Function at 0x4d8950
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x110], rcx
mov r10d, edx
mov qword [rsp + 0x128], r9
mov r9, qword [rcx + 0x20]
mov ecx, r8d
mov r8d, 0x20
sar eax, cl
mov edx, eax
lea rcx, [r9 + 1]
neg edx
sub r8, rcx
and edx, r10d
or edx, eax
mov rax, qword [rsp + 0x110]
mov byte [rax + r9], dl
mov r9, rcx
xor edx, edx
add r9, rax
mov rcx, r9
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x4c]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x5c]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x64]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x110]
mov esi, dword [rax + 0x68]
mov eax, dword [rax + 0x6c]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x74]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x110]
mov r11d, dword [rax + 0x78]
mov eax, dword [rax + 0x7c]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0xbc], 2
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x110]
mov ecx, dword [rax]
mov edx, ecx
mov r9d, edx
bswap r9d
mov eax, dword [rax + 4]
mov r14d, eax
bswap r14d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 8]
mov r12d, eax
bswap r12d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0xc]
mov r10d, eax
bswap r10d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x10]
mov r8d, eax
bswap r8d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x14]
mov r15d, eax
bswap r15d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x18]
mov r13d, eax
bswap r13d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x1c]
mov ebx, eax
bswap ebx
mov esi, dword [rsp + 0x24]
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x74]
xor eax, dword [rsp + 0x50]
xor ecx, dword [rsp + 0x78]
xor esi, eax
mov edi, dword [rsp + 0x70]
xor edi, dword [rsp + 0x68]
xor edi, dword [rsp + 0x34]
mov dword [rsp + 0x3c], ecx
mov eax, dword [rsp + 0x3c]
mov ebp, dword [rsp + 0x44]
mov dword [rsp + 0xb4], esi
mov esi, edi
mov ecx, dword [rsp + 0x88]
xor ecx, dword [rsp + 0x80]
xor eax, r11d
xor ebp, dword [rsp + 0x48]
mov edx, dword [rsp + 0x5c]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rsp + 0x8c]
xor edx, dword [rsp + 0x60]
mov dword [rsp + 0xa4], eax
xor ecx, dword [rsp + 0x90]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xa8], ecx
xor eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0xa0]
xor ecx, dword [rsp + 0x98]
mov dword [rsp + 0x3c], eax
xor ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0xa8]
xor esi, ecx
xor eax, dword [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0xa8], esi
xor edx, dword [rsp + 0x2c]
xor edx, ecx
mov edi, dword [rsp + 0x58]
xor ebp, dword [rsp + 0x38]
mov dword [rsp + 0xb8], edx
mov edx, dword [rsp + 0x5c]
xor ebp, ecx
xor edi, r14d
