Function at 0x7ff7903c2b34
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movups xmm0, xmmword [rdx + 0x28]
mov rsi, qword [rdx + 0x20]
lea r14, [rcx + 0x104]
xor ebx, ebx
mov qword [rsp + 0x90], rdx
lea r15, [rcx + 0x103]
mov rdi, rcx
mov r12d, ebx
mov qword [rsp + 0x68], rsi
movdqu xmmword [r11 - 0x68], xmm0
cmp byte [rcx + 0x70], bl
je 0x7ff7903c2bd4
cmp byte [r14], bl
je 0x7ff7903c2ba9
cmp byte [r15], bl
je 0x7ff7903c2bb8
mov rbp, qword [rcx + 0x40]
mov rdx, qword [rcx + 0x68]
jmp 0x7ff7903c2bc0
cmp byte [r15], bl
jne 0x7ff7903c2bb8
mov rbp, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x60]
jmp 0x7ff7903c2bc0
mov rbp, qword [rcx + 0x50]
mov rdx, qword [rcx + 0x58]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop dword [rax + rax]
mov r12, rax
jmp 0x7ff7903c2be5
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColorBrush]
nop dword [rax + rax]
mov rbp, rax
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x8c]
mov rbp, rax
mov r9d, dword [rsp + 0x88]
mov r8d, dword [rsp + 0x84]
mov edx, dword [rsp + 0x80]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_Rectangle]
nop dword [rax + rax]
test rbp, rbp
je 0x7ff7903c2c42
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop dword [rax + rax]
test r12, r12
je 0x7ff7903c2c59
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop dword [rax + rax]
mov ebp, 1
mov rcx, rsi
mov edx, ebp
call qword [sym.imp.ext_ms_win_gdi_draw_l1_1_1.dll_SetBkMode]
nop dword [rax + rax]
mov dword [rsp + 0x58], eax
cmp byte [r14], bl
je 0x7ff7903c2c84
cmp byte [r15], bl
je 0x7ff7903c2c8e
mov ecx, 0x3ff
jmp 0x7ff7903c2c93
mov ecx, 0x3fd
cmp byte [r15], bl
je 0x7ff7903c2c93
mov ecx, 0x3fe
call fcn.7ff7901f3a2c
and eax, 0xffffff
mov rcx, rsi
mov edx, eax
call qword [sym.imp.GDI32.dll_SetTextColor]
nop dword [rax + rax]
mov r14, qword [rdi + 0xb0]
mov r12d, eax
mov eax, dword [rdi + 0x80]
neg eax
mov qword [rsp + 0x60], r14
mov rax, qword [rdi + 0x98]
sbb r15d, r15d
mov qword [rsp + 0x78], rax
and r15d, 0x20000
add r15d, 0x25
mov dword [rsp + 0x48], r15d
xor eax, eax
lock cmpxchg dword [0x7ff7904d9050], ebp
jne 0x7ff7903c2ce4
mov eax, dword [0x7ff7904d85e8]
mov r13d, 4
test eax, eax
jne 0x7ff7903c3259
mov ecx, 0x338
mov dword [rsp + 0x4c], ebx
mov dword [rsp + 0x50], ebx
call fcn.7ff7901b5eb0
mov qword [rsp + 0x70], rax
test rax, rax
je 0x7ff7903c3073
or dword [rsp + 0x44], 0xffffffff
lea r15, [rax + 7]
mov edi, dword [rsp + 0x44]
lea r13, [0x7ff79046b092]
mov ecx, ebx
mov esi, ebx
mov r14d, ebx
mov ebp, 0x67
movzx eax, byte [r13 - 1]
movzx r11d, byte [r13 - 2]
movzx r10d, byte [r13 + 2]
shl r11d, 8
or r11d, eax
shl r10d, 8
movzx eax, byte [r13]
lea r13, [r13 + 8]
shl r11d, 8
or r11d, eax
movzx eax, byte [r13 - 7]
shl r11d, 8
or r11d, eax
movzx eax, byte [r13 - 5]
or r10d, eax
xor r14d, r11d
movzx eax, byte [r13 - 4]
mov r9d, r14d
shl r10d, 8
or r10d, eax
movzx eax, byte [r13 - 3]
shl r10d, 8
or r10d, eax
xor esi, r10d
xor r9d, esi
xor r9d, 0xac987321
lea eax, [r9 + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, r9d
rol eax, 0xa
add edx, eax
xor r14d, edx
lea eax, [r14 + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, r14d
rol eax, 2
sub edx, eax
xor r9d, edx
imul edx, r9d, 0x605e
mov eax, r9d
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor r14d, edx
mov eax, r14d
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor r9d, edx
mov edx, r9d
xor edx, 0xab69605e
sub eax, edx
xor r14d, eax
mov eax, r14d
