Function at 0x420df0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0xc904973f
push dword [0x44b9fc]
call fcn.0043fb70
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push ebx
push dword [ebp + 8]
call eax
test eax, eax
je 0x420e8c
cmp dword [edi], 0xffffffff
jne 0x420f38
jmp 0x42141f
push 0x39be051d
push dword [0x44b9fc]
call fcn.0043fb70
add esp, 8
mov dword [esi], eax
push 0x847b02a2
push dword [0x44b9fc]
call fcn.0043fb70
add esp, 8
mov dword [esi + 4], eax
push 0x2e775759
push dword [0x44b9fc]
call fcn.0043fb70
add esp, 8
mov dword [esi + 8], eax
mov ebx, dword [esi + 0x28]
jmp 0x420ee3
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x420f14
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x420ee0
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 4]
test eax, eax
je 0x420f14
push dword [edi]
call dword [esi + 8]
mov dword [edi], 0xffffffff
jmp 0x420ee0
push 0x18c354a9
push dword [0x44b9fc]
call fcn.0043fb70
add esp, 8
push dword [esi + 0x28]
call eax
mov ebx, dword [ebp + 0xc]
cmp dword [edi], 0xffffffff
je 0x42141f
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x420f40
mov edx, dword [ebp + 8]
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x420f50
mov dword [esi + 0x1c], edi
mov edx, ebx
nop
nop
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x420f60
add eax, 3
and eax, 0xfffffffc
call fcn.004081e0
mov eax, esp
and eax, 0xfffffff0
mov dword [esi], eax
mov esp, eax
mov dword [esi + 0x2c], 0xe5e6d32c
mov dword [esi + 0x30], 0x37c936d8
mov dword [esi + 0x34], 0xd91410cb
mov dword [esi + 0x38], 0xdb9292f1
mov word [esi + 0x3c], 0x1b3c
mov dword [esi + 0x3e], 0
mov word [esi + 0x42], 0
mov eax, 0xc3
mov edx, 0x3c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esi + eax - 0x97]
mov ebx, edx
xor ebx, eax
and ebx, edi
xor ebx, eax
add bl, 0x31
mov byte [esi + eax - 0x97], bl
inc eax
dec edx
cmp eax, 0xdb
jne 0x420fc0
mov dword [esi + 0xc], 0xd31e0c0f
mov byte [esi + 0x10], 0xec
mov dword [esi + 0x11], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0xc
mov edi, eax
xor edi, 0xac
lea edx, [edi + edx*2]
xor dl, byte [esi + eax + 0xc]
add dl, 0xa4
mov byte [esi + eax + 0xc], dl
add eax, 0xdc22cafb
mov edx, eax
xor edx, 0xdc22cafa
and eax, 0x105
add eax, eax
sub eax, edx
cmp eax, 9
jb 0x421000
movzx eax, byte [esi + 0xc]
mov edi, dword [esi]
test al, al
je 0x42105b
lea edx, [esi + 0xd]
mov edi, dword [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [edx]
inc edx
test al, al
jne 0x421050
mov byte [edi], 0
movzx eax, byte [ecx]
test al, al
je 0x42107d
inc ecx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x421070
jmp 0x421080
mov edx, dword [ebp + 8]
mov byte [edi], 0
movzx eax, byte [esi + 0x2c]
test al, al
je 0x42109b
lea ecx, [esi + 0x2d]
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x421090
mov byte [edi], 0
movzx eax, byte [edx]
test al, al
je 0x4210bb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [edx]
inc edx
test al, al
jne 0x4210b0
mov dword [esi + 4], edi
mov byte [edi], 0x3a
mov dword [esi + 0x2c], 0x436f3b25
mov dword [esi + 0x30], 0x535f4f53
mov dword [esi + 0x34], 0x441a0355
mov dword [esi + 0x38], 0x30352729
mov dword [esi + 0x3c], 0x3f2f2a23
mov dword [esi + 0x40], 0x380d4759
mov dword [esi + 0x44], 0x28273f3e
mov dword [esi + 0x48], 0x21213c28
mov dword [esi + 0x4c], 0x230f716a
mov dword [esi + 0x50], 0x333f2f33
mov dword [esi + 0x54], 0x8504c35
mov dword [esi + 0x58], 0x38530609
mov dword [esi + 0x5c], 0x1431030d
mov dword [esi + 0x60], 0x1303060f
mov dword [esi + 0x64], 0x1207225d
mov dword [esi + 0x68], 0x243e554e
mov dword [esi + 0x6c], 0x43110305
mov dword [esi + 0x70], 0x260a280f
mov dword [esi + 0x74], 0x343b1225
mov dword [esi + 0x78], 0xd0bbf0f1
mov dword [esi + 0x7c], 0xb1cdf1d0
mov dword [esi + 0x80], 0xd0c1ecc4
mov dword [esi + 0x84], 0x819fcce3
mov dword [esi + 0x88], 0xa2f5f8c7
mov dword [esi + 0x8c], 0xc0f0fccf
