Function at 0x41fd80
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov esi, esp
mov edi, ecx
mov dword [esi + 0xdc], 0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd0], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 2
mov dword [esi + 0xc8], 1
push 0xc904973f
push dword [0x44ab0c]
call fcn.0043e580
add esp, 8
lea ecx, [esi + 0x3c]
lea edx, [esi + 0xc0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
jne 0x41fead
push 0x39be051d
push dword [0x44ab0c]
call fcn.0043e580
add esp, 8
mov dword [esi + 0xc], eax
push 0x847b02a2
push dword [0x44ab0c]
call fcn.0043e580
add esp, 8
mov dword [esi + 0x10], eax
push 0x2e775759
push dword [0x44ab0c]
call fcn.0043e580
add esp, 8
mov dword [esi + 0x14], eax
mov ebx, dword [esi + 0x3c]
jmp 0x41fe63
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x41fe95
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x41fe60
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 0x10]
test eax, eax
je 0x41fe95
push dword [edi]
call dword [esi + 0x14]
mov dword [edi], 0xffffffff
jmp 0x41fe60
push 0x18c354a9
push dword [0x44ab0c]
call fcn.0043e580
add esp, 8
push dword [esi + 0x3c]
call eax
xor ebx, ebx
cmp dword [edi], 0xffffffff
je 0x42052a
mov dword [esi + 0x28], edi
mov edi, dword [ebp + 0x10]
nop
nop
cmp byte [edi + ebx], 0
lea ebx, [ebx + 1]
jne 0x41fec0
lea ecx, [edi + ebx]
dec ecx
not edi
mov dword [esi + 0xc], ecx
and edi, ecx
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
nop
nop
nop
nop
cmp byte [ebx + edx], 0
lea edx, [edx + 1]
jne 0x41fee0
lea eax, [ebx + edx]
dec eax
mov edx, ebx
not edx
mov dword [esi + 0x14], eax
and edx, eax
mov dword [esi + 0x10], edx
xor edx, edx
nop
nop
nop
nop
nop
cmp byte [ecx + edx], 0
lea edx, [edx + 1]
jne 0x41ff00
mov eax, dword [esi + 0xc]
xor eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
xor eax, ebx
add eax, dword [esi + 0xc]
add edx, ecx
dec edx
mov ebx, ecx
not ebx
and ebx, edx
xor edx, ecx
add edx, eax
add edi, dword [esi + 0x10]
add edi, edi
sub edi, edx
lea eax, [edi + ebx*2]
add eax, 0x93
and eax, 0xfffffffc
call fcn.004080f0
mov eax, esp
and eax, 0xfffffff0
mov dword [esi + 0xc], eax
mov esp, eax
mov dword [esi + 0x40], 0xa5a6b36c
mov dword [esi + 0x44], 0x978996b8
mov dword [esi + 0x48], 0xb974708b
mov dword [esi + 0x4c], 0xbbf2f2d1
mov word [esi + 0x50], 0x7b5c
mov dword [esi + 0x52], 0
mov word [esi + 0x56], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x13
xor dl, byte [esi + eax + 0x40]
add dl, 0xa1
mov byte [esi + eax + 0x40], dl
inc eax
cmp eax, 0x18
jne 0x41ff80
mov dword [esi + 0x1c], 0xc3362427
mov byte [esi + 0x20], 0xe4
mov dword [esi + 0x21], 0
mov dword [esi + 0x24], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esi + eax + 0x1c]
lea edx, [eax + eax]
mov ebx, edx
and ebx, 0x10
or ebx, eax
xor ebx, 0xa6161ba8
mov ecx, ebx
and ecx, edi
add ebx, edi
add ecx, ecx
sub ebx, ecx
add bl, 0xb8
mov byte [esi + eax + 0x1c], bl
and edx, 2
xor eax, 1
add eax, edx
cmp eax, 0xc
jb 0x41ffc0
movzx eax, byte [esi + 0x1c]
mov ebx, dword [esi + 0xc]
test al, al
je 0x42001b
lea edx, [esi + 0x1d]
mov ebx, dword [esi + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420010
mov byte [ebx], 0
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ecx]
test al, al
je 0x42003b
inc ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420030
mov byte [ebx], 0
movzx eax, byte [esi + 0x40]
test al, al
je 0x42005b
lea ecx, [esi + 0x41]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420050
mov byte [ebx], 0
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
test al, al
je 0x42007b
inc ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420070
mov byte [ebx], 0x3a
mov dword [esi + 0x40], 0xd1f94d33
mov dword [esi + 0x44], 0xe1e1d1e9
mov dword [esi + 0x48], 0xd02e15e3
mov dword [esi + 0x4c], 0x24d7e9e7
mov dword [esi + 0x50], 0x2d192219
mov dword [esi + 0x54], 0x2cffb9c7
mov dword [esi + 0x58], 0x1411292a
mov dword [esi + 0x5c], 0x332b1024
mov dword [esi + 0x60], 0x3119c7fe
mov dword [esi + 0x64], 0x1013109
mov dword [esi + 0x68], 0x14a4d803
mov dword [esi + 0x6c], 0x2cfd0607
mov dword [esi + 0x70], 0x2b353b
mov dword [esi + 0x74], 0x13d063d
mov dword [esi + 0x78], 0x2312acb
mov dword [esi + 0x7c], 0x38d2fbc2
mov dword [esi + 0x80], 0xd12b1513
mov dword [esi + 0x84], 0x3616341d
mov dword [esi + 0x88], 0xc0cd1a33
mov dword [esi + 0x8c], 0x44d51c1f
mov dword [esi + 0x90], 0xa3bf6744
mov dword [esi + 0x94], 0x44bb50b8
mov dword [esi + 0x98], 0xf389b869
mov dword [esi + 0x9c], 0xb2575445
mov dword [esi + 0xa0], 0x5c44485d
mov dword [esi + 0xa4], 0x42774e71
mov dword [esi + 0xa8], 0x4650b870
mov dword [esi + 0xac], 0x4441767a
mov dword [esi + 0xb0], 0x82b68d42
mov dword [esi + 0xb4], 0xaad8a48d
mov word [esi + 0xb8], 0xdfd6
mov word [esi + 0xbe], 0
mov dword [esi + 0xba], 0
mov eax, 0x56a41ff1
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax - 0x56a41fb1]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0x4a
mov byte [esi + eax - 0x56a41fb1], cl
inc eax
cmp eax, 0x56a42071
jne 0x4201a0
inc ebx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x4201eb
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4201e0
mov byte [ebx], 0
movzx eax, byte [esi + 0x40]
test al, al
je 0x42020b
lea ecx, [esi + 0x41]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420200
mov byte [ebx], 0
mov edi, dword [esi + 0xc]
sub ebx, edi
push 0xd0026952
push dword [0x44ab0c]
call fcn.0043e580
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x28]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x420278
cmp dword [edi], 0xffffffff
je 0x420278
push 0x59ea2086
push dword [0x44ab0c]
call fcn.0043e580
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44ab0c]
call fcn.0043e580
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor ebx, ebx
jmp 0x42052a
cmp eax, 0xffffffff
je 0x42039e
push 0x400
call fcn.004082d0
add esp, 4
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
add eax, 0x400
mov dword [esi + 0x24], eax
lea eax, [esi + 0x1c]
mov ecx, edi
push eax
call fcn.004207d0
mov bl, 1
test al, al
je 0x420515
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x24]
jne 0x42042c
mov dword [esi + 0x10], ecx
mov dword [esi + 0xc], eax
lea eax, [ebx + 1]
mov edi, ebx
shr edi, 1
add edi, ebx
cmp edi, eax
ja 0x4202d9
mov edi, eax
push edi
call fcn.004082d0
add esp, 4
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x42041e
mov dword [esi + 0x30], edi
cmp eax, ecx
mov edx, dword [esi + 0x10]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], eax
jbe 0x4203a5
cmp edx, eax
jbe 0x4203a5
test ebx, ebx
je 0x42040a
mov edx, dword [esi + 0x14]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x18]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x42033c
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x420329
