Function at 0x7ffbf1cd9d94
Capabilities:
Check for software breakpoints
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r13d, ecx
mov dword [rsp + 0x38], ecx
xor ecx, ecx
mov r15, r9
mov qword [rsp + 0x48], r9
mov r12, r8
mov qword [rsp + 0x50], r8
mov r14, rdx
mov qword [rsp + 0x58], rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x7ffbf1cd9ebb
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
je 0x7ffbf1cd9e06
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x7ffbf1cd9ebb
mov rax, qword [rax + rdi + 0x90]
test eax, eax
je 0x7ffbf1cd9ebb
mov esi, eax
xor ebp, ebp
add rsi, rdi
cmp dword [rsi], ebx
je 0x7ffbf1cd9ebb
mov rax, rsi
mov r13b, bl
mov r15d, dword [rax]
mov ecx, dword [rax + 0x10]
mov r14d, dword [rax + 0xc]
add rcx, rdi
add r15, rdi
add r14, rdi
xor r12d, r12d
mov qword [rsp + 0x30], rcx
cmp qword [r15], rbx
je 0x7ffbf1cd9e8e
xor eax, eax
mov rax, qword [rax + rcx]
mov qword [rsp + 0x40], rax
cmp byte [rax], 0xcc
jne 0x7ffbf1cd9e7e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r11, rax
test rax, rax
jne 0x7ffbf1cd9f37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13b, 1
mov rcx, qword [rsp + 0x30]
inc r12
mov rax, r12
shl rax, 3
cmp qword [rax + r15], rbx
jne 0x7ffbf1cd9e4d
inc rbp
lea rax, [rbp + rbp*4]
lea rax, [rsi + rax*4]
cmp dword [rax], ebx
jne 0x7ffbf1cd9e2b
mov r12, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
test r13b, r13b
mov r13d, dword [rsp + 0x38]
jne 0x7ffbf1cda369
mov r15, qword [rsp + 0x48]
test r13d, r13d
je 0x7ffbf1cda364
test r14, r14
je 0x7ffbf1cda364
test r12, r12
je 0x7ffbf1cda364
cmp dword [r12], 1
mov ebp, 0x80070057
jne 0x7ffbf1cda09f
cmp r13d, 0xf
jae 0x7ffbf1cd9fb3
cmp dword [r12 + 4], ebx
je 0x7ffbf1cd9fcb
and dword [r12 + 0x244], ebx
mov dword [r12 + 0x240], r13d
mov dword [r12 + 0x218], 1
cmp r13d, 0x10
jb 0x7ffbf1cda097
mov ecx, 7
mov eax, r13d
and eax, ecx
sub ecx, eax
mov esi, ecx
add rsi, r14
jmp 0x7ffbf1cda00c
movsxd rdx, dword [rax + 0x3c]
shl rdx, 6
add rdx, rax
xor eax, eax
movzx r8d, word [rdx + 6]
movzx r10d, word [rdx + 0x14]
mov dword [rsp + 0x28], eax
test r8d, r8d
jle 0x7ffbf1cd9e79
mov r9d, dword [r10 + rdx + 0x3c]
mov r8, qword [rsp + 0x40]
movzx ecx, word [rdx + 6]
and r9d, 0x20
test r9d, r9d
jne 0x7ffbf1cd9f7b
bt dword [r10 + rdx + 0x3c], 0x1d
jae 0x7ffbf1cd9fa3
mov ecx, dword [r10 + rdx + 0x24]
add rcx, r11
cmp rcx, r8
ja 0x7ffbf1cd9f9f
mov eax, dword [r10 + rdx + 0x20]
lea rcx, [rax + rcx - 1]
cmp r8, rcx
jbe 0x7ffbf1cd9e76
mov eax, dword [rsp + 0x28]
movzx ecx, word [rdx + 6]
inc eax
cmp eax, ecx
mov dword [rsp + 0x28], eax
jge 0x7ffbf1cd9e79
jmp 0x7ffbf1cd9f6d
mov eax, r13d
lea rdx, [rax + r14 - 0xf]
test rdx, rdx
je 0x7ffbf1cda095
cmp dword [r12 + 4], ebx
jne 0x7ffbf1cd9fd5
mov ebx, 0x800480d2
jmp 0x7ffbf1cda097
and dword [r12 + 0x244], ebx
mov dword [r12 + 0x240], r13d
mov dword [r12 + 0x218], 1
cmp r13d, 0x10
jb 0x7ffbf1cda097
mov ecx, 7
mov eax, r13d
and eax, ecx
sub ecx, eax
mov esi, ecx
add rsi, rdx
lea rdi, [r12 + 0x238]
mov ecx, 8
lea r8, [r12 + 0x2c]
rep movsb byte [rdi], byte [rsi]
mov eax, dword [r12 + 0x24]
lea rdx, [r12 + 0x230]
xor dword [r12 + 0x238], eax
mov eax, dword [r12 + 0x28]
lea rcx, [r12 + 0x238]
xor dword [r12 + 0x23c], eax
xor r9d, r9d
call fcn.7ffbf1d0dc74
mov edx, dword [r12 + 0x1c]
mov eax, dword [r12 + 0x20]
xor dword [r12 + 0x230], edx
xor dword [r12 + 0x234], eax
lea rcx, [r12 + 0x110]
lea r8, [r12 + 0x230]
mov edx, 8
call fcn.7ffbf1d0f390
lea rcx, [r12 + 0x21c]
call fcn.7ffbf1d01968
jmp 0x7ffbf1cda097
mov ebx, ebp
test ebx, ebx
js 0x7ffbf1cda369
cmp dword [r12 + 4], 0
jne 0x7ffbf1cda0b1
mov ebx, 0x800480d2
jmp 0x7ffbf1cda369
cmp dword [r12], 1
jne 0x7ffbf1cda1a6
mov edx, r13d
cmp r13d, 0x10
jae 0x7ffbf1cda0de
mov r8, r14
mov rcx, r12
call fcn.7ffbf1cfc2dc
nop
invalid
shr edx, 3
lea rdi, [rsp + 0x28]
mov ecx, 8
add edx, edx
lea r9, [r12 + 0xac]
lea r8, [rsp + 0x30]
lea ebx, [rdx*4 - 8]
mov ebp, edx
add rbx, r14
mov rsi, rbx
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
call fcn.7ffbf1d01844
lea r8, [rsp + 0x30]
lea rcx, [r12 + 0x110]
mov edx, 8
call fcn.7ffbf1d0f390
lea rcx, [r12 + 0x110]
mov r8, r14
mov edx, r13d
call fcn.7ffbf1d0f1d8
mov edx, dword [r12 + 0x1c]
mov eax, dword [r12 + 0x20]
xor dword [rsp + 0x30], edx
xor dword [rsp + 0x34], eax
lea r8, [r12 + 0x2c]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov r9d, 1
call fcn.7ffbf1d0dc74
mov edx, dword [r12 + 0x24]
mov eax, dword [r12 + 0x28]
xor dword [rsp + 0x28], edx
xor dword [rsp + 0x2c], eax
mov edx, 4
lea rsi, [rsp + 0x28]
mov rcx, rdx
mov rdi, rbx
rep movsb byte [rdi], byte [rsi]
lea edi, [rbp*4 - 4]
lea rsi, [rsp + 0x2c]
add rdi, r14
mov rcx, rdx
rep movsb byte [rdi], byte [rsi]
jmp 0x7ffbf1cda360
cmp dword [r12], 3
jne 0x7ffbf1cda1f5
mov eax, r13d
shr eax, 4
test r13b, 0xf
jne 0x7ffbf1cda1fa
test eax, eax
je 0x7ffbf1cda360
mov ebx, eax
mov rcx, qword [r12 + 8]
lea rdx, [rsp + 0x78]
mov r9d, 1
mov r8, r14
call fcn.7ffbf1d1ed3c
sub rbx, 1
lea rsi, [rsp + 0x78]
mov rdi, r14
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
jne 0x7ffbf1cda1c3
jmp 0x7ffbf1cda360
test r15, r15
jne 0x7ffbf1cda201
mov ebx, ebp
jmp 0x7ffbf1cda369
mov rcx, qword [r15 + 8]
mov rdx, qword [r12 + 8]
xor ebx, ebx
mov eax, ecx
shr rcx, 4
lea r15d, [rbx + 0x10]
and eax, 0xf
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], ebx
sub r15d, eax
mov r12d, ecx
test rdx, rdx
je 0x7ffbf1cda35a
mov rax, qword [rsp + 0x48]
lea edx, [rbx + 8]
lea rcx, [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
call fcn.7ffbf1d03a08
lea rdi, [rsp + 0x58]
lea rsi, [rsp + 0x48]
lea ecx, [rbx + 8]
rep movsb byte [rdi], byte [rsi]
test r15d, r15d
je 0x7ffbf1cda2d1
lea edx, [rbx + 8]
lea rcx, [rsp + 0x50]
mov ebp, r15d
cmp r13d, r15d
mov qword [rsp + 0x50], r12
cmovb ebp, r13d
call fcn.7ffbf1d03a08
lea rdi, [rsp + 0x60]
lea rsi, [rsp + 0x50]
lea ecx, [rbx + 8]
lea r9d, [rbx + 1]
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x68]
call fcn.7ffbf1d1ed3c
movsxd rax, r15d
test ebp, ebp
je 0x7ffbf1cda2c6
lea rcx, [rsp + 0x78]
mov rdx, r14
mov edi, ebp
sub rcx, rax
mov al, byte [rcx]
inc rcx
xor byte [rdx], al
inc rdx
sub rdi, 1
jne 0x7ffbf1cda2b6
mov eax, ebp
sub r13d, ebp
add r14, rax
inc r12
test r13d, r13d
je 0x7ffbf1cda35c
mov rbx, qword [rsp + 0x40]
mov ebp, 0x10
lea rcx, [rsp + 0x40]
mov edx, 8
cmp r13d, ebp
mov qword [rsp + 0x40], r12
cmovb ebp, r13d
call fcn.7ffbf1d03a08
lea rdi, [rsp + 0x60]
lea rsi, [rsp + 0x40]
mov ecx, 8
lea r8, [rsp + 0x58]
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x68]
mov r9d, 1
mov rcx, rbx
call fcn.7ffbf1d1ed3c
test ebp, ebp
je 0x7ffbf1cda347
lea rdx, [rsp + 0x68]
mov rcx, r14
mov edi, ebp
sub rdx, r14
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub rdi, 1
jne 0x7ffbf1cda339
mov eax, ebp
inc r12
add r14, rax
sub r13d, ebp
jne 0x7ffbf1cda2df
mov ebx, dword [rsp + 0x38]
jmp 0x7ffbf1cda35c
mov ebx, ebp
test ebx, ebx
js 0x7ffbf1cda369
xor ebx, ebx
jmp 0x7ffbf1cda369
mov ebx, 0x80070057
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.7ffbf1d2cc34
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret