Function at 0x6d974120
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov qword [rsp + 0x58], r9
mov eax, r8d
mov qword [rsp + 0x50], rcx
mov r9d, dword [rcx + 4]
add rax, qword [rcx + 0xa0]
bswap rax
mov qword [rsp + 0x64], rax
mov eax, r8d
or eax, r9d
je 0x6d9741b1
test r8d, r8d
je 0x6d974bf0
cmp r9d, 4
je 0x6d974c3f
mov ecx, r8d
mov eax, 0xff
mov r10d, r9d
shr eax, cl
mov r8d, 0x10
not eax
sub r8, r10
and eax, edx
lea rdx, [rsp + r10 + 0x60]
mov byte [rsp + r10 + 0x60], al
lea eax, [r9 + 1]
cmp eax, 3
ja 0x6d9741bc
nop dword [rax + rax]
mov ecx, eax
add eax, 1
cmp eax, 3
mov byte [rsp + rcx + 0x60], 0
jbe 0x6d9741a0
jmp 0x6d9741bc
lea rdx, [rsp + 0x64]
mov r8d, 0xc
mov rdi, qword [rsp + 0x50]
lea r14, [rsp + 0xb0]
lea r15, [0x6daef8a0]
mov rcx, rdi
call fcn.6d96c040
mov eax, dword [rdi + 8]
lea rdx, [rdi + 0x84]
mov rcx, r14
lea esi, [rax + rax*2]
add esi, esi
mov ebx, esi
shl rbx, 2
sub rdx, rbx
mov r8, rbx
call fcn.6da41170
mov eax, 0x1e
lea rcx, [r14 + rbx]
lea rdx, [rdi + 0xc]
sub eax, esi
mov ebx, 0xa
mov r8d, eax
shl r8, 2
call fcn.6da41170
lea rax, [r14 + 0xc]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rax
nop dword [rax]
mov rax, qword [rsp + 0x11c]
mov rdx, qword [rsp + 0x20]
mov r8d, 0x6c
mov rcx, qword [rsp + 0x28]
lea rsi, [0x6daef4a0]
lea rdi, [0x6daef0a0]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x124]
mov dword [rsp + 0x78], eax
call sub.msvcrt.dll_memmove
mov rax, qword [rsp + 0x70]
mov r12d, dword [rsp + 0xc0]
mov edx, dword [rsp + 0xc8]
mov ecx, dword [rsp + 0x78]
xor dword [rsp + 0xf4], edx
mov r9d, dword [rsp + 0xc4]
mov rbx, rax
xor eax, r12d
xor dword [rsp + 0xf0], r9d
xor ecx, edx
mov edx, eax
shr rbx, 0x20
shr edx, 0x10
mov r8, rbx
lea rbx, [0x6daeeca0]
movzx edx, dl
xor r8d, r9d
mov r11d, dword [rsi + rdx*4]
lea rsi, [0x6daef0a0]
movzx edx, ah
mov r13d, dword [rsp + 0xec]
mov r10d, dword [rsi + rdx*4]
lea rsi, [0x6daeeca0]
movzx edx, al
shr eax, 0x18
mov r9d, dword [rsi + rdx*4]
mov edx, dword [r15 + rax*4]
mov eax, r8d
shr eax, 0x18
xor r13d, r12d
mov esi, dword [r15 + rax*4]
mov rax, r8
mov dword [rsp + 0xec], r13d
movzx eax, ah
xor edx, r9d
mov edi, dword [rdi + rax*4]
movzx eax, r8b
shr r8d, 0x10
mov ebp, dword [rbx + rax*4]
lea rbx, [0x6daef4a0]
movzx r8d, r8b
xor edx, r11d
xor edx, r10d
xor r10d, edi
mov eax, ebp
xor ebp, r9d
mov r9d, ecx
xor eax, esi
xor eax, dword [rbx + r8*4]
shr r9d, 0x10
movzx r9d, r9b
mov r8d, ecx
shr r8d, 0x18
mov r8d, dword [r15 + r8*4]
xor eax, edi
mov edi, dword [rbx + r9*4]
lea rbx, [0x6daeeca0]
movzx r9d, cl
movzx ecx, ch
mov r9d, dword [rbx + r9*4]
xor esi, r8d
xor r11d, edi
xor r8d, r9d
xor ebp, r9d
xor r8d, edi
lea rdi, [0x6daef0a0]
xor r8d, dword [rdi + rcx*4]
mov ecx, dword [rsp + 0xbc]
lea rdi, [0x6daef4a0]
mov r9d, ecx
movzx ebx, ch
shr r9d, 0x18
mov r14d, dword [r15 + r9*4]
mov r9d, ecx
movzx ecx, cl
shr r9d, 0x10
movzx r9d, r9b
mov edi, dword [rdi + r9*4]
mov r9, rbx
lea rbx, [0x6daef0a0]
xor esi, r14d
mov r9d, dword [rbx + r9*4]
lea rbx, [0x6daeeca0]
xor r11d, edi
xor r10d, r9d
xor r14d, dword [rbx + rcx*4]
mov ecx, r14d
mov r14d, esi
xor ecx, edi
mov edi, edx
shl r14d, 8
xor ecx, r9d
mov r9d, r11d
xor edi, esi
xor r9d, eax
and edi, 0xff000000
xor r14d, eax
and r9d, 0xff0000
and r14d, 0xff000000
or edi, r9d
mov r9d, ecx
xor r9d, ebp
movzx r9d, r9b
or edi, r9d
mov r9d, r10d
xor r9d, r8d
and r9d, 0xff00
or edi, r9d
mov r9d, ebp
shr r9d, 0x18
mov dword [rsp + 0xb0], edi
xor r9d, edx
movzx r9d, r9b
or r9d, r14d
mov r14d, r11d
shl r14d, 8
xor r14d, r8d
and r14d, 0xff0000
or r9d, r14d
mov r14d, r10d
shl r14d, 8
xor r14d, ecx
and r14d, 0xff00
or r9d, r14d
mov r14d, esi
mov dword [rsp + 0xb4], r9d
mov r9d, ebp
shl r14d, 0x10
shr r9d, 0x10
xor r14d, r8d
xor r9d, eax
and r14d, 0xff000000
movzx r9d, r9b
or r9d, r14d
mov r14d, r11d
shl r14d, 0x10
shr ebp, 8
shl esi, 0x18
xor r14d, ecx
xor ebp, r8d
xor esi, ecx
and r14d, 0xff0000
shr r11d, 8
and esi, 0xff000000
or r9d, r14d
mov r14d, r10d
xor r11d, edx
shr r14d, 0x10
shr r10d, 8
movzx ebp, bpl
xor r14d, edx
or ebp, esi
and r11d, 0xff0000
xor r10d, eax
and r14d, 0xff00
or ebp, r11d
and r10d, 0xff00
or r9d, r14d
or ebp, r10d
sub dword [rsp + 0x40], 1
mov dword [rsp + 0xb8], r9d
mov dword [rsp + 0xbc], ebp
jne 0x6d974230
mov r14, qword [rsp + 0x20]
mov edx, r13d
mov ebx, r12d
mov dword [rsp + 0x44], 0xd
mov esi, edi
lea rax, [r14 + 0x38]
mov qword [rsp + 0x48], rax
jmp 0x6d974530
mov ebx, dword [rsp + 0xc0]
mov edx, dword [rsp + 0xec]
xor ebx, esi
xor edx, esi
mov rdi, qword [rsp + 0xf4]
mov dword [rsp + 0xc0], ebx
mov r8, qword [r14]
mov eax, edx
mov dword [rsp + 0xec], edx
mov ecx, dword [rsp + 0x124]
shr eax, 0x10
mov r12, qword [rsp + 0xfc]
mov rbp, qword [rsp + 0x104]
movzx eax, al
mov rsi, qword [rsp + 0x10c]
mov r11, qword [rsp + 0x114]
mov r10, qword [rsp + 0xec]
mov r9, qword [rsp + 0x11c]
mov dword [rsp + 0x40], ebx
mov qword [r14 + 0x3c], r8
mov rbx, r8
mov r8, qword [r14 + 8]
shr rbx, 0x20
mov dword [rsp + 0xa8], ecx
mov qword [rsp + 0x30], rbx
lea rbx, [0x6daef4a0]
shr r10, 0x20
mov qword [r14 + 0x44], r8
mov r8, qword [r14 + 0x10]
mov qword [r14 + 0x4c], r8
mov r8, qword [r14 + 0x18]
mov qword [r14 + 0x54], r8
mov r8, qword [r14 + 0x20]
mov qword [r14 + 0x5c], r8
mov r8, qword [r14 + 0x28]
mov qword [r14 + 0x64], r8
mov r8, qword [r14 + 0x30]
mov qword [r14 + 0x6c], r8
mov r8d, dword [r14 + 0x38]
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], r11
mov esi, edi
mov dword [r14 + 0x74], r8d
mov qword [rsp + 0xe0], r9
shr esi, 0x10
mov r11d, dword [rbx + rax*4]
lea rbx, [0x6daef0a0]
movzx eax, dh
mov dword [rsp + 0xe8], ecx
lea r9, [0x6daeeca0]
movzx esi, sil
mov ecx, dword [rbx + rax*4]
lea rbx, [0x6daeeca0]
movzx eax, dl
shr edx, 0x18
mov r8d, edi
mov ebp, dword [rbx + rax*4]
mov r13d, dword [r15 + rdx*4]
mov eax, r10d
mov rdx, r10
shr eax, 0x18
lea rbx, [0x6daef0a0]
mov dword [rsp + 0x20], ecx
xor r13d, ebp
xor r13d, r11d
xor r13d, ecx
mov ecx, dword [r15 + rax*4]
movzx eax, dh
mov r10d, dword [rbx + rax*4]
lea rbx, [0x6daeeca0]
movzx eax, dl
shr edx, 0x10
mov r12d, dword [rbx + rax*4]
lea rbx, [0x6daef4a0]
movzx edx, dl
mov esi, dword [rbx + rsi*4]
mov eax, r12d
xor eax, ecx
xor eax, dword [rbx + rdx*4]
movzx ebx, dil
mov ebx, dword [r9 + rbx*4]
mov edx, edi
shr rdi, 0x20
shr edx, 0x18
lea r9, [0x6daef0a0]
mov edx, dword [r15 + rdx*4]
mov dword [rsp + 0x28], ebx
xor r12d, dword [rsp + 0x28]
xor eax, r10d
xor ecx, edx
xor edx, ebx
mov rbx, r8
mov r8d, edi
movzx ebx, bh
xor edx, esi
shr r8d, 0x18
xor r12d, ebp
xor edx, dword [r9 + rbx*4]
mov ebp, dword [r15 + r8*4]
mov r8d, edi
lea rbx, [0x6daef4a0]
shr r8d, 0x10
movzx r8d, r8b
mov r8d, dword [rbx + r8*4]
mov rbx, rdi
movzx edi, dil
movzx ebx, bh
xor ecx, ebp
xor esi, r8d
xor esi, r11d
mov r11, rbx
lea rbx, [0x6daeeca0]
mov r11d, dword [r9 + r11*4]
xor ebp, dword [rbx + rdi*4]
mov edi, dword [rsp + 0x30]
xor r10d, r11d
xor r10d, dword [rsp + 0x20]
xor ebp, r8d
mov r8d, esi
xor ebp, r11d
xor r8d, eax
mov r9d, r10d
and r8d, 0xff0000
mov r11d, r10d
xor r9d, edx
shl r11d, 8
and r9d, 0xff00
xor r11d, ebp
or r8d, r9d
mov r9d, r12d
and r11d, 0xff00
xor r9d, ebp
movzx r9d, r9b
or r8d, r9d
mov r9d, r13d
xor r9d, ecx
and r9d, 0xff000000
or r8d, r9d
mov r9d, esi
shl r9d, 8
mov dword [rsp + 0xb0], r8d
xor r9d, edx
and r9d, 0xff0000
or r9d, r11d
mov r11d, ecx
shl r11d, 8
xor r11d, eax
and r11d, 0xff000000
or r9d, r11d
mov r11d, r12d
shr r11d, 0x18
xor r11d, r13d
movzx r11d, r11b
or r9d, r11d
mov r11d, ecx
mov dword [rsp + 0xb4], r9d
mov r9d, r12d
shl r11d, 0x10
shr r9d, 0x10
xor r11d, edx
xor r9d, eax
and r11d, 0xff000000
movzx r9d, r9b
or r9d, r11d
mov r11d, esi
shl r11d, 0x10
xor r11d, ebp
and r11d, 0xff0000
or r9d, r11d
xor edi, r8d
mov r11d, r10d
shr r10d, 8
mov dword [rsp + 0xf0], edi
shr r12d, 8
xor r10d, eax
mov rax, qword [rsp + 0xf0]
shl ecx, 0x18
xor r12d, edx
xor ecx, ebp
shr esi, 8
and ecx, 0xff000000
xor esi, r13d
shr r11d, 0x10
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf8]
movzx r12d, r12b
xor r11d, r13d
or r12d, ecx
and esi, 0xff0000
and r11d, 0xff00
and r10d, 0xff00
or r12d, esi
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x100]
or r9d, r11d
or r12d, r10d
mov dword [rsp + 0xb8], r9d
xor dword [rsp + 0xc0], r8d
mov dword [rsp + 0xbc], r12d
mov r8d, 0x40
mov rdx, r14
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0xa0], rax
call sub.msvcrt.dll_memmove
mov rax, qword [rsp + 0x80]
lea rcx, [0x6daef4a0]
mov edx, dword [rsp + 0x74]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xe0], rax
mov eax, edi
shr eax, 0x10
movzx eax, al
mov esi, dword [rcx + rax*4]
mov rax, rdi
lea rcx, [0x6daef0a0]
movzx eax, ah
mov r9d, dword [rcx + rax*4]
movzx eax, dil
shr edi, 0x18
mov ebp, dword [rbx + rax*4]
mov eax, edx
mov ecx, dword [r15 + rdi*4]
shr eax, 0x18
lea rdi, [0x6daef0a0]
mov r11d, dword [r15 + rax*4]
movzx eax, dh
mov r10d, dword [rdi + rax*4]
movzx eax, dl
shr edx, 0x10
mov r12d, dword [rbx + rax*4]
lea rbx, [0x6daef4a0]
movzx edx, dl
xor ecx, ebp
xor ecx, esi
mov eax, r12d
xor ecx, r9d
xor eax, r11d
xor eax, dword [rbx + rdx*4]
mov edx, dword [rsp + 0x78]
mov r8d, edx
mov edi, edx
movzx r13d, dl
shr r8d, 0x18
xor eax, r10d
movzx edx, dh
mov r8d, dword [r15 + r8*4]
xor r11d, r8d
shr edi, 0x10
movzx edi, dil
mov edi, dword [rbx + rdi*4]
lea rbx, [0x6daeeca0]
mov r13d, dword [rbx + r13*4]
lea rbx, [0x6daef0a0]
xor r8d, r13d
xor r12d, r13d
mov r13d, dword [rsp + 0x40]
xor r8d, edi
xor r8d, dword [rbx + rdx*4]
xor r12d, ebp
lea rbx, [0x6daef4a0]
mov edx, r13d
shr edx, 0x18
mov ebp, dword [r15 + rdx*4]
mov edx, r13d
shr edx, 0x10
movzx edx, dl
mov edx, dword [rbx + rdx*4]
mov rbx, r13
xor r11d, ebp
xor edi, edx
xor edi, esi