mov r8d, r14d
xor eax, 0x137f
ror r8d, 6
imul edx, eax, 0xab69
xor r8d, edx
xor r9d, r8d
lea eax, [r9 + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, r9d
rol eax, 2
add edx, eax
xor r14d, edx
lea eax, [r14 + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 8
sub edx, eax
xor r9d, edx
mov eax, r9d
mov r8d, 0xab69605e
xor eax, r8d
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, r9d
ror eax, 0xa
xor edx, eax
xor r14d, edx
mov eax, r14d
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, r14d
shr eax, 0xa
xor edx, eax
xor edx, r9d
mov r9d, 0x605e
mov eax, edx
not eax
ror eax, 5
add eax, r9d
imul eax, eax, 0x7f1
xor r14d, eax
lea esi, [r14 - 0x7f1]
xor esi, edx
xor esi, r8d
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor r14d, edx
lea eax, [r14 - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, r14d
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov r8d, esi
xor eax, 0x137f
ror r8d, 9
imul edx, eax, 0x605e
add r8d, edx
xor r14d, r8d
mov eax, r14d
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 7
add edx, eax
xor esi, edx
xor r14d, esi
xor r14d, 0xac987321
mov eax, r14d
ror eax, 3
imul edx, eax, 0x137f
sub edx, 0xd0dd417
xor esi, edx
lea eax, [rsi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor r14d, edx
lea eax, [r14 - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [rsi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor r14d, edx
mov eax, r14d
xor eax, r9d
imul edx, eax, 0xab69
mov eax, r14d
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, edi
rol eax, 2
mov byte [r15], sil
mov edi, r10d
ror esi, 8
mov byte [r15 - 1], sil
lea r15, [r15 + 8]
ror esi, 8
xor edx, eax
xor edx, ecx
mov byte [r15 - 0xa], sil
xor r14d, edx
ror esi, 8
mov byte [r15 - 0xc], r14b
mov ecx, r11d
ror r14d, 8
mov byte [r15 - 0xd], r14b
ror r14d, 8
mov byte [r15 - 0xe], r14b
ror r14d, 8
mov byte [r15 - 0xf], r14b
mov byte [r15 - 0xb], sil
ror r14d, 8
ror esi, 8
sub rbp, 1
jne 0x7ff7903c2d44
mov rdi, qword [rsp + 0x70]
mov rax, rbx
mov rsi, qword [rsp + 0x68]
mov cl, bl
mov r15d, dword [rsp + 0x48]
mov ebp, ebx
mov edx, 0x338
mov r13d, 4
xor cl, byte [rax + rdi]
inc rax
cmp rax, rdx
jb 0x7ff7903c304f
movzx eax, cl
cmp rax, qword [0x7ff79046b3c8]
je 0x7ff7903c30cb
mov rcx, rdi
call fcn.7ff7901665e4
mov r14, qword [rsp + 0x60]
lea rdi, [0x7ff7904d8920]
mov rbp, r13
cmp qword [rdi], rbx
je 0x7ff7903c3091
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
add rdi, 0x18
sub rbp, 1
jne 0x7ff7903c307d
xor edx, edx
lea r8d, [rbp + 0x60]
lea rcx, [0x7ff7904d8920]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x170
lea rdx, [0x7ff79044ce50]
lea rcx, [section..data]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
jmp 0x7ff7903c3261
mov byte [rdi + rdx - 1], bl
lea rcx, [0x7ff7904d8920]
xor edx, edx
lea r8d, [rdx + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r14, rdi
cmp byte [rdi], bl
je 0x7ff7903c3221
mov qword [rsp + 0x68], rdi
mov rdx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], bx
jne 0x7ff7903c30f8
lea rdi, [rdi + rax*2]
mov eax, dword [rsp + 0x50]
add rdi, 2
lea rcx, [rax + rax*2]
lea rax, [0x7ff7904d8920]
lea r14, [rax + rcx*8]
xor ecx, ecx
mov r8, r14
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
nop dword [rax + rax]
test eax, eax
je 0x7ff7903c3212
mov rax, qword [r14]
mov ecx, 0x5a4d
mov ebp, ebx
cmp word [rax], cx
je 0x7ff7903c314b
mov ebp, 0xc000007b
jmp 0x7ff7903c3196
movsxd rcx, dword [rax + 0x3c]
cmp ecx, 0x10000000
jae 0x7ff7903c3144
add rcx, qword [r14]
cmp rcx, qword [r14]
jb 0x7ff7903c3144
cmp dword [rcx], 0x4550
jne 0x7ff7903c3144
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
sub ax, dx
mov edx, 0xfeff
test dx, ax
je 0x7ff7903c3184
mov ebp, 0xc000000d
jmp 0x7ff7903c3196
mov rax, qword [rcx + 0x88]
mov qword [r14 + 0xc], rax
mov eax, dword [rcx + 0x50]
mov dword [r14 + 8], eax
mov eax, dword [rdi]
mov ecx, ebx
add rdi, r13
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], ebx
test eax, eax
je 0x7ff7903c3204
mov rdx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], bl
jne 0x7ff7903c31b0
inc rdi
add rdi, rax
test ebp, ebp
js 0x7ff7903c31ee
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
je 0x7ff7903c3217
mov eax, dword [rsp + 0x4c]
lea r8, [section..data]
mov ecx, dword [rsp + 0x44]
mov qword [r8 + rax*8], rdx
jmp 0x7ff7903c31f2
mov eax, dword [rsp + 0x4c]
inc eax
inc ecx
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x44], ecx
cmp ecx, dword [rsp + 0x48]
jb 0x7ff7903c31a9
inc dword [rsp + 0x50]
cmp byte [rdi], bl
jne 0x7ff7903c30f1
jmp 0x7ff7903c3217
mov ebp, 0xc000007a
mov r14, qword [rsp + 0x68]
test r14, r14
je 0x7ff7903c3241
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test ebp, ebp
js 0x7ff7903c306e
mov eax, dword [0x7ff7904d85e8]
mov ebp, 1
mov r14, qword [rsp + 0x60]
add eax, ebp
mov dword [0x7ff7904d85e8], eax
mov eax, ebx
xchg dword [0x7ff7904d9050], eax
movabs r10, 0xe62ca6fe305b8a70
mov rax, qword [0x7ff7904d5078]
mov rdx, r14
mov rcx, rsi
call qword [0x7ff79045bf28]
mov rdi, rax
movabs r10, 0xfa2817df7ad26370
mov rdx, qword [rsp + 0x78]
lea r9, [rsp + 0x80]
mov rax, qword [0x7ff7904d50d8]
or r8d, 0xffffffff
mov qword [rsp + 0x28], rbx
mov rcx, rsi
mov dword [rsp + 0x20], r15d
call qword [0x7ff79045bf28]
mov ebp, ebx
mov ecx, 0x80004005
test eax, eax
cmove ebp, ecx
test rdi, rdi
je 0x7ff7903c32ec
movabs r10, 0xe62ca6fe305b8a70
mov rax, qword [0x7ff7904d5078]
mov rdx, rdi
mov rcx, rsi
call qword [0x7ff79045bf28]
mov r14d, 1
xor eax, eax
lock cmpxchg dword [0x7ff7904d9050], r14d
jne 0x7ff7903c32f2
mov eax, dword [0x7ff7904d85e8]
test eax, eax
jle 0x7ff7903c3362
sub eax, r14d
mov dword [0x7ff7904d85e8], eax
jne 0x7ff7903c3362
lea r15, [0x7ff7904d8920]
mov rdi, r15
cmp qword [rdi], rbx
je 0x7ff7903c3332
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
add rdi, 0x18
sub r13, r14
jne 0x7ff7903c331e
xor edx, edx
lea r8d, [r13 + 0x60]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x170
lea rdx, [0x7ff79044ce50]
lea rcx, [section..data]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
xchg dword [0x7ff7904d9050], ebx
cmp r12d, 0xffffffff
je 0x7ff7903c3380
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SetTextColor]
nop dword [rax + rax]
mov edx, dword [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.ext_ms_win_gdi_draw_l1_1_1.dll_SetBkMode]
nop dword [rax + rax]
mov rax, qword [rsp + 0x90]
test byte [rax + 0x10], 0x10
je 0x7ff7903c33e5
movaps xmm0, xmmword [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov edx, 0xfffffffc
movdqa xmmword [rsp + 0x90], xmm0
mov r8d, edx
call qword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_InflateRect]
nop dword [rax + rax]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_DrawFocusRect]
nop dword [rax + rax]
mov eax, ebp
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff7901bf100
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret