Function at 0x1403ef794
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov eax, pe_nt_image_headers64
mov r10, rcx
mov qword [rsp + 0xf8], r9
mov r9, qword [rcx + 0x20]
mov ecx, r8d
sar eax, cl
mov r11d, edx
mov ecx, eax
neg eax
lea rdx, [r9 + 1]
and eax, r11d
or eax, ecx
mov ecx, 0x20
sub rcx, rdx
add rdx, r10
mov byte [r10 + r9], al
xor eax, eax
mov rdi, rdx
rep stosb byte [rdi], al
mov eax, dword [r10 + 0x28]
mov r15d, dword [r10 + 0x58]
mov r14d, dword [r10 + 0x5c]
mov r13d, dword [r10 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [r10 + 0x2c]
mov dword [rsp + 0x34], eax
mov eax, dword [r10 + 0x30]
mov dword [rsp + 0x48], eax
mov eax, dword [r10 + 0x34]
mov dword [rsp + 0x4c], eax
mov eax, dword [r10 + 0x38]
mov dword [rsp + 0x58], eax
mov eax, dword [r10 + 0x3c]
mov dword [rsp + 0x5c], eax
mov eax, dword [r10 + 0x40]
mov dword [rsp + 0x60], eax
mov eax, dword [r10 + 0x44]
mov dword [rsp + 0x64], eax
mov eax, dword [r10 + 0x48]
mov dword [rsp + 0x28], eax
mov eax, dword [r10 + 0x4c]
mov dword [rsp + 0x38], eax
mov eax, dword [r10 + 0x50]
mov dword [rsp + 0x40], eax
mov eax, dword [r10 + 0x54]
mov dword [rsp + 0x50], eax
mov eax, dword [r10 + 0x64]
mov dword [rsp + 0x68], eax
mov eax, dword [r10 + 0x68]
mov dword [rsp + 0x84], 2
mov r12d, dword [r10 + 0x6c]
mov dword [rsp + 8], eax
mov eax, dword [r10 + 0x70]
mov dword [rsp + 0x1c], eax
mov eax, dword [r10 + 0x74]
mov dword [rsp + 4], eax
mov eax, dword [r10 + 0x78]
mov dword [rsp + 0xc], eax
mov eax, dword [r10 + 0x7c]
mov dword [rsp], eax
mov eax, dword [r10 + 0x80]
mov dword [rsp + 0x18], eax
mov eax, dword [r10 + 0x84]
mov dword [rsp + 0x20], eax
mov ebp, dword [r10]
bswap ebp
mov eax, dword [r10 + 4]
bswap eax
mov dword [rsp + 0x24], eax
mov r11d, dword [r10 + 8]
bswap r11d
mov edx, dword [r10 + 0xc]
bswap edx
mov r8d, dword [r10 + 0x10]
bswap r8d
mov ecx, dword [r10 + 0x14]
bswap ecx
mov eax, dword [r10 + 0x18]
bswap eax
mov dword [rsp + 0x10], eax
mov r9d, dword [r10 + 0x1c]
bswap r9d
mov ebx, dword [rsp + 0x48]
xor ebx, dword [rsp + 0x40]
mov esi, dword [rsp + 0x34]
xor esi, dword [rsp + 0x38]
mov dword [rsp + 0x80], ebx
mov ebx, dword [rsp + 0x58]
mov eax, esi
mov edi, dword [rsp + 0x30]
xor eax, r12d
mov esi, dword [rsp + 0x4c]
xor edi, dword [rsp + 0x28]
xor ebx, r15d
mov dword [rsp + 0x70], eax
xor esi, dword [rsp + 0x50]
mov dword [rsp + 0x74], ebx
mov ebx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x74]
xor eax, dword [rsp + 0xc]
xor ebx, r14d
mov dword [rsp + 0x74], eax
xor esi, dword [rsp + 4]
mov dword [rsp + 0x78], ebx
mov ebx, dword [rsp + 0x60]
mov eax, dword [rsp + 0x78]
xor eax, dword [rsp]
xor ebx, r13d
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], ebx
mov eax, dword [rsp + 0x7c]
xor eax, dword [rsp + 0x18]
mov ebx, dword [rsp + 0x64]
mov dword [rsp + 0x7c], eax
xor ebx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x80]
xor ebx, dword [rsp + 0x20]
xor eax, dword [rsp + 0x1c]
xor esi, ebx
xor eax, ebx
mov dword [rsp + 0x80], eax
xor edi, dword [rsp + 8]
mov eax, dword [rsp + 0x30]
xor edi, ebx
xor eax, ebp
xor ebp, r9d
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x34]
xor eax, dword [rsp + 0x24]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
xor eax, r11d
xor r11d, r9d
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x4c]
xor eax, edx
xor edx, r9d
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x58]
xor eax, r8d
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x5c]
xor eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x60]
xor eax, dword [rsp + 0x10]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x64]
xor eax, r9d
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x28]
xor eax, r9d
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
xor eax, ebp
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x40]
xor eax, dword [rsp + 0x24]
xor r14d, r8d
xor r13d, ecx
xor r14d, dword [rsp + 0x74]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x50]
xor r15d, edx
xor r13d, dword [rsp + 0x78]
xor r15d, esi
xor eax, r11d
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x68]
xor eax, dword [rsp + 0x10]
xor eax, dword [rsp + 0x7c]
xor edx, dword [rsp]
xor edx, dword [rsp + 0x74]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 8]
xor eax, dword [rsp + 0x10]
rol edx, 2
xor eax, ebx
xor r12d, dword [rsp + 0x10]
xor r8d, dword [rsp + 0x18]
mov dword [rsp], edx
xor ecx, dword [rsp + 0x20]
xor r12d, r9d
xor r8d, dword [rsp + 0x78]
mov dword [rsp + 8], eax
mov eax, dword [rsp + 0x10]
xor eax, dword [rsp + 0xc]
rol r8d, 2
xor r12d, edi
xor eax, r11d
xor ecx, dword [rsp + 0x7c]
xor ebp, dword [rsp + 0x1c]
mov dword [rsp + 0x18], r8d
xor eax, esi
mov edx, dword [rsp + 0x88]
xor ebp, dword [rsp + 0x70]
rol eax, 2
mov r9d, dword [rsp + 0x24]
xor r9d, dword [rsp + 4]
mov dword [rsp + 0x1c], ebp
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x28]
xor r9d, dword [rsp + 0x10]
xor r9d, dword [rsp + 0x80]
rol ecx, 2
xor edx, ebx
mov dword [rsp + 0x20], ecx
xor eax, ebx
mov ecx, dword [rsp + 0x30]
rol r15d, 1
shl rax, 0x20
mov dword [rsp + 4], r9d
rol r14d, 1
lea rbx, [0x14072fa20]
shl r15, 0x20
or rdx, rax
mov eax, dword [rsp + 0x8c]
xor ecx, edi
shl r14, 0x20
rol r13d, 1
xor eax, edi
shl r13, 0x20
shl rax, 0x20
or rcx, rax
mov eax, dword [rsp + 0x64]
xor eax, dword [rsp + 0x70]
shl rax, 0x20
mov r8d, dword [rsp + 0x34]
xor r8d, dword [rsp + 0x70]
or r8, rax
mov eax, dword [rsp + 0x40]
xor eax, dword [rsp + 0x80]
shl rax, 0x20
mov r9d, dword [rsp + 0x48]
mov r11d, dword [rsp + 0x60]
xor r9d, dword [rsp + 0x80]
xor r11d, dword [rsp + 0x7c]
or r9, rax
mov eax, dword [rsp + 0x4c]
xor eax, esi
lea rsi, [0x14072f9e0]
or r15, rax
mov eax, dword [rsp + 0x58]
xor eax, dword [rsp + 0x74]
or r14, rax
mov eax, dword [rsp + 0x5c]
xor eax, dword [rsp + 0x78]
or r13, rax
mov eax, dword [rsp + 0x38]
rol eax, 1
shl rax, 0x20
or rax, r11
mov r11, rdx
mov rdi, r14
xor r8, r9
xor rax, r15
or r11, rcx
or rdi, r13
xor r11, r9
and r9, rdx
xor rdi, r15
and r15, r14
xor rcx, r9
xor r13, r15
xor r9, r8
and r8, r11
not rcx
xor r15, rax
not r13
and rax, rdi
xor r8, rcx
or rcx, r9
xor rax, r13
or r13, r15
xor rdx, rcx
xor r9, r8
xor r11, rcx
and r8, rcx
xor r15, rax
mov ecx, edx
and rax, r13
xor r14, r13
xor r15, rdx
rol ecx, 2
mov qword [rsp + 0x10], rax
not r11
xor ecx, r15d
mov rax, r15
rol r15d, 0xe
xor r15d, ecx
shr rax, 0x20
rol ecx, 0xa
shr rdx, 0x20
xor r14, r11
rol edx, 2
xor ecx, r15d
rol r15d, 1
xor edx, eax
rol eax, 0xe
xor eax, edx
rol edx, 0xa
xor edx, eax
rol eax, 1
shl rax, 0x20
shl rdx, 0x20
or rdx, rcx
or r15, rax
mov ecx, r11d
mov rax, r14
shr r11, 0x20
shr rax, 0x20
mov rbp, rdx
mov rdx, qword [rsp + 0x10]
rol r11d, 2
rol ecx, 2
xor r11d, eax
rol eax, 0xe
xor ecx, r14d
xor eax, r11d
rol r14d, 0xe
rol r11d, 0xa
xor r14d, ecx
rol ecx, 0xa
xor r11d, eax
xor ecx, r14d
rol eax, 1
shl r11, 0x20
or rcx, r11
shl rax, 0x20
xor rdi, r13
mov r11d, r9d
rol r14d, 1
xor rdi, r8
xor rdx, r9
rol r11d, 2
not rdi
or r14, rax
mov eax, r8d
shr r8, 0x20
rol r8d, 2
mov r13, rdi
rol eax, 2
xor r11d, edx
shr r13, 0x20
xor eax, edi
rol edi, 0xe
xor r8d, r13d
rol r13d, 0xe
xor edi, eax
xor r13d, r8d
rol r8d, 0xa
xor r8d, r13d
rol eax, 0xa
shl r8, 0x20
xor eax, edi
rol r13d, 1
rol edi, 1
or r8, rax
shl r13, 0x20
mov rax, rdx
rol edx, 0xe
shr rax, 0x20
or r13, rdi
lea rdi, [0x14072fa60]
xor edx, r11d
rol r11d, 0xa
shr r9, 0x20
xor r11d, edx
rol edx, 1
add rbx, 8
rol r9d, 2
xor r15, qword [rsi]
add rsi, 8
xor r9d, eax
rol eax, 0xe
xor eax, r9d
rol r9d, 0xa
xor r9d, eax
rol eax, 1
shl rax, 0x20
shl r9, 0x20
or rax, rdx
mov rdx, qword [rbx - 8]
or r9, r11
xor rdx, rbp
cmp rdi, rbx
jne 0x1403efb79
mov dword [rsp + 0x30], edx
shr rdx, 0x20
lea rbx, [0x14072f9c0]
lea rsi, [0x14072f9a0]
mov dword [rsp + 0x34], ecx
shr rcx, 0x20
mov dword [rsp + 0x48], r8d
shr r8, 0x20
mov dword [rsp + 0x4c], r9d
shr r9, 0x20
mov dword [rsp + 0x64], eax
shr rax, 0x20
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], r15d
shr r15, 0x20
mov dword [rsp + 0x5c], r14d
shr r14, 0x20
mov dword [rsp + 0x60], r13d
shr r13, 0x20
mov r9d, dword [rsp + 8]
mov r11d, dword [rsp + 4]
mov eax, r12d
and r11d, dword [rsp + 8]
mov ecx, dword [rsp + 0x1c]
or r9d, r12d
xor ecx, dword [rsp + 4]
xor r9d, dword [rsp + 4]
xor eax, r11d
mov r12d, dword [rsp + 8]
xor r11d, ecx
not eax
and ecx, r9d
xor ecx, eax
mov ebp, dword [rsp + 0x18]
or eax, r11d
mov r8d, dword [rsp]
xor r12d, eax
xor r11d, ecx
xor r9d, eax
and ecx, eax
mov eax, dword [rsp + 0xc]
and eax, dword [rsp]
not r9d
or r8d, dword [rsp + 0x18]
xor ebp, eax
xor r8d, dword [rsp + 0xc]
mov edx, dword [rsp + 0x20]
xor edx, dword [rsp + 0xc]
not ebp
xor eax, edx
and edx, r8d
mov edi, dword [rsp]
xor edx, ebp
or ebp, eax
xor eax, edx
xor edi, ebp
and edx, ebp
xor eax, r12d
rol r12d, 2
xor r12d, eax
rol eax, 0xe
xor eax, r12d
rol r12d, 0xa
xor r12d, eax
rol eax, 1
xor r8d, ebp
xor edi, r9d
xor r8d, ecx
rol r9d, 2
xor edx, r11d
xor eax, dword [rsi]
xor r9d, edi
not r8d
rol edi, 0xe
mov dword [rsp + 8], r12d
rol ecx, 2
rol r11d, 2
xor edi, r9d
mov dword [rsp + 0xc], eax
xor ecx, r8d
xor r11d, edx
rol r9d, 0xa
add rbx, 4
rol r8d, 0xe
rol edx, 0xe
xor r9d, edi
add rsi, 4
xor r8d, ecx
xor edx, r11d
rol edi, 1
lea rax, [0x14072f9e0]
rol ecx, 0xa
rol r11d, 0xa
mov dword [rsp], edi
mov edi, dword [rsp + 8]
xor ecx, r8d
xor r11d, edx
xor edi, dword [rbx - 4]
rol r8d, 1
rol edx, 1
mov dword [rsp + 0x1c], ecx
mov r12d, r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 4], r11d
mov dword [rsp + 0x20], edx
mov dword [rsp + 8], edi
cmp rax, rbx
jne 0x1403efd97
xor eax, eax
mov ecx, 8
mov rdi, r10
cmp dword [rsp + 0x84], 1
rep stosd dword [rdi], eax
je 0x1403efee9
mov dword [rsp + 0x84], 1
jmp 0x1403ef8a6
mov eax, dword [rsp + 0x30]
xor eax, dword [rsp + 0x28]
xor eax, dword [rsp + 8]
bswap eax
mov rsi, qword [rsp + 0xf8]
mov dword [rsi], eax
mov eax, dword [rsp + 0x34]
xor eax, dword [rsp + 0x38]
xor eax, r9d
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [rsp + 0x48]
xor eax, dword [rsp + 0x40]
xor eax, dword [rsp + 0x1c]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [rsp + 0x4c]
xor eax, dword [rsp + 0x50]
xor eax, r11d
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [rsp + 0x58]
xor eax, r15d
xor eax, dword [rsp + 0xc]
bswap eax
mov dword [rsi + 0x10], eax
mov eax, dword [rsp + 0x5c]
xor eax, r14d
xor eax, dword [rsp]
bswap eax
mov dword [rsi + 0x14], eax
mov eax, dword [rsp + 0x60]
xor eax, r13d
xor eax, r8d
bswap eax
cmp dword [rsp + 0x100], 8
mov dword [rsi + 0x18], eax
jne 0x1403eff79
mov eax, dword [rsp + 0x64]
xor eax, dword [rsp + 0x68]
xor eax, edx
bswap eax
mov dword [rsi + 0x1c], eax
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret