Function at 0x641140
Capabilities:
Encrypt data using aes
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11d, edx
test rcx, rcx
je 0x641cec
test r8, r8
je 0x641cec
mov eax, edx
and eax, 0xffffffbf
cmp eax, 0x80
jne 0x6412f8
cmp edx, 0x80
je 0x641318
cmp edx, 0xc0
jne 0x641304
mov dword [r8 + 0xf0], 0xc
movzx r9d, byte [rcx]
movzx eax, byte [rcx + 1]
shl r9d, 0x18
shl eax, 0x10
xor r9d, eax
movzx eax, byte [rcx + 3]
xor r9d, eax
movzx eax, byte [rcx + 2]
shl eax, 8
xor r9d, eax
mov dword [r8], r9d
movzx eax, byte [rcx + 4]
movzx edx, byte [rcx + 5]
shl eax, 0x18
shl edx, 0x10
xor eax, edx
movzx edx, byte [rcx + 7]
xor eax, edx
movzx edx, byte [rcx + 6]
shl edx, 8
xor eax, edx
mov dword [r8 + 4], eax
movzx r10d, byte [rcx + 8]
movzx edx, byte [rcx + 9]
shl r10d, 0x18
shl edx, 0x10
xor r10d, edx
movzx edx, byte [rcx + 0xb]
xor r10d, edx
movzx edx, byte [rcx + 0xa]
shl edx, 8
xor r10d, edx
mov dword [r8 + 8], r10d
movzx ebx, byte [rcx + 0xc]
movzx edx, byte [rcx + 0xd]
shl ebx, 0x18
shl edx, 0x10
xor ebx, edx
movzx edx, byte [rcx + 0xf]
xor ebx, edx
movzx edx, byte [rcx + 0xe]
shl edx, 8
xor ebx, edx
mov dword [r8 + 0xc], ebx
cmp r11d, 0x80
je 0x641330
movzx edx, byte [rcx + 0x10]
movzx esi, byte [rcx + 0x11]
shl edx, 0x18
shl esi, 0x10
xor edx, esi
movzx esi, byte [rcx + 0x13]
xor edx, esi
movzx esi, byte [rcx + 0x12]
shl esi, 8
xor edx, esi
mov dword [r8 + 0x10], edx
movzx edx, byte [rcx + 0x14]
movzx esi, byte [rcx + 0x15]
shl edx, 0x18
shl esi, 0x10
xor edx, esi
movzx esi, byte [rcx + 0x17]
xor edx, esi
movzx esi, byte [rcx + 0x16]
shl esi, 8
xor edx, esi
mov dword [r8 + 0x14], edx
cmp r11d, 0xc0
je 0x6418c0
movzx edx, byte [rcx + 0x18]
movzx esi, byte [rcx + 0x19]
shl edx, 0x18
shl esi, 0x10
xor edx, esi
movzx esi, byte [rcx + 0x1b]
xor edx, esi
movzx esi, byte [rcx + 0x1a]
shl esi, 8
xor edx, esi
mov dword [r8 + 0x18], edx
movzx edx, byte [rcx + 0x1c]
movzx esi, byte [rcx + 0x1d]
shl edx, 0x18
shl esi, 0x10
xor edx, esi
movzx esi, byte [rcx + 0x1f]
movzx ecx, byte [rcx + 0x1e]
xor edx, esi
shl ecx, 8
xor edx, ecx
mov dword [r8 + 0x1c], edx
cmp r11d, 0x100
je 0x641798
xor eax, eax
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp edx, 0x100
jne 0x641cf6
mov dword [r8 + 0xf0], 0xe
jmp 0x641198
mov dword [r8 + 0xf0], 0xa
jmp 0x641198
lea rdi, [0x00961ce0]
movzx edx, bl
mov ecx, ebx
xor r9d, 0x1000000
mov edx, dword [rdi + rdx*4]
lea rbp, [0x009618e0]
shr ecx, 0x18
lea rsi, [0x009614e0]
lea r11, [0x009610e0]
and edx, 0xff00
xor edx, r9d
movzx r9d, byte [rbp + rcx*4]
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
xor edx, r9d
mov ecx, dword [rsi + rcx*4]
and ecx, 0xff000000
xor edx, ecx
movzx ecx, bh
mov ecx, dword [r11 + rcx*4]
and ecx, 0xff0000
xor edx, ecx
xor eax, edx
mov dword [r8 + 0x10], edx
xor edx, 0x2000000
mov ecx, eax
mov dword [r8 + 0x14], eax