add eax, edx
add ecx, edx
add edx, dword [esi + 0x14]
mov edi, dword [esi + 0xc]
sub edi, dword [esi + 0x10]
cmp edi, 0xfffffff8
ja 0x42040a
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x42034f
jmp 0x42040a
xor ebx, ebx
jmp 0x42052a
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add eax, edx
mov dword [esi + 0x10], eax
add edx, dword [esi + 0xc]
and ebx, 3
mov ecx, ebx
shr ecx, 1
mov eax, edx
mov edi, dword [esi + 0x10]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [esi + 0x10]
mov eax, ebx
xor eax, 0xfffffffe
or ebx, 1
and ebx, eax
je 0x42040a
mov ecx, dword [esi + 0x14]
and ecx, 2
movzx eax, byte [edx + ecx]
mov byte [edi + ecx], al
cmp ebx, 1
je 0x42040a
movzx eax, byte [edx + ecx + 1]
mov byte [edi + ecx + 1], al
cmp ebx, 2
je 0x42040a
movzx eax, byte [edx + ecx + 2]
mov byte [edi + ecx + 2], al
push dword [esi + 0x1c]
call fcn.004082e0
add esp, 4
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x20], ecx
add edi, eax
mov dword [esi + 0x24], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
inc ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x40], 0xc7cab540
mov dword [esi + 0x44], 0x22202427
mov dword [esi + 0x48], 0x2e2e2010
mov byte [esi + 0x4c], 0x7c
mov dword [esi + 0x4d], 0
mov ecx, 0x48babe
mov edi, 0x7ab74541
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edi
and ebx, 0x52b00549
mov edx, ecx
and edx, 0x4880b6
or edx, ebx
movzx ebx, byte [esi + ecx - 0x48ba7e]
xor edx, ebx
mov ebx, edx
not ebx
and ebx, 0x49
lea edx, [edx + ebx*2]
inc dl
mov byte [esi + ecx - 0x48ba7e], dl
inc ecx
dec edi
cmp ecx, 0x48bacf
jne 0x420470
movzx ecx, byte [esi + 0x40]
mov edx, eax
mov dword [esi + 0x14], eax
test cl, cl
mov edi, dword [esi + 0x28]
je 0x420501
lea edx, [esi + 0x40]
mov dword [esi + 0xc], edx
mov ebx, eax
mov edx, eax
mov dword [esi + 0x14], eax
jmp 0x4204dd
mov ecx, dword [esi + 0xc]
movzx ecx, byte [ecx]
test cl, cl
mov edi, dword [esi + 0x28]
je 0x420501
movzx edx, byte [ebx]
test dl, dl
je 0x420507
inc ebx
inc dword [esi + 0xc]
mov edi, dword [esi + 0x14]
inc edi
cmp dl, cl
je 0x4204f7
mov ecx, edi
mov dword [esi + 0x14], edi
mov ebx, edi
je 0x4204d0
lea ecx, [esi + 0x40]
mov dword [esi + 0xc], ecx
jmp 0x4204d0
cmp dword [esi + 0x14], 0
jne 0x420544
mov ecx, edi
push 0x3ea
call fcn.0041fa90
xor ebx, ebx
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x42052a
cmp eax, dword [esi + 0x20]
je 0x42052a
push eax
call fcn.004082e0
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
cmp dl, dh
je 0x420515
mov ebx, eax
mov edx, dword [esi + 0x10]
sub ebx, edx
je 0x420572
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], edx
mov edi, eax
xor ecx, ecx
mov edx, dword [esi + 0xc]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
xor ecx, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [esi + 0x28]
add dword [esi + 0x20], ebx
mov ecx, edi
lea eax, [esi + 0x1c]
push eax
call fcn.004207d0
test al, al
je 0x420513
mov ebx, eax
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
mov ecx, edx
sub ecx, eax
cmp edx, dword [esi + 0x24]
jne 0x420763
mov dword [esi + 0x38], edx
mov dword [esi + 0x18], eax
lea eax, [ecx + 1]
mov edx, ecx
shr edx, 1
mov dword [esi + 0x14], ecx
add edx, ecx
cmp edx, eax
ja 0x4205ae
mov edx, eax
mov dword [esi + 0x30], edx
push edx
call fcn.004082d0
add esp, 4
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x42074f
cmp eax, ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x34], eax
jbe 0x420630
cmp dword [esi + 0x38], eax
jbe 0x420630
test ecx, ecx
je 0x42073e
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
add ecx, eax
dec ecx
mov dword [esi + 0x2c], ecx
mov ecx, dword [esi + 0x34]
lea edx, [ecx + eax]
dec edx
mov ecx, eax
and ecx, 7
mov dword [esi + 0x10], ecx
mov dword [esi + 0xc], edx
je 0x4206c6
neg dword [esi + 0x10]
xor ecx, ecx
mov edx, dword [esi + 0x2c]
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [edx + ecx]
mov edi, dword [esi + 0xc]
mov byte [edi + ecx], al
dec ecx
cmp dword [esi + 0x10], ecx
jne 0x420610
add edx, ecx
mov dword [esi + 0x2c], edx
add dword [esi + 0xc], ecx
add ecx, dword [esi + 0x14]
jmp 0x4206c8
shr ecx, 2
mov edx, dword [esi + 0x18]
mov dword [esi + 0xc], edx
mov edi, eax
mov edx, dword [esi + 0xc]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, dword [esi + 0x14]
mov edx, ecx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi + 0x18]
mov eax, ecx
and eax, 3
mov ecx, eax
shr ecx, 1
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], edi
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov ecx, eax
xor ecx, 0xfffffffe
or eax, 1
and eax, ecx
je 0x42073e
mov edx, dword [esi + 0x14]
and edx, 2
mov ecx, dword [esi + 0x10]
movzx ecx, byte [ecx + edx]
mov edi, dword [esi + 0xc]
mov dword [esi + 0x18], edx
mov byte [edi + edx], cl
cmp eax, 1
je 0x42073e
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
movzx ecx, byte [ecx + edx + 1]
mov edi, dword [esi + 0xc]
mov byte [edi + edx + 1], cl
cmp eax, 2
je 0x42073e
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x10]
movzx eax, byte [eax + edx + 2]
mov ecx, dword [esi + 0xc]
mov byte [ecx + edx + 2], al
jmp 0x42073e
mov ecx, eax
mov dword [esi + 0x10], ecx
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x38]
cmp eax, 0xfffffff8
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0xc]
ja 0x42073e
neg dword [esi + 0x10]
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [edx + edi]
mov byte [ecx + edi], al
movzx eax, byte [edx + edi - 1]
mov byte [ecx + edi - 1], al
movzx eax, byte [edx + edi - 2]
mov byte [ecx + edi - 2], al
movzx eax, byte [edx + edi - 3]
mov byte [ecx + edi - 3], al
movzx eax, byte [edx + edi - 4]
mov byte [ecx + edi - 4], al
movzx eax, byte [edx + edi - 5]
mov byte [ecx + edi - 5], al
movzx eax, byte [edx + edi - 6]
mov byte [ecx + edi - 6], al
movzx eax, byte [edx + edi - 7]
mov byte [ecx + edi - 7], al
add edi, 0xfffffff8
cmp dword [esi + 0x10], edi
jne 0x4206f0
push dword [esi + 0x1c]
call fcn.004082e0
add esp, 4
mov edi, dword [esi + 0x28]
mov eax, dword [esi + 0x34]
mov dword [esi + 0x1c], eax
mov ecx, dword [esi + 0x14]
lea edx, [eax + ecx]
mov dword [esi + 0x20], edx
mov edx, dword [esi + 0x30]
add edx, eax
mov dword [esi + 0x24], edx
mov byte [eax + ecx], 0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
inc ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x40], 0xfee5e3
xor ecx, ecx
nop
nop
nop
mov edx, ecx
add dl, 0x55
xor dl, byte [esi + ecx + 0x40]
add dl, 0x57
mov byte [esi + ecx + 0x40], dl
mov edx, ecx
not edx
or edx, 1
add edx, ecx
or ecx, 1
add ecx, edx
inc ecx
cmp ecx, 4
jb 0x420780
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax + ecx]
mov dh, byte [esi + ecx + 0x40]
test dl, dl
je 0x420540
inc ecx
cmp dl, dh
je 0x4207b0
jmp 0x420540