Function at 0x405783
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x368
movaps xmmword [rsp + 0x350], xmm15
movaps xmmword [rsp + 0x340], xmm14
movaps xmmword [rsp + 0x330], xmm13
movaps xmmword [rsp + 0x320], xmm12
movaps xmmword [rsp + 0x310], xmm11
movaps xmmword [rsp + 0x300], xmm10
movaps xmmword [rsp + 0x2f0], xmm9
movaps xmmword [rsp + 0x2e0], xmm8
movaps xmmword [rsp + 0x2d0], xmm7
movaps xmmword [rsp + 0x2c0], xmm6
mov r13, qword [rdx]
mov r8, qword [rdx + 8]
mov r9, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
mov rdx, rax
shr rdx, 3
mov qword [rsp + 0xe8], rdx
movabs rdx, 0xffffffffffffff8
and rdx, rax
and eax, 7
mov qword [rsp + 0xc8], rax
shl rdx, 4
mov qword [rsp + 0xd8], r8
lea rax, [r8 + rdx]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd0], r9
add rdx, r9
mov qword [rsp + 0xc0], rdx
mov eax, pe_nt_image_headers64
lea rdx, [rsp + 0x30]
lea rbx, [rdx + rax]
movdqa xmm11, xmmword [rcx + 0x1d0]
movdqa xmm12, xmmword [rcx + 0x1c0]
movdqa xmm13, xmmword [rcx + 0x1b0]
movdqa xmm14, xmmword [rcx + 0x1a0]
movdqa xmm6, xmmword [rcx + 0x190]
movdqa xmm15, xmmword [rcx + 0x180]
movdqa xmm7, xmmword [rcx + 0x170]
movdqa xmm8, xmmword [rcx + 0x160]
movaps xmm0, xmmword [rcx + 0x150]
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmm0, xmmword [rcx + 0x140]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmm0, xmmword [rcx + 0x130]
movaps xmmword [rsp + 0x190], xmm0
movaps xmm0, xmmword [rcx + 0xf0]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmm0, xmmword [rcx + 0x100]
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmm9, xmmword [rcx + 0x110]
movdqa xmm10, xmmword [rcx + 0x120]
xor eax, eax
mov r14d, 8
lea r15, [rsp + 0x1c8]
lea r12, [rsp + 0xf0]
lea rbp, [rsp + 0x228]
movdqa xmmword [rsp + 0x210], xmm6
movdqa xmmword [rsp + 0x200], xmm8
cmp qword [rsp + 0xe8], rax
je 0x405ed2
mov qword [rsp + 0xb8], rax
mov rcx, rax
shl rcx, 7
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rcx
lea rsi, [rax + rcx]
and qword [rsp + 0xb0], 0
mov eax, pe_nt_image_headers64
lea rdi, [rsi + rax]
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbx
and qword [rsp + 0x110], 0
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], r14
mov rcx, r15
mov rdx, r12
call fcn.004015bc
mov rax, qword [rsp + 0x1d8]
test rax, rax
je 0x4059e2
movdqu xmm0, xmmword [rsp + 0x1c8]
movdqu xmmword [rax], xmm0
inc qword [rsp + 0xb0]
jmp 0x4059b3
mov rcx, qword [rsp + 0xb0]
cmp rcx, 7
jbe 0x40603f
mov r14, rbx
mov rax, qword [rsp + 0x28]
add rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
inc qword [rsp + 0xb8]
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x240]
lea rbx, [rsp + 0x30]
mov rdx, rbx
call sub.ntdll.dll_memcpy
and qword [rsp + 0xb0], 0
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0x1d8], rbx
mov rbx, r14
mov qword [rsp + 0x1e0], r14
and qword [rsp + 0x1e8], 0
mov r14d, 8
mov qword [rsp + 0x1f0], r14
mov qword [rsp + 0x1f8], r14
mov rcx, rbp
mov rdx, r15
call fcn.004015bc
mov rax, qword [rsp + 0x238]
test rax, rax
je 0x405aa6
movdqu xmm0, xmmword [rsp + 0x228]
movdqu xmmword [rax], xmm0
inc qword [rsp + 0xb0]
jmp 0x405a77
mov rcx, qword [rsp + 0xb0]
cmp rcx, 7
jbe 0x40603f
mov ecx, 0x10
mov rdi, r12
lea rsi, [rsp + 0x30]
rep movsq qword [rdi], qword [rsi]
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmm11
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x100]
pxor xmm0, xmm11
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [rsp + 0x110]
pxor xmm0, xmm11
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x120]
pxor xmm0, xmm11
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [rsp + 0x130]
pxor xmm0, xmm11
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [rsp + 0x140]
pxor xmm0, xmm11
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmm0, xmmword [rsp + 0x150]
pxor xmm0, xmm11
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmm0, xmmword [rsp + 0x160]
pxor xmm0, xmm11
movdqa xmmword [rsp + 0xa0], xmm0
xor eax, eax
movdqa xmm1, xmmword [rsp + 0x1b0]
movdqa xmm2, xmmword [rsp + 0x170]
cmp rax, 0x80
je 0x405ba5
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm12
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405b85
xor eax, eax
cmp rax, 0x80
je 0x405bc7
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm13
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405ba7
xor eax, eax
cmp rax, 0x80
je 0x405be9
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm14
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405bc9
xor eax, eax
cmp rax, 0x80
je 0x405c0a
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm6
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405beb
xor eax, eax
