Function at 0x180011640
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0xb8]
sub rsp, 0x1a0
mov rax, qword [0x180280040]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, qword [rdx + 8]
add qword [rcx + 0x88], rsi
shr rsi, 6
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x60], rsi
test rsi, rsi
je 0x1800120be
mov eax, dword [rcx + 0x90]
mov rsi, qword [rdx]
mov dword [rsp + 0x28], eax
mov eax, dword [rcx + 0x94]
mov dword [rsp + 0x2c], eax
mov eax, dword [rcx + 0x98]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 0x9c]
mov qword [r11 + 0x10], rbx
lea rbx, [rsi + 6]
mov dword [rsp + 0x34], eax
mov eax, dword [rcx + 0xa0]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0xa4]
mov qword [r11 + 0x18], r12
mov dword [rsp + 0x3c], eax
mov eax, dword [rcx + 0xa8]
mov qword [r11 + 0x20], r13
mov dword [rsp + 0x40], eax
mov eax, dword [rcx + 0xac]
mov qword [r11 - 0x20], r14
mov dword [rsp + 0x44], eax
mov qword [r11 - 0x28], r15
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
nop dword [rax]
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0xc0
call sub.VCRUNTIME140.dll_memset
movzx eax, byte [rbx - 5]
movzx ecx, byte [rsi]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx - 1]
mov dword [rbp - 0x80], ecx
movzx ecx, byte [rbx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 3]
mov dword [rsp + 0x20], ecx
mov dword [rbp - 0x7c], ecx
movzx ecx, byte [rbx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 7]
mov dword [rbp - 0x78], ecx
movzx ecx, byte [rbx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xb]
mov dword [rbp - 0x74], ecx
movzx ecx, byte [rbx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xf]
mov dword [rbp - 0x70], ecx
movzx ecx, byte [rbx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x13]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x14]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x15]
shl ecx, 8
or ecx, eax
mov dword [rbp - 0x68], ecx
movzx eax, byte [rbx + 0x17]
movzx ecx, byte [rbx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x18]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1b]
mov dword [rbp - 0x64], ecx
movzx ecx, byte [rbx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1c]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1f]
mov dword [rbp - 0x60], ecx
movzx ecx, byte [rbx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x20]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x21]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x23]
mov dword [rbp - 0x5c], ecx
movzx ecx, byte [rbx + 0x22]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x24]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x25]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x27]
mov dword [rbp - 0x58], ecx
movzx ecx, byte [rbx + 0x26]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x28]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x29]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x2b]
mov dword [rbp - 0x54], ecx
movzx ecx, byte [rbx + 0x2a]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x2c]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x2d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x2f]
mov dword [rbp - 0x50], ecx
movzx ecx, byte [rbx + 0x2e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x30]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x31]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x33]
mov dword [rbp - 0x4c], ecx
movzx ecx, byte [rbx + 0x32]
shl ecx, 8
or ecx, eax
mov qword [rsp + 0x48], 4
movzx eax, byte [rbx + 0x34]
lea rsi, [rbp - 0x7c]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x35]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x37]
mov dword [rbp - 0x48], ecx
movzx ecx, byte [rbx + 0x36]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x38]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x39]
mov ebx, dword [rsp + 0x20]
shl ecx, 8
or ecx, eax
mov dword [rbp - 0x44], ecx
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rsi + 4]
mov r12d, ebx
mov r11d, dword [rsi + 0x34]
mov edx, r8d
mov r10d, dword [rsi + 0x38]
mov eax, ebx
mov r9d, dword [rsi + 8]
mov ecx, r11d
ror eax, 7
mov r15d, r10d
mov r13d, dword [rsi + 0x2c]
ror edx, 0x12
ror r12d, 0x12
xor r12d, eax
ror r15d, 0x13
ror ecx, 0x13
mov eax, ebx
shr eax, 3
xor r12d, eax
mov qword [rsp + 0x20], rsi
mov eax, r11d
ror eax, 0x11
xor ecx, eax
mov eax, r11d
shr eax, 0xa
xor ecx, eax
mov eax, r8d
ror eax, 7
add r12d, ecx
add r12d, dword [rsi - 4]
xor edx, eax
add r12d, dword [rsi + 0x20]
mov eax, r8d
shr eax, 3
mov r14d, r12d
xor edx, eax
ror r14d, 0x13
mov dword [rsi + 0x3c], r12d
mov eax, r10d
ror eax, 0x11
xor r15d, eax
mov eax, r10d
shr eax, 0xa
xor r15d, eax
lea eax, [rbx + rdx]
add r15d, eax
mov edx, r9d
add r15d, dword [rsi + 0x24]
mov eax, r9d
ror eax, 7
ror edx, 0x12
xor edx, eax
mov dword [rsi + 0x40], r15d
mov eax, r9d
shr eax, 3
xor edx, eax
mov eax, r12d
ror eax, 0x11
xor r14d, eax
mov eax, r12d
shr eax, 0xa
xor r14d, eax
lea eax, [r8 + rdx]
mov r8d, dword [rsi + 0xc]
add r14d, eax
add r14d, dword [rsi + 0x28]
mov eax, r8d
ror eax, 7
mov edx, r8d
ror edx, 0x12
xor edx, eax
mov dword [rsi + 0x44], r14d
mov eax, r8d
mov esi, r15d
shr eax, 3
xor edx, eax
ror esi, 0x13
mov eax, r15d
ror eax, 0x11
xor esi, eax
mov eax, r15d
shr eax, 0xa
mov edi, r14d
xor esi, eax
ror edi, 0x13
lea eax, [r9 + rdx]
add esi, eax
mov rax, qword [rsp + 0x20]
add esi, r13d
mov ecx, esi
ror ecx, 0x13
mov r9d, dword [rax + 0x10]
mov edx, r9d
mov ebx, dword [rax + 0x30]
mov dword [rax + 0x48], esi
add rax, 0x30
mov qword [rsp + 0x68], rax
mov eax, r9d
ror eax, 7
ror edx, 0x12
xor edx, eax
mov eax, r9d
shr eax, 3
xor edx, eax
mov eax, r14d
ror eax, 0x11
xor edi, eax
mov eax, r14d
shr eax, 0xa
xor edi, eax
lea eax, [r8 + rdx]
mov r8, qword [rsp + 0x20]
add edi, eax
add edi, ebx
mov dword [r8 + 0x4c], edi
mov r8d, dword [r8 + 0x14]
mov eax, r8d
ror eax, 7
mov edx, r8d
ror edx, 0x12
xor edx, eax
mov eax, r8d
shr eax, 3
xor edx, eax
mov eax, esi
ror eax, 0x11
xor ecx, eax
mov eax, esi
shr eax, 0xa
xor ecx, eax
lea eax, [r9 + rdx]
add ecx, eax
mov rax, qword [rsp + 0x20]
add r11d, ecx
mov ecx, edi
ror ecx, 0x13
mov r9d, dword [rax + 0x18]
mov edx, r9d
mov dword [rax + 0x50], r11d
mov eax, r9d
ror eax, 7
ror edx, 0x12
xor edx, eax
mov eax, r9d
shr eax, 3
xor edx, eax
mov eax, edi
ror eax, 0x11
xor ecx, eax
mov eax, edi
shr eax, 0xa
xor ecx, eax
lea eax, [r8 + rdx]
add ecx, eax
mov rax, qword [rsp + 0x20]
add r10d, ecx
mov r8d, dword [rax + 0x1c]
mov edx, r8d
mov dword [rax + 0x54], r10d
mov eax, r8d
ror edx, 0x12
ror eax, 7
xor edx, eax
mov ecx, r11d
ror ecx, 0x13
mov eax, r8d
shr eax, 3
xor edx, eax
mov eax, r11d
ror eax, 0x11
add r9d, edx
xor ecx, eax
shr r11d, 0xa
mov rax, qword [rsp + 0x20]
xor ecx, r11d
add r9d, ecx
mov ecx, r10d
ror ecx, 0x13
add r9d, r12d
mov r12d, dword [rax + 0x20]
mov edx, r12d
mov dword [rax + 0x58], r9d
mov eax, r12d
ror eax, 7
ror edx, 0x12
xor edx, eax
mov eax, r12d
shr eax, 3
xor edx, eax
mov eax, r10d
ror eax, 0x11
add r8d, edx
xor ecx, eax
shr r10d, 0xa
xor ecx, r10d
add r8d, ecx
mov ecx, r9d
ror ecx, 0x13
add r8d, r15d
mov r15, qword [rsp + 0x20]
mov r11d, dword [r15 + 0x24]
mov edx, r11d
mov r10d, dword [r15 + 0x28]
mov eax, r11d
ror eax, 7
ror edx, 0x12
xor edx, eax
mov dword [r15 + 0x5c], r8d
mov eax, r11d
shr eax, 3
xor edx, eax
mov eax, r9d
ror eax, 0x11
xor ecx, eax
shr r9d, 0xa
xor r9d, ecx
mov ecx, r8d
lea eax, [r12 + rdx]
ror ecx, 0x13
add r9d, eax
mov edx, r10d
ror edx, 0x12
add r9d, r14d
mov eax, r10d
mov dword [r15 + 0x60], r9d
ror eax, 7
xor edx, eax
mov eax, r10d
shr eax, 3
xor edx, eax
mov eax, r8d
ror eax, 0x11
xor ecx, eax
shr r8d, 0xa
xor ecx, r8d
lea eax, [r11 + rdx]
mov edx, r13d
add ecx, eax
ror edx, 0x12
add ecx, esi
mov eax, r13d
mov dword [r15 + 0x64], ecx
ror eax, 7
mov rsi, qword [rsp + 0x68]
xor edx, eax
shr r13d, 3
mov eax, r9d
ror eax, 0x11
mov ecx, r9d
ror ecx, 0x13
xor edx, r13d
xor ecx, eax
shr r9d, 0xa
xor ecx, r9d
lea eax, [r10 + rdx]
add ecx, eax
add ecx, edi
sub qword [rsp + 0x48], 1
mov dword [r15 + 0x68], ecx
jne 0x180011950
mov r9d, dword [rsp + 0x28]
xor edi, edi
mov r10d, dword [rsp + 0x2c]
mov r11d, dword [rsp + 0x30]
mov esi, dword [rsp + 0x34]
mov r14d, dword [rsp + 0x38]
mov r15d, dword [rsp + 0x3c]
mov r12d, dword [rsp + 0x40]
mov r13d, dword [rsp + 0x44]
mov rbx, qword [rsp + 0x58]
nop dword [rax + rax]
lea r8d, [rdi*8]
mov edx, r9d
ror edx, 0x16
mov eax, r14d
ror eax, 0xb
mov ecx, r14d
ror ecx, 0x19
xor ecx, eax
mov eax, r14d
ror eax, 6
xor ecx, eax
mov eax, r12d
xor eax, r15d
and eax, r14d
xor eax, r12d
add ecx, eax
lea rax, [0x180205d10]
add ecx, dword [rax + r8*4]
mov eax, r9d
add ecx, dword [rbp + r8*4 - 0x80]
ror eax, 0xd
add r13d, ecx
xor edx, eax
add esi, r13d
mov eax, r9d
mov ecx, r11d
ror eax, 2
or ecx, r10d
xor edx, eax
and ecx, r9d
mov eax, r11d
and eax, r10d
or ecx, eax
mov eax, esi
ror eax, 0xb
add r13d, ecx
add r13d, edx
mov ecx, esi
ror ecx, 0x19
lea edx, [r8 + 1]
xor ecx, eax
mov eax, esi
ror eax, 6
xor ecx, eax
mov eax, r15d
xor eax, r14d
and eax, esi
xor eax, r15d
add ecx, eax
lea rax, [0x180205d10]
add ecx, dword [rax + rdx*4]
mov eax, r13d
add ecx, dword [rbp + rdx*4 - 0x80]
mov edx, r13d
add r12d, ecx
ror eax, 0xd
add r11d, r12d
ror edx, 0x16
xor edx, eax
mov ecx, r10d
or ecx, r9d
mov eax, r13d
ror eax, 2
and ecx, r13d
xor edx, eax
mov eax, r10d
and eax, r9d
or ecx, eax
mov eax, r11d
add r12d, ecx
ror eax, 0xb
add r12d, edx
mov ecx, r11d
ror ecx, 0x19
lea edx, [r8 + 2]
xor ecx, eax
mov eax, r11d
ror eax, 6
xor ecx, eax
mov eax, r14d
xor eax, esi
and eax, r11d
xor eax, r14d
add ecx, eax
lea rax, [0x180205d10]
add ecx, dword [rax + rdx*4]
mov eax, r12d
add ecx, dword [rbp + rdx*4 - 0x80]
mov edx, r12d
ror eax, 0xd
add r15d, ecx
ror edx, 0x16
add r10d, r15d
xor edx, eax
mov ecx, r13d
or ecx, r9d
mov eax, r12d
ror eax, 2
and ecx, r12d
xor edx, eax
mov eax, r13d
and eax, r9d
or ecx, eax
mov eax, r10d
ror eax, 0xb
add r15d, ecx
add r15d, edx
mov ecx, r10d
ror ecx, 0x19
lea edx, [r8 + 3]
xor ecx, eax
mov eax, r10d
ror eax, 6
xor ecx, eax
mov eax, esi
xor eax, r11d
and eax, r10d
xor eax, esi
add ecx, eax
lea rax, [0x180205d10]
add ecx, dword [rax + rdx*4]
mov eax, r15d
add ecx, dword [rbp + rdx*4 - 0x80]
mov edx, r15d
ror eax, 0xd
add r14d, ecx
ror edx, 0x16
add r9d, r14d
xor edx, eax
mov ecx, r13d
or ecx, r12d
mov eax, r15d
ror eax, 2
and ecx, r15d
xor edx, eax
mov eax, r13d
and eax, r12d
or ecx, eax
mov eax, r9d
ror eax, 0xb
add r14d, ecx
add r14d, edx
mov ecx, r9d
ror ecx, 0x19
lea edx, [r8 + 4]
xor ecx, eax
mov eax, r9d
ror eax, 6
xor ecx, eax
mov eax, r11d
xor eax, r10d
and eax, r9d
xor eax, r11d
add ecx, eax
lea rax, [0x180205d10]
add ecx, dword [rax + rdx*4]
mov eax, r14d
add ecx, dword [rbp + rdx*4 - 0x80]
mov edx, r14d
add esi, ecx
add r13d, esi
ror edx, 0x16
ror eax, 0xd
mov ecx, r12d
xor edx, eax
or ecx, r15d
and ecx, r14d
mov eax, r14d
ror eax, 2
xor edx, eax
mov eax, r12d
and eax, r15d
or ecx, eax
mov eax, r13d
ror eax, 0xb
add esi, ecx
add esi, edx
mov ecx, r13d
ror ecx, 0x19
lea edx, [r8 + 5]
xor ecx, eax
mov eax, r13d
ror eax, 6
xor ecx, eax
mov eax, r10d
xor eax, r9d
and eax, r13d
xor eax, r10d
add ecx, eax
lea rax, [0x180205d10]
add ecx, dword [rax + rdx*4]
mov eax, esi
add ecx, dword [rbp + rdx*4 - 0x80]
mov edx, esi
ror eax, 0xd
add r11d, ecx
ror edx, 0x16
add r12d, r11d
xor edx, eax
mov ecx, r15d
or ecx, r14d
mov eax, esi
ror eax, 2
and ecx, esi
xor edx, eax
mov eax, r15d
and eax, r14d
or ecx, eax
mov eax, r12d
ror eax, 0xb
add r11d, ecx
add r11d, edx
mov ecx, r12d
ror ecx, 0x19
lea edx, [r8 + 6]
xor ecx, eax
mov eax, r12d
ror eax, 6
xor ecx, eax
mov eax, r13d
xor eax, r9d
and eax, r12d
xor eax, r9d
add ecx, eax
lea rax, [0x180205d10]
add ecx, dword [rax + rdx*4]
mov eax, r11d
add ecx, dword [rbp + rdx*4 - 0x80]
mov edx, r11d
ror eax, 0xd
add r10d, ecx
ror edx, 0x16
mov ecx, r14d
xor edx, eax
or ecx, esi
mov eax, r11d
add r15d, r10d
ror eax, 2
and ecx, r11d
xor edx, eax
mov eax, r14d
and eax, esi
or ecx, eax
add r10d, ecx
mov eax, r15d
ror eax, 0xb
add r10d, edx
lea edx, [r8 + 7]
mov ecx, r15d
ror ecx, 0x19
inc edi
xor ecx, eax
mov eax, r15d
ror eax, 6
xor ecx, eax
mov eax, r13d
xor eax, r12d
and eax, r15d
xor eax, r13d
add ecx, eax
lea rax, [0x180205d10]
add ecx, dword [rax + rdx*4]
mov eax, r10d
add ecx, dword [rbp + rdx*4 - 0x80]
mov edx, r10d
add r9d, ecx
ror eax, 0xd
ror edx, 0x16
add r14d, r9d
xor edx, eax
mov ecx, esi
or ecx, r11d
mov eax, r10d
ror eax, 2
and ecx, r10d
xor edx, eax
mov eax, esi
and eax, r11d
or ecx, eax
add r9d, ecx
add r9d, edx
cmp edi, 8
jl 0x180011ca0
mov rdi, qword [rsp + 0x70]
add rbx, 0x40
mov eax, dword [rsp + 0x28]
add eax, r9d
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x28], eax
mov dword [rdi + 0x90], eax
mov eax, dword [rsp + 0x2c]
add eax, r10d
mov dword [rsp + 0x2c], eax
mov dword [rdi + 0x94], eax
mov eax, dword [rsp + 0x30]
add eax, r11d
mov dword [rsp + 0x30], eax
mov dword [rdi + 0x98], eax
mov eax, dword [rsp + 0x34]
add eax, esi
mov esi, dword [rsp + 0x38]
add esi, r14d
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], esi
mov dword [rdi + 0xa0], esi
mov esi, dword [rsp + 0x3c]
add esi, r15d
mov dword [rdi + 0x9c], eax
mov dword [rsp + 0x3c], esi
mov dword [rdi + 0xa4], esi
mov esi, dword [rsp + 0x40]
add esi, r12d
mov dword [rsp + 0x40], esi
mov dword [rdi + 0xa8], esi
mov esi, dword [rsp + 0x44]
add esi, r13d
mov dword [rsp + 0x44], esi
mov dword [rdi + 0xac], esi
mov rsi, qword [rsp + 0x50]
add rsi, 0x40
sub qword [rsp + 0x60], 1
mov qword [rsp + 0x50], rsi
jne 0x180011700
mov r15, qword [rsp + 0x190]
mov r14, qword [rsp + 0x198]
mov r13, qword [rsp + 0x1d8]
mov r12, qword [rsp + 0x1d0]
mov rbx, qword [rsp + 0x1c8]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1801e4790
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret