Function at 0x10176900
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x101aaa01
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x2cc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x2e4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x310]
movzx eax, byte [ebp + 0x127]
mov esi, dword [esp + 0x304]
mov edi, dword [esp + 0x30c]
mov ebx, dword [esp + 0x2fc]
push eax
push str.gcm_process
mov dword [esp + 0x3c], ecx
push ebp
lea ecx, [esp + 0x60]
mov dword [esp + 0x30], esi
mov dword [esp + 0x58], edi
call fcn.10061660
cmp dword [esp + 0x308], 0
mov dword [esp + 0x2ec], 0
je 0x101769e2
test esi, esi
jne 0x101769e2
mov edx, dword [ebp]
push str.NULL_input.
mov eax, dword [edx + 0x14]
mov ecx, ebp
call eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x2ec], 0xffffffff
call fcn.100616a0
xor al, al
mov ecx, dword [esp + 0x2e4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2cc]
xor ecx, esp
call fcn.1018f87e
add esp, 0x2dc
ret 0x20
mov ecx, edi
call fcn.100f6330
mov ecx, dword [esp + 0x308]
mov esi, eax
lea eax, [esi + ecx]
mov dword [esp + 0x50], eax
add eax, 0x20
push eax
mov ecx, edi
call fcn.1001cc40
test al, al
jne 0x10176a12
mov edx, dword [ebp]
push str.Unable_to_allocate_GCM_output_buffer.
jmp 0x1017699b
cmp byte [esp + 0x2f4], 0
push esi
je 0x10176a36
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x34], edi
call fcn.10018050
mov ebp, eax
mov dword [esp + 0x24], ebp
jmp 0x10176a4d
mov ecx, edi
call fcn.10018050
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ecx
mov ebp, ecx
mov edi, eax
mov eax, dword [ebx + 0x538]
cmp eax, 0x10
mov dl, byte [0x1026e91c]
mov byte [esp + 0x23], dl
jg 0x101769a2
xor esi, esi
cmp eax, esi
jl 0x101769a2
cmp dword [ebx + 0x534], 1
jne 0x10176b20
cmp eax, esi
je 0x10176ada
push esi
cdq
push 8
push edx
push eax
call fcn.1018fc20
add dword [ebx + 0x540], eax
lea ecx, [esp + 0x1ac]
adc dword [ebx + 0x544], edx
call fcn.1002a630
lea eax, [esp + 0x1ac]
push eax
lea esi, [ebx + 0x4f0]
mov eax, ebx
mov byte [esp + 0x2f0], 1
call fcn.10173900
add esp, 4
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x2ec], 0
call fcn.1002a650
xor esi, esi
mov ecx, 0xfffffb00
lea eax, [ebx + 0x50f]
sub ecx, ebx
add byte [eax], 1
jne 0x10176af7
sub eax, 1
lea edx, [ecx + eax]
cmp edx, 0xc
jge 0x10176ae7
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
lea edx, [ebx + 0x520]
push edx
lea edx, [ebx + 0x500]
push edx
call eax
mov dword [ebx + 0x538], esi
mov dword [ebx + 0x534], 2
cmp dword [ebx + 0x534], 2
jne 0x101769a2
lea ecx, [esp + 0x78]
call fcn.1002a630
cmp dword [ebx + 0x538], esi
mov byte [esp + 0x2ec], 2
mov dword [esp + 0x18], esi
jne 0x10177362
cmp byte [esp + 0x2f4], 0
mov eax, dword [esp + 0x308]
mov dword [esp + 0x18], esi
je 0x10176f73
cmp byte [esp + 0x23], 0
je 0x10176e89
and eax, 0xfffffff0
jbe 0x10177362
add eax, 0xffffffff
mov ecx, ebp
sub ecx, edi
mov dword [esp + 0x44], ecx
shr eax, 4
add eax, 1
mov ecx, 0xfffffb00
sub ecx, ebx
mov dword [esp + 0x1c], eax
shl eax, 4
mov dword [esp + 0x2c], ecx
lea esi, [edi + 6]
lea ecx, [ebp + 5]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
lea ecx, [ebx + 0x526]
mov dword [esp + 0x28], esi
mov dword [esp + 0x38], 2
jmp 0x10176bc4
mov esi, dword [esp + 0x28]
movzx eax, byte [esi + 1]
cdq
shld edx, eax, 8
shl eax, 8
mov edi, eax
movzx eax, byte [esi]
mov ebp, edx
cdq
or edi, eax
or ebp, edx
shld ebp, edi, 8
movzx eax, byte [esi - 1]
shl edi, 8
cdq
or edi, eax
or ebp, edx
shld ebp, edi, 8
movzx eax, byte [esi - 2]
shl edi, 8
cdq
or edi, eax
movzx eax, byte [esi - 3]
or ebp, edx
shld ebp, edi, 8
shl edi, 8
cdq
or edi, eax
movzx eax, byte [esi - 4]
or ebp, edx
shld ebp, edi, 8
shl edi, 8
cdq
or edi, eax
movzx eax, byte [esi - 5]
or ebp, edx
shld ebp, edi, 8
cdq
shl edi, 8
or edi, eax
movzx eax, byte [esi - 6]
or ebp, edx
shld ebp, edi, 8
cdq
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 1]
or ebp, edx
cdq
shld edx, eax, 8
mov dword [esp + 0x3c], edi
shl eax, 8
mov edi, eax
movzx eax, byte [ecx]
mov dword [esp + 0x40], ebp
mov ebp, edx
cdq
or edi, eax
movzx eax, byte [ecx - 1]
or ebp, edx
shld ebp, edi, 8
shl edi, 8
cdq
or edi, eax
movzx eax, byte [ecx - 2]
or ebp, edx
shld ebp, edi, 8
shl edi, 8
cdq
or edi, eax
movzx eax, byte [ecx - 3]
or ebp, edx
shld ebp, edi, 8
cdq
shl edi, 8
or edi, eax
movzx eax, byte [ecx - 4]
or ebp, edx
shld ebp, edi, 8
cdq
shl edi, 8
or edi, eax
movzx eax, byte [ecx - 5]
or ebp, edx
shld ebp, edi, 8
shl edi, 8
cdq
or edi, eax
movzx eax, byte [ecx - 6]
or ebp, edx
shld ebp, edi, 8
shl edi, 8
cdq
or ebp, edx
xor ebp, dword [esp + 0x40]
mov dword [esp + 0x70], edi
mov edi, eax
mov eax, dword [esp + 0x70]
or eax, edi
xor eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x14]
mov edx, ebp
shr edx, 0x18
mov byte [edi + 2], dl
mov edi, dword [esp + 0x44]
mov edx, ebp
shr edx, 0x10
mov byte [edi + esi], dl
mov esi, dword [esp + 0x14]
mov edx, ebp
shr edx, 8
mov byte [esi], dl
mov edx, ebp
mov byte [esi - 1], dl
mov edx, eax
mov byte [esi - 5], al
mov edi, ebp
shrd edx, edi, 0x18
mov byte [esi - 2], dl
shr edi, 0x18
mov edx, eax
mov edi, ebp
shrd edx, edi, 0x10
mov byte [esi - 3], dl
mov edx, eax
shr edi, 0x10
mov dword [esp + 0x60], eax
mov edi, ebp
shrd edx, edi, 8
mov byte [esi - 4], dl
movzx eax, byte [ecx - 0x2f]
cdq
shld edx, eax, 8
shl eax, 8
mov esi, eax
movzx eax, byte [ecx - 0x30]
shr edi, 8
mov edi, edx
cdq
or esi, eax
movzx eax, byte [ecx - 0x31]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx - 0x32]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or esi, eax
movzx eax, byte [ecx - 0x33]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or esi, eax
movzx eax, byte [ecx - 0x34]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or edi, edx
or esi, eax
movzx eax, byte [ecx - 0x35]
shld edi, esi, 8
shl esi, 8
cdq
or edi, edx
or esi, eax
movzx eax, byte [ecx - 0x36]
shld edi, esi, 8
cdq
or edi, edx
xor edi, ebp
shl esi, 8
mov edx, edi
shr edx, 0x18
mov byte [ecx - 0x2f], dl
mov dword [esp + 0x68], esi
mov edx, edi
shr edx, 0x10
mov byte [ecx - 0x30], dl
mov esi, eax
mov eax, dword [esp + 0x68]
or eax, esi
xor eax, dword [esp + 0x60]
mov edx, edi
shr edx, 8
mov byte [ecx - 0x31], dl
mov edx, edi
mov byte [ecx - 0x32], dl
mov edx, eax
mov esi, edi
shrd edx, esi, 0x18
mov byte [ecx - 0x33], dl
shr esi, 0x18
mov edx, eax
mov esi, edi
shrd edx, esi, 0x10
mov byte [ecx - 0x34], dl
mov edx, eax
shrd edx, edi, 8
mov byte [ecx - 0x36], al
mov eax, 8
add dword [esp + 0x28], eax
add dword [esp + 0x14], eax
mov byte [ecx - 0x35], dl
shr esi, 0x10
shr edi, 8
add ecx, eax
sub dword [esp + 0x38], 1
jne 0x10176bc0
add dword [ebx + 0x548], 0x80
lea eax, [esp + 0x78]
push eax
adc dword [ebx + 0x54c], 0
lea esi, [ebx + 0x4f0]
mov eax, ebx
call fcn.10173900
add esp, 4
lea eax, [ebx + 0x50f]
mov edi, edi
add byte [eax], 1
jne 0x10176e54
mov ecx, dword [esp + 0x2c]
sub eax, 1
lea edx, [eax + ecx]
cmp edx, 0xc
jge 0x10176e40
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
lea eax, [ebx + 0x520]
push eax
lea eax, [ebx + 0x500]
push eax
mov eax, dword [edx + 0x10]
call eax
sub dword [esp + 0x1c], 1
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x28]
jne 0x10176ba8
mov ebp, dword [esp + 0x24]
jmp 0x1017735e
and eax, 0xfffffff0
mov dword [esp + 0x24], eax
jbe 0x10177362
mov esi, edi
sub esi, ebp
mov eax, 0xfffffb00
sub eax, ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], eax
jmp 0x10176eb4
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
lea eax, [edx + ebp]
lea ecx, [ebx + 0x4f0]
mov edx, 2
jmp 0x10176ed4
mov esi, dword [esp + 0x28]
mov edi, dword [esi + eax]
mov esi, dword [esi + eax + 4]
xor esi, dword [ecx + 0x34]
xor edi, dword [ecx + 0x30]
mov dword [eax + 4], esi
mov dword [eax], edi
mov esi, edi
xor dword [ecx], esi
mov esi, dword [eax + 4]
xor dword [ecx + 4], esi
add eax, 8
add ecx, 8
sub edx, 1
jne 0x10176ed0
add dword [ebx + 0x548], 0x80
lea eax, [esp + 0x78]
push eax
adc dword [ebx + 0x54c], 0
lea esi, [ebx + 0x4f0]
mov eax, ebx
call fcn.10173900
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [ebx + 0x50f]
jmp 0x10176f30
add byte [eax], 1
jne 0x10176f40
sub eax, 1
lea edx, [eax + ecx]
cmp edx, 0xc
jge 0x10176f30
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
lea eax, [ebx + 0x520]
push eax
lea eax, [ebx + 0x500]
push eax
mov eax, dword [edx + 0x10]
call eax
mov eax, dword [esp + 0x18]
add eax, 0x10
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
jb 0x10176eb0
jmp 0x1017735e
cmp byte [esp + 0x23], 0
je 0x10177295
and eax, 0xfffffff0
jbe 0x10177362
add eax, 0xffffffff
mov ecx, edi
sub ecx, ebp
mov dword [esp + 0x28], ecx
shr eax, 4
add eax, 1
mov ecx, 0xfffffb00
sub ecx, ebx
add ebp, 6
mov dword [esp + 0x38], eax
shl eax, 4
mov dword [esp + 0x2c], ecx
lea ecx, [edi + 5]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
lea ecx, [ebx + 0x4f6]
mov dword [esp + 0x1c], 2
movzx eax, byte [ebp + 1]
cdq
shld edx, eax, 8
shl eax, 8
mov esi, eax
movzx eax, byte [ebp]
mov edi, edx
cdq
or esi, eax
or edi, edx
shld edi, esi, 8
movzx eax, byte [ebp - 1]
shl esi, 8
cdq
or esi, eax
or edi, edx
shld edi, esi, 8
movzx eax, byte [ebp - 2]
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ebp - 3]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ebp - 4]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ebp - 5]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 6]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 1]
or edi, edx
cdq
shld edx, eax, 8
mov dword [esp + 0x44], esi
shl eax, 8
mov esi, eax
movzx eax, byte [ecx]
mov dword [esp + 0x48], edi
mov edi, edx
cdq
or esi, eax
movzx eax, byte [ecx - 1]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx - 2]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx - 3]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or esi, eax
movzx eax, byte [ecx - 4]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or esi, eax
or edi, edx
shld edi, esi, 8
movzx eax, byte [ecx - 5]
shl esi, 8
cdq
or esi, eax
or edi, edx
movzx eax, byte [ecx - 6]
shld edi, esi, 8
cdq
or edi, edx
xor edi, dword [esp + 0x48]
shl esi, 8
mov dword [esp + 0x60], esi
mov edx, edi
shr edx, 0x18
mov byte [ecx + 1], dl
mov esi, eax
mov eax, dword [esp + 0x60]
or eax, esi
xor eax, dword [esp + 0x44]
mov edx, edi
shr edx, 0x10
mov byte [ecx], dl
mov edx, edi
shr edx, 8
mov byte [ecx - 1], dl
mov edx, edi
mov byte [ecx - 2], dl
mov edx, eax
mov esi, edi
shrd edx, esi, 0x18
shr esi, 0x18
mov esi, edi
mov byte [ecx - 3], dl
mov edx, eax
shrd edx, esi, 0x10
mov byte [ecx - 6], al
mov byte [ecx - 4], dl
mov edx, eax
movzx eax, byte [ecx + 0x31]
shrd edx, edi, 8
mov byte [ecx - 5], dl
cdq
shld edx, eax, 8
shr esi, 0x10
shl eax, 8
mov esi, eax
movzx eax, byte [ecx + 0x30]
shr edi, 8
mov edi, edx
cdq
or esi, eax
movzx eax, byte [ecx + 0x2f]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x2e]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x2d]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x2c]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x2b]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x2a]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
mov eax, dword [esp + 0x48]
or edi, edx
mov edx, dword [esp + 0x44]
xor edx, esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x3c], edx
xor eax, edi
mov edx, eax
shr edx, 0x18
mov byte [esi + 2], dl
mov esi, dword [esp + 0x28]
mov edx, eax
shr edx, 0x10
mov byte [esi + ebp], dl
mov esi, dword [esp + 0x14]
mov edx, eax
shr edx, 8
mov byte [esi], dl
mov edx, eax
mov byte [esi - 1], dl
mov edx, dword [esp + 0x3c]
mov esi, eax
shrd edx, esi, 0x18
shr esi, 0x18
mov esi, dword [esp + 0x14]
mov byte [esi - 2], dl
mov edx, dword [esp + 0x3c]
mov esi, eax
shrd edx, esi, 0x10
shr esi, 0x10
mov esi, dword [esp + 0x14]
mov byte [esi - 3], dl
mov edx, dword [esp + 0x3c]
shrd edx, eax, 8
shr eax, 8
mov al, byte [esp + 0x3c]
mov byte [esi - 4], dl
mov byte [esi - 5], al
add esi, 8
add ebp, 8
add ecx, 8
sub dword [esp + 0x1c], 1
mov dword [esp + 0x14], esi
jne 0x10176fc6
add dword [ebx + 0x548], 0x80
lea ecx, [esp + 0x78]
push ecx
adc dword [ebx + 0x54c], 0
lea esi, [ebx + 0x4f0]
mov eax, ebx
call fcn.10173900
add esp, 4
lea eax, [ebx + 0x50f]
lea ebx, [ebx]
add byte [eax], 1
jne 0x10177264
mov edx, dword [esp + 0x2c]
sub eax, 1
lea ecx, [eax + edx]
cmp ecx, 0xc
jge 0x10177250
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
lea eax, [ebx + 0x520]
push eax
lea eax, [ebx + 0x500]
push eax
mov eax, dword [edx + 0x10]
call eax
sub dword [esp + 0x38], 1
mov ecx, dword [esp + 0x14]
jne 0x10176fb4
mov ebp, dword [esp + 0x24]
jmp 0x1017735e
and eax, 0xfffffff0
mov dword [esp + 0x24], eax
jbe 0x10177362
mov eax, 0xfffffb00
sub edi, ebp
sub eax, ebx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x18]
add ecx, ebp
lea eax, [ebx + 0x4f0]
mov dword [esp + 0x1c], 2
mov edx, dword [ecx]
xor dword [eax], edx
mov edx, dword [ecx + 4]
xor dword [eax + 4], edx
mov edx, dword [eax + 0x30]
mov esi, dword [eax + 0x34]
xor edx, dword [ecx]
xor esi, dword [ecx + 4]
mov dword [ecx + edi], edx
mov dword [ecx + edi + 4], esi
add eax, 8
add ecx, 8
sub dword [esp + 0x1c], 1
jne 0x101772c3
add dword [ebx + 0x548], 0x80
lea eax, [esp + 0x78]
push eax
adc dword [ebx + 0x54c], 0
lea esi, [ebx + 0x4f0]
mov eax, ebx
call fcn.10173900
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [ebx + 0x50f]
lea esp, [esp]
add byte [eax], 1
jne 0x10177330
sub eax, 1
lea edx, [eax + ecx]
cmp edx, 0xc
jge 0x10177320
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
lea eax, [ebx + 0x520]
push eax
lea eax, [ebx + 0x500]
push eax
mov eax, dword [edx + 0x10]
call eax
mov eax, dword [esp + 0x18]
add eax, 0x10
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
jb 0x101772af
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x308]
jae 0x10177457
mov eax, dword [esp + 0x308]
sub edi, ebp
lea esi, [ecx + ebp]
sub eax, ecx
mov dword [esp + 0x1c], esi
mov ebp, eax
cmp dword [ebx + 0x538], 0x10
jne 0x101773fa
add dword [ebx + 0x548], 0x80
lea ecx, [esp + 0x78]
push ecx
adc dword [ebx + 0x54c], 0
lea esi, [ebx + 0x4f0]
mov eax, ebx
call fcn.10173900
mov ecx, 0xfffffb00
add esp, 4
lea eax, [ebx + 0x50f]
sub ecx, ebx
add byte [eax], 1
jne 0x101773d3
sub eax, 1
lea edx, [eax + ecx]
cmp edx, 0xc
jge 0x101773c3
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
lea edx, [ebx + 0x520]
push edx
lea edx, [ebx + 0x500]
push edx
call eax
mov esi, dword [esp + 0x1c]
mov dword [ebx + 0x538], 0
cmp byte [esp + 0x2f4], 0
je 0x10177418
mov ecx, dword [ebx + 0x538]
mov al, byte [ebx + ecx + 0x520]
xor al, byte [edi + esi]
mov byte [esi], al
jmp 0x1017742c
mov edx, dword [ebx + 0x538]
mov al, byte [esi]
mov cl, byte [ebx + edx + 0x520]
xor cl, al
mov byte [edi + esi], cl
mov edx, dword [ebx + 0x538]
xor byte [ebx + edx + 0x4f0], al
add dword [ebx + 0x538], 1
lea ecx, [ebx + edx + 0x4f0]
add esi, 1
sub ebp, 1
mov dword [esp + 0x1c], esi
jne 0x10177387
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
push eax
call fcn.10018270
lea ecx, [esp + 0x78]
mov byte [esp + 0x2ec], 0
call fcn.1002a650
lea ecx, [esp + 0x54]
mov dword [esp + 0x2ec], 0xffffffff
call fcn.100616a0
mov al, 1
jmp 0x101769b8