xor ecx, r10d
xor ebx, ecx
mov dword [r8 + 0x18], ecx
movzx ecx, bl
mov dword [r8 + 0x1c], ebx
mov ecx, dword [rdi + rcx*4]
and ecx, 0xff00
xor ecx, edx
mov edx, ebx
shr edx, 0x18
movzx edx, byte [rbp + rdx*4]
xor ecx, edx
mov edx, ebx
shr edx, 0x10
movzx edx, dl
mov edx, dword [rsi + rdx*4]
and edx, 0xff000000
xor ecx, edx
movzx edx, bh
mov edx, dword [r11 + rdx*4]
and edx, 0xff0000
xor ecx, edx
mov edx, r10d
xor edx, ecx
xor eax, ecx
mov dword [r8 + 0x20], ecx
xor ecx, 0x4000000
mov r10d, edx
mov dword [r8 + 0x24], eax
xor r10d, ebx
mov dword [r8 + 0x28], edx
movzx r9d, r10b
mov dword [r8 + 0x2c], r10d
mov r9d, dword [rdi + r9*4]
and r9d, 0xff00
xor ecx, r9d
mov r9d, r10d
shr r9d, 0x18
movzx r9d, byte [rbp + r9*4]
xor ecx, r9d
mov r9d, r10d
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [rsi + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
mov ecx, r10d
movzx ecx, ch
mov r9d, dword [r11 + rcx*4]
and r9d, 0xff0000
xor r9d, r15d
xor eax, r9d
mov dword [r8 + 0x30], r9d
xor r9d, 0x8000000
mov ecx, eax
xor ebx, eax
mov dword [r8 + 0x34], eax
xor ecx, edx
mov dword [r8 + 0x3c], ebx
mov dword [r8 + 0x38], ecx
movzx ecx, bl
mov ecx, dword [rdi + rcx*4]
and ecx, 0xff00
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x18
movzx r9d, byte [rbp + r9*4]
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [rsi + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
movzx ecx, bh
mov r9d, dword [r11 + rcx*4]
mov ecx, r15d
and r9d, 0xff0000
xor ecx, r9d
xor edx, ecx
xor eax, ecx
mov dword [r8 + 0x40], ecx
xor ecx, 0x10000000
mov r10d, edx
mov dword [r8 + 0x44], eax
xor r10d, ebx
mov dword [r8 + 0x48], edx
movzx r9d, r10b
mov dword [r8 + 0x4c], r10d
mov r9d, dword [rdi + r9*4]
and r9d, 0xff00
xor ecx, r9d
mov r9d, r10d
shr r9d, 0x18
movzx r9d, byte [rbp + r9*4]
xor ecx, r9d
mov r9d, r10d
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [rsi + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
mov ecx, r10d
movzx ecx, ch
mov r9d, dword [r11 + rcx*4]
and r9d, 0xff0000
xor r9d, r15d
xor eax, r9d
mov dword [r8 + 0x50], r9d
mov ecx, eax
mov dword [r8 + 0x54], eax
xor ecx, edx
xor ebx, eax
xor r9d, 0x20000000
mov dword [r8 + 0x58], ecx
movzx ecx, bl
mov r10d, ebx
mov ecx, dword [rdi + rcx*4]
mov dword [r8 + 0x5c], ebx
and ecx, 0xff00
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x18
movzx r9d, byte [rbp + r9*4]
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [rsi + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
movzx ecx, bh
mov r9d, dword [r11 + rcx*4]
mov ecx, r15d
and r9d, 0xff0000
xor ecx, r9d
xor edx, ecx
xor eax, ecx
mov dword [r8 + 0x60], ecx
xor ecx, 0x40000000
xor r10d, edx
mov dword [r8 + 0x64], eax
movzx r9d, r10b
mov dword [r8 + 0x68], edx
mov r9d, dword [rdi + r9*4]
mov dword [r8 + 0x6c], r10d
and r9d, 0xff00
xor ecx, r9d
mov r9d, r10d