mov dword [esi + 0x90], 0xf2f5feeb
mov dword [esi + 0x94], 0xf6c4ace4
mov dword [esi + 0x98], 0xd0cfd6d6
mov dword [esi + 0x9c], 0x92829bd6
mov dword [esi + 0xa0], 0xbaa4b89f
mov word [esi + 0xa4], 0xa9a2
mov byte [esi + 0xaa], 0
mov dword [esi + 0xa6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax + 0x2c]
mov edx, ecx
not edx
and edx, 0x47
mov edi, 0x671984cb
sub edi, eax
xor ecx, 0x6a308a47
or ecx, edx
xor ecx, edi
mov edx, ecx
and edx, 0x2002fb
xor edx, 0x4611b8
mov ebx, ecx
and ebx, 2
mov edi, edx
or edx, 2
imul edx, ebx
xor ebx, 2
and edi, 0xf9
imul edi, ebx
xor ecx, 0x43
add ecx, edi
add ecx, edx
inc cl
mov byte [esi + eax + 0x2c], cl
mov ecx, eax
not ecx
or ecx, 1
add ecx, eax
or eax, 1
add eax, ecx
inc eax
cmp eax, 0x7f
jb 0x4211d0
mov edx, dword [esi + 4]
inc edx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x42125b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x421250
mov byte [edx], 0
movzx eax, byte [esi + 0x2c]
test al, al
je 0x42127b
lea ecx, [esi + 0x2d]
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x421270
mov byte [edx], 0
mov edi, edx
mov ebx, dword [esi]
sub edi, ebx
push 0xd0026952
push dword [0x44b9fc]
call fcn.0043fb70
add esp, 8
push 0
push edi
push ebx
mov edi, dword [esi + 0x1c]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x4212e9
cmp dword [edi], 0xffffffff
je 0x4212e9
push 0x59ea2086
push dword [0x44b9fc]
call fcn.0043fb70
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44b9fc]
call fcn.0043fb70
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x4217d3
cmp eax, 0xffffffff
je 0x42141f
push 0x400
call fcn.00408300
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add eax, 0x400
mov dword [esi + 0x14], eax
lea eax, [esi + 0xc]
mov ecx, edi
push eax
call fcn.004217e0
mov cl, 1
mov dword [esi + 4], ecx
test al, al
je 0x4217bb
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x421485
mov dword [esi + 4], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x20], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x421350
mov edi, eax
push edi
call fcn.00408300
add esp, 4
mov edx, dword [esi]
test edx, edx
je 0x421477
mov dword [esi + 0x24], edi
cmp eax, edx
mov dword [esi + 8], ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x18], eax
jbe 0x421426
cmp ecx, eax
jbe 0x421426
test ebx, ebx
je 0x421463
mov edi, edx
mov edx, dword [esi + 8]
mov eax, edx
and eax, 0xfffffffe
mov ecx, edx
not ecx
and ecx, 1
sub eax, ecx
lea ecx, [edi + eax]
add eax, dword [esi + 0x18]
mov edi, edx
and edi, 7
je 0x4213be
neg edi
xor edx, edx
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
dec edx
cmp edi, edx
jne 0x4213ab
add ecx, edx
add eax, edx
add edx, dword [esi + 8]
mov edi, dword [esi]
sub edi, dword [esi + 4]
cmp edi, 0xfffffff8
ja 0x421463
neg edx
xor edi, edi
movzx ebx, byte [ecx + edi]
mov byte [eax + edi], bl
movzx ebx, byte [ecx + edi - 1]
mov byte [eax + edi - 1], bl
movzx ebx, byte [ecx + edi - 2]
mov byte [eax + edi - 2], bl
movzx ebx, byte [ecx + edi - 3]
mov byte [eax + edi - 3], bl
movzx ebx, byte [ecx + edi - 4]
mov byte [eax + edi - 4], bl
movzx ebx, byte [ecx + edi - 5]
mov byte [eax + edi - 5], bl
movzx ebx, byte [ecx + edi - 6]
mov byte [eax + edi - 6], bl
movzx ebx, byte [ecx + edi - 7]
mov byte [eax + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x4213d0
jmp 0x421463
xor eax, eax
jmp 0x4217d3
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x20]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x421463
mov ecx, dword [esi + 8]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.00408310
add esp, 4
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x18]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x2c], 0x33363538
mov dword [esi + 0x30], 0x5658545b
mov dword [esi + 0x34], 0x4a4a4858
mov byte [esi + 0x38], 0x7c
mov dword [esi + 0x39], 0
mov byte [esi + 0x3d], 0
mov ecx, 0xe8
mov edi, 0x17