mov dword [rsp + 0xac], ebp
mov ebp, dword [rsp + 0x44]
xor edx, r12d
mov dword [rsp + 0x44], edi
mov edi, dword [rsp + 0x70]
mov dword [rsp + 0x58], edx
mov edx, dword [rsp + 0x88]
xor ebp, r9d
xor r9d, ebx
xor edi, r10d
xor r10d, ebx
mov dword [rsp + 0xb0], ebp
mov ebp, dword [rsp + 0x8c]
xor edx, r15d
mov dword [rsp + 0x5c], edi
mov edi, dword [rsp + 0x74]
mov eax, r10d
mov dword [rsp + 0x74], edx
mov r10d, r12d
mov edx, dword [rsp + 0xa0]
xor ebp, r13d
mov r12d, dword [rsp + 0x50]
mov dword [rsp + 0x88], ebp
xor r10d, ebx
xor edi, r8d
xor edx, ebx
mov dword [rsp + 0x70], edi
mov esi, dword [rsp + 0x98]
mov dword [rsp + 0x8c], edx
mov edx, r9d
mov r9d, dword [rsp + 0x48]
xor r12d, edx
mov ebp, r12d
mov r12d, dword [rsp + 0x60]
xor r9d, ebx
mov dword [rsp + 0x48], r9d
mov r9d, dword [rsp + 0x68]
xor r12d, r14d
xor esi, r13d
xor r11d, r13d
mov dword [rsp + 0xa0], r12d
mov r12d, dword [rsp + 0x78]
xor r9d, r10d
xor r11d, r10d
mov dword [rsp + 0x68], r9d
mov r9d, dword [rsp + 0x90]
xor r12d, eax
mov edi, r12d
mov r12d, dword [rsp + 0x80]
xor edi, dword [rsp + 0xa8]
xor r9d, r15d
xor r12d, r8d
xor r12d, dword [rsp + 0xa4]
xor edx, dword [rsp + 0x2c]
xor eax, dword [rsp + 0x28]
xor r8d, dword [rsp + 0x30]
mov dword [rsp + 0x60], r12d
mov r12d, dword [rsp + 0x40]
xor r15d, dword [rsp + 0x20]
xor r8d, dword [rsp + 0x3c]
xor r15d, dword [rsp + 0x40]
xor r12d, esi
mov esi, dword [rsp + 0x38]
xor r9d, dword [rsp + 0x3c]
rol r8d, 2
mov dword [rsp + 0x50], r12d
mov r12d, dword [rsp + 0x24]
xor esi, r13d
mov dword [rsp + 0x30], r8d
mov r8d, dword [rsp + 0x44]
xor r12d, r13d
xor esi, ecx
mov r10d, dword [rsp + 0x48]
xor ebx, r12d
mov r12d, dword [rsp + 0xac]
mov dword [rsp + 0x38], esi
mov esi, dword [rsp + 0xb4]
xor r12d, ebx
mov ebx, edx
xor ebx, esi
mov dword [rsp + 0x24], r12d
mov r12d, dword [rsp + 0xa8]
mov dword [rsp + 0x2c], ebx
mov ebx, dword [rsp + 0x34]
xor r11d, r12d
xor ebx, r14d
rol r11d, 2
lea r14, [0x0061fc20]
mov edx, ebx
xor edx, r13d
mov r13d, dword [rsp + 0xb0]
mov ebx, edx
mov edx, dword [rsp + 0xb8]
xor ebx, edx
mov dword [rsp + 0x34], ebx
mov ebx, dword [rsp + 0xa4]
xor eax, ebx
rol eax, 2
rol r15d, 2
xor r13d, ecx
xor r10d, ecx
mov dword [rsp + 0x20], r15d
mov r15d, dword [rsp + 0xac]
shl r10, 0x20
rol edi, 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x58]
or r10, r13
shl rdi, 0x20
xor r8d, r15d
xor ebp, r15d
mov r15d, dword [rsp + 0xa0]
rol r9d, 1
shl rbp, 0x20
xor eax, esi
shl r9, 0x20
xor r15d, esi
mov esi, edx
or rbp, r8
mov rcx, r15
mov r15d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x50]
shl rcx, 0x20
mov r13d, dword [rsp + 0x74]
or rcx, rax
xor r15d, edx
mov eax, dword [rsp + 0x5c]
rol r8d, 1
mov rdx, r15
xor r13d, ebx
shl r8, 0x20
mov rbx, rcx
xor eax, esi
shl rdx, 0x20
mov esi, dword [rsp + 0x38]
mov rcx, rbp
or rdx, rax
mov eax, dword [rsp + 0x70]
lea r15, [0x0061fbe0]
xor eax, r12d
mov r12d, dword [rsp + 0x60]
or rdi, rax
mov eax, dword [rsp + 0x88]
xor eax, dword [rsp + 0x3c]
rol r12d, 1
or r9, rax
mov eax, dword [rsp + 0x8c]
xor eax, dword [rsp + 0x40]
shl r12, 0x20
or r12, r13
or r8, rax
nop
mov rax, r10
xor rbx, rdx
xor r8, rdi
or rax, rcx
xor rax, rdx
and rdx, r10
xor rcx, rdx
mov r13, rdx
mov rdx, r12
or rdx, r9
xor r13, rbx
not rcx
and rbx, rax
xor rdx, rdi
and rdi, r12
xor rbx, rcx
or rcx, r13
xor r9, rdi
xor rdi, r8
and r8, rdx
xor r10, rcx
not r9
xor r13, rbx
xor rax, rcx
and rbx, rcx
xor r8, r9
mov rcx, rdi
mov rbp, r10
or r9, rdi
xor rcx, r8
xor r12, r9
and r8, r9
not rax
xor rcx, r10
rol r10d, 2
xor r10d, ecx
mov rdi, rcx
rol ecx, 0xe
xor ecx, r10d
shr rdi, 0x20
rol r10d, 0xa
shr rbp, 0x20
xor r12, rax
rol ebp, 2
xor r10d, ecx
rol ecx, 1
xor ebp, edi
rol edi, 0xe
xor edi, ebp
rol ebp, 0xa
xor ebp, edi
rol edi, 1
shl rbp, 0x20
shl rdi, 0x20
or r10, rbp
or rdi, rcx
mov rbp, r12
mov ecx, eax
shr rax, 0x20
shr rbp, 0x20
rol eax, 2
rol ecx, 2
xor eax, ebp
rol ebp, 0xe
xor ecx, r12d
xor ebp, eax
rol r12d, 0xe
rol eax, 0xa
xor r12d, ecx
rol ecx, 0xa
xor eax, ebp
xor ecx, r12d
rol ebp, 1
shl rax, 0x20
or rcx, rax
shl rbp, 0x20
xor r9, rdx
mov eax, ebx
rol r12d, 1
xor r9, rbx
rol eax, 2
xor r8, r13
not r9
or r12, rbp
xor eax, r9d
mov rbp, r9
rol r9d, 0xe
mov edx, r9d
shr rbp, 0x20
xor edx, eax
rol eax, 0xa
mov r9d, eax
mov rax, rbx
shr rax, 0x20
rol eax, 2
xor eax, ebp
rol ebp, 0xe
xor ebp, eax
rol eax, 0xa
mov ebx, eax
mov eax, r9d
mov r9d, edx
xor ebx, ebp
rol ebp, 1
xor eax, edx
mov rdx, r8
shl rbp, 0x20
rol r9d, 1
shl rbx, 0x20
or r9, rbp
mov ebp, r13d
shr rdx, 0x20
rol ebp, 2
or rbx, rax
xor ebp, r8d
rol r8d, 0xe
mov eax, r8d
mov r8d, edx
xor eax, ebp
rol ebp, 0xa
shr r13, 0x20
rol r8d, 0xe
xor ebp, eax
xor r10, qword [r14]
rol r13d, 2
rol eax, 1
add r14, 8
xor rdi, qword [r15]
xor r13d, edx
add r15, 8
mov edx, r13d
xor r8d, r13d
rol edx, 0xa
xor edx, r8d
rol r8d, 1
shl r8, 0x20
shl rdx, 0x20
or r8, rax
lea rax, [0x0061fc60]
or rdx, rbp
cmp r14, rax
jne 0x4d8ef0
mov rbp, rcx
mov dword [rsp + 0x88], r12d
shr r12, 0x20
mov rcx, rbx
mov dword [rsp + 0x44], r10d
shr r10, 0x20
shr rcx, 0x20
lea rax, [0x0061fbc0]
mov dword [rsp + 0x58], ebp
shr rbp, 0x20
mov dword [rsp + 0x70], edx
shr rdx, 0x20
mov dword [rsp + 0x74], edi
shr rdi, 0x20
mov dword [rsp + 0x8c], r9d
shr r9, 0x20
mov dword [rsp + 0xa0], r8d
shr r8, 0x20
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x48], r10
mov r10d, dword [rsp + 0x20]
mov qword [rsp + 0x50], rbp
mov ebp, dword [rsp + 0x30]
