Function at 0x564370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xab0
mov ebx, dword [esp + 0xaf8]
mov edi, dword [esp + 0xaf4]
mov ecx, dword [esp + 0xae4]
mov ebp, dword [esp + 0xae0]
mov esi, dword [esp + 0xad0]
mov eax, dword [ecx + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x40]
mov dword [esp + 8], eax
lea eax, [esp + 0x748]
push 0x354
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [esp + 0x3c4]
push 0x368
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [esp + 0x24]
push 0x384
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov ecx, ebp
mov ebp, edi
mov edx, esi
push dword [esp + 0xafc]
push ebx
call fcn.00564ea0
add esp, 8
push 0x2c08
push dword [esp + 0xac8]
call fcn.00554f90
add esp, 8
mov edi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp]
mov esi, dword [ebp + 4]
mov dword [esp + 0x72c], 0x100
mov dword [esp + 0x730], edx
mov dword [esp + 0x734], eax
mov dword [esp + 0x738], ecx
mov dword [esp + 0x73c], esi
mov dword [esp + 0x740], 1
mov dword [esp + 0x744], 0
mov dword [esp + 0xa9c], 0
xor eax, eax
mov edx, 0
test esi, esi
je 0x56447a
mov edx, dword [ecx]
mov dword [esp + 0xaa0], edx
mov dword [esp + 0xaa4], 0
mov dword [esp + 0xaa8], 0
mov dword [esp + 0xaac], 0
mov edx, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x18]
mov ebp, dword [ebp + 0x1c]
mov dword [esp + 0x3a8], 0x2c0
mov dword [esp + 0x3ac], esi
mov dword [esp + 0x3b0], edx
mov dword [esp + 0x3b4], ecx
mov dword [esp + 0x3b8], ebp
mov dword [esp + 0x3bc], 1
mov dword [esp + 0x3c0], 0
mov dword [esp + 0x718], 0
test ebp, ebp
je 0x5644fc
mov eax, dword [ecx]
mov dword [esp + 0x71c], eax
mov dword [esp + 0x720], 0
mov dword [esp + 0x724], 0
mov dword [esp + 0x728], 0
mov esi, dword [esp + 0xaf4]
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x30]
mov esi, dword [esi + 0x34]
mov ebp, dword [esp + 8]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0
mov dword [esp + 0x394], 0
test esi, esi
je 0x564572
mov eax, dword [eax]
jmp 0x564574
xor eax, eax
mov esi, dword [esp + 0xafc]
mov dword [esp + 0x398], eax
mov dword [esp + 0x39c], 0
mov dword [esp + 0x3a0], 0
mov dword [esp + 0x3a4], 0
lea ecx, [esp + 0x72c]
mov edx, edi
push esi
push ebx
call fcn.00565080
add esp, 8
lea ecx, [esp + 0x3a8]
mov edx, edi
push esi
push ebx
call fcn.00565080
add esp, 8
lea ecx, [esp + 0x24]
mov dword [esp + 4], edi
mov edx, edi
push esi
push ebx
call fcn.00565080
add esp, 8
mov edx, dword [esp + 0xae4]
mov esi, dword [edx + 0x34]
mov ebx, dword [ebx]
mov edi, ebx
shr edi, 3
mov ebp, esi
shr ebp, 1
mov eax, ebx
and al, 7
mov ecx, eax
xor cl, 0x1f
shr ebp, cl
mov ecx, eax
shl esi, cl
mov eax, dword [esp + 0xafc]
movzx eax, byte [eax + edi]
or esi, eax
mov eax, dword [esp + 0xafc]
mov dword [eax + edi + 4], ebp
mov eax, dword [esp + 0xafc]
mov dword [eax + edi], esi
lea eax, [ebx + 2]
mov ebp, dword [esp + 0xaf8]
mov dword [ebp], eax
mov esi, dword [edx + 0x38]
movzx ecx, byte [edx + 0x34]
shr esi, cl
mov edi, eax
shr edi, 3
mov edx, esi
shr edx, 1
and al, 7
mov ecx, eax
xor cl, 0x1f
shr edx, cl
mov ecx, eax
shl esi, cl
mov eax, dword [esp + 0xafc]
movzx eax, byte [eax + edi]
or esi, eax
mov eax, dword [esp + 0xafc]
mov dword [eax + edi + 4], edx
mov eax, dword [esp + 0xafc]
mov dword [eax + edi], esi
mov eax, ebp
mov edi, dword [esp + 0xafc]
add ebx, 6
mov dword [ebp], ebx
mov ebp, dword [esp + 0xaf4]
cmp dword [ebp], 0
je 0x5646f7
xor esi, esi
nop
mov edi, ebx
shr edi, 3
mov eax, dword [esp + 0xafc]
movzx eax, byte [eax + edi]
mov dword [esp + 8], eax
mov edx, dword [esp + 0xae8]
mov ebp, edx
shr ebp, 1
mov eax, ebx
and al, 7
mov ecx, eax
xor cl, 0x1f
shr ebp, cl
mov ecx, eax
shl edx, cl
or edx, dword [esp + 8]
mov eax, dword [esp + 0xafc]
mov dword [eax + edi + 4], ebp
mov ebp, dword [esp + 0xaf4]
mov eax, dword [esp + 0xafc]
mov dword [eax + edi], edx
mov eax, dword [esp + 0xaf8]
mov edi, dword [esp + 0xafc]
add ebx, 2
mov dword [eax], ebx
inc esi
cmp esi, dword [ebp]
jb 0x564690
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x564723
mov edx, dword [ebp + 0x48]
mov ecx, dword [esp + 0xac4]
push edi
mov esi, dword [esp + 0xafc]
push esi
push dword [esp + 0xc]
push dword [ebp + 0x5c]
push eax
call fcn.00565890
add esp, 0x14
jmp 0x564740
mov ecx, dword [ebp + 0x5c]
mov edx, 6
push edi
mov esi, dword [esp + 0xafc]
push esi
push dword [esp + 0xc]
call fcn.00565410
add esp, 0xc
mov eax, dword [ebp + 0x54]
test eax, eax
je 0x564765
mov edx, dword [ebp + 0x50]
mov ecx, dword [esp + 0xac4]
push edi
push esi
push dword [esp + 0xc]
push dword [ebp + 0x6c]
push eax
call fcn.00565890
add esp, 0x14
jmp 0x56477b
mov ecx, dword [ebp + 0x6c]
mov edx, 2
push edi
push esi
push dword [esp + 0xc]
call fcn.00565410
add esp, 0xc
mov esi, dword [ebp + 0x58]
mov ebx, dword [ebp + 0x5c]
mov edi, dword [esp + 0x72c]
imul edi, ebx
test edi, edi
je 0x5647b5
push edi
mov ebp, dword [esp + 0xac8]
push ebp
call fcn.00554f90
add esp, 8
mov dword [esp + 0xaa8], eax
add edi, edi
push edi
push ebp
call fcn.00554f90
add esp, 8
jmp 0x5647c2
mov dword [esp + 0xaa8], 0
xor eax, eax
mov dword [esp + 0xaac], eax
test ebx, ebx
mov edi, dword [esp + 4]
je 0x564831
xor ebp, ebp
mov dword [esp + 8], ebx
nop word [eax + eax]
mov edx, dword [esp + 0x72c]
mov ebx, edi
mov edi, edx
imul edi, ebp
mov eax, dword [esp + 0xaa8]
add eax, edi
add edi, edi
add edi, dword [esp + 0xaac]
mov ecx, esi
push dword [esp + 0xafc]
push dword [esp + 0xafc]
push edi
mov edi, ebx
mov ebx, dword [esp + 0x14]
push eax
push edi
push 0x100
call fcn.005669d0
add esp, 0x18
inc ebp
add esi, 0x410
cmp ebx, ebp
jne 0x5647e0
mov eax, dword [esp + 0xaf4]
mov esi, dword [eax + 0x60]
mov ebx, dword [eax + 0x64]
mov edi, dword [esp + 0x3a8]
imul edi, ebx
test edi, edi
je 0x564872
push edi
mov ebp, dword [esp + 0xac8]
push ebp
call fcn.00554f90
add esp, 8
mov dword [esp + 0x724], eax
add edi, edi
push edi
push ebp
call fcn.00554f90
add esp, 8
jmp 0x56487f
mov dword [esp + 0x724], 0
xor eax, eax
mov dword [esp + 0x728], eax
test ebx, ebx
mov edi, dword [esp + 4]
je 0x5648f1
xor ebp, ebp
mov dword [esp + 8], ebx
nop word cs:[eax + eax]
mov edx, dword [esp + 0x3a8]
mov ebx, edi
mov edi, edx
imul edi, ebp
mov eax, dword [esp + 0x724]
add eax, edi
add edi, edi
add edi, dword [esp + 0x728]
mov ecx, esi
push dword [esp + 0xafc]
push dword [esp + 0xafc]
push edi
mov edi, ebx
mov ebx, dword [esp + 0x14]
push eax
push edi
push 0x2c0
call fcn.005669d0
add esp, 0x18
inc ebp
add esi, 0xb10
cmp ebx, ebp
jne 0x5648a0
mov eax, dword [esp + 0xaf4]
mov esi, dword [eax + 0x68]
mov ebx, dword [eax + 0x6c]
mov edi, dword [esp + 0x24]
imul edi, ebx
test edi, edi
je 0x56492f
push edi
mov ebp, dword [esp + 0xac8]
push ebp
call fcn.00554f90
add esp, 8
mov dword [esp + 0x3a0], eax
add edi, edi
push edi
push ebp
call fcn.00554f90
add esp, 8
jmp 0x56493c
mov dword [esp + 0x3a0], 0
xor eax, eax
mov edi, dword [esp + 4]
mov dword [esp + 0x3a4], eax
test ebx, ebx
je 0x564999
xor ebp, ebp
nop dword [eax]
mov edx, dword [esp + 0x24]
mov edi, edx
imul edi, ebp
mov eax, dword [esp + 0x3a0]
add eax, edi
add edi, edi
add edi, dword [esp + 0x3a4]
mov ecx, esi
push dword [esp + 0xafc]
push dword [esp + 0xafc]
push edi
mov edi, dword [esp + 0x10]
push eax
push edi
push dword [esp + 0x24]
call fcn.005669d0
add esp, 0x18
inc ebp
add esi, 0x890
cmp ebx, ebp
jne 0x564950
push edi
push dword [esp + 0xac8]
call fcn.00554fb0
add esp, 8
cmp dword [esp + 0xaf0], 0
mov eax, dword [esp + 0xae8]
je 0x564dc5
shl eax, 9
movzx ebx, byte [esp + 0xadc]
mov bh, byte [esp + 0xad8]
mov esi, dword [esp + 0xacc]
add eax, dword [0x86ae10]
mov dword [esp + 8], eax
xor eax, eax
jmp 0x564a9b
mov ebp, edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
shr ecx, 6
and edi, 7
lea eax, [ecx - 2]
test eax, 0xfffffffd
mov eax, 3
cmove eax, edi
cmp ecx, 7
cmove eax, edi
cmp edi, 3
mov ecx, 3
cmovae eax, ecx
lea ecx, [esp + 0x24]
push 2
push ebp
mov edi, dword [esp + 0xb00]
push edi
mov edi, dword [esp + 0xb00]
push dword [edi + 0x50]
push eax
call fcn.00566330
add esp, 0x14
mov eax, dword [esp + 0xaf8]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ch, al
mov edi, eax
shr edi, 3
movzx eax, byte [ebp + edi]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov edx, eax
shr edx, 1
and ch, 7
mov cl, ch
xor cl, 0x1f
shr edx, cl
mov cl, ch
shl eax, cl
or eax, dword [esp + 0xc]
mov dword [ebp + edi + 4], edx
mov dword [ebp + edi], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xaf8]
mov dword [ecx], eax
mov eax, dword [esp + 4]
inc eax
cmp eax, dword [esp + 0xaf0]
je 0x564dc5
mov byte [esp + 2], bl
mov dword [esp + 4], eax
shl eax, 4
mov ecx, dword [esp + 0xaec]
mov ebp, dword [ecx + eax]
mov edi, dword [ecx + eax + 4]
mov edx, dword [ecx + eax + 8]
mov dword [esp + 0x20], edx
movzx edx, word [ecx + eax + 0xc]
movzx eax, word [ecx + eax + 0xe]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x3a8]
mov dword [esp + 0x1c], edx
push dword [esp + 0xafc]
push dword [esp + 0xafc]
call fcn.00566120
add esp, 8
mov eax, edi
shr eax, 0x19
mov ecx, edi
shr ecx, 0x18
and ecx, 0xffffff80
or ecx, eax
movsx edx, cl
and edi, 0x1ffffff
mov dword [esp + 0x10], edi
add edx, edi
mov eax, ebp
cmp ebp, 6
jb 0x564b70
cmp ebp, 0x81
ja 0x564b30
lea eax, [ebp - 2]
bsr edi, eax
xor edi, 0xffffffe0
lea ecx, [edi + 0x1f]
shr eax, cl
lea eax, [eax + edi*2]
add eax, 0x40
jmp 0x564b70
cmp ebp, 0x841
ja 0x564b46
lea eax, [ebp - 0x42]
bsr eax, eax
xor eax, 0xffffffe0
add eax, 0x2a
jmp 0x564b70
mov eax, 0x15
cmp ebp, 0x1842
jb 0x564b70
xor eax, eax
cmp ebp, 0x5842
setb al
xor eax, 0x17
nop word cs:[eax + eax]
cmp edx, 9
mov byte [esp + 3], bh
ja 0x564b90
lea ecx, [edx + 0xfffe]
jmp 0x564bd0
cmp edx, 0x85
ja 0x564bb0
lea edi, [edx - 6]
bsr ebx, edi
xor ebx, 0xffffffe0
lea ecx, [ebx + 0x1f]
shr edi, cl
lea ecx, [edi + ebx*2]
add ecx, 0x42
jmp 0x564bd0
mov ecx, 0x17
cmp edx, 0x845
ja 0x564bd0
lea ecx, [edx - 0x46]
bsr ecx, ecx
xor ecx, 0xffffffe0
add ecx, 0x2c
nop dword [eax]
mov dword [esp + 0x18], ecx
movzx edi, ax
shl edi, 2
mov eax, dword [0x8b5f74]
mov eax, dword [eax + edi]
mov ecx, ebp
mov ebx, dword [0x8bacc4]
sub ecx, dword [ebx + edi]
mov dword [esp + 0xc], ecx
movzx edi, word [esp + 0x18]
shl edi, 2
mov ecx, dword [0x8bacc0]
sub edx, dword [ecx + edi]
xor ebx, ebx
mov ecx, eax
shld ebx, edx, cl
shl edx, cl
test al, 0x20
cmovne ebx, edx
mov ecx, 0
cmovne edx, ecx
or edx, dword [esp + 0xc]
mov ecx, dword [0x8b5f70]
add eax, dword [ecx + edi]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xaf8]
mov eax, edx
mov edx, dword [ecx]
mov dword [esp + 0x18], edx
mov ecx, edx
mov edi, edx
shr edi, 3
and cl, 7
shld ebx, eax, cl
shl eax, cl
mov edx, dword [esp + 0xafc]
movzx ecx, byte [edx + edi]
or eax, ecx
mov dword [edx + edi + 4], ebx
mov ecx, dword [esp + 0xaf8]
mov dword [edx + edi], eax
mov eax, dword [esp + 0xc]
add eax, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0xaf4]
cmp dword [eax + 0x4c], 0
je 0x564d00
movzx edx, byte [esp + 2]
mov ebx, edx
test ebp, ebp
mov bh, byte [esp + 3]
je 0x564d43
mov bl, bh
movzx eax, bh
movzx ecx, dl
mov edx, dword [esp + 8]
movzx ecx, byte [edx + ecx + 0x100]
or cl, byte [edx + eax]
movzx eax, cl
mov ecx, esi
and ecx, dword [esp + 0xad4]
mov edx, dword [esp + 0xac8]
mov bh, byte [edx + ecx]
movzx edx, bh
lea ecx, [esp + 0x72c]
push 6
push dword [esp + 0xb00]
push dword [esp + 0xb00]
mov edi, esi
mov esi, dword [esp + 0xb00]
push dword [esi + 0x48]
mov esi, edi
push eax
call fcn.00566330
add esp, 0x14
inc esi
mov edx, ebx
dec ebp
jne 0x564c90
jmp 0x564d43
test ebp, ebp
je 0x564d3a
lea edi, [esp + 0x72c]
mov ebx, ecx
nop dword [eax]
mov eax, esi
and eax, dword [esp + 0xad4]
mov ecx, dword [esp + 0xac8]
movzx edx, byte [ecx + eax]
mov ecx, edi
push dword [esp + 0xafc]
push ebx
call fcn.00566120
add esp, 8
inc esi
dec ebp
jne 0x564d10
movzx ebx, byte [esp + 2]
mov bh, byte [esp + 3]
mov eax, dword [esp + 0x10]
add esi, eax
test eax, eax
mov ecx, dword [esp + 0xad4]
mov edi, dword [esp + 0xafc]
je 0x564a89
lea eax, [esi - 2]
and eax, ecx
mov edx, dword [esp + 0xac8]
movzx ebx, byte [edx + eax]
lea eax, [esi - 1]
and eax, ecx
mov bh, byte [edx + eax]
cmp dword [esp + 0x1c], 0x80
jb 0x564a89
mov eax, dword [esp + 0x14]
mov edx, eax
and edx, 0x3ff
shr eax, 0xa
mov ebp, dword [esp + 0xaf4]
cmp dword [ebp + 0x54], 0
mov dword [esp + 0x14], eax
jne 0x5649e8
lea ecx, [esp + 0x24]
push edi
mov eax, dword [esp + 0xafc]
push eax
call fcn.00566120
add esp, 8
mov ebp, edi
jmp 0x564a39
push dword [esp + 0x3a0]
mov esi, dword [esp + 0xac8]
push esi
call fcn.00554fb0
add esp, 8
mov dword [esp + 0x3a0], 0
push dword [esp + 0x3a4]
push esi
call fcn.00554fb0
add esp, 8
mov dword [esp + 0x3a4], 0
push dword [esp + 0x724]
push esi
call fcn.00554fb0
add esp, 8
mov dword [esp + 0x724], 0
push dword [esp + 0x728]
push esi
call fcn.00554fb0
add esp, 8
mov dword [esp + 0x728], 0
push dword [esp + 0xaa8]
push esi
call fcn.00554fb0
add esp, 8
mov dword [esp + 0xaa8], 0
push dword [esp + 0xaac]
push esi
call fcn.00554fb0
add esp, 8
cmp dword [esp + 0xae0], 0
mov edx, dword [esp + 0xaf8]
je 0x564e8e
mov eax, dword [edx]
add eax, 7
mov ecx, eax
and ecx, 0xfffffff8
mov dword [edx], ecx
shr eax, 3
mov ecx, dword [esp + 0xafc]
mov byte [ecx + eax], 0
add esp, 0xab0
pop esi
pop edi
pop ebx
pop ebp
ret