Function at 0x7ff7903c1ee4
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov eax, dword [rcx + 0x84]
mov rdi, rcx
neg eax
mov qword [rbp - 0x49], rcx
sbb r13b, r13b
xor ecx, ecx
and r13b, 0x3f
add r13b, 0xc0
mov byte [rbp - 0x78], r13b
call qword [sym.imp.USER32.dll_GetDC]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp - 0x61], rax
mov r12, rax
test rax, rax
jne 0x7ff7903c1f62
call fcn.7ff79018056c
xor r8d, r8d
mov ebx, eax
test eax, eax
js 0x7ff7903c285b
mov eax, dword [rdi + 0x80]
lea r14, [rdi + 0xf0]
mov r15d, dword [rdi + 0x74]
mov ebx, 1
mov dword [rbp - 0x59], eax
mov eax, dword [rdi + 0xfc]
sub eax, dword [rdi + 0x20]
mov dword [rbp - 0x51], eax
mov eax, dword [rdi + 0xf8]
sub eax, dword [rdi + 0x1c]
mov dword [rbp - 0x75], eax
mov dword [rbp - 0x65], r15d
xor eax, eax
lock cmpxchg dword [0x7ff7904d9050], ebx
jne 0x7ff7903c1f97
mov eax, dword [0x7ff7904d85e8]
test eax, eax
jne 0x7ff7903c2537
mov ecx, 0x338
mov dword [rbp - 0x6d], r8d
mov dword [rbp - 0x71], r8d
mov dword [rbp - 0x69], r8d
call fcn.7ff7901b5eb0
xor r8d, r8d
mov qword [rbp - 0x41], rax
test rax, rax
je 0x7ff7903c233d
mov esi, r8d
lea r13, [rax + 7]
or ecx, 0xffffffff
lea r15, [0x7ff79046b092]
mov r12d, r8d
lea edi, [r8 + 0x67]
mov r14d, r8d
movzx eax, byte [r15 - 1]
movzx r11d, byte [r15 - 2]
movzx r10d, byte [r15 + 2]
shl r11d, 8
or r11d, eax
shl r10d, 8
movzx eax, byte [r15]
lea r15, [r15 + 8]
shl r11d, 8
or r11d, eax
movzx eax, byte [r15 - 7]
shl r11d, 8
or r11d, eax
movzx eax, byte [r15 - 5]
or r10d, eax
xor r14d, r11d
movzx eax, byte [r15 - 4]
mov r9d, r14d
shl r10d, 8
or r10d, eax
movzx eax, byte [r15 - 3]
shl r10d, 8
or r10d, eax
xor r12d, r10d
xor r9d, r12d
xor r9d, 0xac987321
lea eax, [r9 + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, r9d
rol eax, 0xa
add edx, eax
xor r14d, edx
lea eax, [r14 + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, r14d
rol eax, 2
sub edx, eax
xor r9d, edx
imul edx, r9d, 0x605e
mov eax, r9d
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor r14d, edx
mov eax, r14d
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor r9d, edx
mov edx, r9d
xor edx, 0xab69605e
sub eax, edx
xor r14d, eax
mov eax, r14d
mov r8d, r14d
xor eax, 0x137f
ror r8d, 6
imul edx, eax, 0xab69
xor r8d, edx
xor r9d, r8d
lea eax, [r9 + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, r9d
rol eax, 2
add edx, eax
xor r14d, edx
lea eax, [r14 + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 8
sub edx, eax
xor r9d, edx
mov eax, r9d
mov r8d, 0xab69605e
xor eax, r8d
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, r9d
ror eax, 0xa
xor edx, eax
xor r14d, edx
mov eax, r14d
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, r14d
shr eax, 0xa
xor edx, eax
xor edx, r9d
mov r9d, 0x605e
mov eax, edx
not eax
ror eax, 5
add eax, r9d
imul eax, eax, 0x7f1
xor r14d, eax
lea r12d, [r14 - 0x7f1]
xor r12d, edx
xor r12d, r8d
mov eax, r12d
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, r12d
shr eax, 2
add edx, eax
xor r14d, edx
lea eax, [r14 - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, r14d
rol eax, 7
add edx, eax
xor r12d, edx
mov eax, r12d
mov r8d, r12d
xor eax, 0x137f
ror r8d, 9
imul edx, eax, 0x605e
add r8d, edx
xor r14d, r8d
mov eax, r14d
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 7
add edx, eax
xor r12d, edx
xor r14d, r12d
xor r14d, 0xac987321
mov eax, r14d
ror eax, 3
imul edx, eax, 0x137f
sub edx, 0xd0dd417
xor r12d, edx
lea eax, [r12 - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, r12d
ror eax, 6
sub edx, eax
xor r14d, edx
lea eax, [r14 - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 0xe
add edx, eax
xor r12d, edx
lea eax, [r12 - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, r12d
ror eax, 0xe
sub edx, eax
xor r14d, edx