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + ecx - 0xbc]
mov ebx, edi
xor ebx, ecx
and ebx, edx
xor ebx, ecx
add bl, 0x78
mov byte [esi + ecx - 0xbc], bl
inc ecx
dec edi
cmp ecx, 0xfa
jne 0x4214d0
movzx ebx, byte [esi + 0x2c]
mov ecx, eax
mov dword [esi + 8], eax
test bl, bl
mov ecx, dword [esi + 0x1c]
je 0x421554
lea edx, [esi + 0x2c]
mov dword [esi + 4], edx
mov edx, eax
mov edi, eax
mov dword [esi + 8], eax
mov edi, dword [esi + 4]
jmp 0x42152a
movzx ebx, byte [edi]
test bl, bl
mov ecx, dword [esi + 0x1c]
je 0x421554
mov bh, byte [edx]
test bh, bh
je 0x4217aa
inc edx
inc edi
mov dword [esi + 4], edi
mov ecx, dword [esi + 8]
lea edi, [ecx + 1]
cmp bh, bl
je 0x42154a
mov ecx, edi
mov dword [esi + 8], edi
mov edx, edi
mov edi, dword [esi + 4]
je 0x421520
lea edi, [esi + 0x2c]
jmp 0x421520
cmp dword [esi + 8], 0
je 0x4217aa
mov edx, dword [esi]
jmp 0x42157d
cmp bl, bh
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi]
je 0x4217bb
mov ebx, eax
sub ebx, edx
je 0x4215a6
mov dword [esi], edx
mov dword [esi + 4], edx
mov edi, eax
xor ecx, ecx
mov edx, dword [esi + 4]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, eax
xor ecx, ecx
mov eax, dword [esi]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 0x1c]
add dword [esi + 0x10], ebx
lea eax, [esi + 0xc]
push eax
call fcn.004217e0
test al, al
je 0x4217b4
mov dword [esi + 4], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x421731
mov dword [esi + 8], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x24], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x4215e5
mov edi, eax
push edi
call fcn.00408300
add esp, 4
mov edx, dword [esi]
test edx, edx
je 0x421723
mov dword [esi + 0xac], edi
cmp eax, edx
mov dword [esi + 0x18], ebx
mov ecx, dword [esi + 8]
mov dword [esi + 0x20], eax
jbe 0x4216cf
cmp ecx, eax
jbe 0x4216cf
test ebx, ebx
je 0x42170c
mov edi, edx
mov edx, dword [esi + 0x18]
mov eax, edx
and eax, 0xfffffffe
mov ecx, edx
not ecx
and ecx, 1
sub eax, ecx
lea ecx, [edi + eax]
add eax, dword [esi + 0x20]
mov edi, edx
and edi, 7
je 0x421663
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
dec edx
cmp edi, edx
jne 0x421650
add ecx, edx
add eax, edx
add edx, dword [esi + 0x18]
mov edi, dword [esi]
sub edi, dword [esi + 8]
cmp edi, 0xfffffff8
ja 0x42170c
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + edi]
mov byte [eax + edi], bl
movzx ebx, byte [ecx + edi - 1]
mov byte [eax + edi - 1], bl
movzx ebx, byte [ecx + edi - 2]
mov byte [eax + edi - 2], bl
movzx ebx, byte [ecx + edi - 3]
mov byte [eax + edi - 3], bl
movzx ebx, byte [ecx + edi - 4]
mov byte [eax + edi - 4], bl
movzx ebx, byte [ecx + edi - 5]
mov byte [eax + edi - 5], bl
movzx ebx, byte [ecx + edi - 6]
mov byte [eax + edi - 6], bl
movzx ebx, byte [ecx + edi - 7]
mov byte [eax + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x421680
jmp 0x42170c
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x24]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x42170c
mov ecx, dword [esi + 0x18]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.00408310
add esp, 4
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0xac]
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov word [esi + 0x2c], 0x503
mov byte [esi + 0x2e], 0xe
mov dword [esi + 0x2f], 0
mov ecx, 0x7d
mov edi, 0x82
nop
nop
nop
nop
movzx ebx, byte [esi + ecx - 0x51]
mov edx, ecx
or edx, ebx
not ebx
or ebx, edi
and ebx, edx
add bl, 0x8f
mov byte [esi + ecx - 0x51], bl
inc ecx
dec edi
cmp ecx, 0x84
jne 0x421760
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + ecx]
mov bh, byte [esi + ecx + 0x2c]
test bl, bl
je 0x421570
inc ecx
cmp bl, bh
je 0x421790
jmp 0x421570
push 0x3ea
call fcn.00420ab0
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4217d0
cmp eax, dword [esi + 0x10]
je 0x4217d0
push eax
call fcn.00408310
add esp, 4
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc