Function at 0x61c7b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x8f0
mov esi, esp
mov dword [esi + 0x8d8], ebp
mov dword [esi + 0x8dc], esp
mov dword [esi + 0x8e8], 0xffffffff
mov dword [esi + 0x8e4], 0x705d80
mov ebx, dword [ebp + 8]
mov edi, ecx
lea ecx, [esi + 0x8e0]
mov eax, dword fs:[0]
test ebx, ebx
mov dword [esi + 0x8e0], eax
mov dword fs:[0], ecx
je 0x61c820
mov eax, ebx
shl eax, 4
lea ecx, [edx + eax]
mov dword [esi + 0x1c], ecx
mov ecx, edx
test eax, eax
je 0x61c83b
add eax, 0xfffffff0
cmp dword [ecx + 8], 0
lea ecx, [ecx + 0x10]
jne 0x61c810
mov byte [edi + 0x18c], 0xa
mov eax, dword [esi + 0x8e0]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
cmp ebx, 3
mov dword [esi + 0xc], edx
je 0x61c874
cmp ebx, 2
je 0x61c8b6
cmp ebx, 1
mov ecx, 0
jne 0x61c8e5
mov eax, dword [edx + 8]
cmp eax, 1
jne 0x61ce0a
mov eax, dword [edx]
movzx eax, byte [eax]
mov byte [edi], al
mov byte [edi + 0x18c], 3
jmp 0x61c827
cmp dword [edx + 8], 1
jne 0x61c8e3
cmp dword [edx + 0x18], 1
jne 0x61c8e3
cmp dword [edx + 0x28], 1
mov ecx, 0
jne 0x61c8e5
mov eax, dword [edx]
mov ecx, dword [edx + 0x10]
mov edx, dword [esi + 0xc]
mov edx, dword [edx + 0x20]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
movzx edx, byte [edx]
shl ecx, 0x10
shl eax, 8
or eax, ecx
mov ecx, 1
shl edx, 0x18
or eax, edx
mov edx, dword [esi + 0xc]
jmp 0x61c8e5
cmp dword [edx + 8], 1
jne 0x61c8e3
cmp dword [edx + 0x18], 1
mov ecx, 0
jne 0x61c8e5
mov eax, dword [edx]
mov ecx, dword [edx + 0x10]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
mov byte [edi], al
mov byte [edi + 1], cl
mov byte [edi + 0x18c], 4
jmp 0x61c827
xor ecx, ecx
mov dword [esi + 8], edi
mov edi, eax
and edi, 1
or edi, ecx
je 0x61c90e
mov edx, dword [esi + 8]
mov ecx, eax
shr eax, 0x18
shr ecx, 8
mov word [edx], cx
mov byte [edx + 2], al
mov byte [edx + 0x18c], 5
jmp 0x61c827
add ebx, 0xfffffff
mov edi, dword [edx + 8]
xor ecx, ecx
mov eax, ebx
and eax, 0xfffffff
cmp eax, 8
jae 0x61c92c
mov ebx, edi
jmp 0x61ca66
movd xmm0, edi
and ebx, 7
mov ecx, eax
lea edi, [edx + 0x88]
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x725630]
sub ecx, ebx
mov dword [esi + 0x10], ebx
mov ebx, ecx
movdqa xmm2, xmm1
nop word cs:[eax + eax]
nop dword [eax]
movd xmm3, dword [edi - 0x40]
movd xmm5, dword [edi - 0x50]
movd xmm4, dword [edi - 0x70]
movd xmm6, dword [edi - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [edi - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [edi]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edi - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [edi - 0x30]
sub edi, 0xffffff80
add ebx, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x61c960
movdqa xmm4, xmm1
movdqa xmm3, xmm2
cmp dword [esi + 0x10], 0
mov edx, dword [esi + 0xc]
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ebx, xmm0
je 0x61ca7d
sub eax, ecx
shl ecx, 4
lea ecx, [ecx + edx + 0x18]
nop
mov edi, dword [ecx]
cmp ebx, edi
cmovae ebx, edi
add ecx, 0x10
dec eax
jne 0x61ca70
movaps xmm0, xmmword [0x725660]
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x21c], 0x2020100
mov word [esi + 0x220], 2
mov dword [esi + 0x1f8], 4
mov dword [esi + 0x1fc], 0
mov dword [esi + 0x200], 0
mov dword [esi + 0x204], 4
xor eax, eax
mov ebx, edx
movups xmmword [esi + 0x208], xmm0
mov byte [esi + 0x218], 0
test al, al
jne 0x61cbfa
jmp 0x61caff
movzx eax, byte [esi + 0x221]
test al, al
jne 0x61cbfa
mov edi, dword [esi + 0x200]
mov dword [esi + 0x10], ebx
cmp edi, 0x80
jb 0x61cb70
mov byte [esi + 0x221], 1
mov byte [esi + 0x218], 0
mov ebx, dword [esi + 0x1f8]
mov dword [esi + 0x200], 0
add ebx, 4
jmp 0x61cb43
add ebx, 0xc
sub edi, 1
jb 0x61cbe0
cmp dword [ebx], 0
je 0x61cb40
push dword [ebx - 4]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x61cb40
mov eax, dword [ebx + 8]
test eax, eax
je 0x61cb9a
mov edx, dword [ebx]
lea ecx, [esi + 0x1f8]
mov dword [esi + 0x8e8], 0
push eax
call fcn.00421680
mov ebx, dword [esi + 0x10]
add esp, 4
mov ecx, dword [esi + 0x1c]
jmp 0x61cbfa
mov byte [esi + 0x221], 1
mov byte [esi + 0x218], 0
mov ebx, dword [esi + 0x1f8]
mov dword [esi + 0x200], 0
add ebx, 4
jmp 0x61cbc3
add ebx, 0xc
sub edi, 1
jb 0x61cbe0
cmp dword [ebx], 0
je 0x61cbc0
push dword [ebx - 4]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x61cbc0
mov ecx, dword [esi + 0x1c]
mov ebx, dword [esi + 0x10]
mov dword [esi + 0x20c], 0
mov dword [esi + 0x210], 0xffffffff
add ebx, 0x10
cmp ebx, ecx
jne 0x61caf0
lea ecx, [esi + 0x90]
lea edx, [esi + 0x1f8]
mov dword [esi + 0x8e8], 0
call fcn.00421e80
mov eax, dword [esi + 0x90]
test eax, eax
je 0x61cf36
movsd xmm2, qword [esi + 0xac]
movsd xmm1, qword [esi + 0xa4]
mov edi, dword [esi + 0x1f8]
mov ecx, dword [esi + 0xbc]
movsd xmm0, qword [esi + 0xb4]
mov ebx, dword [esi + 0x200]
movsd qword [esi + 0x4c], xmm2
movsd qword [esi + 0x44], xmm1
movq xmm2, qword [esi + 0x94]
movq xmm1, qword [esi + 0x9c]
add edi, 4
mov dword [esi + 0x5c], ecx
movsd qword [esi + 0x54], xmm0
movq qword [esi + 0x3c], xmm1
movq qword [esi + 0x34], xmm2
mov dword [esi + 0x30], eax
jmp 0x61cc93
add edi, 0xc
sub ebx, 1
jb 0x61ccb0
cmp dword [edi], 0
je 0x61cc90
push dword [edi - 4]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x61cc90
cmp dword [esi + 0x1fc], 0
je 0x61cccd
push dword [esi + 0x1f8]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esi + 0x208], 0
mov edi, dword [esi + 0xc]
mov ebx, dword [ebp + 8]
je 0x61ccfa
push dword [esi + 0x204]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esi + 0x8e8], 1
mov dword [esi + 0x28], 1
mov dword [esi + 0x24], 3
mov word [esi + 0x2c], 0x102
mov dword [esi + 0x8e8], 1
lea ecx, [esi + 0x90]
lea edx, [esi + 0x24]
push ebx
push edi
call fcn.0061e650
add esp, 8
cmp dword [esi + 0x90], 0
lea ecx, [esi + 0x1f8]
jne 0x61cde9
lea eax, [esi + 0x94]
push 0x164
push eax
push ecx
mov ebx, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea edi, [esi + 0x4c4]
push 0x164
push ebx
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esi + 0x2c]
movzx eax, byte [esi + 0x2d]
mov dword [esi + 0x8e8], 2
lea ecx, [esi + 0x360]
push edi
push eax
call fcn.004153c0
add esp, 8
lea ecx, [esi + 0x4c4]
mov dword [esi + 0x8e8], 1
call fcn.0061f3c0
cmp dword [esi + 0x360], 0
jne 0x61cde9
lea edi, [esi + 0x780]
lea eax, [esi + 0x364]
push 0x158
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx ebx, byte [esi + 0x4bc]
movzx eax, word [esi + 0x4bd]
movzx ecx, byte [esi + 0x4bf]
cmp bl, 3
mov word [esi + 0x18], ax
mov byte [esi + 0x1a], cl
jne 0x61d0ff
lea eax, [esi + 0x30]
mov dword [esi + 0x8e8], 0xffffffff
push eax
call fcn.00639170
add esp, 4
mov edi, dword [esi + 0xc]
mov ebx, dword [ebp + 8]
jmp 0x61cfb0
mov dword [esi + 8], edi
mov edi, dword [edx]
mov ebx, 1
mov edx, 1
mov dword [esi + 0x8e8], 0xffffffff
lea ecx, [esi + 0x90]
push eax
push edi
call fcn.00640630
add esp, 8
mov edx, dword [esi + 0xcc]
mov edi, dword [esi + 0xd0]
cmp dword [esi + 0xc8], 0
jne 0x61ce9c
test edi, edi
je 0x61ce8f
js 0x61d1f5
movzx eax, byte [0x919aa5]
mov eax, dword [0x919820]
mov dword [esi + 0x10], edx
test eax, eax
jne 0x61ce78
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x61d1e7
mov dword [0x919820], eax
push edi
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [esi + 0x10]
mov ebx, eax
test eax, eax
je 0x61d1e7
push edi
push edx
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, ebx
movsd xmm0, qword [esi + 0x90]
movq xmm1, qword [esi + 0x98]
mov ecx, dword [esi + 8]
movq xmm2, qword [esi + 0xa0]
movq xmm3, qword [esi + 0xa8]
movq xmm4, qword [esi + 0xb0]
mov eax, dword [esi + 0xc0]
movq xmm5, qword [esi + 0xb8]
movsd qword [esi + 0x1f8], xmm0
movq qword [esi + 0x200], xmm1
movq qword [esi + 0x208], xmm2
movq qword [esi + 0x210], xmm3
movq qword [esi + 0x218], xmm4
movq qword [ecx + 0x20], xmm4
movq qword [ecx + 0x18], xmm3
movq qword [ecx + 0x10], xmm2
movq qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
movq qword [ecx + 0x28], xmm5
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x38], 1
mov dword [ecx + 0x3c], edx
mov dword [ecx + 0x40], edi
mov byte [ecx + 0x18c], 6
jmp 0x61c827
mov edi, dword [esi + 0x1f8]
mov ebx, dword [esi + 0x200]
add edi, 4
jmp 0x61cf53
add edi, 0xc
sub ebx, 1
jb 0x61cf70
cmp dword [edi], 0
je 0x61cf50
push dword [edi - 4]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x61cf50
cmp dword [esi + 0x1fc], 0
je 0x61cf8d
push dword [esi + 0x1f8]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esi + 0x208], 0
mov edi, dword [esi + 0xc]
mov ebx, dword [ebp + 8]
je 0x61cfb0
push dword [esi + 0x204]
push 0
push dword [0x919820]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
xorps xmm0, xmm0
xor ecx, ecx
shl eax, 4
movaps xmmword [esi + 0x180], xmm0
movaps xmmword [esi + 0x170], xmm0
movaps xmmword [esi + 0x160], xmm0
movaps xmmword [esi + 0x150], xmm0
movaps xmmword [esi + 0x140], xmm0
movaps xmmword [esi + 0x130], xmm0
movaps xmmword [esi + 0x120], xmm0
movaps xmmword [esi + 0x110], xmm0
movaps xmmword [esi + 0x100], xmm0
movaps xmmword [esi + 0xf0], xmm0
movaps xmmword [esi + 0xe0], xmm0
movaps xmmword [esi + 0xd0], xmm0
movaps xmmword [esi + 0xc0], xmm0
movaps xmmword [esi + 0xb0], xmm0
movaps xmmword [esi + 0xa0], xmm0
movaps xmmword [esi + 0x90], xmm0
nop word [eax + eax]
cmp dword [edi + ecx + 8], 1
jne 0x61d09c
mov edx, dword [edi + ecx]
add ecx, 0x10
cmp eax, ecx
movzx edx, byte [edx]
mov byte [esi + edx + 0x90], 1
lea edx, [esi + 0x1f8]
jne 0x61d030
movzx ebx, byte [esi + 0x90]
lea eax, [esi + 0x91]
push 0xff
push eax
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp bl, 2
je 0x61d0a6
mov edi, dword [esi + 8]
mov byte [edi], bl
lea eax, [edi + 1]
push 0xff
lea ecx, [esi + 0x1f8]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [edi + 0x18c], 8
jmp 0x61c827
mov dword [esi + 0x8e8], 0xffffffff
mov dword [esi + 0x8e8], 0xffffffff
lea ecx, [esi + 0x90]
mov edx, edi
push dword [ebp + 8]
call fcn.00615bb0
add esp, 4
cmp byte [esi + 0x99], 3
jne 0x61d0db
mov eax, dword [esi + 8]
mov byte [eax + 0x18c], 0xa
jmp 0x61c827
mov eax, dword [esi + 0x98]
mov ecx, dword [esi + 8]
movsd xmm0, qword [esi + 0x90]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
mov byte [ecx + 0x18c], 9
jmp 0x61c827
lea eax, [esi + 0x628]
push 0x158
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm0, qword [esi + 0x30]
movsd xmm1, qword [esi + 0x38]
movzx eax, word [esi + 0x18]
mov edi, dword [esi + 8]
movsd qword [esi + 0x60], xmm0
movsd xmm0, qword [esi + 0x40]
movsd qword [esi + 0x68], xmm1
mov word [esi + 0x14], ax
movzx eax, byte [esi + 0x1a]
movsd qword [esi + 0x70], xmm0
movsd xmm0, qword [esi + 0x48]
mov byte [esi + 0x16], al
mov eax, dword [esi + 0x20]
movsd qword [esi + 0x78], xmm0
movsd xmm0, qword [esi + 0x50]
movsd xmm2, qword [esi + 0x78]
movsd qword [esi + 0x80], xmm0
movsd xmm0, qword [esi + 0x58]
movsd xmm1, qword [esi + 0x80]
movsd qword [edi + 0x18], xmm2
movq xmm2, qword [esi + 0x60]
movsd qword [esi + 0x88], xmm0
movsd qword [edi + 0x20], xmm1
movsd xmm1, qword [esi + 0x70]
movsd xmm0, qword [esi + 0x88]
movq qword [edi], xmm2
movsd qword [edi + 0x10], xmm1
movq xmm1, qword [esi + 0x68]
movsd qword [edi + 0x28], xmm0
movq qword [edi + 8], xmm1
mov dword [edi + 0x30], eax
lea eax, [edi + 0x34]
push 0x158
lea ecx, [esi + 0x628]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, word [esi + 0x14]
movzx ecx, byte [esi + 0x16]
mov byte [edi + 0x18c], bl
mov word [edi + 0x18d], ax
mov byte [edi + 0x18f], cl
jmp 0x61c827
mov ecx, 1
mov edx, edi
call fcn.00709d20
ud2
call fcn.00425040
ud2