Function at 0x6d9b2de0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x118
mov r10, qword [rcx + 0x20]
mov rsi, rcx
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0x108], r9
mov ecx, r8d
mov r9d, pe_nt_image_headers64
mov r8d, 0x1f
sar r9d, cl
lea rcx, [rsi + r10 + 1]
sub r8, r10
mov eax, r9d
neg eax
and eax, edx
xor edx, edx
or eax, r9d
mov byte [rsi + r10], al
call sub.msvcrt.dll_memset
mov eax, dword [rsi + 0x28]
mov r14d, eax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x84], eax
mov eax, dword [rsi + 0x30]
mov dword [rsp + 0x88], eax
mov eax, dword [rsi + 0x34]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsi + 0x38]
mov dword [rsp + 0xe0], eax
mov eax, dword [rsi + 0x3c]
mov r15d, eax
mov eax, dword [rsi + 0x40]
mov dword [rsp + 0xe4], eax
mov eax, dword [rsi + 0x44]
mov r10d, eax
mov eax, dword [rsi + 0x48]
mov dword [rsp + 0x50], eax
mov eax, dword [rsi + 0x4c]
mov dword [rsp + 0x60], eax
mov eax, dword [rsi + 0x50]
mov dword [rsp + 0x70], eax
mov eax, dword [rsi + 0x54]
mov dword [rsp + 0x90], eax
mov eax, dword [rsi + 0x58]
mov dword [rsp + 0xa0], eax
mov eax, dword [rsi + 0x5c]
mov dword [rsp + 0xb0], eax
mov eax, dword [rsi + 0x60]
mov dword [rsp + 0xc0], eax
mov eax, dword [rsi + 0x64]
mov dword [rsp + 0xd0], eax
mov rax, rsi
mov esi, dword [rsi + 0x68]
mov edx, dword [rax + 0x6c]
mov ebp, esi
mov dword [rsp + 0x38], edx
mov edx, dword [rax + 0x70]
mov dword [rsp + 0x3c], edx
mov edx, dword [rax + 0x74]
mov dword [rsp + 0x104], 2
mov dword [rsp + 0x40], edx
mov edx, dword [rax + 0x78]
mov dword [rsp + 0x28], edx
mov edx, dword [rax + 0x7c]
mov dword [rsp + 0x2c], edx
mov edx, dword [rax + 0x80]
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xe8]
mov r11d, dword [rax]
bswap r11d
mov ebx, dword [rax + 4]
bswap ebx
mov dword [rsp + 0x80], ebx
mov r9d, dword [rax + 8]
bswap r9d
mov r8d, dword [rax + 0xc]
bswap r8d
mov esi, dword [rax + 0x10]
bswap esi
mov edi, dword [rax + 0x14]
bswap edi
mov edx, dword [rax + 0x18]
bswap edx
mov ecx, dword [rax + 0x1c]
bswap ecx
mov eax, dword [rsp + 0x60]
xor eax, dword [rsp + 0x84]
mov ebx, r14d
xor ebx, r11d
mov r13d, dword [rsp + 0x50]
mov r12d, dword [rsp + 0x90]
mov dword [rsp + 0xf4], ebx
mov ebx, dword [rsp + 0x84]
xor r11d, ecx
xor ebx, dword [rsp + 0x80]
xor r12d, dword [rsp + 0x8c]
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0x38]
xor r13d, r14d
xor dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0xa0]
xor r13d, ebp
xor eax, dword [rsp + 0xe0]
mov r14d, dword [rsp + 0x70]
xor r14d, dword [rsp + 0x88]
xor r12d, dword [rsp + 0x40]
xor r14d, dword [rsp + 0x3c]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x28]
xor dword [rsp + 0x44], eax
mov eax, dword [rsp + 0xb0]
xor eax, r15d
xor r15d, edi
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x2c]
xor dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xc0]
xor eax, dword [rsp + 0xe4]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x30]
xor dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0xd0]
xor eax, r10d
xor eax, dword [rsp + 0x34]
xor r10d, ecx
mov dword [rsp + 0x84], ebx
mov ebx, dword [rsp + 0x88]
mov dword [rsp + 0xf8], r15d
mov r15d, dword [rsp + 0xe4]
mov dword [rsp + 0xfc], r10d
mov r10d, r8d
xor r10d, ecx
xor r12d, eax
xor r14d, eax
xor ebx, r9d
xor r13d, eax
xor r15d, edx
mov dword [rsp + 0x88], ebx
mov ebx, dword [rsp + 0x8c]
mov dword [rsp + 0xe4], r15d
mov r15d, r9d
mov r9d, dword [rsp + 0x50]
xor r15d, ecx
xor ebx, r8d
mov r8d, dword [rsp + 0x70]
xor r8d, dword [rsp + 0x80]
xor r9d, ecx
mov dword [rsp + 0x8c], ebx
mov ebx, dword [rsp + 0xe0]
mov dword [rsp + 0x100], r9d
mov r9d, dword [rsp + 0x60]
xor ebx, esi
mov dword [rsp + 0x70], r8d
mov r8d, dword [rsp + 0xa0]
xor r9d, r11d
mov dword [rsp + 0xe0], ebx
mov ebx, r11d
mov r11d, dword [rsp + 0x90]
mov dword [rsp + 0x60], r9d
mov r9d, dword [rsp + 0xc0]
xor r11d, r15d
xor r8d, r10d
xor ecx, edx
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x90], r11d
xor r9d, edi
mov r8d, dword [rsp + 0xb0]
mov r11d, dword [rsp + 0xd0]
xor ebp, edx
xor dword [rsp + 0x38], ecx
xor r9d, dword [rsp + 0x48]
xor ebp, eax
xor dword [rsp + 0x38], r13d
xor r8d, esi
xor r11d, edx
xor r8d, dword [rsp + 0x44]
xor r11d, dword [rsp + 0x4c]
xor dword [rsp + 0x50], r12d
xor dword [rsp + 0x3c], ebx
mov ebx, dword [rsp + 0x80]
xor dword [rsp + 0x28], edx
mov ecx, dword [rsp + 0xf0]
xor dword [rsp + 0x28], r15d
xor ebx, edx
xor dword [rsp + 0x2c], r10d
xor dword [rsp + 0x40], ebx
mov edx, dword [rsp + 0x44]
xor dword [rsp + 0x30], esi
mov esi, dword [rsp + 0x48]
xor dword [rsp + 0x2c], edx
xor dword [rsp + 0x34], edi
xor dword [rsp + 0x28], r12d
mov edi, dword [rsp + 0x4c]
xor dword [rsp + 0x3c], ecx
xor dword [rsp + 0x34], edi
xor dword [rsp + 0x40], r14d
xor dword [rsp + 0x30], esi
ror dword [rsp + 0x28], 0x1e
ror dword [rsp + 0x2c], 0x1e
ror dword [rsp + 0x30], 0x1e
mov r15d, dword [rsp + 0x100]
ror dword [rsp + 0x34], 0x1e
mov edx, dword [rsp + 0xe0]
mov r10d, dword [rsp + 0x60]
xor r15d, eax
shl r15, 0x20
xor eax, dword [rsp + 0xf4]
xor edx, r12d
rol r9d, 1
xor r10d, r13d
xor r13d, dword [rsp + 0x84]
shl r9, 0x20
rol r11d, 1
shl r10, 0x20
shl r11, 0x20
or r15, rax
mov eax, dword [rsp + 0x70]
or r10, r13
xor eax, ecx
mov rbx, rax
mov eax, dword [rsp + 0x88]
shl rbx, 0x20
xor eax, ecx
mov ecx, dword [rsp + 0x90]
or rbx, rax
mov eax, dword [rsp + 0x8c]
xor ecx, r14d
xor eax, r14d
shl rcx, 0x20
or rcx, rax
mov eax, dword [rsp + 0x50]
rol eax, 1
shl rax, 0x20
or rax, rdx
mov edx, r8d
mov r8d, dword [rsp + 0xf8]
xor r8d, dword [rsp + 0x44]
rol edx, 1
mov dword [rsp + 0x44], ebp
shl rdx, 0x20
or rdx, r8
mov r8d, dword [rsp + 0xe4]
xor r8d, esi
or r9, r8
mov r8d, dword [rsp + 0xfc]
xor r8d, edi
xor edi, edi
or r11, r8
mov rbp, rdi
nop
mov rdi, r10
mov r8, r9
xor rbx, rcx
or rdi, r15
or r8, rdx
xor r11, rax
xor rdi, rcx
xor r8, rax
and rcx, r15
and rax, rdx
not r10
not r9
xor r9, rax
xor r10, rcx
xor rax, r11
xor rcx, rbx
and r11, r8
and rbx, rdi
xor rbx, r10
mov r12, r11
or r10, rcx
xor r15, r10
xor r12, r9
not rdi
mov rsi, r12
mov r14d, r15d
xor r12, r15
xor rcx, rbx
xor rdi, r10
and rbx, r10
xor r12, rax
mov r10, r9
ror r14d, 0x1e
or r10, rax
xor r14d, r12d
mov r13, r12
not r8
ror r12d, 0x12
xor rdx, r10
xor r12d, r14d
and rsi, r10
xor r8, r10
shr r13, 0x20
ror r14d, 0x16
shr r15, 0x20
ror r15d, 0x1e
mov r9, rdx
mov edx, r12d
xor r15d, r13d
ror r13d, 0x12
xor r9, rdi
xor r13d, r15d
rol edx, 1
mov r11d, edi
mov eax, r13d
shr rdi, 0x20
ror r11d, 0x1e
rol eax, 1
mov r10, rdi
xor r11d, r9d
shl rax, 0x20
ror r10d, 0x1e
xor r8, rbx
or rax, rdx
mov rdx, r9
ror r9d, 0x12
shr rdx, 0x20
xor r9d, r11d
ror r11d, 0x16
xor r10d, edx
ror edx, 0x12
xor r11d, r9d
xor edx, r10d
ror r10d, 0x16
rol r9d, 1
xor r10d, edx
rol edx, 1
ror r15d, 0x16
shl r10, 0x20
shl rdx, 0x20
or r10, r11
or rdx, r9
mov r11d, ebx
mov r9, r8
shr r9, 0x20
ror r11d, 0x1e
shr rbx, 0x20
ror ebx, 0x1e
xor r11d, r8d
ror r8d, 0x12
xor ebx, r9d
ror r9d, 0x12
xor r8d, r11d
xor r9d, ebx
ror ebx, 0x16
ror r11d, 0x16
xor ebx, r9d
rol r9d, 1
xor rsi, rcx
xor r11d, r8d
shl rbx, 0x20
rol r8d, 1
shl r9, 0x20
or rbx, r11
mov r11, rsi
or r9, r8
mov r8d, ecx
shr rcx, 0x20
shr r11, 0x20
ror ecx, 0x1e
ror r8d, 0x1e
xor ecx, r11d
ror r11d, 0x12
xor r8d, esi
xor r11d, ecx
ror ecx, 0x16
ror esi, 0x12
xor ecx, r11d
xor esi, r8d
ror r8d, 0x16
shl rcx, 0x20
rol r11d, 1
xor r8d, esi
shl r11, 0x20
rol esi, 1
xor r15d, r13d
or r11, rsi
lea rsi, [0x6db1c240]
shl r15, 0x20
xor r12d, r14d
or rcx, r8
or r15, r12
xor r15, qword [rsi + rbp]
lea rsi, [0x6db1c200]
xor rax, qword [rsi + rbp]
add rbp, 8
cmp rbp, 0x40
jne 0x6d9b3250
mov dword [rsp + 0x84], r10d
shr r10, 0x20
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x60], r10
shr rbx, 0x20
mov dword [rsp + 0x8c], ecx
mov dword [rsp + 0xe0], eax
shr rcx, 0x20
shr rax, 0x20
mov dword [rsp + 0xe4], r9d
mov r10d, r11d
shr r9, 0x20
shr r11, 0x20
mov r14d, r15d
mov qword [rsp + 0x70], rbx
shr r15, 0x20
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc0], r9
mov qword [rsp + 0xd0], r11
mov ebp, dword [rsp + 0x44]
