Function at 0x4df9c0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x20], r9d
mov rax, rsp
sub rsp, 0x88
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
mov r15, qword [rcx + 0x10]
mov rbx, qword [r15 + 0x30]
xor r13d, r13d
mov esi, r9d
movsxd rdi, dword [rbx + 0x78]
mov rbp, r8
mov qword [rsp + 0xa0], r8
lea eax, [rdi + 1]
mov r12, rdx
mov r14, rcx
mov dword [rbx + 0x78], eax
lea eax, [rdi - 1]
mov qword [rsp + 0x30], r15
test edi, eax
jne 0x4dfa45
mov rdx, qword [rbx + 0x80]
mov rcx, qword [rbx]
lea eax, [rdi + rdi + 1]
movsxd r8, eax
shl r8, 2
call fcn.0043b230
mov qword [rbx + 0x80], rax
mov rcx, qword [rbx + 0x80]
mov edx, 0xffffffff
test rcx, rcx
je 0x4dfa59
mov dword [rcx + rdi*4], edx
movzx ecx, byte [r12 + 0x48]
mov r8d, edx
shr cl, 4
sub r8d, edi
not cl
mov dword [rsp + 0x98], r8d
and cl, 2
or cl, 0x44
cmp byte [rsp + 0xd8], r13b
mov byte [rsp + 0x90], cl
jne 0x4dfab1
movsx eax, word [rsp + 0xc0]
movzx edx, cl
mov r9d, r8d
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb8]
mov r8d, esi
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.0044f840
mov rax, qword [r14]
bt dword [rax + 0x2c], 0x13
jae 0x4dfad9
mov rcx, qword [r12 + 0x70]
mov rdx, qword [r12]
add rcx, 0x50
call fcn.00427900
test rax, rax
jne 0x4dfae2
cmp qword [r12 + 0x20], r13
jne 0x4dfae2
test rbp, rbp
je 0x4dfd74
test rbp, rbp
movzx esi, byte [rsp + 0xd0]
mov rbx, rbp
je 0x4dfb66
cmp byte [rbx + 0x10], 0x6d
jne 0x4dfb5d
test byte [rbx + 0x11], 3
je 0x4dfb5d
mov rcx, qword [rbx + 0x20]
xor edx, edx
call fcn.004360f0
test eax, eax
je 0x4dfb5d
mov rax, qword [r14 + 0x1c0]
mov rcx, r14
test rax, rax
cmovne rcx, rax
mov rax, qword [rcx + 0x278]
test rax, rax
je 0x4dfb43
nop
nop
cmp qword [rax], rbx
jne 0x4dfb3a
cmp dword [rax + 0x18], esi
je 0x4dfb54
mov rax, qword [rax + 8]
test rax, rax
jne 0x4dfb30
mov r9d, esi
mov r8, r12
mov rdx, rbx
mov rcx, r14
call fcn.004df050
test rax, rax
je 0x4dfb5d
or r13d, dword [rax + 0x1c]
mov rbx, qword [rbx + 0x40]
test rbx, rbx
jne 0x4dfaf2
mov rdx, r12
mov rcx, r14
call fcn.0046d790
mov edx, dword [r14 + 0x54]
movsx ecx, word [r12 + 0x42]
mov edi, eax
or edi, r13d
lea r13d, [rdx + 1]
lea edx, [rcx + rdx + 1]
mov dword [r14 + 0x54], edx
mov rcx, qword [r15 + 0x30]
movsxd rbx, dword [r15 + 0x3c]
cmp dword [rcx + 0x60], ebx
jg 0x4dfbaa
mov edx, 1
mov rcx, r15
call fcn.00441a80
test eax, eax
jne 0x4dfbe5
mov rax, qword [r15 + 8]
inc dword [r15 + 0x3c]
mov edx, dword [rsp + 0xb8]
lea rcx, [rbx + rbx*2]
mov byte [rax + rcx*8], reloc.WLDAP32.dll_Ordinal_33
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 4], edx
mov dword [rax + rcx*8 + 8], r13d
mov dword [rax + rcx*8 + 0xc], 0
mov qword [rax + rcx*8 + 0x10], 0
mov byte [rax + rcx*8 + 1], 0
xor ebx, ebx
cmp word [r12 + 0x42], bx
jle 0x4dfc33
mov ebp, dword [rsp + 0xa8]
cmp edi, 0xffffffff
je 0x4dfc05
cmp ebx, 0x1f
