Function at 0x41f260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, edx
mov dword [ebp - 8], edx
add esi, 0xdeadbeef
add esi, ecx
mov edx, esi
mov dword [ebp - 4], edx
push edi
mov edi, esi
cmp ecx, 0xc
jbe switch.0x0041f365
add ecx, 0xfffffff3
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 0xc], eax
mov edi, edi
movzx ecx, byte [ebx + 7]
movzx eax, byte [ebx + 6]
shl ecx, 8
add ecx, eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 5]
add edx, esi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 4]
shl ecx, 8
add edi, eax
movzx eax, byte [ebx + 0xa]
add edi, ecx
movzx ecx, byte [ebx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx + 3]
shl ecx, 8
mov esi, edx
add ecx, eax
ror esi, 0x1c
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
add ebx, 0xc
add ecx, eax
sub ecx, edx
add edx, edi
add ecx, dword [ebp - 4]
xor esi, ecx
sub edi, esi
mov eax, esi
add esi, edx
ror eax, 0x1a
xor eax, edi
sub edx, eax
mov ecx, eax
ror ecx, 0x18
add eax, esi
xor ecx, edx
sub esi, ecx
mov edx, ecx
ror edx, 0x10
add ecx, eax
xor edx, esi
mov edi, edx
sub eax, edx
ror edi, 0xd
add edx, ecx
xor edi, eax
mov dword [ebp - 4], edx
sub ecx, edi
mov esi, edi
ror esi, 0x1c
add edi, edx
xor esi, ecx
mov ecx, dword [ebp - 8]
sub ecx, 0xc
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], ecx
jne 0x41f2a0
mov edi, edi
cmp ecx, 0xc
ja 0x41f3d1
jmp dword [ecx*4 + 0x41f434]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add esi, eax
movzx eax, byte [ebx + 8]
add esi, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add edx, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add edx, eax
movzx eax, byte [ebx]
add edx, eax
mov dword [ebp - 4], edx
xor esi, edi
mov eax, edi
ror eax, 0x12
sub esi, eax
mov eax, esi
mov edx, esi
xor edx, dword [ebp - 4]
ror eax, 0x15
sub edx, eax
xor edi, edx
mov eax, edx
ror eax, 7
sub edi, eax
xor esi, edi
mov eax, edi
ror eax, 0x10
sub esi, eax
mov eax, esi
mov ecx, esi
ror eax, 0x1c
xor ecx, edx
sub ecx, eax
mov eax, ecx
xor edi, ecx
ror eax, 0x12
sub edi, eax
mov eax, edi
xor esi, edi
ror eax, 8
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, esi
pop esi
lfence
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x420e8a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420ec9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420ec9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420ec9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420ec9
cmp dword [ecx + 0x74], 0xe
jbe 0x420ec9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret