Function at 0x539160
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x128], r9
mov r9, qword [rcx + 0x20]
mov ecx, pe_nt_image_headers64
sarx r8d, ecx, r8d
mov eax, r8d
neg eax
mov rsi, qword [rsp + 0x110]
and eax, edx
lea rcx, [r9 + 1]
or eax, r8d
mov byte [rsi + r9], al
mov r9, rcx
add r9, rsi
mov r8d, 0x20
sub r8, rcx
xor edx, edx
mov rcx, r9
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x94], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x48]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x4c]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x110]
mov r12d, dword [rax + 0x5c]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x64]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x110]
mov esi, dword [rax + 0x68]
mov eax, dword [rax + 0x6c]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x110]
mov r11d, dword [rax + 0x78]
mov r15d, dword [rax + 0x74]
mov eax, dword [rax + 0x7c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x80]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0x84]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x110]
mov r8d, dword [rax]
mov dword [rsp + 0xbc], 2
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x48], r11d
mov ecx, r8d
bswap ecx
mov eax, dword [rax + 4]
bswap eax
mov rsi, qword [rsp + 0x110]
mov dword [rsp + 0x50], eax
mov esi, dword [rsi + 8]
mov r13d, esi
bswap r13d
mov rsi, qword [rsp + 0x110]
mov esi, dword [rsi + 0xc]
mov r10d, esi
bswap r10d
mov rsi, qword [rsp + 0x110]
mov esi, dword [rsi + 0x10]
mov r8d, esi
bswap r8d
mov rsi, qword [rsp + 0x110]
mov esi, dword [rsi + 0x14]
mov r9d, esi
bswap r9d
mov rsi, qword [rsp + 0x110]
mov esi, dword [rsi + 0x18]
mov eax, esi
bswap eax
mov rsi, qword [rsp + 0x110]
mov esi, dword [rsi + 0x1c]
mov ebx, esi
bswap ebx
mov edx, dword [rsp + 0x54]
mov r11d, dword [rsp + 0x40]
xor edx, dword [rsp + 0x58]
mov dword [rsp + 0x40], edx
mov r14d, dword [rsp + 0x80]
mov esi, dword [rsp + 0x90]
xor r14d, dword [rsp + 0x78]
xor esi, dword [rsp + 0x88]
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0xa8], esi
mov r14d, dword [rsp + 0x84]
mov esi, dword [rsp + 0x40]
xor r14d, r12d
xor esi, dword [rsp + 0x2c]
mov dword [rsp + 0xa4], r14d
mov dword [rsp + 0xb4], esi
mov edi, dword [rsp + 0x68]
mov esi, dword [rsp + 0xa0]
xor edi, dword [rsp + 0x60]
xor esi, dword [rsp + 0x48]
mov dword [rsp + 0xa0], esi
mov r14d, dword [rsp + 0x94]
mov esi, dword [rsp + 0xa4]
mov edx, edi
mov edi, dword [rsp + 0x6c]
xor esi, dword [rsp + 0x30]
xor edi, dword [rsp + 0x70]
xor r14d, dword [rsp + 0x98]
xor r14d, dword [rsp + 0x28]
xor edi, r15d
mov dword [rsp + 0x40], esi
mov esi, dword [rsp + 0xa8]
xor edi, r14d
xor esi, dword [rsp + 0x38]
mov dword [rsp + 0xa4], edi
mov ebp, dword [rsp + 0x4c]
xor edx, dword [rsp + 0x34]
xor edx, r14d
xor ebp, r11d
mov dword [rsp + 0xa8], edx
mov edx, dword [rsp + 0x54]
xor ebp, dword [rsp + 0x3c]
xor ebp, r14d
xor edx, dword [rsp + 0x50]
mov edi, dword [rsp + 0x6c]
mov dword [rsp + 0xac], ebp
mov dword [rsp + 0x54], edx
mov ebp, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x68]
xor ebp, ecx
xor edx, r13d
xor edi, r10d
mov dword [rsp + 0xb0], ebp
mov dword [rsp + 0x68], edx
mov ebp, dword [rsp + 0x84]
mov edx, dword [rsp + 0x94]
mov dword [rsp + 0x6c], edi
mov edi, dword [rsp + 0x80]
xor ebp, r9d
xor edi, r8d
xor edx, ebx
xor r10d, ebx
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x84], ebp
mov edi, dword [rsp + 0x90]
mov ebp, dword [rsp + 0x58]
mov dword [rsp + 0x94], edx
mov edx, r10d
mov r10d, r13d
mov r13d, r11d
mov r11d, dword [rsp + 0x60]
xor ecx, ebx
xor r10d, ebx
xor edi, eax
xor r13d, ebx
xor ebp, ecx
xor r11d, dword [rsp + 0x50]
mov dword [rsp + 0xb8], r11d
mov r11d, dword [rsp + 0x70]
mov dword [rsp + 0x90], edi
xor r11d, r10d
mov dword [rsp + 0x70], r11d
mov r11d, dword [rsp + 0x88]
mov edi, dword [rsp + 0x78]
xor r11d, r9d
mov dword [rsp + 0x58], r11d
mov r11d, dword [rsp + 0x98]
xor edi, edx
xor r11d, eax
mov dword [rsp + 0x4c], r11d
xor edi, dword [rsp + 0xa4]
mov r11d, dword [rsp + 0x58]
xor ecx, dword [rsp + 0x34]
xor r11d, dword [rsp + 0x40]
mov dword [rsp + 0x58], r11d
mov r11d, dword [rsp + 0x4c]
mov dword [rsp + 0x4c], esi
xor r11d, esi
mov esi, dword [rsp + 0x3c]
mov dword [rsp + 0x60], r11d
xor esi, eax
xor esi, r14d
mov dword [rsp + 0x3c], esi
mov esi, dword [rsp + 0x2c]
mov r11d, dword [rsp + 0x48]
xor esi, eax
xor ebx, esi
xor ebx, dword [rsp + 0xac]
mov dword [rsp + 0x2c], ebx
mov ebx, dword [rsp + 0xb4]
xor r11d, eax
xor ecx, ebx
xor r11d, r10d
mov dword [rsp + 0x34], ecx
mov ecx, dword [rsp + 0x50]
mov r10d, r11d
mov r11d, dword [rsp + 0xa4]
xor ecx, r15d
mov r15d, dword [rsp + 0xa8]
mov esi, dword [rsp + 0xa0]
xor ecx, eax
xor r10d, r11d
xor edx, dword [rsp + 0x30]
xor r9d, dword [rsp + 0x28]
xor r15d, ecx
xor r12d, r8d
rorx ecx, r10d, 0x1e
xor r8d, dword [rsp + 0x38]
mov r10d, r13d
mov r13d, dword [rsp + 0xb0]
xor edx, esi
xor r8d, dword [rsp + 0x40]
xor r9d, dword [rsp + 0x4c]
xor r10d, r14d
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 0xac]
xor r12d, dword [rsp + 0xa0]
xor r13d, r14d
rorx eax, edx, 0x1e
shl r10, 0x20
mov dword [rsp + 0x30], eax
rorx eax, r8d, 0x1e
mov dword [rsp + 0x38], eax
rorx eax, r9d, 0x1e
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x54]
or r10, r13
xor ebp, ecx
xor eax, ecx
shl rbp, 0x20
mov ecx, dword [rsp + 0xb8]
or rbp, rax
mov eax, dword [rsp + 0x68]
xor ecx, ebx
xor eax, ebx
shl rcx, 0x20
mov r8d, dword [rsp + 0xa8]
or rcx, rax
mov eax, dword [rsp + 0x70]
rorx edi, edi, 0x1f
xor eax, r8d
mov rdx, rax
mov eax, dword [rsp + 0x6c]
shl rdx, 0x20
xor eax, r8d
or rdx, rax
mov eax, dword [rsp + 0x80]
shl rdi, 0x20
xor eax, r11d
or rdi, rax