mov r9d, dword [rsp + 0x38]
mov esi, dword [rsp + 0x2c]
mov ebx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x28]
mov qword [rsp + 0x50], r15
mov r15d, edx
shr rdx, 0x20
mov qword [rsp + 0xb0], rdx
xor edx, edx
mov edi, r9d
xor ebx, ecx
not r9d
or edi, ebp
xor r11d, r8d
xor edi, ecx
and ecx, ebp
xor r9d, ecx
xor ecx, ebx
and ebx, edi
xor ebx, r9d
not edi
or r9d, ecx
xor ebp, r9d
xor ecx, ebx
mov r12d, r9d
and ebx, r9d
mov r9d, edi
mov edi, eax
or edi, esi
not eax
xor r9d, r12d
xor edi, r8d
and r8d, esi
xor eax, r8d
mov r12d, r8d
mov r8d, r11d
and r8d, edi
xor r12d, r11d
xor r8d, eax
or eax, r12d
mov r11d, r8d
xor r8d, ebp
xor esi, eax
and r11d, eax
xor r8d, r12d
mov r13d, eax
ror ebp, 0x1e
mov eax, edi
lea rdi, [0x6db1c1e0]
xor ebp, r8d
not eax
ror r8d, 0x12
xor r8d, ebp
xor eax, r13d
ror ebp, 0x16
xor ebp, r8d
ror r8d, 0x1f
xor esi, r9d
xor eax, ebx
xor r11d, ecx
xor ebp, dword [rdi + rdx]
ror r9d, 0x1e
ror ebx, 0x1e
ror ecx, 0x1e
lea rdi, [0x6db1c1c0]
xor r9d, esi
xor ebx, eax
xor ecx, r11d
ror esi, 0x12
ror eax, 0x12
ror r11d, 0x12
xor esi, r9d
xor eax, ebx
xor r11d, ecx
ror r9d, 0x16
ror ebx, 0x16
ror ecx, 0x16
xor r8d, dword [rdi + rdx]
add rdx, 4
xor r9d, esi
xor ebx, eax
xor ecx, r11d
ror esi, 0x1f
ror eax, 0x1f
ror r11d, 0x1f
cmp rdx, 0x20
jne 0x6d9b34c5
sub dword [rsp + 0x104], 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xe8]
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x3c], ebx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x34], r11d
mov dword [rsp + 0x28], r8d
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
jne 0x6d9b2f0e
mov edx, dword [rsp + 0x50]
mov ebx, r10d
xor edx, ebp
xor edx, r14d
bswap edx
mov rdi, qword [rsp + 0x108]
mov eax, dword [rsp + 0x60]
xor eax, dword [rsp + 0x38]
xor eax, dword [rsp + 0x84]
mov dword [rdi], edx
bswap eax
mov ecx, dword [rsp + 0x70]
xor ecx, dword [rsp + 0x3c]
mov dword [rdi + 4], eax
xor ecx, dword [rsp + 0x88]
bswap ecx
mov eax, dword [rsp + 0x90]
xor eax, dword [rsp + 0x40]
mov r10d, dword [rsp + 0x8c]
mov dword [rdi + 8], ecx
xor r10d, eax
bswap r10d
mov r14d, dword [rsp + 0xa0]
xor r14d, dword [rsp + 0x28]
mov dword [rdi + 0xc], r10d
xor r14d, dword [rsp + 0xe0]
bswap r14d
mov r13d, dword [rsp + 0xb0]
xor r13d, dword [rsp + 0x2c]
mov dword [rdi + 0x10], r14d
xor r13d, r15d
bswap r13d
mov r15d, dword [rsp + 0xc0]
xor r15d, dword [rsp + 0x30]
mov dword [rdi + 0x14], r13d
xor r15d, dword [rsp + 0xe4]
bswap r15d
cmp dword [rsp + 0x180], 7
mov dword [rdi + 0x18], r15d
jbe 0x6d9b36d2
mov r9d, dword [rsp + 0xd0]
xor r9d, dword [rsp + 0x34]
xor r9d, ebx
bswap r9d
mov dword [rdi + 0x1c], r9d
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret