Function at 0x516b10
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x128], r9
mov r9, qword [rcx + 0x20]
mov ecx, pe_nt_image_headers64
sarx r8d, ecx, r8d
mov rbx, qword [rsp + 0x110]
mov eax, r8d
neg eax
and eax, edx
xor edx, edx
or eax, r8d
mov r8d, 0x1f
lea rcx, [rbx + r9 + 1]
mov byte [rbx + r9], al
sub r8, r9
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x9c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x4c]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x110]
mov r12d, dword [rax + 0x5c]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x64]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x68]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x6c]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x110]
mov ebx, dword [rax + 0x74]
mov r11d, dword [rax + 0x78]
mov eax, dword [rax + 0x7c]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0xbc], 2
mov ecx, dword [rax]
mov edx, ecx
mov ebp, edx
bswap ebp
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 4]
mov edi, eax
bswap edi
mov rsi, qword [rsp + 0x110]
mov eax, edi
xor eax, ebx
mov dword [rsp + 0xb4], eax
mov esi, dword [rsi + 8]
mov r10d, esi
bswap r10d
mov rsi, qword [rsp + 0x110]
mov esi, dword [rsi + 0xc]
mov eax, esi
bswap eax
mov rsi, qword [rsp + 0x110]
mov esi, dword [rsi + 0x10]
mov r9d, esi
bswap r9d
mov rsi, qword [rsp + 0x110]
mov esi, dword [rsi + 0x14]
mov r8d, esi
bswap r8d
mov rsi, qword [rsp + 0x110]
mov dword [rsp + 0x3c], r8d
mov esi, dword [rsi + 0x18]
bswap esi
mov ecx, dword [rsp + 0x24]
mov r14, qword [rsp + 0x110]
mov edx, esi
xor edx, r11d
mov dword [rsp + 0xb0], edx
xor ecx, esi
mov r14d, dword [r14 + 0x1c]
mov dword [rsp + 0xb8], ecx
bswap r14d
mov ecx, dword [rsp + 0x88]
xor ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x54]
xor edx, dword [rsp + 0x58]
xor edx, dword [rsp + 0x24]
mov r15d, dword [rsp + 0x78]
xor r15d, dword [rsp + 0x70]
mov r13d, dword [rsp + 0x7c]
mov r8d, ecx
mov ecx, dword [rsp + 0x8c]
xor ecx, dword [rsp + 0x90]
xor ecx, dword [rsp + 0x34]
xor r8d, dword [rsp + 0x30]
xor r13d, r12d
mov dword [rsp + 0xa8], edx
xor r13d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x68]
xor r15d, r11d
mov r11d, dword [rsp + 0x50]
mov dword [rsp + 0x98], r15d
mov r15d, dword [rsp + 0x60]
xor ebx, ecx
mov dword [rsp + 0x44], r8d
mov r8d, dword [rsp + 0x9c]
xor edx, r11d
mov dword [rsp + 0x40], r13d
mov r13d, dword [rsp + 0x2c]
xor r11d, eax
xor edx, ebx
mov ebx, dword [rsp + 0xa0]
mov dword [rsp + 0xa4], r11d
xor eax, r14d
mov dword [rsp + 0x50], edx
mov edx, dword [rsp + 0x38]
xor r13d, ecx
xor r15d, ebx
xor ebx, r10d
xor r10d, r14d
xor r13d, r15d
mov r15d, dword [rsp + 0x48]
xor edx, ecx
mov dword [rsp + 0xa0], ebx
mov ebx, dword [rsp + 0x78]
xor r15d, r8d
xor r8d, ebp
xor ebp, r14d
xor r15d, edx
mov edx, dword [rsp + 0x54]
xor ebx, r9d
mov dword [rsp + 0x9c], r8d
xor edx, edi
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x78], ebx
mov r8d, dword [rsp + 0x3c]
mov r11d, dword [rsp + 0x7c]
mov edx, ebp
mov ebx, dword [rsp + 0x88]
mov ebp, dword [rsp + 0x58]
xor r11d, r8d
mov dword [rsp + 0x7c], r11d
mov r11d, dword [rsp + 0x8c]
xor ebx, esi
xor ebp, edx
mov dword [rsp + 0x88], ebx
mov ebx, dword [rsp + 0x80]
xor r11d, r14d
mov dword [rsp + 0x8c], r11d
mov r11d, r10d
mov r10d, dword [rsp + 0x48]
xor r10d, r14d
xor edi, dword [rsp + 0x60]
xor r14d, r15d
xor r14d, dword [rsp + 0xb8]
xor ebx, r8d
xor ebx, dword [rsp + 0x40]
xor edx, dword [rsp + 0x2c]
xor r12d, r9d
mov r8d, dword [rsp + 0x90]
xor r12d, dword [rsp + 0x98]
xor r10d, ecx
xor ebp, r15d
xor r9d, dword [rsp + 0x30]
shl r10, 0x20
shl rbp, 0x20
mov dword [rsp + 0xac], edi
mov edi, dword [rsp + 0x68]
mov dword [rsp + 0x24], r14d
mov r14d, dword [rsp + 0xa8]
mov dword [rsp + 0x58], ebx
xor r8d, esi
xor r8d, dword [rsp + 0x44]
rorx r12d, r12d, 0x1f
xor edi, r11d
xor edx, r14d
mov dword [rsp + 0x60], edi
mov edi, dword [rsp + 0x70]
rorx r8d, r8d, 0x1f
xor edi, eax
xor edi, dword [rsp + 0x50]
xor eax, dword [rsp + 0x28]
mov dword [rsp + 0x48], edi
mov edi, dword [rsp + 0x38]
xor edi, esi
xor esi, r13d
mov ebx, edi
mov edi, dword [rsp + 0x3c]
xor edi, dword [rsp + 0x34]
xor ebx, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x2c], edx
mov ebx, dword [rsp + 0xb4]
xor ecx, dword [rsp + 0x9c]
xor r9d, dword [rsp + 0x40]
xor edi, dword [rsp + 0x44]
xor r11d, dword [rsp + 0x50]
mov edx, dword [rsp + 0xa0]
xor ebx, esi
mov esi, dword [rsp + 0x98]
xor r11d, dword [rsp + 0xb0]
or r10, rcx
mov ecx, dword [rsp + 0xac]
rorx r9d, r9d, 0x1e
xor eax, esi
xor r15d, dword [rsp + 0x54]
mov dword [rsp + 0x30], r9d
rorx r9d, edi, 0x1e
rorx eax, eax, 0x1e
rorx edi, dword [rsp + 0x48], 0x1f
shl rdi, 0x20
xor ecx, r14d
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
xor eax, dword [rsp + 0x50]
shl r12, 0x20
xor edx, r14d
shl rcx, 0x20
mov dword [rsp + 0x34], r9d
rorx r9d, dword [rsp + 0x58], 0x1f
or rcx, rdx
mov edx, dword [rsp + 0x60]
shl r9, 0x20
shl r8, 0x20
or rbp, r15
rorx r11d, r11d, 0x1e
lea r14, [0x006fab20]
lea r15, [0x006faae0]
or rdi, rax
mov eax, dword [rsp + 0x7c]
xor edx, r13d
xor r13d, dword [rsp + 0xa4]
shl rdx, 0x20
xor eax, esi
mov rsi, rcx
mov rcx, rbp
or r12, rax
mov eax, dword [rsp + 0x88]
xor eax, dword [rsp + 0x40]
or rdx, r13
or r9, rax
mov eax, dword [rsp + 0x8c]
xor eax, dword [rsp + 0x44]
or r8, rax
nop word cs:[rax + rax]
nop
mov rax, r10
xor rsi, rdx
xor r8, rdi
or rax, rcx
xor rax, rdx
and rdx, r10
xor rcx, rdx
mov r13, rdx
mov rdx, r12
or rdx, r9
xor r13, rsi
not rcx
and rsi, rax
xor rdx, rdi
and rdi, r12
xor rsi, rcx
or rcx, r13
xor r9, rdi
xor rdi, r8
and r8, rdx
xor r10, rcx
not r9
xor r13, rsi
xor rax, rcx
and rsi, rcx
xor r8, r9
mov rcx, rdi
mov rbp, r10
or r9, rdi
xor rcx, r8
shr rbp, 0x20
not rax
xor r12, r9
xor rcx, r10
rorx ebp, ebp, 0x1e
rorx r10d, r10d, 0x1e
and r8, r9
mov rdi, rcx
xor r10d, ecx
rorx ecx, ecx, 0x12
shr rdi, 0x20
xor ecx, r10d
rorx r10d, r10d, 0x16
xor ebp, edi
rorx edi, edi, 0x12
xor edi, ebp
rorx ebp, ebp, 0x16
xor ebp, edi
rorx edi, edi, 0x1f
xor r12, rax
xor r10d, ecx
shl rbp, 0x20
shl rdi, 0x20
rorx ecx, ecx, 0x1f
xor rdx, r9
or r10, rbp
or rdi, rcx
mov rbp, r12
rorx ecx, eax, 0x1e
shr rax, 0x20
shr rbp, 0x20
xor ecx, r12d
rorx r12d, r12d, 0x12
rorx eax, eax, 0x1e
xor r12d, ecx
rorx ecx, ecx, 0x16
xor rdx, rsi
xor eax, ebp
rorx ebp, ebp, 0x12
xor ecx, r12d
not rdx
xor ebp, eax
rorx eax, eax, 0x16
rorx r12d, r12d, 0x1f
xor eax, ebp
rorx ebp, ebp, 0x1f
shl rax, 0x20
shl rbp, 0x20
or rcx, rax
rorx eax, esi, 0x1e
or r12, rbp
shr rsi, 0x20
xor eax, edx
mov rbp, rdx
rorx edx, edx, 0x12
xor edx, eax
shr rbp, 0x20
rorx r9d, eax, 0x16
rorx eax, esi, 0x1e
xor eax, ebp
rorx ebp, ebp, 0x12
xor ebp, eax
rorx esi, eax, 0x16
mov eax, r9d
xor esi, ebp
rorx r9d, ebp, 0x1f
xor eax, edx
rorx edx, edx, 0x1f
shl rsi, 0x20
shl r9, 0x20
rorx ebp, r13d, 0x1e
or rsi, rax
or r9, rdx
xor r8, r13
shr r13, 0x20
mov rdx, r8
rorx r13d, r13d, 0x1e
xor ebp, r8d
rorx eax, r8d, 0x12
shr rdx, 0x20
xor eax, ebp
rorx ebp, ebp, 0x16
xor r10, qword [r14]
xor r13d, edx
rorx r8d, edx, 0x12
xor ebp, eax
xor rdi, qword [r15]
xor r8d, r13d
rorx edx, r13d, 0x16
rorx eax, eax, 0x1f
xor edx, r8d
rorx r8d, r8d, 0x1f
add r14, 8
add r15, 8
shl r8, 0x20
shl rdx, 0x20
or r8, rax
lea rax, [0x006fab60]
or rdx, rbp
cmp r14, rax
jne 0x517060
mov rbp, rcx
mov dword [rsp + 0x9c], r10d
mov dword [rsp + 0x50], edx
shr r10, 0x20
shr rdx, 0x20
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x78], edi
shr rbp, 0x20
shr rdi, 0x20
mov rcx, rsi
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0xa0], esi
mov qword [rsp + 0x68], rdx
shr rcx, 0x20
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x88], r9d
shr r9, 0x20
mov dword [rsp + 0x8c], r8d
shr r8, 0x20
mov qword [rsp + 0x60], rcx
lea rcx, [0x006faac0]
mov dword [rsp + 0x7c], r12d
mov qword [rsp + 0x90], r8
shr r12, 0x20
lea r8, [0x006faaa0]
mov qword [rsp + 0x80], r9
mov edi, dword [rsp + 0x24]
mov esi, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
mov ebp, dword [rsp + 0x30]
mov edx, dword [rsp + 0x34]
mov r10d, dword [rsp + 0x38]
nop word [rax + rax]
mov r9d, r10d
xor eax, ebx
xor edx, r11d
lea r15, [0x006faae0]
or r9d, edi
xor r9d, ebx
and ebx, r10d
xor edi, ebx
xor ebx, eax
and eax, r9d
not edi
xor eax, edi
or edi, ebx
xor r10d, edi
xor ebx, eax
and eax, edi
xor edi, r9d
mov r9d, esi
not edi
or r9d, ebp
xor r9d, r11d
and r11d, esi
xor ebp, r11d
xor r11d, edx
and edx, r9d
not ebp
xor edx, ebp
or ebp, r11d
xor esi, ebp
xor r11d, edx
and edx, ebp
xor r11d, r10d
xor esi, edi
rorx r10d, r10d, 0x1e
rorx edi, edi, 0x1e
xor r10d, r11d
xor edi, esi
rorx r11d, r11d, 0x12
rorx esi, esi, 0x12
xor r11d, r10d
xor esi, edi
rorx r10d, r10d, 0x16
rorx edi, edi, 0x16
xor r10d, r11d
xor edi, esi
xor r9d, ebp
xor edx, ebx
xor r9d, eax
rorx ebx, ebx, 0x1e
rorx eax, eax, 0x1e
xor r10d, dword [rcx]
not r9d
xor ebx, edx
rorx edx, edx, 0x12
xor eax, r9d
rorx r9d, r9d, 0x12
xor edx, ebx
add rcx, 4
xor r9d, eax
rorx ebx, ebx, 0x16
rorx eax, eax, 0x16
rorx r11d, r11d, 0x1f
xor ebx, edx
xor r11d, dword [r8]
rorx esi, esi, 0x1f
xor eax, r9d
rorx ebp, r9d, 0x1f
rorx edx, edx, 0x1f
add r8, 4
cmp rcx, r15
jne 0x517300
mov ecx, edx
mov dword [rsp + 0x34], edx
mov rdx, qword [rsp + 0x110]
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], r10d
mov qword [rdx], 0
mov qword [rdx + 8], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
xor edx, edx
cmp dword [rsp + 0xbc], 1
jne 0x517520
mov r8d, dword [rsp + 0x48]
xor r8d, r10d
xor r8d, dword [rsp + 0x9c]
bswap r8d
mov rdx, qword [rsp + 0x128]
mov r15d, dword [rsp + 0x58]
mov dword [rdx], r8d
xor r15d, edi
xor r15d, dword [rsp + 0x54]
bswap r15d
mov r14d, dword [rsp + 0x60]
mov rdi, rdx
mov dword [rdx + 4], r15d
xor r14d, eax
xor r14d, dword [rsp + 0xa0]
bswap r14d
mov rax, rdx
mov dword [rdx + 8], r14d
mov edx, dword [rsp + 0x68]
xor edx, ebx
xor edx, dword [rsp + 0x50]
bswap edx
mov r13d, dword [rsp + 0x70]
mov dword [rdi + 0xc], edx
xor r13d, r11d
xor r13d, dword [rsp + 0x78]
bswap r13d
xor r12d, esi
mov esi, dword [rsp + 0x7c]
mov dword [rdi + 0x10], r13d
xor esi, r12d
bswap esi
mov r10d, dword [rsp + 0x80]
mov dword [rdi + 0x14], esi
xor r10d, ebp
xor r10d, dword [rsp + 0x88]
bswap r10d
cmp dword [rsp + 0x130], 8
mov dword [rdi + 0x18], r10d
jne 0x517505
mov edi, dword [rsp + 0x90]
xor edi, ecx
xor edi, dword [rsp + 0x8c]
bswap edi
mov dword [rax + 0x1c], edi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0xbc], 1
jmp 0x516ce1