Function at 0x602060
Capabilities:
Encrypt data using aes
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov r11d, edx
test rcx, rcx
je 0x602c2c
test r8, r8
je 0x602c2c
mov eax, edx
and eax, 0xffffffbf
cmp eax, 0x80
jne 0x602238
cmp edx, 0x80
je 0x602258
cmp edx, 0xc0
jne 0x602244
mov dword [r8 + 0xf0], 0xc
movzx edx, byte [rcx]
movzx eax, byte [rcx + 1]
shl edx, 0x18
shl eax, 0x10
xor edx, eax
movzx eax, byte [rcx + 3]
xor edx, eax
movzx eax, byte [rcx + 2]
shl eax, 8
xor edx, eax
mov dword [r8], edx
movzx eax, byte [rcx + 4]
movzx r9d, byte [rcx + 5]
shl eax, 0x18
shl r9d, 0x10
xor eax, r9d
movzx r9d, byte [rcx + 7]
xor eax, r9d
movzx r9d, byte [rcx + 6]
shl r9d, 8
xor eax, r9d
mov dword [r8 + 4], eax
movzx r9d, byte [rcx + 8]
movzx r10d, byte [rcx + 9]
shl r9d, 0x18
shl r10d, 0x10
xor r9d, r10d
movzx r10d, byte [rcx + 0xb]
xor r9d, r10d
movzx r10d, byte [rcx + 0xa]
shl r10d, 8
xor r9d, r10d
mov dword [r8 + 8], r9d
movzx ebx, byte [rcx + 0xc]
movzx r10d, byte [rcx + 0xd]
shl ebx, 0x18
shl r10d, 0x10
xor ebx, r10d
movzx r10d, byte [rcx + 0xf]
xor ebx, r10d
movzx r10d, byte [rcx + 0xe]
shl r10d, 8
xor ebx, r10d
mov dword [r8 + 0xc], ebx
cmp r11d, 0x80
je 0x602270
movzx esi, byte [rcx + 0x10]
movzx r10d, byte [rcx + 0x11]
shl esi, 0x18
shl r10d, 0x10
xor esi, r10d
movzx r10d, byte [rcx + 0x13]
xor esi, r10d
movzx r10d, byte [rcx + 0x12]
shl r10d, 8
xor esi, r10d
mov dword [r8 + 0x10], esi
movzx r10d, byte [rcx + 0x14]
movzx edi, byte [rcx + 0x15]
shl r10d, 0x18
shl edi, 0x10
xor r10d, edi
movzx edi, byte [rcx + 0x17]
xor r10d, edi
movzx edi, byte [rcx + 0x16]
shl edi, 8
xor r10d, edi
mov dword [r8 + 0x14], r10d
cmp r11d, 0xc0
je 0x6027c8
movzx r10d, byte [rcx + 0x18]
movzx esi, byte [rcx + 0x19]
shl r10d, 0x18
shl esi, 0x10
xor r10d, esi
movzx esi, byte [rcx + 0x1b]
xor r10d, esi
movzx esi, byte [rcx + 0x1a]
shl esi, 8
xor r10d, esi
mov dword [r8 + 0x18], r10d
movzx r10d, byte [rcx + 0x1c]
movzx esi, byte [rcx + 0x1d]
shl r10d, 0x18
shl esi, 0x10
xor r10d, esi
movzx esi, byte [rcx + 0x1f]
movzx ecx, byte [rcx + 0x1e]
xor r10d, esi
shl ecx, 8
xor ecx, r10d
mov dword [r8 + 0x1c], ecx
cmp r11d, 0x100
je 0x6026b0
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp edx, 0x100
jne 0x602c36
mov dword [r8 + 0xf0], 0xe
jmp 0x6020b4
mov dword [r8 + 0xf0], 0xa
jmp 0x6020b4
lea rsi, [0x00922c60]
movzx ecx, bl
xor edx, 0x1000000
mov ecx, dword [rsi + rcx*4]
lea rdi, [0x00922860]
lea r11, [0x00922460]
lea r10, [0x00922060]
and ecx, 0xff00
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [rdi + rcx*4]
xor edx, ecx
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [r11 + rcx*4]
and ecx, 0xff000000
xor edx, ecx
movzx ecx, bh
mov ecx, dword [r10 + rcx*4]
and ecx, 0xff0000
xor edx, ecx
mov ecx, r9d
xor eax, edx
mov dword [r8 + 0x10], edx
xor edx, 0x2000000
xor ecx, eax
mov dword [r8 + 0x14], eax
xor ebx, ecx
mov dword [r8 + 0x18], ecx
movzx ecx, bl
mov dword [r8 + 0x1c], ebx
mov ecx, dword [rsi + rcx*4]
and ecx, 0xff00
xor ecx, edx
mov edx, ebx
shr edx, 0x18
movzx edx, byte [rdi + rdx*4]
xor ecx, edx
mov edx, ebx
shr edx, 0x10
movzx edx, dl
mov edx, dword [r11 + rdx*4]
and edx, 0xff000000
xor ecx, edx
movzx edx, bh
mov edx, dword [r10 + rdx*4]
and edx, 0xff0000
xor ecx, edx
mov edx, r9d
xor edx, ecx
xor eax, ecx
mov dword [r8 + 0x20], ecx
xor ecx, 0x4000000
mov ebp, edx
mov dword [r8 + 0x24], eax
xor ebp, ebx
mov dword [r8 + 0x28], edx
movzx r9d, bpl
mov dword [r8 + 0x2c], ebp
mov r9d, dword [rsi + r9*4]
and r9d, 0xff00
xor ecx, r9d
mov r9d, ebp
shr r9d, 0x18
movzx r9d, byte [rdi + r9*4]
xor ecx, r9d
mov r9d, ebp
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [r11 + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
mov ecx, ebp
movzx ebp, ch
mov r9d, dword [r10 + rbp*4]
and r9d, 0xff0000
xor r9d, r15d
xor eax, r9d
mov dword [r8 + 0x30], r9d
xor r9d, 0x8000000
mov ecx, eax
xor ebx, eax
mov dword [r8 + 0x34], eax
xor ecx, edx
movzx ebp, bh
mov dword [r8 + 0x3c], ebx
mov dword [r8 + 0x38], ecx
movzx ecx, bl
mov ecx, dword [rsi + rcx*4]
and ecx, 0xff00
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x18
movzx r9d, byte [rdi + r9*4]
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [r11 + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r9d, dword [r10 + rbp*4]
and r9d, 0xff0000
xor ecx, r9d
xor edx, ecx
xor eax, ecx
mov dword [r8 + 0x40], ecx
xor ecx, 0x10000000
mov ebp, edx
mov dword [r8 + 0x44], eax
xor ebp, ebx
mov dword [r8 + 0x48], edx
movzx r9d, bpl
mov dword [r8 + 0x4c], ebp
mov r9d, dword [rsi + r9*4]
and r9d, 0xff00
xor ecx, r9d
mov r9d, ebp
shr r9d, 0x18
movzx r9d, byte [rdi + r9*4]
xor ecx, r9d
mov r9d, ebp
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [r11 + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
mov ecx, ebp
movzx ebp, ch
mov r9d, dword [r10 + rbp*4]
and r9d, 0xff0000
xor r9d, r15d
xor eax, r9d
mov dword [r8 + 0x50], r9d
mov ecx, eax
mov dword [r8 + 0x54], eax
xor ecx, edx
xor ebx, eax
xor r9d, 0x20000000
mov dword [r8 + 0x58], ecx
movzx ecx, bl
movzx ebp, bh
mov ecx, dword [rsi + rcx*4]
mov dword [r8 + 0x5c], ebx
and ecx, 0xff00
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x18
movzx r9d, byte [rdi + r9*4]
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [r11 + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r9d, dword [r10 + rbp*4]
mov ebp, ebx
and r9d, 0xff0000
xor ecx, r9d
xor edx, ecx
xor eax, ecx
mov dword [r8 + 0x60], ecx
xor ecx, 0x40000000
xor ebp, edx
mov dword [r8 + 0x64], eax
movzx r9d, bpl
mov dword [r8 + 0x6c], ebp
mov r9d, dword [rsi + r9*4]
mov dword [r8 + 0x68], edx
and r9d, 0xff00
xor ecx, r9d
mov r9d, ebp
shr r9d, 0x18
movzx r9d, byte [rdi + r9*4]
xor ecx, r9d
mov r9d, ebp
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [r11 + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
mov ecx, ebp
movzx ebp, ch
mov ecx, edx
mov r9d, dword [r10 + rbp*4]
and r9d, 0xff0000
xor r9d, r15d
xor eax, r9d
mov dword [r8 + 0x70], r9d
add r9d, 0x80000000
xor ebx, eax
xor ecx, eax
mov dword [r8 + 0x74], eax
mov dword [r8 + 0x78], ecx
movzx ecx, bl
movzx ebp, bh
mov ecx, dword [rsi + rcx*4]
mov dword [r8 + 0x7c], ebx
and ecx, 0xff00
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x18
movzx r9d, byte [rdi + r9*4]
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [r11 + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r9d, dword [r10 + rbp*4]
mov ebp, ebx
and r9d, 0xff0000
xor ecx, r9d
xor edx, ecx
xor eax, ecx
mov dword [r8 + 0x80], ecx
xor ecx, 0x1b000000
xor ebp, edx
mov r9d, edx
mov dword [r8 + 0x88], edx
movzx edx, bpl
mov dword [r8 + 0x84], eax
mov dword [r8 + 0x8c], ebp
mov edx, dword [rsi + rdx*4]
and edx, 0xff00
xor ecx, edx
mov edx, ebp
shr edx, 0x18
movzx edx, byte [rdi + rdx*4]
xor ecx, edx
mov edx, ebp
shr edx, 0x10
movzx edx, dl
mov edx, dword [r11 + rdx*4]
and edx, 0xff000000
xor ecx, edx
mov edx, ebp
movzx ebp, dh
mov edx, dword [r10 + rbp*4]
and edx, 0xff0000
xor edx, ecx
mov ecx, r9d
xor eax, edx
mov dword [r8 + 0x90], edx
xor edx, 0x36000000
xor ebx, eax
xor ecx, eax
mov dword [r8 + 0x94], eax
mov dword [r8 + 0x98], ecx
movzx ecx, bl
mov ecx, dword [rsi + rcx*4]
mov dword [r8 + 0x9c], ebx
and ecx, 0xff00
xor ecx, edx
mov edx, ebx
shr edx, 0x18
movzx edx, byte [rdi + rdx*4]
xor ecx, edx
mov edx, ebx
shr edx, 0x10
movzx edx, dl
mov edx, dword [r11 + rdx*4]
and edx, 0xff000000
xor ecx, edx
movzx edx, bh
mov edx, dword [r10 + rdx*4]
and edx, 0xff0000
xor edx, ecx
xor eax, edx
mov dword [r8 + 0xa0], edx
xor edx, r9d
mov dword [r8 + 0xa8], edx
xor edx, ebx
mov dword [r8 + 0xa4], eax
mov dword [r8 + 0xac], edx
jmp 0x602222
lea r10, [0x00920f20]
add r8, 0x20
lea rbp, [0x00922c60]
lea r12, [r10 + 0x1c]
lea rdi, [0x00922860]
lea rsi, [0x00922460]
lea r11, [0x00922060]
jmp 0x60274a
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [r11 + rcx*4]
and ecx, 0xff0000
mov r15d, ecx
movzx ecx, bh
mov r14d, dword [rbp + rcx*4]
mov ecx, r15d
movzx r15d, bl
movzx r15d, byte [rdi + r15*4]
and r14d, 0xff00
or ecx, r14d
mov r14d, ebx
xor ecx, dword [r8 - 0x30]
shr r14d, 0x18
mov r14d, dword [rsi + r14*4]
and r14d, 0xff000000
or r14d, r15d
xor ecx, r14d
mov dword [r8 - 0x10], ecx
xor ecx, dword [r8 - 0x2c]
mov dword [r8 - 0xc], ecx
xor ecx, dword [r8 - 0x28]
mov dword [r8 - 8], ecx
xor ecx, r13d
mov dword [r8 - 4], ecx
mov r13d, dword [r8 - 4]
xor edx, dword [r10]
add r10, 4
add r8, 0x20
movzx ecx, r13b
mov ecx, dword [rbp + rcx*4]
and ecx, 0xff00
xor edx, ecx
mov ecx, r13d
shr ecx, 0x18
movzx ecx, byte [rdi + rcx*4]
xor edx, ecx
mov ecx, r13d
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [rsi + rcx*4]
and ecx, 0xff000000
xor ecx, edx
mov edx, r13d
movzx edx, dh
mov edx, dword [r11 + rdx*4]
and edx, 0xff0000
xor edx, ecx
xor eax, edx
mov dword [r8 - 0x20], edx
xor r9d, eax
mov dword [r8 - 0x1c], eax
xor ebx, r9d
mov dword [r8 - 0x18], r9d
mov dword [r8 - 0x14], ebx
cmp r10, r12
jne 0x6026e0
jmp 0x602222
lea rdi, [0x00922c60]
movzx ecx, r10b
xor edx, 0x1000000
mov ecx, dword [rdi + rcx*4]
lea rbp, [0x00922860]
lea r11, [0x00922460]
lea r15, [0x00922060]
and ecx, 0xff00
xor edx, ecx
mov ecx, r10d
shr ecx, 0x18
movzx ecx, byte [rbp + rcx*4]
xor edx, ecx
mov ecx, r10d
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [r11 + rcx*4]
and ecx, 0xff000000
xor edx, ecx
mov ecx, r10d
movzx ecx, ch
mov r12d, dword [r15 + rcx*4]
and r12d, 0xff0000
xor edx, r12d
mov r12d, eax
xor r12d, edx
mov dword [r8 + 0x18], edx
xor r9d, r12d
mov dword [r8 + 0x1c], r12d
mov r12d, ebx
xor r12d, r9d
mov dword [r8 + 0x20], r9d
xor esi, r12d
mov dword [r8 + 0x24], r12d
xor r10d, esi
mov dword [r8 + 0x28], esi
movzx r12d, r10b
mov ecx, r10d
mov dword [r8 + 0x2c], r10d
mov r13d, dword [rdi + r12*4]
mov r12d, r10d
movzx ecx, ch
shr r12d, 0x18
movzx r12d, byte [rbp + r12*4]
and r13d, 0xff00
or r13d, r12d
mov r12d, r10d
shr r12d, 0x10
xor r13d, 0x2000000
movzx r12d, r12b
mov r12d, dword [r11 + r12*4]
and r12d, 0xff000000
xor r13d, r12d
mov r12d, dword [r15 + rcx*4]
and r12d, 0xff0000
xor r13d, r12d
mov r12d, r9d
xor eax, r13d
xor edx, r13d
mov r13d, ebx
xor r13d, eax
xor r12d, eax
mov dword [r8 + 0x30], edx
mov dword [r8 + 0x38], r12d
mov r12d, r13d
xor r12d, esi
mov dword [r8 + 0x3c], r13d
xor r10d, r12d
mov dword [r8 + 0x40], r12d
mov r14d, r10d
movzx r12d, r10b
mov ecx, r10d
mov dword [r8 + 0x34], eax
mov r12d, dword [rdi + r12*4]
shr r14d, 0x18
movzx ecx, ch
mov dword [r8 + 0x44], r10d
movzx r14d, byte [rbp + r14*4]
and r12d, 0xff00
or r12d, r14d
mov r14d, r12d
mov r12d, r10d
shr r12d, 0x10
xor r14d, 0x4000000
movzx r12d, r12b
mov r12d, dword [r11 + r12*4]
and r12d, 0xff000000
xor r12d, r14d
mov r14, rcx
mov rcx, r15
mov r14d, dword [r15 + r14*4]
and r14d, 0xff0000
xor r12d, r14d
mov r14d, r10d
xor r12d, edx
mov edx, eax
xor edx, r12d
xor r9d, r12d
mov dword [r8 + 0x48], r12d
mov dword [r8 + 0x4c], edx
mov edx, r13d
mov r13d, esi
xor r13d, r9d
xor edx, r9d
mov dword [r8 + 0x50], r9d
xor r14d, r13d
mov dword [r8 + 0x54], edx
mov r15d, r14d
movzx edx, r14b
mov dword [r8 + 0x58], r13d
mov edx, dword [rdi + rdx*4]
shr r15d, 0x18
mov dword [r8 + 0x5c], r14d
movzx r15d, byte [rbp + r15*4]
and edx, 0xff00
or edx, r15d
mov r15d, r14d
shr r15d, 0x10
xor edx, 0x8000000
movzx r15d, r15b
mov r15d, dword [r11 + r15*4]
and r15d, 0xff000000
xor r15d, edx
mov edx, r14d
mov r14d, r9d
movzx edx, dh
mov edx, dword [rcx + rdx*4]
and edx, 0xff0000
xor edx, r15d
xor ebx, edx
xor eax, edx
xor r12d, edx
mov edx, r10d
xor edx, ebx
xor r13d, ebx
xor r14d, eax
mov dword [r8 + 0x60], r12d
mov dword [r8 + 0x70], r13d
mov r15d, edx
movzx r13d, dl
movzx ecx, dh
shr r15d, 0x18
mov r13d, dword [rdi + r13*4]
mov dword [r8 + 0x68], r14d
movzx r14d, byte [rbp + r15*4]
mov dword [r8 + 0x74], edx
and r13d, 0xff00
mov dword [r8 + 0x64], eax
or r13d, r14d
mov dword [r8 + 0x6c], ebx
mov r14d, r13d
mov r13d, edx
xor r14d, 0x10000000
shr r13d, 0x10
movzx r13d, r13b
mov r13d, dword [r11 + r13*4]
and r13d, 0xff000000
xor r13d, r14d
mov r14, rcx
lea rcx, [0x00922060]
mov r14d, dword [rcx + r14*4]
and r14d, 0xff0000
xor r13d, r14d
xor r12d, r13d
mov r13d, eax
xor r13d, r12d
xor r9d, r12d
xor esi, r12d
mov dword [r8 + 0x78], r12d
mov dword [r8 + 0x7c], r13d
mov r13d, ebx
xor edx, esi
xor r13d, r9d
mov dword [r8 + 0x8c], edx
mov dword [r8 + 0x84], r13d
mov r13d, edx
movzx edx, dl
mov r14d, r13d
mov edx, dword [rdi + rdx*4]
mov dword [r8 + 0x80], r9d
shr r14d, 0x18
mov dword [r8 + 0x88], esi
movzx r14d, byte [rbp + r14*4]
and edx, 0xff00
or edx, r14d
mov r14d, r13d
shr r14d, 0x10
xor edx, 0x20000000
movzx r14d, r14b
mov r14d, dword [r11 + r14*4]
and r14d, 0xff000000
xor r14d, edx
mov edx, r13d
mov r13d, esi
movzx edx, dh
mov edx, dword [rcx + rdx*4]
and edx, 0xff0000
xor edx, r14d
xor eax, edx
xor r12d, edx
mov edx, r9d
xor edx, eax
xor r10d, eax
mov dword [r8 + 0x90], r12d
mov dword [r8 + 0x98], edx
mov edx, ebx
mov r15d, r10d
mov ecx, r10d
xor edx, eax
shr r15d, 0x18
movzx ecx, ch
mov dword [r8 + 0x94], eax
xor r13d, edx
movzx r14d, byte [rbp + r15*4]
lea r15, [0x00922060]
mov dword [r8 + 0x9c], edx
mov dword [r8 + 0xa0], r13d
movzx r13d, r10b
mov r13d, dword [rdi + r13*4]
mov dword [r8 + 0xa4], r10d
and r13d, 0xff00
or r13d, r14d
mov r14d, r13d
mov r13d, r10d
shr r13d, 0x10
xor r14d, 0x40000000
movzx r13d, r13b
mov r13d, dword [r11 + r13*4]
and r13d, 0xff000000
xor r13d, r14d
mov r14d, dword [r15 + rcx*4]
and r14d, 0xff0000
xor r13d, r14d
xor r12d, r13d
mov r13d, eax
xor r9d, r12d
mov dword [r8 + 0xa8], r12d
xor r13d, r12d
xor esi, r9d
xor edx, r9d
mov dword [r8 + 0xac], r13d
mov dword [r8 + 0xb8], esi
xor esi, r10d
mov r10d, esi
mov dword [r8 + 0xb4], edx
mov ecx, esi
movzx edx, sil
mov edx, dword [rdi + rdx*4]
shr r10d, 0x18
mov dword [r8 + 0xbc], esi
movzx r10d, byte [rbp + r10*4]
mov dword [r8 + 0xb0], r9d
and edx, 0xff00
or r10d, edx
lea edx, [r10 - 0x80000000]
mov r10d, esi
movzx esi, ch
shr r10d, 0x10
mov ecx, dword [r15 + rsi*4]
movzx r10d, r10b
mov r10d, dword [r11 + r10*4]
and ecx, 0xff0000
and r10d, 0xff000000
xor edx, r10d
xor edx, ecx
xor eax, edx
xor r12d, edx
xor edx, ebx
mov dword [r8 + 0xc4], eax
xor eax, r9d
mov dword [r8 + 0xc0], r12d
mov dword [r8 + 0xc8], eax
mov dword [r8 + 0xcc], edx
jmp 0x602222
mov eax, 0xffffffff
jmp 0x602224
mov eax, 0xfffffffe
jmp 0x602224