movzx esi, bh
lea rbx, [0x6daef0a0]
mov esi, dword [rbx + rsi*4]
movzx ebx, r13b
xor r10d, esi
xor r10d, r9d
lea r9, [0x6daeeca0]
xor ebp, dword [r9 + rbx*4]
mov r9d, edi
mov ebx, r12d
shl r9d, 8
xor r9d, r8d
and r9d, 0xff0000
xor ebp, edx
mov edx, r10d
xor ebp, esi
mov esi, edi
xor edx, r8d
xor esi, eax
and edx, 0xff00
and esi, 0xff0000
or esi, edx
mov edx, r12d
xor edx, ebp
movzx edx, dl
or esi, edx
mov edx, ecx
xor edx, r11d
and edx, 0xff000000
or esi, edx
mov edx, r10d
shl edx, 8
mov dword [rsp + 0xb0], esi
xor edx, ebp
and edx, 0xff00
or r9d, edx
mov edx, r11d
shr ebx, 0x10
shl edx, 8
xor ebx, eax
xor edx, eax
movzx ebx, bl
and edx, 0xff000000
or r9d, edx
mov edx, r12d
shr r12d, 8
shr edx, 0x18
xor r12d, r8d
xor edx, ecx
movzx r12d, r12b
movzx edx, dl
or r9d, edx
mov edx, r11d
shl r11d, 0x18
shl edx, 0x10
xor r11d, ebp
mov dword [rsp + 0xb4], r9d
xor edx, r8d
and r11d, 0xff000000
and edx, 0xff000000
or r12d, r11d
or ebx, edx
mov edx, edi
shr edi, 8
shl edx, 0x10
xor edi, ecx
xor edx, ebp
and edi, 0xff0000
and edx, 0xff0000
or r12d, edi
or ebx, edx
mov edx, r10d
shr r10d, 8
shr edx, 0x10
xor edx, ecx
and edx, 0xff00
or ebx, edx
xor r10d, eax
and r10d, 0xff00
mov dword [rsp + 0xb8], ebx
or r12d, r10d
mov dword [rsp + 0xbc], r12d
sub dword [rsp + 0x44], 1
jne 0x6d974522
mov eax, dword [rsp + 0xc0]
mov r10d, esi
xor r10d, dword [rsp + 0xec]
xor eax, esi
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0xec], r10d
bswap r9d
mov rcx, qword [rsp + 0x58]
mov dword [rcx], r9d
bswap ebx
mov dword [rcx + 4], ebx
bswap r12d
mov dword [rcx + 8], r12d
bswap eax
mov dword [rcx + 0xc], eax
bswap r10d
mov dword [rcx + 0x10], r10d
mov eax, dword [rsp + 0xf0]
bswap eax
mov dword [rcx + 0x14], eax
mov eax, dword [rsp + 0xf4]
bswap eax
cmp qword [rsp + 0x1a0], 8
mov dword [rcx + 0x18], eax
je 0x6d974c10
mov rcx, qword [rsp + 0x50]
lea r8, [0x6daefd40]
mov r9d, 7
mov edx, 0x17
call fcn.6d972020
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r9d, 3
jbe 0x6d974164
mov r8d, 0x10
lea rdx, [rsp + r9 + 0x60]
sub r8, r9
jmp 0x6d9741bc
mov eax, dword [rsp + 0xf8]
bswap eax
mov rcx, qword [rsp + 0x58]
lea r8, [0x6daefd20]
mov r9d, 8
mov edx, 0x16
mov dword [rcx + 0x1c], eax
mov rcx, qword [rsp + 0x50]
call fcn.6d972020
jmp 0x6d974bd7
mov ecx, r8d
mov eax, 0xff
mov r8d, 0x10
shr eax, cl
not eax
and eax, edx
lea rdx, [rsp + 0x60]
mov byte [rsp + 0x60], al
mov eax, 1
jmp 0x6d9741a0