cmp rax, 0x80
je 0x405c2c
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm15
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405c0c
xor eax, eax
cmp rax, 0x80
je 0x405c4d
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm7
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405c2e
xor eax, eax
cmp rax, 0x80
je 0x405c6f
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm8
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405c4f
xor eax, eax
cmp rax, 0x80
je 0x405c90
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm1
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405c71
xor eax, eax
movdqa xmm1, xmmword [rsp + 0x1a0]
cmp rax, 0x80
je 0x405cba
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm1
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405c9b
xor eax, eax
movdqa xmm1, xmmword [rsp + 0x190]
cmp rax, 0x80
je 0x405ce4
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm1
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405cc5
xor eax, eax
movdqa xmm1, xmmword [rsp + 0x180]
cmp rax, 0x80
je 0x405d0f
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm10
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405cef
xor eax, eax
cmp rax, 0x80
je 0x405d31
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm9
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405d11
xor eax, eax
cmp rax, 0x80
je 0x405d52
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm2
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405d33
xor eax, eax
cmp rax, 0x80
je 0x405d73
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdeclast xmm0, xmm1
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x405d54
movdqa xmm0, xmmword [rsp + 0x30]
movdqa xmm1, xmmword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x50]
movaps xmm3, xmmword [rsp + 0x60]
movaps xmm4, xmmword [rsp + 0x70]
movaps xmm5, xmmword [rsp + 0x80]
movdqa xmm8, xmm7
movdqa xmm7, xmm15
movdqa xmm15, xmm13
movdqa xmm13, xmm11
movaps xmm11, xmmword [rsp + 0x90]
movdqa xmm6, xmm14
movdqa xmm14, xmm12
movaps xmm12, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0xf0], xmm0
movdqa xmmword [rsp + 0x100], xmm1
movdqa xmmword [rsp + 0x110], xmm2
movaps xmmword [rsp + 0x120], xmm3
movaps xmmword [rsp + 0x130], xmm4
movaps xmmword [rsp + 0x140], xmm5
movaps xmmword [rsp + 0x150], xmm11
movdqa xmm11, xmm13
movdqa xmm13, xmm15
movdqa xmm15, xmm7
movdqa xmm7, xmm8
movdqa xmm8, xmmword [rsp + 0x200]
movaps xmmword [rsp + 0x160], xmm12
movdqa xmm12, xmm14
movdqa xmm14, xmm6
movdqa xmm6, xmmword [rsp + 0x210]
xor eax, eax
cmp rax, 0x10
je 0x405e56
mov cl, byte [r13 + rax]
xor byte [rsp + rax + 0xf0], cl
inc rax
jmp 0x405e3f
mov eax, 1
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0x100]
cmp rax, 8
je 0x405e94
xor r8d, r8d
cmp r8, 0x10
je 0x405e87
mov r9b, byte [rcx + r8]
xor byte [rdx + r8], r9b
inc r8
jmp 0x405e74
inc rax
add rdx, 0x10
add rcx, 0x10
jmp 0x405e6b
mov r8d, pe_nt_image_headers64
mov rcx, qword [rsp + 0x28]
mov rdx, r12
call sub.ntdll.dll_memcpy
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x2b0]
call fcn.00403131
movdqu xmm0, xmmword [rsp + 0x30]
movdqu xmmword [r13], xmm0
mov rax, qword [rsp + 0xb8]
jmp 0x405935
xor r14d, r14d
lea rsi, [rsp + 0xf0]
lea rdi, [rsp + 0x30]
mov r12, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
cmp r12, r14
je 0x405fd3
mov r15, r14
shl r15, 4
mov rax, qword [rsp + 0xe0]
lea rbx, [rax + r15]
mov rcx, rsi
mov rdx, rbx
call fcn.00403131
mov rcx, rdi
mov rdx, rbx
call fcn.00403131
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmm11
aesdec xmm0, xmm12
aesdec xmm0, xmm13
aesdec xmm0, xmm14
aesdec xmm0, xmm6
aesdec xmm0, xmm15
aesdec xmm0, xmm7
aesdec xmm0, xmm8
aesdec xmm0, xmmword [rsp + 0x1b0]
aesdec xmm0, xmmword [rsp + 0x1a0]
aesdec xmm0, xmmword [rsp + 0x190]
aesdec xmm0, xmm10
aesdec xmm0, xmm9
aesdec xmm0, xmmword [rsp + 0x170]
aesdeclast xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0x30], xmm0
xor eax, eax
cmp rax, 0x10
je 0x405fb1
mov cl, byte [r13 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
jmp 0x405f9d
inc r14
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp + r15], xmm0
movdqu xmm0, xmmword [rsp + 0xf0]
movdqu xmmword [r13], xmm0
jmp 0x405ef2
movaps xmm6, xmmword [rsp + 0x2c0]
movaps xmm7, xmmword [rsp + 0x2d0]
movaps xmm8, xmmword [rsp + 0x2e0]
movaps xmm9, xmmword [rsp + 0x2f0]
movaps xmm10, xmmword [rsp + 0x300]
movaps xmm11, xmmword [rsp + 0x310]
movaps xmm12, xmmword [rsp + 0x320]
movaps xmm13, xmmword [rsp + 0x330]
movaps xmm14, xmmword [rsp + 0x340]
movaps xmm15, xmmword [rsp + 0x350]
add rsp, 0x368
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 8
call fcn.0047cd30
ud2