jg 0x4dfc1f
bt edi, ebx
jae 0x4dfc1f
lea eax, [rbx + r13 + 1]
mov r9d, ebx
mov r8d, ebp
mov rdx, r12
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.00480470
movsx eax, word [r12 + 0x42]
inc ebx
cmp ebx, eax
jl 0x4dfbf6
mov rbp, qword [rsp + 0xa0]
test rbp, rbp
mov edi, dword [r15 + 0x3c]
mov rbx, rbp
je 0x4dfc7c
mov ebp, dword [rsp + 0x98]
cmp byte [rbx + 0x10], 0x6d
jne 0x4dfc6b
cmp byte [rbx + 0x11], 1
jne 0x4dfc6b
mov r9d, r13d
mov r8, r12
mov rdx, rbx
mov rcx, r14
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
call fcn.004df6d0
mov rbx, qword [rbx + 0x40]
test rbx, rbx
jne 0x4dfc46
mov rbp, qword [rsp + 0xa0]
movsxd rbx, dword [r15 + 0x3c]
cmp edi, ebx
jge 0x4dfd4f
mov rax, qword [r15 + 0x30]
cmp dword [rax + 0x60], ebx
jg 0x4dfca9
mov edx, 1
mov rcx, r15
call fcn.00441a80
test eax, eax
je 0x4dfca9
mov ebx, 1
jmp 0x4dfcf3
mov rax, qword [r15 + 8]
inc dword [r15 + 0x3c]
mov dl, byte [rsp + 0x90]
lea rcx, [rbx + rbx*2]
mov byte [rax + rcx*8], dl
mov edx, dword [rsp + 0xa8]
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 4], edx
mov edx, dword [rsp + 0x98]
mov qword [rax + rcx*8 + 0x10], 0
mov dword [rax + rcx*8 + 8], edx
mov edx, dword [rsp + 0xb8]
mov byte [rax + rcx*8 + 1], 0
mov dword [rax + rcx*8 + 0xc], edx
mov rdi, qword [r15 + 8]
movsx rsi, word [rsp + 0xc0]
mov rcx, qword [r15]
test rdi, rdi
je 0x4dfd42
cmp byte [rcx + 0x50], 0
jne 0x4dfd42
test ebx, ebx
jns 0x4dfd18
mov ebx, dword [r15 + 0x3c]
dec ebx
movsxd rax, ebx
lea rbx, [rax + rax*2]
movsx edx, byte [rdi + rbx*8 + 1]
mov r8, qword [rdi + rbx*8 + 0x10]
call fcn.00441fd0
mov qword [rdi + rbx*8 + 0x10], 0
mov dword [rdi + rbx*8 + 0x10], esi
mov byte [rdi + rbx*8 + 1], 0xf2
jmp 0x4dfd4f
mov r8, rsi
mov edx, 0xfffffff2
call fcn.00441fd0
xor ebx, ebx
xor r9d, r9d
mov r8d, r13d
mov rdx, r12
mov rcx, r14
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call fcn.004c32f0
mov esi, dword [rsp + 0xa8]
jmp 0x4dfd76
xor ebx, ebx
cmp qword [r12 + 0x18], 0
jne 0x4dfe85
mov r9d, dword [rsp + 0xb0]
mov r8d, esi
mov rdx, r12
mov rcx, r14
mov qword [rsp + 0x20], rbx
call fcn.004900b0
mov rax, qword [r15 + 0x30]
movsxd rdi, dword [r15 + 0x3c]
cmp dword [rax + 0x60], edi
movzx ebx, byte [rsp + 0xc8]
jg 0x4dfdc3
mov edx, 1
mov rcx, r15
call fcn.00441a80
test eax, eax
jne 0x4dfdfa
inc dword [r15 + 0x3c]
mov rcx, qword [r15 + 8]
lea rdx, [rdi + rdi*2]
xor r8d, r8d
test bl, bl
mov byte [rcx + rdx*8], 0x5f
mov eax, r8d
setne al
mov byte [rcx + rdx*8 + 3], 0
mov dword [rcx + rdx*8 + 4], esi
mov dword [rcx + rdx*8 + 0xc], r8d
mov qword [rcx + rdx*8 + 0x10], r8
mov dword [rcx + rdx*8 + 8], eax
mov byte [rcx + rdx*8 + 1], r8b
test bl, bl
je 0x4dfe85
mov rbx, qword [r15 + 8]
mov rdi, qword [r12]
mov rcx, qword [r15]
test rbx, rbx
je 0x4dfe7b
cmp byte [rcx + 0x50], 0
jne 0x4dfe7b
mov eax, dword [r15 + 0x3c]
dec eax
cdqe
