Function at 0x536e50
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov eax, pe_nt_image_headers64
sarx r8d, eax, r8d
mov r10d, edx
mov edx, r8d
mov qword [rsp + 0x110], rcx
neg edx
mov rcx, qword [rcx + 0x20]
mov rbx, qword [rsp + 0x110]
mov qword [rsp + 0x128], r9
and edx, r10d
or edx, r8d
lea rax, [rcx + 1]
mov r8d, 0x20
mov byte [rbx + rcx], dl
mov rcx, rax
sub r8, rax
xor edx, edx
add rcx, rbx
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x94], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x4c]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x110]
mov r12d, dword [rax + 0x5c]
mov r13d, dword [rax + 0x60]
mov eax, dword [rax + 0x64]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x110]
mov ebx, dword [rax + 0x68]
mov eax, dword [rax + 0x6c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x74]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x110]
mov edi, dword [rax + 0x78]
mov eax, dword [rax + 0x7c]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x110]
mov r8d, dword [rax]
mov rcx, rax
mov dword [rsp + 0xbc], 2
mov edx, r8d
mov esi, edx
bswap esi
mov eax, dword [rax + 4]
mov edx, eax
bswap edx
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0x4c], edx
mov eax, dword [rax + 8]
mov r15d, eax
bswap r15d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0xc]
mov r10d, eax
bswap r10d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x10]
mov r8d, eax
bswap r8d
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x14]
bswap eax
mov ecx, dword [rcx + 0x18]
mov dword [rsp + 0x50], eax
mov r14d, ecx
bswap r14d
mov rcx, qword [rsp + 0x110]
mov ecx, dword [rcx + 0x1c]
mov r11d, ecx
bswap r11d
mov ecx, dword [rsp + 0x68]
xor ecx, dword [rsp + 0x60]
mov eax, ecx
mov ecx, dword [rsp + 0x84]
xor ecx, dword [rsp + 0x88]
xor eax, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x6c]
mov dword [rsp + 0x44], ecx
xor r9d, dword [rsp + 0x70]
mov ebp, dword [rsp + 0x54]
mov dword [rsp + 0xa4], eax
mov ecx, dword [rsp + 0x90]
mov eax, dword [rsp + 0x44]
mov edx, r9d
mov r9d, dword [rsp + 0x80]
xor r9d, dword [rsp + 0x78]
xor ecx, r12d
xor r9d, dword [rsp + 0x40]
xor eax, edi
xor edx, dword [rsp + 0x38]
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 0x94]
xor ebp, dword [rsp + 0x58]
mov dword [rsp + 0xa8], eax
xor ecx, r13d
mov eax, dword [rsp + 0x48]
xor ebp, ebx
xor eax, dword [rsp + 0x34]
mov dword [rsp + 0xb0], ecx
mov ecx, dword [rsp + 0xa0]
xor ecx, dword [rsp + 0x98]
xor ecx, dword [rsp + 0x2c]
mov dword [rsp + 0xac], eax
xor r9d, ecx
xor ebp, ecx
mov eax, dword [rsp + 0xb0]
xor eax, dword [rsp + 0x3c]
mov dword [rsp + 0x48], r9d
mov r9d, edx
xor r9d, ecx
mov dword [rsp + 0x44], eax
mov dword [rsp + 0xb4], r9d
mov r9d, ebp
mov ebp, dword [rsp + 0x54]
mov edx, dword [rsp + 0x68]
xor edx, dword [rsp + 0x4c]
mov dword [rsp + 0x68], edx
mov edx, dword [rsp + 0x80]
xor ebp, esi
mov dword [rsp + 0xb0], ebp
mov ebp, dword [rsp + 0x6c]
xor edx, r10d
mov dword [rsp + 0x80], edx
mov edx, dword [rsp + 0x84]
xor ebp, r15d
xor r15d, r11d
mov dword [rsp + 0x6c], ebp
mov ebp, dword [rsp + 0x90]
xor edx, r8d
xor ebp, dword [rsp + 0x50]
mov dword [rsp + 0x54], r15d
mov r15d, esi
mov dword [rsp + 0x84], edx
mov edx, dword [rsp + 0x94]
xor r15d, r11d
mov dword [rsp + 0x90], ebp
mov ebp, dword [rsp + 0xa0]
xor edx, r14d
mov esi, dword [rsp + 0x58]
xor ebp, r11d
mov dword [rsp + 0x94], edx
mov edx, r15d
mov r15d, dword [rsp + 0x60]
mov dword [rsp + 0xa0], ebp
mov ebp, r10d
xor esi, r11d
mov r10d, dword [rsp + 0x70]
xor ebp, r11d
xor r15d, edx
xor r10d, dword [rsp + 0x4c]
xor r12d, r8d
mov eax, ebp
mov ebp, esi
mov esi, dword [rsp + 0x78]
xor esi, dword [rsp + 0x54]
mov dword [rsp + 0x70], esi
mov esi, dword [rsp + 0x88]
xor ebx, r14d
xor ebp, ecx
mov dword [rsp + 0xb8], r10d
mov r10d, dword [rsp + 0x98]
xor edi, r14d
xor ebx, ecx
xor esi, eax
xor esi, dword [rsp + 0x48]
xor r13d, dword [rsp + 0x50]
xor r10d, r14d
mov dword [rsp + 0x60], esi
xor r12d, dword [rsp + 0xa8]
xor r10d, dword [rsp + 0x44]
xor edx, dword [rsp + 0x38]
rorx r12d, r12d, 0x1f
xor r8d, dword [rsp + 0x3c]
xor edi, dword [rsp + 0x54]
mov dword [rsp + 0x58], r10d
mov r10d, dword [rsp + 0x30]
mov esi, dword [rsp + 0x50]
xor esi, dword [rsp + 0x2c]
xor esi, dword [rsp + 0x44]
xor r10d, r14d
xor eax, dword [rsp + 0x34]
xor r13d, dword [rsp + 0xac]
xor r11d, r10d
rorx r13d, r13d, 0x1f
xor r11d, r9d
mov dword [rsp + 0x30], r11d
mov r11d, dword [rsp + 0xa4]
xor r11d, edx
mov edx, dword [rsp + 0x4c]
xor edx, dword [rsp + 0x40]
xor edx, r14d
mov dword [rsp + 0x38], r11d
mov r11d, dword [rsp + 0xac]
mov r14d, dword [rsp + 0x48]
mov r10d, edx
mov edx, dword [rsp + 0xb4]
xor r8d, r11d
xor r10d, edx
xor r14d, edi
rorx r8d, r8d, 0x1e
mov dword [rsp + 0x3c], r8d
rorx r8d, esi, 0x1e
mov dword [rsp + 0x2c], r8d
mov r8, rbp
shl r8, 0x20
mov dword [rsp + 0x40], r10d
mov r10d, r14d
mov r14d, dword [rsp + 0xa8]
rorx edi, r10d, 0x1e
mov r10, r8
mov r8d, dword [rsp + 0xb0]
xor eax, r14d
xor r8d, ecx
rorx eax, eax, 0x1e
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x80]
or r10, r8
xor r15d, r9d
xor r9d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x6c]
shl r13, 0x20
mov rcx, r15
mov r15d, dword [rsp + 0xa4]
shl r12, 0x20
shl rcx, 0x20
mov rbp, rcx
mov ecx, dword [rsp + 0xb8]
xor r8d, r15d
or rbp, r9
mov r9d, dword [rsp + 0x70]
rorx esi, dword [rsp + 0x60], 0x1f
shl rsi, 0x20
xor ecx, r15d
mov r15d, dword [rsp + 0x90]
xor r9d, edx
shl rcx, 0x20
or rcx, r8
mov r8d, edx
mov rdx, r9
xor r15d, r14d
xor eax, r8d
shl rdx, 0x20
rorx r8d, dword [rsp + 0x58], 0x1f
or r12, r15
or rdx, rax
mov eax, dword [rsp + 0x94]
mov r9d, dword [rsp + 0x84]
shl r8, 0x20
xor r9d, dword [rsp + 0x48]
lea r14, [0x006cef40]
lea r15, [0x006cef00]
xor eax, r11d
or r9, rsi
mov r11, rcx
mov rcx, rbp
or r13, rax
mov eax, dword [rsp + 0xa0]
xor eax, dword [rsp + 0x44]
mov rbp, r9
or r8, rax
nop dword [rax]
mov rax, r10
mov rsi, rdx
xor r11, rdx
xor r8, rbp
and rsi, r10
or rax, rcx
xor rax, rdx
xor rcx, rsi
xor rsi, r11
mov rdx, r12
and r11, rax
not rcx
or rdx, r13
xor r11, rcx
or rcx, rsi
xor rdx, rbp
xor r10, rcx
xor rsi, r11
xor rax, rcx
and r11, rcx
mov rcx, rbp
mov r9, r10
not rax
and rcx, r12
shr r9, 0x20
xor r13, rcx
xor rcx, r8
and r8, rdx
rorx r9d, r9d, 0x1e
not r13
xor r8, r13
or r13, rcx
xor rcx, r8
xor r12, r13
and r8, r13
xor rcx, r10
rorx r10d, r10d, 0x1e
mov rbp, rcx
xor r10d, ecx
rorx ecx, ecx, 0x12
shr rbp, 0x20
xor ecx, r10d
rorx r10d, r10d, 0x16
xor r9d, ebp
rorx ebp, ebp, 0x12
xor ebp, r9d
rorx r9d, r9d, 0x16
xor r9d, ebp
xor r12, rax
xor r10d, ecx
rorx ecx, ecx, 0x1f
shl r9, 0x20
xor r13, rdx
or r10, r9
rorx r9d, ebp, 0x1f
mov rbp, r12
shl r9, 0x20
or r9, rcx
shr rbp, 0x20
rorx ecx, eax, 0x1e
xor ecx, r12d
shr rax, 0x20
xor r13, r11
rorx r12d, r12d, 0x12
xor r12d, ecx
rorx eax, eax, 0x1e
xor eax, ebp
rorx ebp, ebp, 0x12
not r13
xor ebp, eax
rorx eax, eax, 0x16
rorx ecx, ecx, 0x16
xor ecx, r12d
xor eax, ebp
rorx ebp, ebp, 0x1f
shl rbp, 0x20
rorx edx, r13d, 0x12
shl rax, 0x20
rorx r12d, r12d, 0x1f
or r12, rbp
mov rbp, r13
or rcx, rax
rorx eax, r11d, 0x1e
xor eax, r13d
shr rbp, 0x20
xor edx, eax
rorx r13d, eax, 0x16
mov rax, r11
shr rax, 0x20
rorx eax, eax, 0x1e
xor eax, ebp
rorx ebp, ebp, 0x12
xor ebp, eax
rorx r11d, eax, 0x16
mov eax, r13d
xor r11d, ebp
xor eax, edx
rorx r13d, ebp, 0x1f
shl r13, 0x20
shl r11, 0x20
rorx edx, edx, 0x1f
rorx ebp, esi, 0x1e
or r11, rax
or r13, rdx
xor r8, rsi
shr rsi, 0x20
mov rdx, r8
rorx esi, esi, 0x1e
xor ebp, r8d
xor r9, qword [r15]
shr rdx, 0x20
rorx eax, r8d, 0x12
xor eax, ebp
xor r10, qword [r14]
xor esi, edx
rorx r8d, edx, 0x12
rorx ebp, ebp, 0x16
add r14, 8
xor r8d, esi
rorx edx, esi, 0x16
xor ebp, eax
rorx eax, eax, 0x1f
xor edx, r8d
rorx r8d, r8d, 0x1f
shl r8, 0x20
add r15, 8
shl rdx, 0x20
or r8, rax
lea rax, [0x006cef80]
or rdx, rbp
mov rbp, r9
cmp r14, rax
jne 0x5373f8
mov rbp, rcx
mov dword [rsp + 0x54], r10d
mov rcx, r11
shr r10, 0x20
mov dword [rsp + 0x68], ebp
shr rbp, 0x20
shr rcx, 0x20
mov esi, dword [rsp + 0x3c]
mov dword [rsp + 0x80], edx
shr rdx, 0x20
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x84], r9d
shr r9, 0x20
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], r10
mov r10d, dword [rsp + 0x34]
mov dword [rsp + 0x6c], r11d
mov r11d, dword [rsp + 0x30]
mov qword [rsp + 0x78], rdx
mov edx, dword [rsp + 0x2c]
mov qword [rsp + 0x88], r9
mov r9d, dword [rsp + 0x38]
mov dword [rsp + 0xa0], r8d
shr r8, 0x20
mov qword [rsp + 0x70], rcx
lea rcx, [0x006ceee0]
mov dword [rsp + 0x90], r12d
shr r12, 0x20
mov dword [rsp + 0x94], r13d
shr r13, 0x20
mov qword [rsp + 0x98], r8
lea r8, [0x006ceec0]
nop
mov ebp, ebx
xor r9d, eax
lea r15, [0x006cef00]
xor edx, edi
or ebp, r11d
xor ebp, eax
and eax, ebx
xor r11d, eax
xor eax, r9d
and r9d, ebp
not r11d
xor r9d, r11d
or r11d, eax
xor ebx, r11d
xor eax, r9d
and r9d, r11d
xor r11d, ebp
mov ebp, r10d
not r11d
or ebp, esi
xor ebp, edi
and edi, r10d
xor esi, edi
xor edi, edx
and edx, ebp
not esi
xor edx, esi
or esi, edi
xor r10d, esi
xor edi, edx
and edx, esi
xor edi, ebx
xor r10d, r11d
rorx ebx, ebx, 0x1e
rorx r11d, r11d, 0x1e
xor ebx, edi
xor r11d, r10d
rorx edi, edi, 0x12
rorx r10d, r10d, 0x12
xor edi, ebx
xor r10d, r11d
rorx ebx, ebx, 0x16
rorx r11d, r11d, 0x16
xor ebx, edi
xor r11d, r10d
xor esi, ebp
xor edx, eax
xor esi, r9d
rorx eax, eax, 0x1e
rorx r9d, r9d, 0x1e
xor eax, edx
not esi
xor ebx, dword [rcx]
rorx edx, edx, 0x12
add rcx, 4
xor r9d, esi
xor edx, eax
rorx esi, esi, 0x12
rorx edi, edi, 0x1f
xor esi, r9d
xor edi, dword [r8]
rorx r9d, r9d, 0x16
rorx eax, eax, 0x16
xor r9d, esi
xor eax, edx
add r8, 4
rorx r10d, r10d, 0x1f
rorx esi, esi, 0x1f
rorx edx, edx, 0x1f
cmp rcx, r15
jne 0x5376a0
mov r14, qword [rsp + 0x110]
mov dword [rsp + 0x2c], edx
xor edx, edx
mov r8d, r10d
cmp dword [rsp + 0xbc], 1
mov dword [rsp + 0x30], r11d
mov ecx, r9d
mov dword [rsp + 0x34], r10d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], eax
mov qword [r14], 0
mov qword [r14 + 8], 0
mov qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 0
jne 0x5378d0
mov r9d, dword [rsp + 0x58]
mov edx, r13d
xor r9d, ebx
xor r9d, dword [rsp + 0x54]
bswap r9d
mov rbx, qword [rsp + 0x128]
mov r15d, dword [rsp + 0x60]
mov dword [rbx], r9d
xor r15d, r11d
xor r15d, dword [rsp + 0x68]
bswap r15d
mov r14d, dword [rsp + 0x70]
mov dword [rbx + 4], r15d
xor r14d, ecx
xor r14d, dword [rsp + 0x6c]
bswap r14d
mov r11d, dword [rsp + 0x78]
mov dword [rbx + 8], r14d
xor r11d, eax
xor r11d, dword [rsp + 0x80]
bswap r11d
mov r10d, dword [rsp + 0x88]
mov dword [rbx + 0xc], r11d
xor r10d, edi
xor r10d, dword [rsp + 0x84]
bswap r10d
mov dword [rbx + 0x10], r10d
mov ebp, r12d
mov ebx, dword [rsp + 0x90]
xor ebp, r8d
xor ebx, ebp
mov r13d, ebx
bswap r13d
mov rbx, qword [rsp + 0x128]
mov r12d, edx
xor r12d, esi
xor r12d, dword [rsp + 0x94]
mov dword [rbx + 0x14], r13d
bswap r12d
cmp dword [rsp + 0x130], 8
mov dword [rbx + 0x18], r12d
jne 0x5378bb
mov ecx, dword [rsp + 0x98]
xor ecx, dword [rsp + 0x2c]
xor ecx, dword [rsp + 0xa0]
bswap ecx
mov dword [rbx + 0x1c], ecx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0xbc], 1
mov rax, r14
mov rcx, r14
jmp 0x537025