mov eax, r14d
xor eax, r9d
imul edx, eax, 0xab69
mov eax, r14d
shr eax, 3
xor edx, eax
xor r12d, edx
mov eax, r12d
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, r12d
xor r12d, ecx
rol eax, 2
mov byte [r13], r12b
mov ecx, r10d
ror r12d, 8
mov byte [r13 - 1], r12b
lea r13, [r13 + 8]
ror r12d, 8
xor edx, eax
xor edx, esi
mov byte [r13 - 0xa], r12b
xor r14d, edx
ror r12d, 8
mov byte [r13 - 0xc], r14b
mov esi, r11d
ror r14d, 8
mov byte [r13 - 0xd], r14b
ror r14d, 8
mov byte [r13 - 0xe], r14b
ror r14d, 8
mov byte [r13 - 0xf], r14b
mov byte [r13 - 0xb], r12b
ror r14d, 8
ror r12d, 8
sub rdi, rbx
jne 0x7ff7903c1ff2
mov rdi, qword [rbp - 0x49]
xor edx, edx
mov rbx, qword [rbp - 0x41]
mov eax, edx
mov esi, dword [rbp - 0x71]
mov cl, dl
mov r15d, dword [rbp - 0x65]
mov r8d, 0x338
mov r13b, byte [rbp - 0x78]
lea r14, [rdi + 0xf0]
mov r12, qword [rbp - 0x61]
xor cl, byte [rax + rbx]
inc rax
cmp rax, r8
jb 0x7ff7903c231b
movzx eax, cl
cmp rax, qword [0x7ff79046b3c8]
je 0x7ff7903c239d
mov rcx, rbx
call fcn.7ff7901665e4
xor r8d, r8d
lea rbx, [0x7ff7904d8920]
mov esi, 4
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff7903c2360
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
xor r8d, r8d
add rbx, 0x18
sub rsi, 1
jne 0x7ff7903c2349
xor edx, edx
lea r8d, [rsi + 0x60]
lea rcx, [0x7ff7904d8920]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x170
lea rdx, [0x7ff79044ce50]
lea rcx, [section..data]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea ebx, [rsi + 1]
jmp 0x7ff7903c253f
mov byte [rbx + r8 - 1], dl
lea rcx, [0x7ff7904d8920]
mov r8d, 0x60
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor r8d, r8d
mov r12, rbx
cmp byte [rbx], r8b
je 0x7ff7903c24fd
mov qword [rbp - 0x49], rbx
mov rdx, rbx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r8w
jne 0x7ff7903c23ce
lea rbx, [rbx + rax*2]
mov eax, dword [rbp - 0x69]
lea rcx, [rax + rax*2]
lea rax, [0x7ff7904d8920]
lea r12, [rax + rcx*8]
xor ecx, ecx
mov r8, r12
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
je 0x7ff7903c24ef
mov rax, qword [r12]
mov ecx, 0x5a4d
mov esi, r8d
cmp word [rax], cx
je 0x7ff7903c2422
mov esi, 0xc000007b
jmp 0x7ff7903c2471
movsxd rcx, dword [rax + 0x3c]
cmp ecx, 0x10000000
jae 0x7ff7903c241b
add rcx, qword [r12]
cmp rcx, qword [r12]
jb 0x7ff7903c241b
cmp dword [rcx], 0x4550
jne 0x7ff7903c241b
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
sub ax, dx
mov edx, 0xfeff
test dx, ax
je 0x7ff7903c245d
mov esi, 0xc000000d
jmp 0x7ff7903c2471
mov rax, qword [rcx + 0x88]
mov qword [r12 + 0xc], rax
mov eax, dword [rcx + 0x50]
mov dword [r12 + 8], eax
mov eax, dword [rbx + 2]
mov ecx, r8d
add rbx, 6
mov dword [rbp - 0x65], eax
mov dword [rbp - 0x71], ecx
test eax, eax
je 0x7ff7903c24dc
mov rdx, rbx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r8b
jne 0x7ff7903c248c
inc rbx
add rbx, rax
test esi, esi
js 0x7ff7903c24c8
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
xor r8d, r8d
test rax, rax
je 0x7ff7903c24f4
mov ecx, dword [rbp - 0x6d]
lea rdx, [section..data]
mov qword [rdx + rcx*8], rax
mov ecx, dword [rbp - 0x71]
mov eax, 1
add dword [rbp - 0x6d], eax
add ecx, eax
mov dword [rbp - 0x71], ecx
cmp ecx, dword [rbp - 0x65]
jb 0x7ff7903c2485
jmp 0x7ff7903c24e1
mov eax, 1
add dword [rbp - 0x69], eax
cmp byte [rbx], r8b
jne 0x7ff7903c23c7
jmp 0x7ff7903c24f4
mov esi, 0xc000007a
mov r12, qword [rbp - 0x49]
test r12, r12
je 0x7ff7903c2520
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor r8d, r8d
mov r12, qword [rbp - 0x61]
test esi, esi
js 0x7ff7903c233d
mov eax, dword [0x7ff7904d85e8]
mov ebx, 1
add eax, ebx
mov dword [0x7ff7904d85e8], eax
xor esi, esi
mov eax, esi
xchg dword [0x7ff7904d9050], eax
sub r15d, 1
je 0x7ff7903c2726
sub r15d, 1
je 0x7ff7903c262a
cmp r15d, 1
jne 0x7ff7903c2729
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0x1f], rax
movups xmmword [rbp + 0xf], xmm0
movabs r10, 0x95359f2d7edc9a70
mov rax, qword [0x7ff7904d5148]
mov edx, ebx
xor ecx, ecx
call qword [0x7ff79045bf28]
mov dword [rbp - 1], 0x28
movabs r10, 0x93fc1ebd305e9370
mov rcx, rax
lea rdx, [rbp - 1]
mov rax, qword [0x7ff7904d5108]
call qword [0x7ff79045bf28]
test eax, eax
je 0x7ff7903c2729
movabs r10, 0x8ce4ae9652ddab70
mov rax, qword [0x7ff7904d5140]
lea rdx, [rbp + 0x13]
xor ecx, ecx
call qword [0x7ff79045bf28]
movabs r10, 0x8ce4ae9652ddab70
mov rax, qword [0x7ff7904d5140]
lea rdx, [rbp + 0x1b]
xor ecx, ecx
call qword [0x7ff79045bf28]
mov eax, dword [rbp + 0x1b]
sub eax, dword [rbp - 0x75]
imul ecx, eax, 0x32
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov rcx, qword [rbp + 0x1b]
shr rcx, 0x20
sub ecx, dword [rbp - 0x51]
imul ecx, ecx, 0x32
mov dword [r14], edx
jmp 0x7ff7903c270f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
movabs r10, 0x95359f2d7edc9a70
mov rax, qword [0x7ff7904d5148]
mov edx, ebx
xor ecx, ecx
call qword [0x7ff79045bf28]
mov dword [rbp - 0x29], 0x28
movabs r10, 0x93fc1ebd305e9370
mov rcx, rax
lea rdx, [rbp - 0x29]
mov rax, qword [0x7ff7904d5108]
call qword [0x7ff79045bf28]
test eax, eax
je 0x7ff7903c2729
movabs r10, 0x8ce4ae9652ddab70
mov rax, qword [0x7ff7904d5140]
lea rdx, [rbp - 0x15]
xor ecx, ecx
call qword [0x7ff79045bf28]
movabs r10, 0x8ce4ae9652ddab70
mov rax, qword [0x7ff7904d5140]
lea rdx, [rbp - 0xd]
xor ecx, ecx
call qword [0x7ff79045bf28]
movups xmm0, xmmword [rbp - 0x15]
mov eax, dword [rbp - 0xd]
movdqu xmmword [rbp - 0x39], xmm0
cmp dword [rbp - 0x59], esi
je 0x7ff7903c26e7
lea ecx, [rax + rax*4]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
add edx, dword [rbp - 0x15]
jmp 0x7ff7903c26fe
sub eax, dword [rbp - 0x75]
imul ecx, eax, 0x5f
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [rbp - 0x31]
shr rax, 0x20
mov dword [r14], edx
sub eax, dword [rbp - 0x51]
imul ecx, eax, 0x5f
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [r14 + 4], edx
jmp 0x7ff7903c2729
mov qword [r14], rsi
xor eax, eax
lock cmpxchg dword [0x7ff7904d9050], ebx
jne 0x7ff7903c2729
mov eax, dword [0x7ff7904d85e8]
test eax, eax
jle 0x7ff7903c27a7
sub eax, ebx
mov dword [0x7ff7904d85e8], eax
jne 0x7ff7903c27a7
mov esi, 4
lea r15, [0x7ff7904d8920]
mov rbx, r15
lea eax, [rsi - 3]
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff7903c2774
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov eax, 1
add rbx, 0x18
sub rsi, rax
jne 0x7ff7903c275b
xor edx, edx
lea r8d, [rsi + 0x60]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x170
lea rdx, [0x7ff79044ce50]
lea rcx, [section..data]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea ebx, [rsi + 1]
mov dword [rsp + 0x40], 2
lea r9, [rbp - 0x61]
mov eax, esi
mov r8, r14
xchg dword [0x7ff7904d9050], eax
mov eax, dword [rdi + 0x20]
mov rdx, r12
sub dword [rdi + 0xf4], eax
mov eax, dword [rdi + 0xf8]
mov ecx, dword [rdi + 0x1c]
sub dword [r14], ecx
mov rcx, qword [rdi + 0x28]
and word [rbp - 0x75], 0
mov dword [rbp - 0x61], eax
mov eax, dword [rdi + 0xfc]
mov dword [rbp - 0x5d], eax
lea rax, [rbp - 0x75]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x51]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x51], rsi
mov byte [rbp - 0x73], r13b
mov byte [rbp - 0x72], bl
call qword [sym.imp.USER32.dll_UpdateLayeredWindow]
nop dword [rax + rax]
test eax, eax
je 0x7ff7903c2829
mov ebx, esi
jmp 0x7ff7903c2830
call fcn.7ff79018056c
mov ebx, eax
mov rcx, qword [rdi + 0x28]
mov edx, 4
call qword [sym.imp.USER32.dll_ShowWindowAsync]
nop dword [rax + rax]
test r12, r12
je 0x7ff7903c285b
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.7ff7901bf100
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret