Function at 0x4011dd
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
mov edi, dword [edx + 0x8c]
lock inc dword [edi]
jle 0x4014bc
mov eax, dword [edx + 0x8c]
lock inc dword [eax]
jle 0x4014bc
mov esi, dword [edx + 0x88]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x68]
mov dword [edx + 0x14], edi
xor edi, edi
mov dword [edx + 0x18], edi
mov dword [edx], edi
mov dword [edx + 4], edi
mov dword [edx + 8], esi
mov esi, dword [ecx]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], 1
mov edx, dword [ecx + 4]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 8]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x58]
push 0x4739c0
call fcn.00402f5f
add esp, 4
cmp dword [esp + 0x58], 0x80000000
je 0x401489
movsd xmm0, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x60]
mov eax, dword [esp + 0x18]
movsd qword [esp + 0x28], xmm1
movsd qword [esp + 0x20], xmm0
mov eax, dword [eax]
lock inc dword [eax + 0xe8]
lock inc dword [eax]
jle 0x4014bc
mov dword [esp], eax
mov dword [esp + 0x30], eax
lea eax, [0x470d08]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x34], 0x426bf75c
mov edx, dword [esp + 0x34]
call fcn.00403c3a
xor ebp, ebp
mov dl, 1
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebp
mov esi, ebp
mov ecx, ebp
mov ebx, ebp
movzx edi, byte [ebp + 0x4739d0]
or esi, 1
or ecx, 2
or ebx, 3
movzx esi, byte [esi + 0x4739d0]
movzx ecx, byte [ecx + 0x4739d0]
movzx ebx, byte [ebx + 0x4739d0]
shl esi, 8
shl ecx, 0x10
shl ebx, 0x18
or esi, edi
or esi, ecx
or esi, ebx
xor esi, dword [eax + ebp]
test dl, 1
mov edx, 0
mov dword [esp + ebp + 0x34], esi
mov ebp, 4
jne 0x4012c8
movzx eax, word [eax + 8]
movsd xmm0, qword [esp + 0x34]
lea edi, [esp + 4]
lea ecx, [esp + 0x20]
mov edx, edi
xor eax, 0xb496
movsd qword [esp + 4], xmm0
mov word [esp + 0xc], ax
push 0xa
call fcn.00457150
add esp, 4
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
xor eax, eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 7
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 0xa], eax
mov dword [ecx + 6], eax
lea eax, [esp + 0x34]
mov word [esp + 0x53], 0x101
mov byte [esp + 0x51], 1
mov ecx, edi
mov edx, esi
push eax
push ebp
call fcn.00456990
add esp, 8
cmp byte [esp + 4], 4
jne 0x40139e
mov edi, dword [esp + 8]
jmp 0x4013af
mov bl, byte [esp + 4]
mov edi, dword [esp + 8]
cmp bl, 4
jne 0x401454
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0xc
call fcn.0045a4d0
test eax, eax
je 0x4014be
mov ecx, dword [esp]
mov edx, 0x40b804
mov dword [eax], ecx
lea ecx, [esp + 0x68]
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
lock inc dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
add ecx, 0x40
push eax
call fcn.004456b1
add esp, 4
mov ecx, ebp
xor edx, edx
call fcn.0043b1bc
mov edi, eax
mov ebx, edx
push ebp
push esi
push edx
call fcn.00462380
add esp, 0xc
mov esi, dword [esp + 0x14]
mov cl, byte [esp + 0x2c]
mov edx, dword [esi + 8]
cmp edx, dword [esi]
jne 0x401428
mov byte [esp], cl
mov ecx, esi
call fcn.0045e8a0
mov cl, byte [esp]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
shl edx, 4
mov dword [eax + edx], edi
mov dword [eax + edx + 4], ebx
mov dword [eax + edx + 8], ebp
mov byte [eax + edx + 0xc], cl
movzx ecx, word [esp + 4]
mov word [eax + edx + 0xd], cx
mov cl, byte [esp + 6]
mov byte [eax + edx + 0xf], cl
inc dword [esi + 8]
jmp 0x401467
lea ecx, [esp + 0x30]
call fcn.00401e6f
movzx ecx, bl
mov edx, edi
call fcn.00429aac
cmp dword [esp + 0x20], 0
je 0x401241
push dword [esp + 0x24]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x401241
lea esi, [esp + 0x68]
mov ecx, esi
call fcn.00404ad2
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.004441b0
xor eax, eax
xchg dword [esi + 0x18], eax
test eax, eax
jne 0x4014cd
lea ecx, [esp + 0x68]
call fcn.00401c8a
add esp, 0x84
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
mov ecx, 4
mov edx, 0xc
call fcn.0046d190
mov ecx, dword [eax]
mov edx, dword [eax + 4]
call fcn.00444107