecx
xor r12d, esi
mov dword [rsp + 0x70], r12d
mov r12d, dword [rsp + 0x78]
xor r10d, r13d
mov dword [rsp + 0x48], r10d
xor r12d, eax
mov esi, r12d
mov r12d, dword [rsp + 0x88]
xor esi, dword [rsp + 0x44]
mov r10d, dword [rsp + 0x60]
xor r10d, dword [rsp + 0x3c]
xor edx, dword [rsp + 0x30]
xor r12d, r8d
xor eax, dword [rsp + 0x2c]
xor r8d, dword [rsp + 0x34]
mov dword [rsp + 0x60], r10d
mov r10d, dword [rsp + 0x48]
xor r10d, dword [rsp + 0x40]
xor r9d, dword [rsp + 0x24]
xor edi, dword [rsp + 0x58]
xor r8d, dword [rsp + 0x3c]
mov dword [rsp + 0x48], r10d
mov r10d, dword [rsp + 0x28]
xor edi, dword [rsp + 0x44]
xor r9d, dword [rsp + 0x40]
xor r12d, dword [rsp + 0xac]
rol r8d, 2
xor r10d, r13d
mov dword [rsp + 0x34], r8d
mov r8d, dword [rsp + 0xb0]
xor r11d, r10d
mov r10d, dword [rsp + 0xb0]
rol edi, 2
xor r10d, r11d
mov r11d, dword [rsp + 0x38]
mov dword [rsp + 0x28], r10d
mov r10d, dword [rsp + 0xa8]
xor r11d, r14d
lea r14, [0x006174c0]
xor r10d, edx
mov edx, r11d
xor edx, r13d
mov dword [rsp + 0x30], r10d
mov r11d, edx
mov edx, dword [rsp + 0xb8]
xor r11d, edx
mov dword [rsp + 0x38], r11d
mov r11d, dword [rsp + 0xac]
xor eax, r11d
rol eax, 2
rol r9d, 2
mov dword [rsp + 0x24], r9d
rol esi, 1
mov r9d, ebp
rol r12d, 1
mov dword [rsp + 0x2c], eax
shl rsi, 0x20
xor r9d, ecx
shl r12, 0x20
mov r10, r9
mov r9d, dword [rsp + 0xb4]
shl r10, 0x20
xor r9d, ecx
or r10, r9
mov r9d, r15d
xor r9d, r8d
mov rbp, r9
mov r9d, dword [rsp + 0x50]
shl rbp, 0x20
xor r9d, r8d
mov r8d, dword [rsp + 0x9c]
mov r15d, dword [rsp + 0xa8]
or rbp, r9
mov eax, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x60]
mov r13d, dword [rsp + 0x80]
xor r8d, r15d
mov rcx, r8
mov r8d, dword [rsp + 0x70]
xor eax, r15d
mov r15d, edx
shl rcx, 0x20
rol r9d, 1
or rcx, rax
mov eax, dword [rsp + 0x68]
shl r9, 0x20
xor r13d, r11d
or r12, r13
mov r11, rcx
mov rcx, rbp
xor r8d, edx
mov rdx, r8
mov r8d, dword [rsp + 0x48]
xor eax, r15d
shl rdx, 0x20
lea r15, [0x00617480]
or rdx, rax
mov eax, dword [rsp + 0x6c]
xor eax, dword [rsp + 0x44]
rol r8d, 1
shl r8, 0x20
or rsi, rax
mov eax, dword [rsp + 0x84]
xor eax, dword [rsp + 0x3c]
or r9, rax
mov eax, dword [rsp + 0x98]
xor eax, dword [rsp + 0x40]
or r8, rax
nop
mov rax, r10
xor r11, rdx
xor r8, rsi
or rax, rcx
xor rax, rdx
and rdx, r10
xor rcx, rdx
mov r13, rdx
mov rdx, r12
or rdx, r9
xor r13, r11
not rcx
xor rdx, rsi
and rsi, r12
and r11, rax
xor r9, rsi
xor r11, rcx
xor rsi, r8
or rcx, r13
and r8, rdx
not r9
xor r10, rcx
xor r13, r11
xor r8, r9
and r11, rcx
xor rax, rcx
mov rcx, rsi
xor rcx, r8
mov rbp, r10
or r9, rsi
xor rcx, r10
rol r10d, 2
xor r12, r9
xor r10d, ecx
mov rsi, rcx
rol ecx, 0xe
xor ecx, r10d
and r8, r9
shr rsi, 0x20
rol r10d, 0xa
shr rbp, 0x20
not rax
rol ebp, 2
xor r12, rax
xor r10d, ecx
xor ebp, esi
rol esi, 0xe
xor esi, ebp
rol ebp, 0xa
xor ebp, esi
rol esi, 1
shl rbp, 0x20
rol ecx, 1
shl rsi, 0x20
or r10, rbp
mov rbp, r12
or rsi, rcx
mov ecx, eax
shr rax, 0x20
shr rbp, 0x20
rol eax, 2
xor eax, ebp
rol ecx, 2
rol ebp, 0xe
xor ecx, r12d
rol r12d, 0xe
xor ebp, eax
rol eax, 0xa
xor r12d, ecx
xor eax, ebp
rol ecx, 0xa
shl rax, 0x20
xor ecx, r12d
rol ebp, 1
or rcx, rax
shl rbp, 0x20
xor r9, rdx
xor r9, r11
mov eax, r11d
rol r12d, 1
not r9
rol eax, 2
or r12, rbp
xor eax, r9d
mov rbp, r9
rol r9d, 0xe
mov edx, r9d
shr rbp, 0x20
xor r8, r13
xor edx, eax
rol eax, 0xa
mov r9d, eax
mov rax, r11
shr rax, 0x20
rol eax, 2
xor eax, ebp
rol ebp, 0xe
xor ebp, eax
rol eax, 0xa
mov r11d, eax
mov eax, r9d
mov r9d, edx
xor r11d, ebp
rol ebp, 1
xor eax, edx
shl rbp, 0x20
rol r9d, 1
mov rdx, r8
shl r11, 0x20
or r9, rbp
mov ebp, r13d
rol ebp, 2
or r11, rax
shr rdx, 0x20
xor ebp, r8d
rol r8d, 0xe
mov eax, r8d
mov r8d, edx
xor eax, ebp
rol ebp, 0xa
shr r13, 0x20
rol r8d, 0xe
xor ebp, eax
xor r10, qword [r14]
rol r13d, 2
add r14, 8
xor rsi, qword [r15]
xor r13d, edx
rol eax, 1
mov edx, r13d
xor r8d, r13d
add r15, 8
rol edx, 0xa
xor edx, r8d
rol r8d, 1
shl r8, 0x20
shl rdx, 0x20
or r8, rax
or rdx, rbp
lea rax, [0x00617500]
cmp r14, rax
jne 0x4e4be0
mov rbp, rcx
mov dword [rsp + 0x50], r10d
shr r10, 0x20
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x54], ebp
shr rbp, 0x20
mov rcx, r11
mov dword [rsp + 0x6c], edx
shr rdx, 0x20
shr rcx, 0x20
mov dword [rsp + 0x80], esi
shr rsi, 0x20
mov dword [rsp + 0x98], r9d
shr r9, 0x20
mov qword [rsp + 0x48], r10
mov r10d, dword [rsp + 0x24]
mov qword [rsp + 0x58], rbp
mov ebp, dword [rsp + 0x34]
mov qword [rsp + 0x70], rdx
mov edx, dword [rsp + 0x30]
mov qword [rsp + 0x78], rsi
mov esi, dword [rsp + 0x2c]
mov qword [rsp + 0x90], r9
mov r9d, dword [rsp + 0x38]
mov dword [rsp + 0x84], r12d
shr r12, 0x20
mov dword [rsp + 0x9c], r8d
shr r8, 0x20
mov qword [rsp + 0x60], rcx
lea rcx, [0x00617460]
mov qword [rsp + 0xa0], r8
lea r8, [0x00617440]
mov dword [rsp + 0x68], r11d
mov qword [rsp + 0x88], r12
nop dword [rax + rax]
mov r11d, ebx
xor edx, r9d
xor r10d, edi
lea r15, [0x00617480]
or r11d, eax
xor r11d, r9d
and r9d, ebx
xor eax, r9d
xor r9d, edx
and edx, r11d
not eax
xor edx, eax
or eax, r9d
xor ebx, eax
xor r9d, edx
and edx, eax
xor eax, r11d
mov r11d, esi
or r11d, ebp
not eax
xor r11d, edi
and edi, esi
xor ebp, edi
xor edi, r10d
and r10d, r11d
not ebp
xor r10d, ebp
or ebp, edi
xor edi, r10d
xor esi, ebp
and r10d, ebp
xor edi, ebx
rol ebx, 2
xor ebx, edi
rol edi, 0xe
xor edi, ebx
rol ebx, 0xa
xor ebx, edi
rol edi, 1
xor ebp, r11d
xor ebx, dword [rcx]
xor ebp, edx
xor esi, eax
xor edi, dword [r8]
xor r10d, r9d
not ebp
rol eax, 2
rol edx, 2
add rcx, 4
rol r9d, 2
xor eax, esi
xor edx, ebp
xor r9d, r10d
rol esi, 0xe
add r8, 4
rol ebp, 0xe
rol r10d, 0xe
xor esi, eax
xor ebp, edx
xor r10d, r9d
rol eax, 0xa
rol edx, 0xa
rol r9d, 0xa
xor eax, esi
xor edx, ebp
xor r9d, r10d
rol esi, 1
rol ebp, 1
rol r10d, 1
cmp rcx, r15
jne 0x4e4e50
mov ecx, edx
mov dword [rsp + 0x30], edx
mov rdx, qword [rsp + 0x110]
mov r11d, ebp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x34], ebp
mov qword [rdx], 0
mov qword [rdx + 8], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
xor edx, edx
cmp dword [rsp + 0xbc], 1
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x24], r10d
jne 0x4e5058
mov r8d, dword [rsp + 0x48]
xor r8d, ebx
xor r8d, dword [rsp + 0x50]
bswap r8d
mov rbx, qword [rsp + 0x128]
mov r15d, dword [rsp + 0x58]
mov dword [rbx], r8d
xor r15d, eax
xor r15d, dword [rsp + 0x54]
bswap r15d
mov r14d, dword [rsp + 0x60]
mov dword [rbx + 4], r15d
xor r14d, ecx
xor r14d, dword [rsp + 0x68]
bswap r14d
mov dword [rbx + 8], r14d
mov ebx, dword [rsp + 0x70]
mov r10d, dword [rsp + 0x6c]
xor ebx, r9d
xor r10d, ebx
bswap r10d
mov rbx, qword [rsp + 0x128]
mov r9d, dword [rsp + 0x78]
mov dword [rbx + 0xc], r10d
xor r9d, edi
xor r9d, dword [rsp + 0x80]
bswap r9d
mov ebp, dword [rsp + 0x88]
mov dword [rbx + 0x10], r9d
mov r13d, dword [rsp + 0x84]
xor ebp, esi
xor r13d, ebp
bswap r13d
mov r12d, dword [rsp + 0x90]
mov dword [rbx + 0x14], r13d
xor r12d, r11d
xor r12d, dword [rsp + 0x98]
bswap r12d
cmp dword [rsp + 0x130], 8
mov dword [rbx + 0x18], r12d
jne 0x4e503d
mov rax, rbx
mov ebx, dword [rsp + 0xa0]
xor ebx, dword [rsp + 0x24]
xor ebx, dword [rsp + 0x9c]
bswap ebx
mov dword [rax + 0x1c], ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0xbc], 1
jmp 0x4e4808