Function at 0x6b4031a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov edi, dword [esp + 0xb4]
mov ecx, dword [esp + 0xbc]
mov ebp, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb8]
mov edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x8c], edx
xor edx, edx
mov dword [esp + 0x24], edi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0xc8]
test ebp, ebp
je 0x6b403a8e
test edi, edi
je 0x6b403a8e
test ecx, ecx
je 0x6b403a8e
test esi, esi
je 0x6b403a8e
cmp eax, 1
ja 0x6b403a72
test bl, 0xf
jne 0x6b403a56
cmp eax, 1
je 0x6b403759
mov eax, edi
add ebp, ebx
lea edi, [esi + 0x20]
add eax, ebx
mov dword [esp + 0x3c], eax
mov edx, eax
cmp ebx, 0xf
jbe 0x6b40373b
movzx eax, byte [esi + 0x30]
movzx ecx, byte [esi + 0x38]
sub ebx, 0x10
not ebx
mov byte [esp + 0x38], al
movzx eax, byte [esi + 0x31]
and ebx, 0xfffffff0
mov byte [esp + 0x24], cl
movzx ecx, byte [esi + 0x39]
mov byte [esp + 0x37], al
movzx eax, byte [esi + 0x32]
mov byte [esp + 0x44], cl
movzx ecx, byte [esi + 0x3a]
mov byte [esp + 0x36], al
movzx eax, byte [esi + 0x33]
mov byte [esp + 0x45], cl
movzx ecx, byte [esi + 0x3b]
mov byte [esp + 0x30], al
movzx eax, byte [esi + 0x34]
mov byte [esp + 0x3a], cl
movzx ecx, byte [esi + 0x3c]
mov byte [esp + 0x39], al
movzx eax, byte [esi + 0x35]
mov dword [esp + 0x48], ebx
add ebx, ebp
mov byte [esp + 0x28], al
movzx eax, byte [esi + 0x36]
mov dword [esp + 0x40], ebx
mov ebx, edx
lea edx, [esp + 0x7c]
mov byte [esp + 0x2c], al
movzx eax, byte [esi + 0x37]
mov byte [esp + 0x3b], cl
movzx ecx, byte [esi + 0x3d]
mov byte [esp + 0x47], al
movzx eax, byte [esi + 0x3e]
mov byte [esp + 0x46], al
movzx eax, byte [esi + 0x3f]
mov dword [esp + 0x1c], edx
movzx edx, byte [esp + 0x46]
mov dword [esp + 0x4c], esi
mov esi, ebp
movzx ebp, byte [esp + 0x47]
mov byte [esp + 0x46], cl
mov ecx, edx
lea esi, [esi]
nop
mov edx, dword [esi - 0x10]
sub ebx, 0x10
sub esi, 0x10
mov dword [esp + 0x5c], edx
mov edx, dword [esi + 4]
mov dword [esp + 0x60], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x64], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x68], edx
mov edx, dword [esi]
mov dword [esp + 0x6c], edx
mov edx, dword [esi + 4]
mov dword [esp + 0x70], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x74], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x78], edx
movzx edx, byte [esp + 0x38]
xor byte [esp + 0x5c], dl
movzx edx, byte [esp + 0x37]
xor byte [esp + 0x5d], dl
movzx edx, byte [esp + 0x36]
xor byte [esp + 0x5e], dl
movzx edx, byte [esp + 0x30]
xor byte [esp + 0x5f], dl
movzx edx, byte [esp + 0x39]
xor byte [esp + 0x60], dl
movzx edx, byte [esp + 0x28]
xor byte [esp + 0x61], dl
movzx edx, byte [esp + 0x2c]
xor byte [esp + 0x6b], al
mov eax, dword [esp + 0x20]
xor byte [esp + 0x62], dl
mov edx, ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x5c]
xor byte [esp + 0x63], dl
movzx edx, byte [esp + 0x24]
xor byte [esp + 0x6a], cl
xor byte [esp + 0x64], dl
movzx edx, byte [esp + 0x44]
mov dword [esp], eax
xor byte [esp + 0x65], dl
movzx edx, byte [esp + 0x45]
mov dword [esp + 4], ebx
xor byte [esp + 0x66], dl
movzx edx, byte [esp + 0x3a]
xor byte [esp + 0x67], dl
movzx edx, byte [esp + 0x3b]
xor byte [esp + 0x68], dl
movzx edx, byte [esp + 0x46]
xor byte [esp + 0x69], dl
call sym.libcrypto_1_1.dll_AES_decrypt
movzx eax, byte [ebx]
xor al, byte [edi]
mov byte [ebx], al
mov byte [esp + 0x38], al
movzx eax, byte [ebx + 1]
xor al, byte [edi + 1]
mov byte [ebx + 1], al
mov byte [esp + 0x37], al
movzx eax, byte [ebx + 2]
xor al, byte [edi + 2]
mov byte [ebx + 2], al
mov byte [esp + 0x36], al
movzx eax, byte [ebx + 3]
xor al, byte [edi + 3]
mov byte [ebx + 3], al
mov byte [esp + 0x30], al
movzx eax, byte [ebx + 4]
xor al, byte [edi + 4]
mov byte [ebx + 4], al
mov byte [esp + 0x39], al
movzx eax, byte [ebx + 5]
xor al, byte [edi + 5]
mov byte [ebx + 5], al
mov byte [esp + 0x28], al
movzx eax, byte [ebx + 6]
xor al, byte [edi + 6]
mov byte [ebx + 6], al
mov byte [esp + 0x2c], al
movzx eax, byte [ebx + 7]
xor al, byte [edi + 7]
mov byte [ebx + 7], al
mov ebp, eax
movzx eax, byte [ebx + 8]
xor al, byte [edi + 8]
mov byte [ebx + 8], al
mov byte [esp + 0x24], al
movzx eax, byte [ebx + 9]
xor al, byte [edi + 9]
mov byte [ebx + 9], al
mov byte [esp + 0x44], al
movzx eax, byte [ebx + 0xa]
xor al, byte [edi + 0xa]
mov byte [ebx + 0xa], al
mov byte [esp + 0x45], al
movzx eax, byte [ebx + 0xb]
xor al, byte [edi + 0xb]
mov byte [ebx + 0xb], al
mov byte [esp + 0x3a], al
movzx eax, byte [ebx + 0xc]
xor al, byte [edi + 0xc]
mov byte [ebx + 0xc], al
mov byte [esp + 0x3b], al
movzx eax, byte [ebx + 0xd]
xor al, byte [edi + 0xd]
mov byte [ebx + 0xd], al
mov byte [esp + 0x46], al
movzx eax, byte [ebx + 0xe]
xor al, byte [edi + 0xe]
mov byte [ebx + 0xe], al
mov ecx, eax
movzx eax, byte [ebx + 0xf]
xor al, byte [edi + 0xf]
mov edi, dword [esp + 0x6c]
mov byte [ebx + 0xf], al
mov dword [esp + 0x7c], edi
mov edi, dword [esp + 0x70]
mov dword [esp + 0x80], edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x84], edi
mov edi, dword [esp + 0x78]
mov dword [esp + 0x88], edi
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x40], esi
jne 0x6b4032f0
mov esi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
add ebx, dword [esp + 0x3c]
movzx eax, byte [esi + 0x10]
movzx edi, byte [esi + 0x1c]
movzx ecx, byte [esi + 0x1d]
movzx ebp, byte [esi + 0x1b]
mov byte [esp + 0x36], al
movzx eax, byte [esi + 0x11]
movzx edx, byte [esi + 0x1e]
mov byte [esp + 0x45], cl
mov ecx, edi
mov byte [esp + 0x37], al
movzx eax, byte [esi + 0x12]
mov edi, edx
mov edx, ebp
mov ebp, ecx
mov byte [esp + 0x38], al
movzx eax, byte [esi + 0x13]
mov byte [esp + 0x3a], al
movzx eax, byte [esi + 0x14]
mov byte [esp + 0x30], al
movzx eax, byte [esi + 0x15]
mov byte [esp + 0x3b], al
movzx eax, byte [esi + 0x16]
mov byte [esp + 0x39], al
movzx eax, byte [esi + 0x17]
mov byte [esp + 0x28], al
movzx eax, byte [esi + 0x18]
mov byte [esp + 0x44], al
movzx eax, byte [esi + 0x19]
mov byte [esp + 0x24], al
movzx eax, byte [esi + 0x1a]
mov byte [esp + 0x2c], al
movzx eax, byte [esi + 0x1f]
lea esi, [esi]
nop
mov ecx, dword [ebx]
mov dword [esp + 0x5c], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 0x60], ecx
mov ecx, dword [ebx + 8]
mov dword [esp + 0x64], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x68], ecx
mov ecx, dword [ebx]
mov dword [esp + 0x6c], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 0x70], ecx
mov ecx, dword [ebx + 8]
mov dword [esp + 0x74], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x78], ecx
movzx ecx, byte [esp + 0x36]
xor byte [esp + 0x5c], cl
movzx ecx, byte [esp + 0x37]
xor byte [esp + 0x5d], cl
movzx ecx, byte [esp + 0x38]
xor byte [esp + 0x5e], cl
movzx ecx, byte [esp + 0x3a]
xor byte [esp + 0x5f], cl
movzx ecx, byte [esp + 0x30]
xor byte [esp + 0x60], cl
movzx ecx, byte [esp + 0x3b]
xor byte [esp + 0x61], cl
movzx ecx, byte [esp + 0x39]
xor byte [esp + 0x6b], al
mov eax, dword [esp + 0x20]
xor byte [esp + 0x62], cl
movzx ecx, byte [esp + 0x28]
mov dword [esp + 8], eax
lea eax, [esp + 0x5c]
mov dword [esp], eax
xor byte [esp + 0x63], cl
movzx ecx, byte [esp + 0x44]
xor byte [esp + 0x67], dl
xor byte [esp + 0x64], cl
movzx ecx, byte [esp + 0x24]
mov dword [esp + 4], ebx
xor byte [esp + 0x65], cl
movzx ecx, byte [esp + 0x2c]
xor byte [esp + 0x66], cl
mov ecx, ebp
xor byte [esp + 0x68], cl
movzx ecx, byte [esp + 0x45]
xor byte [esp + 0x69], cl
mov ecx, edi
xor byte [esp + 0x6a], cl
call sym.libcrypto_1_1.dll_AES_decrypt
movzx eax, byte [ebx]
xor al, byte [esi]
mov byte [ebx], al
mov byte [esp + 0x36], al
movzx eax, byte [ebx + 1]
xor al, byte [esi + 1]
mov byte [ebx + 1], al
mov byte [esp + 0x37], al
movzx eax, byte [ebx + 2]
xor al, byte [esi + 2]
mov byte [ebx + 2], al
mov byte [esp + 0x38], al
movzx eax, byte [ebx + 3]
xor al, byte [esi + 3]
mov byte [ebx + 3], al
mov byte [esp + 0x3a], al
movzx eax, byte [ebx + 4]
xor al, byte [esi + 4]
mov byte [ebx + 4], al
mov byte [esp + 0x30], al
movzx eax, byte [ebx + 5]
xor al, byte [esi + 5]
mov byte [ebx + 5], al
mov byte [esp + 0x3b], al
movzx eax, byte [ebx + 6]
xor al, byte [esi + 6]
mov byte [ebx + 6], al
mov byte [esp + 0x39], al
movzx eax, byte [ebx + 7]
xor al, byte [esi + 7]
mov byte [ebx + 7], al
mov byte [esp + 0x28], al
movzx eax, byte [ebx + 8]
xor al, byte [esi + 8]
mov byte [ebx + 8], al
mov byte [esp + 0x44], al
movzx eax, byte [ebx + 9]
xor al, byte [esi + 9]
mov byte [ebx + 9], al
mov byte [esp + 0x24], al
movzx eax, byte [ebx + 0xa]
xor al, byte [esi + 0xa]
mov byte [ebx + 0xa], al
mov byte [esp + 0x2c], al
movzx eax, byte [ebx + 0xb]
xor al, byte [esi + 0xb]
mov byte [ebx + 0xb], al
mov edx, eax
movzx eax, byte [ebx + 0xc]
xor al, byte [esi + 0xc]
mov byte [ebx + 0xc], al
mov ebp, eax
movzx eax, byte [ebx + 0xd]
xor al, byte [esi + 0xd]
mov byte [ebx + 0xd], al
mov byte [esp + 0x45], al
movzx eax, byte [ebx + 0xe]
xor al, byte [esi + 0xe]
mov byte [ebx + 0xe], al
mov edi, eax
movzx eax, byte [ebx + 0xf]
xor al, byte [esi + 0xf]
mov esi, dword [esp + 0x6c]
add ebx, 0x10
mov byte [ebx - 1], al
mov dword [esp + 0x7c], esi
mov esi, dword [esp + 0x70]
mov dword [esp + 0x80], esi
mov esi, dword [esp + 0x74]
mov dword [esp + 0x84], esi
mov esi, dword [esp + 0x78]
mov dword [esp + 0x88], esi
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x3c], ebx
jne 0x6b403560
mov eax, dword [esp + 0x8c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b403aaa
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esi + 0x10]
cmp ebx, 0xf
jbe 0x6b40373b
sub ebx, 0x10
lea ecx, [esp + 0x7c]
mov dword [esp + 0x30], esi
movzx edx, byte [esi]
and ebx, 0xfffffff0
mov dword [esp + 0x1c], ecx
lea eax, [ebx + 0x10]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
add eax, ebp
mov dword [esp + 0x28], eax
mov eax, esi
mov esi, dword [esp + 0x20]
jmp 0x6b403792
mov ebx, ecx
xor dl, byte [ebp]
mov byte [ebx], dl
movzx edx, byte [ebp + 1]
xor dl, byte [eax + 1]
mov byte [ebx + 1], dl
movzx edx, byte [ebp + 2]
xor dl, byte [eax + 2]
mov byte [ebx + 2], dl
movzx edx, byte [ebp + 3]
xor dl, byte [eax + 3]
mov byte [ebx + 3], dl
movzx edx, byte [ebp + 4]
xor dl, byte [eax + 4]
mov byte [ebx + 4], dl
movzx edx, byte [ebp + 5]
xor dl, byte [eax + 5]
mov byte [ebx + 5], dl
movzx edx, byte [ebp + 6]
xor dl, byte [eax + 6]
mov byte [ebx + 6], dl
movzx edx, byte [ebp + 7]
xor dl, byte [eax + 7]
mov byte [ebx + 7], dl
movzx edx, byte [ebp + 8]
xor dl, byte [eax + 8]
mov byte [ebx + 8], dl
movzx edx, byte [ebp + 9]
xor dl, byte [eax + 9]
mov byte [ebx + 9], dl
movzx edx, byte [ebp + 0xa]
xor dl, byte [eax + 0xa]
mov byte [ebx + 0xa], dl
movzx edx, byte [ebp + 0xb]
xor dl, byte [eax + 0xb]
mov byte [ebx + 0xb], dl
movzx edx, byte [ebp + 0xc]
xor dl, byte [eax + 0xc]
mov byte [ebx + 0xc], dl
movzx edx, byte [ebp + 0xd]
xor dl, byte [eax + 0xd]
mov byte [ebx + 0xd], dl
movzx edx, byte [ebp + 0xe]
xor dl, byte [eax + 0xe]
mov byte [ebx + 0xe], dl
movzx edx, byte [ebp + 0xf]
xor dl, byte [eax + 0xf]
mov byte [ebx + 0xf], dl
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_AES_encrypt
movzx edx, byte [ebx]
xor dl, byte [edi]
lea ecx, [ebx + 0x10]
mov byte [ebx], dl
movzx eax, byte [edi + 1]
xor byte [ebx + 1], al
movzx eax, byte [edi + 2]
xor byte [ebx + 2], al
movzx eax, byte [edi + 3]
xor byte [ebx + 3], al
movzx eax, byte [edi + 4]
xor byte [ebx + 4], al
movzx eax, byte [edi + 5]
xor byte [ebx + 5], al
movzx eax, byte [edi + 6]
xor byte [ebx + 6], al
movzx eax, byte [edi + 7]
xor byte [ebx + 7], al
movzx eax, byte [edi + 8]
xor byte [ebx + 8], al
movzx eax, byte [edi + 9]
xor byte [ebx + 9], al
movzx eax, byte [edi + 0xa]
xor byte [ebx + 0xa], al
movzx eax, byte [edi + 0xb]
xor byte [ebx + 0xb], al
movzx eax, byte [edi + 0xc]
xor byte [ebx + 0xc], al
movzx eax, byte [edi + 0xd]
xor byte [ebx + 0xd], al
movzx eax, byte [edi + 0xe]
xor byte [ebx + 0xe], al
movzx eax, byte [edi + 0xf]
xor byte [ebx + 0xf], al
mov eax, dword [ebp]
add ebp, 0x10
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x80], eax
mov eax, dword [ebp - 8]
mov dword [esp + 0x84], eax
mov eax, dword [ebp - 4]
mov dword [esp + 0x88], eax
mov eax, ebx
cmp dword [esp + 0x28], ebp
jne 0x6b403790
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
lea edi, [esi + 0x30]
movzx edx, byte [esi + 0x20]
lea eax, [esi + 0x20]
mov esi, edi
mov edi, dword [esp + 0x1c]
jmp 0x6b403912
mov eax, ebx
mov ecx, dword [ebx - 0x10]
sub ebx, 0x10
xor byte [ebx], dl
mov dword [esp + 0x5c], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 0x60], ecx
mov ecx, dword [ebx + 8]
mov dword [esp + 0x64], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x68], ecx
movzx edx, byte [eax + 1]
xor byte [ebx + 1], dl
movzx edx, byte [eax + 2]
xor byte [ebx + 2], dl
movzx edx, byte [eax + 3]
xor byte [ebx + 3], dl
movzx edx, byte [eax + 4]
xor byte [ebx + 4], dl
movzx edx, byte [eax + 5]
xor byte [ebx + 5], dl
movzx edx, byte [eax + 6]
xor byte [ebx + 6], dl
movzx edx, byte [eax + 7]
xor byte [ebx + 7], dl
movzx edx, byte [eax + 8]
xor byte [ebx + 8], dl
movzx edx, byte [eax + 9]
xor byte [ebx + 9], dl
movzx edx, byte [eax + 0xa]
xor byte [ebx + 0xa], dl
movzx edx, byte [eax + 0xb]
xor byte [ebx + 0xb], dl
movzx edx, byte [eax + 0xc]
xor byte [ebx + 0xc], dl
movzx edx, byte [eax + 0xd]
xor byte [ebx + 0xd], dl
movzx edx, byte [eax + 0xe]
xor byte [ebx + 0xe], dl
movzx eax, byte [eax + 0xf]
xor byte [ebx + 0xf], al
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_AES_encrypt
movzx edx, byte [ebx]
xor dl, byte [esi]
mov byte [ebx], dl
movzx eax, byte [esi + 1]
xor byte [ebx + 1], al
movzx eax, byte [esi + 2]
xor byte [ebx + 2], al
movzx eax, byte [esi + 3]
xor byte [ebx + 3], al
movzx eax, byte [esi + 4]
xor byte [ebx + 4], al
movzx eax, byte [esi + 5]
xor byte [ebx + 5], al
movzx eax, byte [esi + 6]
xor byte [ebx + 6], al
movzx eax, byte [esi + 7]
xor byte [ebx + 7], al
movzx eax, byte [esi + 8]
xor byte [ebx + 8], al
movzx eax, byte [esi + 9]
xor byte [ebx + 9], al
movzx eax, byte [esi + 0xa]
xor byte [ebx + 0xa], al
movzx eax, byte [esi + 0xb]
xor byte [ebx + 0xb], al
movzx eax, byte [esi + 0xc]
xor byte [ebx + 0xc], al
movzx eax, byte [esi + 0xd]
xor byte [ebx + 0xd], al
movzx eax, byte [esi + 0xe]
xor byte [ebx + 0xe], al
movzx eax, byte [esi + 0xf]
mov esi, edi
xor byte [ebx + 0xf], al
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x88], eax
cmp dword [esp + 0x24], ebx
jne 0x6b403910
jmp 0x6b40373b
mov dword [esp + 8], 0xb9
mov dword [esp + 4], 0x6b5c7140
mov dword [esp], str.assertion_failed:__length___AES_BLOCK_SIZE___0
call sym.libcrypto_1_1.dll_OPENSSL_die
mov dword [esp + 8], 0xb8
mov dword [esp + 4], 0x6b5c7140
mov dword [esp], str.assertion_failed:__AES_ENCRYPT__enc____AES_DECRYPT__enc_
call sym.libcrypto_1_1.dll_OPENSSL_die
mov dword [esp + 8], 0xb7
mov dword [esp + 4], 0x6b5c7140
mov dword [esp], str.assertion_failed:_in__out__key__ivec
call sym.libcrypto_1_1.dll_OPENSSL_die
call sym.___stack_chk_fail
nop