lea rsi, [rax + rax*2]
movsx edx, byte [rbx + rsi*8 + 1]
mov r8, qword [rbx + rsi*8 + 0x10]
call fcn.00441fd0
xor eax, eax
test rdi, rdi
mov qword [rbx + rsi*8 + 0x10], rax
jne 0x4dfe4a
mov qword [rbx + rsi*8 + 0x10], rax
mov byte [rbx + rsi*8 + 1], al
jmp 0x4dfe85
cmp byte [rdi], 0
mov rax, rdi
je 0x4dfe5a
inc rax
cmp byte [rax], 0
jne 0x4dfe52
mov rcx, qword [r15]
sub eax, edi
mov rdx, rdi
and eax, 0x3fffffff
movsxd r8, eax
call fcn.0043b390
mov byte [rbx + rsi*8 + 1], 0xff
mov qword [rbx + rsi*8 + 0x10], rax
jmp 0x4dfe85
mov r8, rdi
xor edx, edx
call fcn.00441fd0
mov rax, qword [r14]
bt dword [rax + 0x2c], 0x13
jae 0x4dffaf
mov r9, qword [r12 + 0x70]
mov r11, qword [r12]
lea rdi, [0x0069aea0]
mov r10, qword [r9 + 0x60]
test r10, r10
je 0x4dfef2
movzx ecx, byte [r11]
xor esi, esi
mov r8, r11
test cl, cl
mov eax, esi
je 0x4dfedc
nop
nop
movzx ecx, cl
inc r8
movzx edx, byte [rcx + rdi]
lea ecx, [rax*8]
xor edx, ecx
mov cl, byte [r8]
xor eax, edx
test cl, cl
jne 0x4dfec0
xor edx, edx
div dword [r9 + 0x50]
mov ecx, edx
add rcx, rcx
mov rbx, qword [r10 + rcx*8 + 8]
mov r9d, dword [r10 + rcx*8]
jmp 0x4dfefc
mov rbx, qword [r9 + 0x58]
mov r9d, dword [r9 + 0x54]
xor esi, esi
test r9d, r9d
je 0x4dffaf
nop
nop
nop
mov rdx, qword [rbx + 0x18]
dec r9d
mov r8, r11
movzx eax, byte [rdx]
test al, al
je 0x4dff4d
nop
nop
nop
nop
movzx ecx, al
movzx eax, byte [r8]
movzx eax, byte [rax + rdi]
cmp byte [rcx + rdi], al
jne 0x4dff4d
mov al, byte [rdx + 1]
inc rdx
inc r8
test al, al
jne 0x4dff30
movzx eax, byte [rdx]
movzx ecx, byte [rax + rdi]
movzx eax, byte [r8]
movzx eax, byte [rax + rdi]
cmp ecx, eax
je 0x4dff6a
test r9d, r9d
mov rbx, qword [rbx]
jne 0x4dff10
jmp 0x4dffaf
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x4dffaf
xor r9d, r9d
mov r8, rbx
mov rdx, r12
mov rcx, r14
call fcn.0046d990
test rax, rax
je 0x4dffa6
mov r9d, r13d
mov r8, r12
mov rdx, rax
mov rcx, r14
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
call fcn.004df6d0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x4dff73
test rbp, rbp
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
je 0x4e0007
mov r15d, dword [rsp + 0x98]
movzx ebx, byte [rsp + 0xd0]
nop
cmp byte [rbp + 0x10], 0x6d
jne 0x4dfff9
cmp byte [rbp + 0x11], 2
jne 0x4dfff9
movzx eax, bl
mov r9d, r13d
mov r8, r12
mov rdx, rbp
mov rcx, r14
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.004df6d0
mov rbp, qword [rbp + 0x40]
test rbp, rbp
jne 0x4dffd0
mov r15, qword [rsp + 0x30]
mov r8, qword [r15 + 0x30]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov eax, 0xffffffff
sub eax, dword [rsp + 0x98]
js 0x4e004b
mov rdx, qword [r8 + 0x80]
test rdx, rdx
je 0x4e004b
movsxd rcx, eax
mov eax, dword [r15 + 0x3c]
mov dword [rdx + rcx*4], eax
mov eax, dword [r15 + 0x3c]
mov r15, qword [rsp + 0x48]
dec eax
mov dword [r8 + 0x64], eax
add rsp, 0x88
ret