Function at 0x530290
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov eax, pe_nt_image_headers64
sarx r8d, eax, r8d
mov qword [rsp + 0x110], rcx
mov rcx, qword [rcx + 0x20]
mov rax, qword [rsp + 0x110]
mov r10d, edx
mov edx, r8d
mov qword [rsp + 0x128], r9
neg edx
and edx, r10d
or edx, r8d
lea r9, [rax + rcx + 1]
mov r8d, 0x1f
mov byte [rax + rcx], dl
sub r8, rcx
xor edx, edx
mov rcx, r9
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x94], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x4c]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x5c]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x110]
mov r13d, dword [rax + 0x60]
mov eax, dword [rax + 0x64]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x68]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x6c]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x110]
mov esi, dword [rax + 0x7c]
mov r11d, dword [rax + 0x74]
mov ebx, dword [rax + 0x78]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x110]
mov ecx, dword [rax]
mov dword [rsp + 0xbc], 2
mov dword [rsp + 0x34], esi
mov edx, ecx
mov ebp, edx
bswap ebp
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 4]
mov r12d, eax
bswap r12d
mov rdi, qword [rsp + 0x110]
mov eax, r12d
xor eax, r11d
mov dword [rsp + 0xb4], eax
mov edi, dword [rdi + 8]
mov r10d, edi
bswap r10d
mov rdi, qword [rsp + 0x110]
mov edi, dword [rdi + 0xc]
mov eax, edi
bswap eax
mov rdi, qword [rsp + 0x110]
mov edi, dword [rdi + 0x10]
mov r9d, edi
bswap r9d
mov rdi, qword [rsp + 0x110]
mov dword [rsp + 0x48], r9d
mov edi, dword [rdi + 0x14]
bswap edi
mov rcx, qword [rsp + 0x110]
mov ecx, dword [rcx + 0x18]
mov esi, ecx
bswap esi
mov r15, qword [rsp + 0x110]
mov r9d, dword [rsp + 0x38]
mov edx, esi
xor edx, ebx
mov dword [rsp + 0xb0], edx
mov r15d, dword [r15 + 0x1c]
mov ecx, r9d
xor ecx, esi
mov dword [rsp + 0xb8], ecx
mov r14d, r15d
bswap r14d
mov edx, dword [rsp + 0x4c]
xor edx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x70]
xor ecx, dword [rsp + 0x68]
mov r15d, dword [rsp + 0x74]
xor r15d, dword [rsp + 0x78]
xor r15d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x80]
xor edx, r9d
mov r9d, dword [rsp + 0x98]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0xa8], edx
mov edx, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x84]
xor r8d, r13d
xor ecx, dword [rsp + 0x88]
xor r8d, dword [rsp + 0x28]
mov dword [rsp + 0x3c], r15d
xor ecx, dword [rsp + 0x2c]
xor edx, ebx
mov r15d, dword [rsp + 0x60]
mov ebx, dword [rsp + 0x44]
mov dword [rsp + 0x90], edx
mov edx, dword [rsp + 0x24]
mov dword [rsp + 0x40], r8d
mov r8d, dword [rsp + 0x58]
xor r11d, ecx
xor r15d, ebx
xor ebx, eax
xor eax, r14d
xor r15d, r11d
mov r11d, dword [rsp + 0x94]
xor edx, ecx
mov dword [rsp + 0x44], r15d
xor r8d, r11d
xor r11d, r10d
xor r10d, r14d
xor r8d, edx
mov edx, dword [rsp + 0x30]
mov dword [rsp + 0x98], r11d
mov dword [rsp + 0x94], r8d
mov r8d, dword [rsp + 0xa0]
xor edx, ecx
mov r15d, r8d
xor r8d, ebp
xor ebp, r14d
xor r15d, r9d
mov dword [rsp + 0xa0], r8d
xor r15d, edx
mov edx, dword [rsp + 0x4c]
xor edx, r12d
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0xa4], ebx
mov ebx, dword [rsp + 0x70]
xor ebx, dword [rsp + 0x48]
mov edx, ebp
mov r11d, dword [rsp + 0x74]
mov r8d, dword [rsp + 0x80]
mov ebp, dword [rsp + 0x50]
mov dword [rsp + 0x70], ebx
mov ebx, dword [rsp + 0x84]
xor r11d, edi
xor r8d, esi
mov dword [rsp + 0x74], r11d
mov r11d, dword [rsp + 0x58]
xor ebp, edx
mov dword [rsp + 0x80], r8d
xor ebx, r14d
mov r8d, dword [rsp + 0x88]
mov dword [rsp + 0x84], ebx
mov ebx, r10d
mov r10d, r9d
mov r9d, dword [rsp + 0x44]
xor r10d, r14d
xor r11d, r12d
mov r12d, dword [rsp + 0x60]
xor r14d, r15d
mov dword [rsp + 0xac], r11d
xor edx, dword [rsp + 0x24]
xor r13d, edi
xor edi, dword [rsp + 0x2c]
xor r13d, dword [rsp + 0x3c]
xor r8d, esi
xor r10d, ecx
xor r8d, dword [rsp + 0x40]
shl r10, 0x20
xor ebp, r15d
xor r12d, ebx
shl rbp, 0x20
mov dword [rsp + 0x58], r12d
mov r12d, dword [rsp + 0x68]
rorx r13d, r13d, 0x1f
rorx r8d, r8d, 0x1f
xor r12d, eax
xor eax, dword [rsp + 0x34]
mov r11d, r12d
mov r12d, dword [rsp + 0x78]
xor r12d, dword [rsp + 0x48]
xor r9d, r11d
mov r11d, dword [rsp + 0x30]
xor r12d, dword [rsp + 0x90]
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0x48]
xor r9d, dword [rsp + 0x28]
xor r11d, esi
xor r11d, ecx
rorx r12d, r12d, 0x1f
mov dword [rsp + 0x30], r11d
mov r11d, dword [rsp + 0xb8]
xor r11d, r14d
mov dword [rsp + 0x38], r11d
mov r14d, dword [rsp + 0xa8]
xor r9d, dword [rsp + 0x3c]
xor edi, dword [rsp + 0x40]
mov r11d, dword [rsp + 0xb4]
xor ebx, dword [rsp + 0x44]
xor ebx, dword [rsp + 0xb0]
xor edx, r14d
mov dword [rsp + 0x24], edx
mov edx, dword [rsp + 0x94]
rorx ebx, ebx, 0x1e
xor edx, esi
mov esi, dword [rsp + 0x90]
xor r11d, edx
xor eax, esi
rorx eax, eax, 0x1e
mov dword [rsp + 0x34], eax
rorx eax, r9d, 0x1e
mov r9d, dword [rsp + 0xac]
mov dword [rsp + 0x28], eax
rorx eax, edi, 0x1e
mov edi, dword [rsp + 0xa0]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0xa4]
xor edi, ecx
or r10, rdi
xor r15d, dword [rsp + 0x4c]
xor r9d, r14d
mov edi, dword [rsp + 0x94]
mov rcx, r9
mov r9d, dword [rsp + 0x98]
shl r12, 0x20
shl r13, 0x20
shl rcx, 0x20
shl r8, 0x20
xor eax, edi
xor r9d, r14d
mov r14d, dword [rsp + 0x58]
or rbp, r15
lea r15, [0x006f1700]
or rcx, r9
rorx r9d, dword [rsp + 0x50], 0x1f
shl r9, 0x20
xor r14d, edi
mov edi, dword [rsp + 0x70]
xor edi, dword [rsp + 0x44]
mov rdx, r14
lea r14, [0x006f1740]
shl rdx, 0x20
or rdx, rax
mov eax, dword [rsp + 0x74]
or r9, rdi
xor eax, esi
mov rsi, rcx
mov rcx, rbp
mov rbp, r9
or r12, rax
mov eax, dword [rsp + 0x80]
xor eax, dword [rsp + 0x3c]
or r13, rax
mov eax, dword [rsp + 0x84]
xor eax, dword [rsp + 0x40]
or r8, rax
mov rax, r10
mov rdi, rdx
xor rsi, rdx
xor r8, rbp
and rdi, r10
or rax, rcx
xor rax, rdx
xor rcx, rdi
xor rdi, rsi
mov rdx, r12
and rsi, rax
not rcx
or rdx, r13
xor rsi, rcx
or rcx, rdi
xor rdx, rbp
xor r10, rcx
xor rdi, rsi
xor rax, rcx
and rsi, rcx
mov rcx, rbp
mov r9, r10
not rax
and rcx, r12
shr r9, 0x20
xor r13, rcx
xor rcx, r8
and r8, rdx
rorx r9d, r9d, 0x1e
not r13
xor r8, r13
or r13, rcx
xor rcx, r8
xor r12, r13
and r8, r13
xor rcx, r10
rorx r10d, r10d, 0x1e
mov rbp, rcx
xor r10d, ecx
rorx ecx, ecx, 0x12
shr rbp, 0x20
xor ecx, r10d
rorx r10d, r10d, 0x16
xor r9d, ebp
rorx ebp, ebp, 0x12
xor ebp, r9d
rorx r9d, r9d, 0x16
xor r9d, ebp
xor r10d, ecx
xor r12, rax
rorx ecx, ecx, 0x1f
shl r9, 0x20
xor r13, rdx
or r10, r9
rorx r9d, ebp, 0x1f
mov rbp, r12
xor r13, rsi
shl r9, 0x20
shr rbp, 0x20
not r13
or r9, rcx
rorx ecx, eax, 0x1e
shr rax, 0x20
rorx edx, r13d, 0x12
rorx eax, eax, 0x1e
xor ecx, r12d
rorx r12d, r12d, 0x12
xor eax, ebp
rorx ebp, ebp, 0x12
xor r12d, ecx
rorx ecx, ecx, 0x16
xor ebp, eax
rorx eax, eax, 0x16
xor ecx, r12d
rorx r12d, r12d, 0x1f
xor eax, ebp
rorx ebp, ebp, 0x1f
shl rax, 0x20
shl rbp, 0x20
or rcx, rax
rorx eax, esi, 0x1e
or r12, rbp
mov rbp, r13
xor eax, r13d
shr rbp, 0x20
xor edx, eax
rorx r13d, eax, 0x16
mov rax, rsi
shr rax, 0x20
rorx eax, eax, 0x1e
xor eax, ebp
rorx ebp, ebp, 0x12
xor ebp, eax
rorx esi, eax, 0x16
mov eax, r13d
xor esi, ebp
rorx r13d, ebp, 0x1f
xor eax, edx
rorx edx, edx, 0x1f
shl rsi, 0x20
shl r13, 0x20
rorx ebp, edi, 0x1e
or rsi, rax
or r13, rdx
xor r8, rdi
shr rdi, 0x20
mov rdx, r8
rorx edi, edi, 0x1e
xor ebp, r8d
xor r9, qword [r15]
shr rdx, 0x20
rorx eax, r8d, 0x12
xor r10, qword [r14]
add r14, 8
xor edi, edx
rorx r8d, edx, 0x12
xor eax, ebp
xor r8d, edi
rorx edx, edi, 0x16
rorx ebp, ebp, 0x16
add r15, 8
xor edx, r8d
rorx r8d, r8d, 0x1f
xor ebp, eax
rorx eax, eax, 0x1f
shl r8, 0x20
shl rdx, 0x20
or r8, rax
lea rax, [0x006f1780]
or rdx, rbp
mov rbp, r9
cmp r14, rax
jne 0x530810
mov rbp, rcx
mov dword [rsp + 0xa0], r10d
mov dword [rsp + 0x44], edx
shr r10, 0x20
shr rdx, 0x20
mov dword [rsp + 0x4c], ebp
shr rbp, 0x20
mov rcx, rsi
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x50], rbp
mov edi, dword [rsp + 0x38]
shr rcx, 0x20
mov dword [rsp + 0x94], esi
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x70], r9d
mov dword [rsp + 0x74], r12d
shr r9, 0x20
shr r12, 0x20
mov dword [rsp + 0x84], r8d
shr r8, 0x20
mov qword [rsp + 0x58], rcx
lea rcx, [0x006f16e0]
mov dword [rsp + 0x80], r13d
mov qword [rsp + 0x88], r8
shr r13, 0x20
lea r8, [0x006f16c0]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x78], r12
mov esi, dword [rsp + 0x34]
mov eax, dword [rsp + 0x24]
mov ebp, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
mov r10d, dword [rsp + 0x30]
nop word cs:[rax + rax]
nop
mov r9d, r10d
xor eax, r11d
xor edx, ebx
lea r15, [0x006f1700]
or r9d, edi
xor r9d, r11d
and r11d, r10d
xor edi, r11d
xor r11d, eax
and eax, r9d
not edi
xor eax, edi
or edi, r11d
xor r10d, edi
xor r11d, eax
and eax, edi
xor edi, r9d
mov r9d, esi
not edi
or r9d, ebp
xor r9d, ebx
and ebx, esi
xor ebp, ebx
xor ebx, edx
and edx, r9d
not ebp
xor edx, ebp
or ebp, ebx
xor esi, ebp
xor ebx, edx
and edx, ebp
xor ebx, r10d
xor esi, edi
rorx r10d, r10d, 0x1e
rorx edi, edi, 0x1e
xor r10d, ebx
xor edi, esi
rorx ebx, ebx, 0x12
rorx esi, esi, 0x12
xor ebx, r10d
xor esi, edi
rorx r10d, r10d, 0x16
rorx edi, edi, 0x16
xor r10d, ebx
xor edi, esi
xor r9d, ebp
xor edx, r11d
xor r9d, eax
rorx r11d, r11d, 0x1e
rorx eax, eax, 0x1e
xor r10d, dword [rcx]
not r9d
xor r11d, edx
rorx edx, edx, 0x12
xor eax, r9d
rorx r9d, r9d, 0x12
xor edx, r11d
add rcx, 4
xor r9d, eax
rorx r11d, r11d, 0x16
rorx eax, eax, 0x16
rorx ebx, ebx, 0x1f
xor r11d, edx
xor ebx, dword [r8]
rorx esi, esi, 0x1f
xor eax, r9d
rorx ebp, r9d, 0x1f
rorx edx, edx, 0x1f
add r8, 4
cmp rcx, r15
jne 0x530ac0
mov r9d, edx
mov dword [rsp + 0x2c], edx
mov rdx, qword [rsp + 0x110]
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x24], eax
mov ecx, ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x30], r10d
mov qword [rdx], 0
mov qword [rdx + 8], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
xor edx, edx
cmp dword [rsp + 0xbc], 1
jne 0x530cf0
mov r8d, dword [rsp + 0x98]
mov edx, r13d
xor r8d, r10d
xor r8d, dword [rsp + 0xa0]
bswap r8d
mov r14, qword [rsp + 0x128]
mov r15d, dword [rsp + 0x50]
mov dword [r14], r8d
xor r15d, edi
xor r15d, dword [rsp + 0x4c]
bswap r15d
mov rdi, r14
mov dword [r14 + 4], r15d
mov r14d, dword [rsp + 0x58]
xor r14d, eax
xor r14d, dword [rsp + 0x94]
bswap r14d
mov eax, dword [rsp + 0x60]
mov r13d, dword [rsp + 0x44]
mov dword [rdi + 8], r14d
xor eax, r11d
xor r13d, eax
bswap r13d
mov r12d, dword [rsp + 0x68]
mov rax, rdi
mov dword [rdi + 0xc], r13d
xor r12d, ebx
xor r12d, dword [rsp + 0x70]
bswap r12d
xor esi, dword [rsp + 0x78]
mov ebp, dword [rsp + 0x74]
mov dword [rdi + 0x10], r12d
xor ebp, esi
bswap ebp
mov dword [rdi + 0x14], ebp
mov edi, edx
xor edi, ecx
xor edi, dword [rsp + 0x80]
bswap edi
cmp dword [rsp + 0x130], 8
mov dword [rax + 0x18], edi
jne 0x530ccf
mov ecx, dword [rsp + 0x88]
xor ecx, r9d
xor ecx, dword [rsp + 0x84]
bswap ecx
mov dword [rax + 0x1c], ecx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0xbc], 1
jmp 0x53045f