shr r9d, 0x18
movzx r9d, byte [rbp + r9*4]
xor ecx, r9d
mov r9d, r10d
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [rsi + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
mov ecx, r10d
movzx ecx, ch
mov r9d, dword [r11 + rcx*4]
mov ecx, edx
and r9d, 0xff0000
xor r9d, r15d
xor eax, r9d
mov dword [r8 + 0x70], r9d
add r9d, 0x80000000
xor ebx, eax
xor ecx, eax
mov dword [r8 + 0x74], eax
mov dword [r8 + 0x78], ecx
movzx ecx, bl
mov ecx, dword [rdi + rcx*4]
mov dword [r8 + 0x7c], ebx
and ecx, 0xff00
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x18
movzx r9d, byte [rbp + r9*4]
xor ecx, r9d
mov r9d, ebx
shr r9d, 0x10
movzx r9d, r9b
mov r9d, dword [rsi + r9*4]
and r9d, 0xff000000
xor ecx, r9d
mov r15d, ecx
movzx ecx, bh
mov r9d, dword [r11 + rcx*4]
mov ecx, r15d
and r9d, 0xff0000
xor ecx, r9d
mov r9d, ebx
xor edx, ecx
xor eax, ecx
mov dword [r8 + 0x80], ecx
xor ecx, 0x1b000000
xor r9d, edx
mov r10d, edx
mov dword [r8 + 0x88], edx
movzx edx, r9b
mov dword [r8 + 0x84], eax
mov dword [r8 + 0x8c], r9d
mov edx, dword [rdi + rdx*4]
and edx, 0xff00
xor ecx, edx
mov edx, r9d
shr edx, 0x18
movzx edx, byte [rbp + rdx*4]
xor ecx, edx
mov edx, r9d
shr edx, 0x10
movzx edx, dl
mov edx, dword [rsi + rdx*4]
and edx, 0xff000000
xor ecx, edx
mov edx, r9d
movzx edx, dh
mov edx, dword [r11 + rdx*4]
and edx, 0xff0000
xor edx, ecx
mov ecx, r10d
xor eax, edx
mov dword [r8 + 0x90], edx
xor edx, 0x36000000
xor ebx, eax
xor ecx, eax
mov dword [r8 + 0x94], eax
mov dword [r8 + 0x98], ecx
movzx ecx, bl
mov ecx, dword [rdi + rcx*4]
mov dword [r8 + 0x9c], ebx
and ecx, 0xff00
xor ecx, edx
mov edx, ebx
shr edx, 0x18
movzx edx, byte [rbp + rdx*4]
xor ecx, edx
mov edx, ebx
shr edx, 0x10
movzx edx, dl
mov edx, dword [rsi + rdx*4]
and edx, 0xff000000
xor ecx, edx
movzx edx, bh
mov edx, dword [r11 + rdx*4]
and edx, 0xff0000
xor edx, ecx
xor eax, edx
mov dword [r8 + 0xa0], edx
xor edx, r10d
mov dword [r8 + 0xa8], edx
xor edx, ebx
mov dword [r8 + 0xa4], eax
mov dword [r8 + 0xac], edx
jmp 0x6412df
lea rcx, [0x0095ffa0]
mov dword [rsp + 0xc], eax
add r8, 0x20
lea rbp, [0x00961ce0]
lea r12, [rcx + 0x1c]
lea rdi, [0x009618e0]
lea rsi, [0x009614e0]
lea r11, [0x009610e0]
jmp 0x641834
mov edx, ebx
movzx eax, bh
movzx r15d, bl
shr edx, 0x10
mov r14d, dword [rbp + rax*4]
movzx r15d, byte [rdi + r15*4]
movzx edx, dl
mov edx, dword [r11 + rdx*4]
and r14d, 0xff00
and edx, 0xff0000
or edx, r14d
mov r14d, ebx
xor edx, dword [r8 - 0x30]
shr r14d, 0x18
mov r14d, dword [rsi + r14*4]
and r14d, 0xff000000
or r14d, r15d
xor edx, r14d
mov dword [r8 - 0x10], edx
xor edx, dword [r8 - 0x2c]
mov dword [r8 - 0xc], edx
xor edx, dword [r8 - 0x28]
mov dword [r8 - 8], edx
xor edx, r13d
mov dword [r8 - 4], edx
mov r13d, dword [r8 - 4]
xor r9d, dword [rcx]
add rcx, 4
add r8, 0x20
movzx edx, r13b
mov eax, r13d
mov edx, dword [rbp + rdx*4]
movzx eax, ah
and edx, 0xff00
xor r9d, edx
mov edx, r13d
shr edx, 0x18
movzx edx, byte [rdi + rdx*4]
xor r9d, edx
mov edx, r13d
shr edx, 0x10
movzx edx, dl
mov edx, dword [rsi + rdx*4]
and edx, 0xff000000
xor edx, r9d
mov r9d, dword [r11 + rax*4]
and r9d, 0xff0000
xor r9d, edx
xor dword [rsp + 0xc], r9d
mov eax, dword [rsp + 0xc]
mov dword [r8 - 0x20], r9d
xor r10d, eax
mov dword [r8 - 0x1c], eax
xor ebx, r10d
mov dword [r8 - 0x18], r10d
mov dword [r8 - 0x14], ebx
cmp rcx, r12
jne 0x6417d0
jmp 0x6412df
lea rdi, [0x00961ce0]
movzx ecx, dl
mov r13d, ebx
mov r14d, ebx
mov ecx, dword [rdi + rcx*4]
xor r9d, 0x1000000
lea rbp, [0x009618e0]
lea rsi, [0x009614e0]
lea r11, [0x009610e0]
and ecx, 0xff00
xor r9d, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [rbp + rcx*4]
xor r9d, ecx
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [rsi + rcx*4]
and ecx, 0xff000000
xor r9d, ecx
movzx ecx, dh
mov ecx, dword [r11 + rcx*4]
and ecx, 0xff0000
xor r9d, ecx
mov ecx, eax
xor ecx, r9d
mov dword [r8 + 0x18], r9d
xor r10d, ecx
mov dword [r8 + 0x1c], ecx
xor r13d, r10d
mov dword [r8 + 0x20], r10d
mov dword [r8 + 0x24], r13d
xor r13d, dword [r8 + 0x10]
xor edx, r13d
mov dword [r8 + 0x28], r13d
movzx ecx, dl
mov r12d, edx
mov dword [r8 + 0x2c], edx
mov ecx, dword [rdi + rcx*4]
shr r12d, 0x18
movzx r12d, byte [rbp + r12*4]
and ecx, 0xff00
or ecx, r12d
mov r12d, edx
shr r12d, 0x10
xor ecx, 0x2000000
movzx r12d, r12b
mov r12d, dword [rsi + r12*4]
and r12d, 0xff000000
xor ecx, r12d
mov r15d, ecx
movzx ecx, dh
mov r12d, dword [r11 + rcx*4]
mov ecx, r15d
and r12d, 0xff0000
xor ecx, r12d
xor eax, ecx
xor r9d, ecx
mov ecx, r10d
xor ecx, eax
xor r14d, eax
mov r15d, eax
mov dword [r8 + 0x34], eax
mov dword [r8 + 0x38], ecx
mov ecx, r13d
xor ecx, r14d
mov dword [r8 + 0x30], r9d
xor edx, ecx
mov dword [r8 + 0x3c], r14d
movzx r12d, dl
mov r13d, edx
movzx eax, dh
mov dword [r8 + 0x44], edx
mov r12d, dword [rdi + r12*4]
shr r13d, 0x18
mov dword [r8 + 0x40], ecx
movzx r13d, byte [rbp + r13*4]
and r12d, 0xff00
or r12d, r13d
mov r13d, r12d
mov r12d, edx
shr r12d, 0x10
xor r13d, 0x4000000
movzx r12d, r12b
mov r12d, dword [rsi + r12*4]
and r12d, 0xff000000
xor r12d, r13d
mov r13d, dword [r11 + rax*4]
mov eax, r15d
and r13d, 0xff0000
xor r12d, r13d
xor r9d, r12d
xor r10d, r9d
xor eax, r9d
mov dword [r8 + 0x48], r9d
xor r14d, r10d
mov dword [r8 + 0x4c], eax
mov r13d, r14d
mov dword [r8 + 0x50], r10d
xor r13d, ecx
mov dword [r8 + 0x54], r14d
xor edx, r13d
mov dword [r8 + 0x58], r13d
movzx ecx, dl
mov r12d, edx
mov dword [r8 + 0x5c], edx
movzx eax, dh
mov ecx, dword [rdi + rcx*4]
shr r12d, 0x18
movzx r12d, byte [rbp + r12*4]
and ecx, 0xff00
or ecx, r12d
mov r12d, edx
shr r12d, 0x10
xor ecx, 0x8000000
movzx r12d, r12b
mov r12d, dword [rsi + r12*4]
and r12d, 0xff000000
xor ecx, r12d
mov r12d, dword [r11 + rax*4]
mov eax, r15d
and r12d, 0xff0000
xor ecx, r12d
mov r12d, r10d
xor ebx, ecx
xor eax, ecx
xor r9d, ecx
xor r13d, ebx
xor r12d, eax
mov dword [r8 + 0x60], r9d
xor edx, r13d
mov dword [r8 + 0x68], r12d
movzx ecx, dl
mov r12d, edx
mov dword [r8 + 0x70], r13d
mov ecx, dword [rdi + rcx*4]
shr r12d, 0x18
mov dword [r8 + 0x74], edx
movzx r12d, byte [rbp + r12*4]
mov dword [r8 + 0x64], eax
and ecx, 0xff00
mov dword [r8 + 0x6c], ebx
or ecx, r12d
mov r12d, edx
xor ecx, 0x10000000
shr r12d, 0x10
movzx r12d, r12b
mov r12d, dword [rsi + r12*4]
and r12d, 0xff000000
xor ecx, r12d
mov r15d, ecx
movzx ecx, dh
mov r12d, dword [r11 + rcx*4]
mov ecx, r15d
and r12d, 0xff0000
xor ecx, r12d
xor r9d, ecx
mov ecx, eax
xor ecx, r9d
xor r10d, r9d
mov dword [r8 + 0x78], r9d
mov dword [r8 + 0x7c], ecx
mov ecx, ebx
xor ecx, r10d
mov dword [r8 + 0x80], r10d
xor r13d, ecx
mov dword [r8 + 0x84], ecx
xor edx, r13d
mov dword [r8 + 0x88], r13d
mov r12d, edx
mov dword [r8 + 0x8c], edx
movzx edx, dl
mov r14d, dword [rdi + rdx*4]
mov edx, r12d
mov ecx, r12d
shr edx, 0x18
movzx edx, byte [rbp + rdx*4]
and r14d, 0xff00
or r14d, edx
mov edx, r12d
shr edx, 0x10
xor r14d, 0x20000000
movzx edx, dl
mov edx, dword [rsi + rdx*4]
and edx, 0xff000000
xor r14d, edx
movzx edx, ch
mov ecx, ebx
mov edx, dword [r11 + rdx*4]
and edx, 0xff0000
xor r14d, edx
mov edx, r10d
xor eax, r14d
xor r9d, r14d
xor ecx, eax
xor edx, eax
mov dword [r8 + 0x90], r9d
xor r13d, ecx
mov dword [r8 + 0x98], edx
xor r12d, r13d
mov dword [r8 + 0x94], eax
movzx edx, r12b
mov r15d, r12d
mov dword [r8 + 0x9c], ecx
mov edx, dword [rdi + rdx*4]
shr r15d, 0x18
mov dword [r8 + 0xa0], r13d
movzx r14d, byte [rbp + r15*4]
mov dword [r8 + 0xa4], r12d
and edx, 0xff00
or edx, r14d
xor edx, 0x40000000
mov r14d, edx
mov edx, r12d
shr edx, 0x10
movzx edx, dl
mov edx, dword [rsi + rdx*4]
and edx, 0xff000000
xor edx, r14d
mov r15d, edx
mov edx, r12d
movzx edx, dh
mov r14d, dword [r11 + rdx*4]
mov edx, r15d
and r14d, 0xff0000
xor edx, r14d
xor r9d, edx
mov edx, eax
xor r10d, r9d
xor edx, r9d
mov dword [r8 + 0xa8], r9d
xor ecx, r10d
mov dword [r8 + 0xac], edx
mov edx, ecx
mov dword [r8 + 0xb4], ecx
xor edx, r13d
mov dword [r8 + 0xb0], r10d
mov dword [r8 + 0xb8], edx
xor edx, r12d
movzx ecx, dl
mov dword [r8 + 0xbc], edx
mov ecx, dword [rdi + rcx*4]
mov edi, edx
shr edi, 0x18
movzx edi, byte [rbp + rdi*4]
and ecx, 0xff00
or ecx, edi
mov edi, edx
movzx edx, dh
shr edi, 0x10
mov edx, dword [r11 + rdx*4]
add ecx, 0x80000000
movzx edi, dil
mov esi, dword [rsi + rdi*4]
and edx, 0xff0000
and esi, 0xff000000
xor ecx, esi
xor edx, ecx
xor eax, edx
xor r9d, edx
xor ebx, edx
mov dword [r8 + 0xc4], eax
xor eax, r10d
mov dword [r8 + 0xc0], r9d
mov dword [r8 + 0xc8], eax
mov dword [r8 + 0xcc], ebx
jmp 0x6412df
mov eax, 0xffffffff
jmp 0x6412e1
mov eax, 0xfffffffe
jmp 0x6412e1