mov qword [rsp + 0x68], rdx
mov edx, dword [rsp + 0x24]
mov qword [rsp + 0x78], rdi
mov edi, dword [rsp + 0x28]
mov qword [rsp + 0x90], r9
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x98], r8
mov r8d, dword [rsp + 0x2c]
mov qword [rsp + 0x60], rcx
lea rcx, [0x0061fba0]
nop word [rax + rax]
mov ebx, esi
xor r8d, r9d
xor r10d, r11d
or ebx, edx
xor ebx, r9d
and r9d, esi
xor edx, r9d
xor r9d, r8d
and r8d, ebx
not edx
xor r8d, edx
or edx, r9d
xor esi, edx
xor r9d, r8d
and r8d, edx
xor edx, ebx
mov ebx, edi
not edx
or ebx, ebp
xor ebx, r11d
and r11d, edi
xor ebp, r11d
xor r11d, r10d
and r10d, ebx
not ebp
xor r10d, ebp
or ebp, r11d
xor r11d, r10d
xor edi, ebp
and r10d, ebp
xor r11d, esi
rol esi, 2
xor esi, r11d
rol r11d, 0xe
xor r11d, esi
rol esi, 0xa
xor esi, r11d
rol r11d, 1
xor ebp, ebx
xor edi, edx
xor ebp, r8d
xor r10d, r9d
rol edx, 2
xor esi, dword [rax]
not ebp
rol r8d, 2
xor edx, edi
add rax, 4
rol r9d, 2
xor r8d, ebp
rol edi, 0xe
xor r11d, dword [rcx]
xor r9d, r10d
rol ebp, 0xe
xor edi, edx
lea rbx, [0x0061fbe0]
rol r10d, 0xe
xor ebp, r8d
rol edx, 0xa
add rcx, 4
xor r10d, r9d
rol r8d, 0xa
xor edx, edi
rol r9d, 0xa
xor r8d, ebp
rol edi, 1
xor r9d, r10d
rol ebp, 1
rol r10d, 1
cmp rax, rbx
jne 0x4d9158
mov dword [rsp + 0x38], esi
mov r14d, esi
mov eax, edx
mov ebx, r8d
mov rsi, qword [rsp + 0x110]
mov dword [rsp + 0x24], edx
xor edx, edx
mov ecx, ebp
cmp dword [rsp + 0xbc], 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], r8d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], r10d
mov qword [rsi], 0
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0
jne 0x4d9370
mov r8d, dword [rsp + 0x48]
xor r8d, r14d
xor r8d, dword [rsp + 0x44]
bswap r8d
mov rsi, qword [rsp + 0x128]
mov r15d, dword [rsp + 0x50]
mov dword [rsi], r8d
xor r15d, eax
xor r15d, dword [rsp + 0x58]
bswap r15d
mov r14d, dword [rsp + 0x60]
mov dword [rsi + 4], r15d
xor r14d, ebx
xor r14d, dword [rsp + 0x5c]
bswap r14d
mov dword [rsi + 8], r14d
mov esi, dword [rsp + 0x68]
mov r10d, dword [rsp + 0x70]
xor esi, r9d
xor r10d, esi
bswap r10d
mov rsi, qword [rsp + 0x128]
mov r9d, dword [rsp + 0x78]
mov dword [rsi + 0xc], r10d
xor r9d, r11d
xor r9d, dword [rsp + 0x74]
bswap r9d
mov ebp, dword [rsp + 0x80]
mov r13d, dword [rsp + 0x88]
mov dword [rsi + 0x10], r9d
xor ebp, edi
xor r13d, ebp
bswap r13d
mov r12d, dword [rsp + 0x90]
mov dword [rsi + 0x14], r13d
xor r12d, ecx
xor r12d, dword [rsp + 0x8c]
bswap r12d
cmp dword [rsp + 0x130], 8
mov dword [rsi + 0x18], r12d
jne 0x4d9354
mov ebx, dword [rsp + 0x98]
xor ebx, dword [rsp + 0x20]
xor ebx, dword [rsp + 0xa0]
bswap ebx
mov dword [rsi + 0x1c], ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0xbc], 1
mov rax, rsi
jmp 0x4d8b3a