mov eax, dword [rsp + 0x90]
mov r13d, dword [rsp + 0x84]
xor eax, dword [rsp + 0x40]
rorx r9d, dword [rsp + 0x58], 0x1f
shl r9, 0x20
or r9, rax
mov eax, dword [rsp + 0x94]
xor r13d, esi
rorx r12d, r12d, 0x1f
shl r12, 0x20
or r12, r13
xor eax, dword [rsp + 0x4c]
rorx r8d, dword [rsp + 0x60], 0x1f
shl r8, 0x20
or r8, rax
mov dword [rsp + 0x40], r15d
mov esi, dword [rsp + 0x3c]
mov r15, r12
mov r12d, dword [rsp + 0x48]
mov r13, rdx
lea r14, [0x0077ad40]
mov rdx, r8
lea r11, [0x0077ad00]
mov r8, rbp
nop
mov rax, r10
or rax, r8
xor rcx, r13
xor rax, r13
and r13, r10
xor r8, r13
xor r13, rcx
and rcx, rax
mov rbx, rcx
mov rcx, r15
or rcx, r9
xor rcx, rdi
xor rdx, rdi
and rdi, r15
xor r9, rdi
not r9
xor rdi, rdx
and rdx, rcx
xor rdx, r9
not r8
or r9, rdi
xor rbx, r8
xor rdi, rdx
or r8, r13
xor r10, r8
xor r13, rbx
xor rax, r8
and rbx, r8
mov r8, rdi
xor r8, r10
mov rbp, r10
mov rdi, r8
shr rdi, 0x20
shr rbp, 0x20
rorx ebp, ebp, 0x1e
xor ebp, edi
rorx r10d, r10d, 0x1e
rorx edi, edi, 0x12
xor r10d, r8d
xor edi, ebp
not rax
xor r15, r9
and rdx, r9
rorx r8d, r8d, 0x12
rorx ebp, ebp, 0x16
xor r8d, r10d
xor ebp, edi
shl rbp, 0x20
xor r15, rax
rorx r10d, r10d, 0x16
xor r10d, r8d
or r10, rbp
rorx edi, edi, 0x1f
mov rbp, r15
shl rdi, 0x20
shr rbp, 0x20
xor r9, rcx
rorx r8d, r8d, 0x1f
or rdi, r8
rorx r8d, eax, 0x1e
shr rax, 0x20
xor r9, rbx
rorx eax, eax, 0x1e
xor eax, ebp
xor r8d, r15d
not r9
rorx ebp, ebp, 0x12
xor ebp, eax
mov rcx, r9
rorx r15d, r15d, 0x12
rorx eax, eax, 0x16
xor r15d, r8d
xor eax, ebp
rorx ebp, ebp, 0x1f
shl rbp, 0x20
shr rcx, 0x20
rorx r8d, r8d, 0x16
xor r8d, r15d
rorx r15d, r15d, 0x1f
or r15, rbp
rorx ebp, ebx, 0x1e
shr rbx, 0x20
shl rax, 0x20
rorx ebx, ebx, 0x1e
xor ebx, ecx
xor ebp, r9d
or r8, rax
rorx eax, r9d, 0x12
rorx r9d, ecx, 0x12
xor r9d, ebx
xor eax, ebp
rorx ecx, ebx, 0x16
xor ecx, r9d
shl rcx, 0x20
rorx ebp, ebp, 0x16
rorx r9d, r9d, 0x1f
xor ebp, eax
shl r9, 0x20
or rcx, rbp
rorx eax, eax, 0x1f
or r9, rax
xor rdx, r13
mov rbp, rdx
mov rbx, rdx
rorx edx, r13d, 0x1e
mov eax, edx
xor eax, ebp
shr rbx, 0x20
shr r13, 0x20
rorx edx, eax, 0x16
rorx ebp, ebp, 0x12
xor ebp, eax
rorx eax, r13d, 0x1e
xor eax, ebx
rorx ebx, ebx, 0x12
xor ebx, eax
rorx r13d, eax, 0x16
xor r13d, ebx
xor edx, ebp
shl r13, 0x20
or r13, rdx
xor r10, qword [r14]
rorx edx, ebx, 0x1f
add r14, 8
shl rdx, 0x20
lea rax, [0x0077ad80]
xor rdi, qword [r11]
rorx ebp, ebp, 0x1f
add r11, 8
or rdx, rbp
cmp r14, rax
jne 0x539720
mov rbp, r8
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x90], r9d
shr rbp, 0x20
shr r9, 0x20
mov r8, rdx
mov dword [rsp + 0x4c], r10d
mov dword [rsp + 0x68], ecx
shr r10, 0x20
shr rcx, 0x20
mov dword [rsp + 0x80], edi
mov rdx, r13
shr rdi, 0x20
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x6c], r13d
mov qword [rsp + 0x88], r9
shr rdx, 0x20
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x94], r8d
mov r11d, r12d
shr r8, 0x20
mov r12, r15
mov ebx, dword [rsp + 0x2c]
mov r15d, dword [rsp + 0x40]
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x40], r10
mov edi, dword [rsp + 0x38]
mov r10d, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x84], r12d
mov qword [rsp + 0x98], r8
shr r12, 0x20
lea rdx, [0x0077ace0]
lea r8, [0x0077acc0]
nop word [rax + rax]
mov r9d, esi
or r9d, ebx
xor r9d, r15d
xor eax, r15d
and r15d, esi
xor ebx, r15d
not ebx
xor r15d, eax
and eax, r9d
xor eax, ebx
or ebx, r15d
xor esi, ebx
xor r15d, eax
and eax, ebx
xor ebx, r9d
mov r9d, r10d
or r9d, edi
xor ecx, r11d
xor r9d, r11d
and r11d, r10d
xor edi, r11d
not edi
xor r11d, ecx
and ecx, r9d
xor ecx, edi
or edi, r11d
xor r10d, edi
xor r11d, ecx
not ebx
xor r11d, esi
xor r10d, ebx
rorx esi, esi, 0x1e
rorx ebx, ebx, 0x1e
xor esi, r11d
xor ebx, r10d
rorx r11d, r11d, 0x12
rorx r10d, r10d, 0x12
xor r11d, esi
xor r10d, ebx
and ecx, edi
rorx esi, esi, 0x16
rorx ebx, ebx, 0x16
xor esi, r11d
xor ebx, r10d
xor r9d, edi
xor r9d, eax
xor ecx, r15d
not r9d
rorx eax, eax, 0x1e
rorx r15d, r15d, 0x1e
xor eax, r9d
xor r15d, ecx
xor esi, dword [rdx]
rorx r9d, r9d, 0x12
rorx ecx, ecx, 0x12
xor r9d, eax
xor ecx, r15d
add rdx, 4
lea r14, [0x0077ad00]
rorx r11d, r11d, 0x1f
rorx eax, eax, 0x16
xor r11d, dword [r8]
rorx r15d, r15d, 0x16
xor eax, r9d
xor r15d, ecx
add r8, 4
rorx r10d, r10d, 0x1f
rorx edi, r9d, 0x1f
rorx ecx, ecx, 0x1f
cmp rdx, r14
jne 0x5399d0
mov dword [rsp + 0x3c], esi
mov edx, esi
mov rsi, qword [rsp + 0x110]
mov dword [rsp + 0x28], ecx
xor ecx, ecx
cmp dword [rsp + 0xbc], 1
mov dword [rsp + 0x2c], ebx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x48], r11d
mov qword [rsi], 0
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0
mov r13d, r10d
mov ebp, edi
jne 0x539c00
mov r9d, dword [rsp + 0x40]
xor r9d, edx
xor r9d, dword [rsp + 0x4c]
bswap r9d
mov r8d, dword [rsp + 0x58]
mov rsi, qword [rsp + 0x128]
xor r8d, ebx
mov dword [rsi], r9d
xor r8d, dword [rsp + 0x54]
bswap r8d
mov r14d, dword [rsp + 0x60]
mov dword [rsi + 4], r8d
xor r14d, eax
xor r14d, dword [rsp + 0x68]
bswap r14d
mov edx, dword [rsp + 0x70]
mov dword [rsi + 8], r14d
xor edx, r15d
xor edx, dword [rsp + 0x6c]
bswap edx
mov r10d, dword [rsp + 0x78]
mov dword [rsi + 0xc], edx
xor r10d, r11d
xor r10d, dword [rsp + 0x80]
bswap r10d
mov edi, r12d
xor edi, r13d
mov dword [rsi + 0x10], r10d
xor edi, dword [rsp + 0x84]
bswap edi
mov ebx, dword [rsp + 0x88]
mov dword [rsi + 0x14], edi
xor ebx, ebp
xor ebx, dword [rsp + 0x90]
bswap ebx
cmp dword [rsp + 0x130], 8
mov dword [rsi + 0x18], ebx
jne 0x539be3
mov ebp, dword [rsp + 0x98]
xor ebp, dword [rsp + 0x28]
xor ebp, dword [rsp + 0x94]
bswap ebp
mov dword [rsi + 0x1c], ebp
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0xbc], 1
mov rax, rsi
jmp 0x539339