Function at 0x140042340
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x110], rcx
mov rax, qword [rsp + 0x110]
mov ecx, edx
mov rsi, qword [rsp + 0x110]
mov r12, r9
mov rdx, qword [rax + 0x20]
mov eax, pe_nt_image_headers64
sarx r8d, eax, r8d
mov eax, r8d
neg eax
and eax, ecx
lea rcx, [rsi + rdx + 1]
or eax, r8d
mov r8d, 0x1f
mov byte [rsi + rdx], al
sub r8, rdx
xor edx, edx
call sym.memset
vpxor xmm0, xmm0, xmm0
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x4c]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0x90], 2
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x5c]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x64]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x110]
mov r15d, dword [rax + 0x68]
mov esi, dword [rax + 0x6c]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x110]
mov ebx, dword [rax + 0x74]
mov r11d, dword [rax + 0x78]
mov edi, dword [rax + 0x7c]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x128], r12
mov r12d, r15d
mov r8d, eax
mov eax, r8d
bswap eax
mov rdi, qword [rsp + 0x110]
mov dword [rsp + 0x98], eax
mov r14d, dword [rdi + 4]
bswap r14d
mov rdx, qword [rsp + 0x110]
mov edi, r14d
xor edi, ebx
mov dword [rsp + 0xb8], edi
mov r15d, dword [rdx + 8]
bswap r15d
mov rdx, qword [rsp + 0x110]
mov eax, dword [rdx + 0xc]
bswap eax
mov rdx, qword [rsp + 0x110]
mov edx, dword [rdx + 0x10]
bswap edx
mov rcx, qword [rsp + 0x110]
mov dword [rsp + 0x40], edx
mov r9d, dword [rcx + 0x14]
bswap r9d
mov rcx, qword [rsp + 0x110]
mov edx, dword [rcx + 0x18]
bswap edx
mov r8, qword [rsp + 0x110]
mov ecx, edx
mov r10d, edx
xor ecx, esi
xor r10d, r11d
mov dword [rsp + 0xbc], ecx
mov dword [rsp + 0xb4], r10d
mov ecx, dword [r8 + 0x1c]
bswap ecx
mov r10d, dword [rsp + 0x64]
mov r13d, dword [rsp + 0x4c]
mov edi, dword [rsp + 0x70]
mov r8d, dword [rsp + 0x74]
mov ebp, dword [rsp + 0x50]
xor r13d, r10d
mov r10d, dword [rsp + 0x54]
xor r13d, esi
xor ebp, edi
mov edi, dword [rsp + 0x78]
mov dword [rsp + 0x80], r13d
mov r13d, dword [rsp + 0x6c]
xor ebp, r11d
mov r11d, dword [rsp + 0x24]
xor r10d, r8d
mov r8d, dword [rsp + 0x58]
mov dword [rsp + 0x94], ebp
mov ebp, dword [rsp + 0x2c]
mov dword [rsp + 0x30], r10d
mov r10d, dword [rsp + 0x5c]
mov esi, dword [rsp + 0x30]
xor r8d, edi
mov edi, dword [rsp + 0x7c]
xor r11d, r8d
mov dword [rsp + 0x38], r11d
mov r11d, dword [rsp + 0x8c]
xor r10d, edi
mov edi, dword [rsp + 0x28]
xor r10d, ebp
xor ebx, r10d
xor esi, edi
mov edi, dword [rsp + 0x48]
mov dword [rsp + 0x30], esi
mov esi, dword [rsp + 0x88]
mov ebp, edi
xor edi, eax
xor eax, ecx
xor ebp, r13d
mov r13d, dword [rsp + 0x68]
mov r8d, ebp
mov ebp, r11d
xor r11d, r15d
xor r15d, ecx
xor r8d, ebx
mov ebx, dword [rsp + 0x20]
mov dword [rsp + 0xa8], r11d
mov dword [rsp + 0x48], r8d
mov r8d, r10d
xor ebp, r13d
mov r13d, esi
xor r8d, r12d
xor ebx, r10d
xor ebp, ebx
mov ebx, dword [rsp + 0x60]
xor r13d, ebx
mov ebx, esi
mov esi, dword [rsp + 0x98]
xor r13d, r8d
xor ebx, esi
xor esi, ecx
mov dword [rsp + 0xb0], ebx
mov ebx, dword [rsp + 0x4c]
xor ebx, r14d
mov dword [rsp + 0xac], ebx
mov dword [rsp + 0xa4], edi
mov r11d, dword [rsp + 0x58]
mov edi, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x54]
xor r11d, edx
mov dword [rsp + 0x98], r11d
mov r11d, r15d
mov r15d, dword [rsp + 0x60]
xor r8d, edi
xor ebx, r9d
mov dword [rsp + 0xa0], r8d
mov r8d, dword [rsp + 0x5c]
mov dword [rsp + 0x9c], ebx
mov ebx, dword [rsp + 0x78]
xor r15d, ecx
mov dword [rsp + 0x88], r15d
mov r15d, dword [rsp + 0x64]
xor r8d, ecx
mov dword [rsp + 0x8c], r8d
mov r8d, esi
xor r15d, esi
mov esi, dword [rsp + 0x74]
mov dword [rsp + 0x64], r15d
mov r15d, dword [rsp + 0x68]
xor r15d, r14d
mov r14d, dword [rsp + 0x70]
xor esi, edi
mov edi, dword [rsp + 0x7c]
mov dword [rsp + 0x60], r15d
mov r15d, dword [rsp + 0x6c]
xor ebx, r9d
xor r12d, edx
xor ecx, r13d
xor r14d, eax
xor edi, edx
xor edx, ebp
xor r15d, r11d
mov dword [rsp + 0x5c], r15d
mov r15d, dword [rsp + 0x48]
xor r15d, r14d
mov dword [rsp + 0x4c], r15d
mov r15d, dword [rsp + 0x94]
mov r14d, r15d
xor r14d, esi
mov esi, dword [rsp + 0x38]
mov dword [rsp + 0x50], r14d
mov r14d, dword [rsp + 0x30]
xor r14d, ebx
mov ebx, edi
mov edi, dword [rsp + 0x24]
xor ebx, esi
mov dword [rsp + 0x54], r14d
mov esi, dword [rsp + 0x28]
mov dword [rsp + 0x58], ebx
mov ebx, r12d
mov r12d, dword [rsp + 0x20]
xor eax, esi
xor r8d, r12d
mov r12d, dword [rsp + 0x40]
mov esi, dword [rsp + 0xbc]
xor eax, r15d
rorx eax, eax, 0x1e
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb0]
xor edi, r12d
mov r12d, dword [rsp + 0x2c]
xor esi, ecx
mov ecx, dword [rsp + 0x80]
xor r12d, r9d
mov r9d, dword [rsp + 0xb8]
xor ecx, r8d
mov r8d, dword [rsp + 0x80]
mov r14d, r12d
mov r12d, ebx
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x64]
xor r12d, r10d
xor r9d, edx
mov edx, dword [rsp + 0x48]
mov ebx, r9d
mov r9d, dword [rsp + 0xb4]
xor ecx, r13d
shl rcx, 0x20
xor r11d, edx
mov edx, dword [rsp + 0x30]
xor r11d, r9d
rorx r11d, r11d, 0x1e
xor edx, edi
mov edi, dword [rsp + 0x38]
rorx r9d, edx, 0x1e
mov dword [rsp + 0x24], r9d
xor r14d, edi
mov edi, dword [rsp + 0xa4]
rorx r9d, r14d, 0x1e
mov r14d, dword [rsp + 0x98]
mov dword [rsp + 0x2c], r9d
mov r9d, dword [rsp + 0x88]
xor r9d, r10d
xor r10d, eax
mov eax, dword [rsp + 0xac]
shl r9, 0x20
or r9, r10
rorx r10d, dword [rsp + 0x54], 0x1f
xor r13d, eax
mov eax, dword [rsp + 0x60]
shl r10, 0x20
or rcx, r13
mov r13d, dword [rsp + 0x48]
xor eax, r8d
mov rdx, rax
mov eax, dword [rsp + 0xa8]
shl rdx, 0x20
xor eax, r8d
mov r8d, dword [rsp + 0x9c]
or rdx, rax
mov eax, dword [rsp + 0x5c]
xor r8d, r15d
xor eax, ebp
xor ebp, edi
mov edi, dword [rsp + 0xa0]
shl rax, 0x20
or rax, rbp
rorx ebp, dword [rsp + 0x4c], 0x1f
shl rbp, 0x20
xor edi, r13d
rorx r13d, dword [rsp + 0x50], 0x1f
shl r13, 0x20
or r13, r8
mov r8d, dword [rsp + 0x30]
or rbp, rdi
xor r8d, r14d
mov r14d, dword [rsp + 0x8c]
or r10, r8
rorx r8d, dword [rsp + 0x58], 0x1f
mov r15d, dword [rsp + 0x38]
shl r8, 0x20
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x38], ebx
xor r14d, r15d
lea r15, [0x1401b9860]
or r8, r14
lea r14, [0x1401b98a0]
mov rsi, r8
mov r8, rcx
mov rcx, rsi
nop dword [rax]
mov rdi, r9
mov rbx, rdx
xor rcx, rbp
or rdi, r8
xor rbx, rax
xor rdi, rax
and rax, r9
xor r8, rax
mov rsi, rax
mov rax, rcx
not r8
xor rsi, rbx
and rbx, rdi
mov rdx, r8
xor rbx, r8
or rdx, rsi
xor rsi, rbx
xor r9, rdx
and rbx, rdx
xor rdx, rdi
mov rdi, r13
or rdi, r10
rorx r8d, r9d, 0x1e
not rdx
xor rdi, rbp
and rbp, r13
xor r10, rbp
and rax, rdi
xor rbp, rcx
not r10
mov rcx, rbp
xor rax, r10
or r10, rbp
xor rcx, rax
xor r13, r10
and rax, r10
xor rcx, r9
shr r9, 0x20
mov rbp, rcx
rorx r9d, r9d, 0x1e
xor r8d, ecx
rorx ecx, ecx, 0x12
shr rbp, 0x20
xor ecx, r8d
rorx r8d, r8d, 0x16
xor r9d, ebp
rorx ebp, ebp, 0x12
xor ebp, r9d
rorx r9d, r9d, 0x16
xor r9d, ebp
rorx ebp, ebp, 0x1f
xor r13, rdx
xor r8d, ecx
shl r9, 0x20
shl rbp, 0x20
rorx ecx, ecx, 0x1f
xor rdi, r10
or r9, r8
or rbp, rcx
rorx r8d, edx, 0x1e
mov rcx, r13
shr rdx, 0x20
shr rcx, 0x20
xor r8d, r13d
rorx r13d, r13d, 0x12
rorx edx, edx, 0x1e
xor r13d, r8d
xor rdi, rbx
rorx r8d, r8d, 0x16
xor edx, ecx
rorx ecx, ecx, 0x12
xor r8d, r13d
not rdi
xor ecx, edx
rorx edx, edx, 0x16
rorx r13d, r13d, 0x1f
mov r10, rdi
xor edx, ecx
rorx ecx, ecx, 0x1f
shr r10, 0x20
shl rcx, 0x20
shl rdx, 0x20
or r13, rcx
rorx ecx, ebx, 0x1e
shr rbx, 0x20
or r8, rdx
rorx ebx, ebx, 0x1e
xor ecx, edi
rorx edi, edi, 0x12
xor ebx, r10d
rorx r10d, r10d, 0x12
xor edi, ecx
rorx ecx, ecx, 0x16
xor r10d, ebx
rorx edx, ebx, 0x16
xor ecx, edi
rorx edi, edi, 0x1f
xor edx, r10d
rorx r10d, r10d, 0x1f
shl rdx, 0x20
shl r10, 0x20
or rdx, rcx
or r10, rdi
xor rax, rsi
rorx edi, esi, 0x1e
mov rcx, rax
shr rsi, 0x20
xor edi, eax
rorx ebx, eax, 0x12
shr rcx, 0x20
rorx esi, esi, 0x1e
xor ebx, edi
rorx edi, edi, 0x16
xor esi, ecx
rorx ecx, ecx, 0x12
xor edi, ebx
xor r9, qword [r14]
xor ecx, esi
rorx eax, esi, 0x16
rorx ebx, ebx, 0x1f
xor rbp, qword [r15]
xor eax, ecx
rorx ecx, ecx, 0x1f
add r14, 8
shl rax, 0x20
shl rcx, 0x20
lea rsi, [0x1401b98e0]
add r15, 8
or rax, rdi
or rcx, rbx
cmp r14, rsi
jne 0x140042920
mov rdi, rcx
mov dword [rsp + 0x8c], edx
mov dword [rsp + 0x48], eax
shr rdx, 0x20
shr rax, 0x20
mov dword [rsp + 0x58], r10d
shr r10, 0x20
mov rcx, r8
mov r14, r13
mov esi, dword [rsp + 0x30]
mov dword [rsp + 0x4c], r8d
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x78], r10d
mov r13, r10
mov dword [rsp + 0x5c], edi
mov r10, rdi
mov qword [rsp + 0x30], rdx
mov r15, rbp
shr rcx, 0x20
mov dword [rsp + 0x88], r9d
shr r15, 0x20
shr r9, 0x20
mov ebx, dword [rsp + 0x38]
mov qword [rsp + 0x38], rax
shr r14, 0x20
shr r10, 0x20
mov edi, dword [rsp + 0x28]
mov qword [rsp + 0x40], r9
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0x64], ecx
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x70], r15d
lea rcx, [0x1401b9840]
mov dword [rsp + 0x74], r14d
mov dword [rsp + 0x7c], r10d
lea r9, [0x1401b9820]
mov r8d, dword [rsp + 0x24]
mov edx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x20]
nop dword [rax + rax]
mov ebp, r12d
xor eax, ebx
xor edx, r11d
or ebp, esi
xor ebp, ebx
and ebx, r12d
xor esi, ebx
xor ebx, eax
and eax, ebp
not esi
xor eax, esi
or esi, ebx
xor r12d, esi
xor ebx, eax
and eax, esi
xor esi, ebp
mov ebp, edi
not esi
or ebp, r8d
xor ebp, r11d
and r11d, edi
xor r8d, r11d
xor r11d, edx
and edx, ebp
not r8d
xor edx, r8d
or r8d, r11d
xor edi, r8d
xor r11d, edx
and edx, r8d
xor r11d, r12d
xor edi, esi
rorx r12d, r12d, 0x1e
rorx esi, esi, 0x1e
xor r12d, r11d
xor esi, edi
rorx r11d, r11d, 0x12
rorx edi, edi, 0x12
xor r11d, r12d
xor edi, esi
rorx r12d, r12d, 0x16
rorx esi, esi, 0x16
xor r12d, r11d
xor esi, edi
xor ebp, r8d
xor edx, ebx
xor ebp, eax
rorx eax, eax, 0x1e
rorx ebx, ebx, 0x1e
xor r12d, dword [rcx]
not ebp
xor ebx, edx
rorx edx, edx, 0x12
xor eax, ebp
rorx ebp, ebp, 0x12
xor edx, ebx
add rcx, 4
xor ebp, eax
rorx eax, eax, 0x16
rorx ebx, ebx, 0x16
rorx r11d, r11d, 0x1f
xor eax, ebp
rorx r8d, ebp, 0x1f
lea rbp, [0x1401b9860]
xor r11d, dword [r9]
xor ebx, edx
rorx edi, edi, 0x1f
rorx edx, edx, 0x1f
add r9, 4
cmp rcx, rbp
jne 0x140042be0
mov dword [rsp + 0x24], r8d
xor r8d, r8d
cmp dword [rsp + 0x90], 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x2c], edx
mov rdi, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
vmovdqu ymmword [rdi], ymm0
je 0x140042d20
mov dword [rsp + 0x90], 1
jmp 0x140042505
mov rdi, qword [rsp + 0x40]
mov r8d, ebx
mov rbx, rax
mov eax, dword [rsp + 0x88]
mov rbp, r15
mov r15d, r12d
mov rcx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x128]
mov dword [rsp + 0x30], r11d
xor eax, edi
xor eax, r15d
bswap eax
mov dword [r12], eax
mov eax, dword [rsp + 0x4c]
xor eax, ecx
xor eax, esi
bswap eax
mov dword [r12 + 4], eax
mov eax, dword [rsp + 0x8c]
xor eax, edx
mov edx, dword [rsp + 0x20]
xor eax, edx
bswap eax
mov dword [r12 + 8], eax
mov eax, dword [rsp + 0x48]
xor eax, ebx
xor eax, r8d
bswap eax
mov dword [r12 + 0xc], eax
mov eax, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x30]
xor eax, ebp
xor eax, ebx
bswap eax
mov dword [r12 + 0x10], eax
mov eax, dword [rsp + 0x54]
mov esi, dword [rsp + 0x28]
xor eax, r14d
xor eax, esi
bswap eax
mov dword [r12 + 0x14], eax
mov eax, dword [rsp + 0x58]
mov esi, dword [rsp + 0x24]
xor eax, r13d
xor eax, esi
bswap eax
cmp dword [rsp + 0x130], 8
mov dword [r12 + 0x18], eax
jne 0x140042de6
mov eax, dword [rsp + 0x5c]
mov esi, dword [rsp + 0x2c]
xor eax, r10d
xor eax, esi
bswap eax
mov dword [r12 + 0x1c], eax
vzeroupper
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret