Function at 0x445242
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
movzx ebp, word [eax]
mov dword [esp], 0x919e3523
mov ecx, 0xe5
mov edx, 0x1a
nop
movzx esi, byte [esp + ecx - 0xe5]
mov edi, esi
not edi
mov ebx, ecx
and ebx, edi
or edi, edx
lea eax, [esi + edi]
inc eax
or eax, ebx
add al, 0x87
mov byte [esp + ecx - 0xe5], al
inc ecx
dec edx
cmp ecx, 0xe9
jne case.default.0x445229
xor ecx, ecx
cmp dword [esp], ebp
setne cl
xor eax, eax
mov ebp, dword [esp + 0x3c]
jmp dword [ecx*4 + 0x4518a8]
mov edi, dword [ebp + 0x3c]
mov esi, dword [ebp + edi]
mov ecx, dword [case.0x445229.4]
nop
nop
nop
jmp ecx
mov dword [esp], 0xd7d60418
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0xaac103ae
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x553efc52]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x9a
mov byte [esp + ecx + 0x553efc52], dl
inc ecx
cmp ecx, 0xaac103b5
jne 0x445260
xor ecx, ecx
cmp esi, dword [esp]
setne cl
jmp dword [ecx*4 + 0x4518c0]
mov ecx, dword [ebp + edi + 0x78]
mov esi, dword [ebp + edi + 0x7c]
mov edi, ecx
test esi, esi
sete cl
test edi, edi
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x4518d8]
mov dword [esp + 0xc], esi
mov eax, dword [ebp + edi + 0x20]
add eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + edi + 0x24]
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [ebp + edi + 0x1c]
add eax, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edi
mov ecx, dword [ebp + edi + 0x18]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x20], ecx
cmp ebx, ecx
setb al
mov dword [esp + 0x1c], 1
jmp dword [eax*4 + 0x4518e0]
mov eax, dword [esp + 0x24]
mov dword [esp + 8], ebx
mov edi, dword [eax + ebx*4]
add edi, ebp
mov eax, 0xffffffff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
cmp byte [edi + eax + 1], 0
lea eax, [eax + 1]
lea edx, [edx + 1]
jne 0x445320
mov dword [esp], 0x424240f3
lea edx, [esp + 4]
mov byte [edx + 2], 0
mov word [edx], 0
mov ebp, 0x6f
mov ebx, 0xb3503790
nop
nop
nop
movzx edx, byte [esp + ebx + 0x4cafc870]
mov esi, ebp
xor esi, ebx
and esi, edx
xor esi, ebx
mov edx, esi
or edx, 0x2f
add edx, esi
not esi
or esi, 0x2f
add edx, esi
add dl, 2
mov byte [esp + ebx + 0x4cafc870], dl
dec ebp
inc ebx
cmp ebp, 0x68
jne 0x445350
test eax, eax
je 0x4453a0
mov esi, dword [esp]
cmp eax, 4
jae 0x4453b0
mov ebx, 0xfb520141
jmp 0x4453eb
mov edx, 0xfb520141
mov ebp, dword [esp + 0x3c]
jmp 0x445410
mov edx, ecx
and edx, 0xfffffffc
mov ebx, 0xfb520141
nop
nop
nop
nop
nop
nop
movsx ebp, byte [edi]
xor ebp, ebx
imul ebp, esi
movsx ebx, byte [edi + 1]
xor ebx, ebp
imul ebx, esi
movsx ebp, byte [edi + 2]
xor ebp, ebx
imul ebp, esi
movsx ebx, byte [edi + 3]
add edi, 4
xor ebx, ebp
imul ebx, esi
add edx, 0xfffffffc
jne 0x4453c0
mov edx, ebx
test al, 3
mov ebp, dword [esp + 0x3c]
je 0x445410
and ecx, 3
xor eax, eax
nop
nop
nop
nop
nop
nop
movsx edx, byte [edi + eax]
xor edx, ebx
imul edx, esi
inc eax
mov ebx, edx
cmp ecx, eax
jne 0x445400
xor eax, eax
cmp edx, dword [esp + 0x40]
setne al
jmp dword [eax*4 + 0x4518e8]
mov ebx, dword [esp + 8]
mov ecx, ebx
not ecx
and ecx, 1
mov eax, ebx
xor eax, 1
sub ebx, eax
add ebx, ecx
lea edx, [ebx + ebx]
not edx
add edx, ebx
and edx, 2
mov esi, ebx
xor esi, 2
mov ecx, ebx
or ecx, 0xfffffffd
and ecx, esi
mov edi, ecx
not edi
and edi, edx
mov esi, edx
not esi
and esi, ecx
imul esi, edi
mov edi, edx
and edi, ecx
or ecx, edx
imul ecx, edi
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
add ebx, eax
add ebx, ecx
add ebx, esi
xor eax, eax
cmp ebx, dword [esp + 0x20]
setb al
jmp dword [eax*4 + 0x4518e0]
jmp dword [0x4518d4]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + eax*4]
xor edx, edx
mov ecx, eax
sub ecx, dword [esp + 0x18]
setae dl
jmp dword [edx*4 + 0x4518f0]
xor edx, edx
cmp ecx, dword [esp + 0xc]
setb dl
jmp dword [edx*4 + 0x4518f8]
add ebp, eax
xor eax, eax
jmp dword [eax*4 + 0x451900]
xor eax, eax
mov ecx, dword [case.0x445229.0]
jmp case.0x445229.23
mov eax, dword [esp + 0x1c]
jmp dword [eax*4 + 0x451900]
mov ecx, dword [case.0x445229.0]
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + ecx]
mov dword [esp], 0xf1feb8ac
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0xd5
xor bl, byte [esp + edx]
add bl, 0xd7
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne case.default.0x4455de
xor edx, edx
cmp eax, dword [esp]
setne dl
xor eax, eax
jmp dword [edx*4 + 0x451920]
mov edx, dword [ebp + ecx + 0x80]
mov ecx, dword [ebp + ecx + 0x84]
mov esi, dword [case.0x4455de.4]
nop
nop
nop
nop
nop
nop
nop
jmp esi
test ecx, ecx
sete cl
test edx, edx
sete ch
or ch, cl
movzx ecx, ch
jmp dword [ecx*4 + 0x451938]
mov esi, dword [ebp + edx]
add esi, ebp
mov ecx, dword [ebp + edx + 0x10]
add ecx, ebp
mov dword [esp + 8], ecx
add ebp, 2
mov ecx, dword [esi]
mov edx, ecx
shr edx, 0x1f
mov dword [esp + 0xc], ebp
jmp dword [edx*4 + 0x451940]
mov eax, dword [esp + 8]
mov eax, dword [eax]
xor ecx, ecx
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
jmp dword [ecx*4 + 0x451958]
mov ecx, dword [esi]
mov edx, ecx
shr edx, 0x1f
xor eax, eax
jmp dword [edx*4 + 0x451940]
xor edx, edx
test ecx, ecx
setne dl
xor eax, eax
jmp dword [edx*4 + 0x451948]
mov dword [esp + 0x10], esi
add ecx, ebp
mov ebx, 0xffffffff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
cmp byte [ecx + ebx + 1], 0
lea ebx, [ebx + 1]
lea eax, [eax + 1]
jne 0x445690
mov dword [esp], 0x424240f3
lea eax, [esp + 4]
mov byte [eax + 2], 0
mov word [eax], 0
mov esi, 0x6f
mov ebp, 0xb3503790
nop
nop
nop
movzx eax, byte [esp + ebp + 0x4cafc870]
mov edx, esi
xor edx, ebp
and edx, eax
xor edx, ebp
mov eax, edx
or eax, 0x2f
add eax, edx
not edx
or edx, 0x2f
add eax, edx
add al, 2
mov byte [esp + ebp + 0x4cafc870], al
dec esi
inc ebp
cmp esi, 0x68
jne 0x4456c0
mov eax, 0xfb520141
test ebx, ebx
je 0x445760
mov ebp, dword [esp]
mov edx, 0xfb520141
cmp ebx, 4
jb 0x44573b
mov eax, edi
and eax, 0xfffffffc
nop
nop
nop
nop
nop
nop
nop
movsx esi, byte [ecx]
xor esi, edx
imul esi, ebp
movsx edx, byte [ecx + 1]
xor edx, esi
imul edx, ebp
movsx esi, byte [ecx + 2]
xor esi, edx
imul esi, ebp
movsx edx, byte [ecx + 3]
add ecx, 4
xor edx, esi
imul edx, ebp
add eax, 0xfffffffc
jne 0x445710
mov eax, edx
test bl, 3
je 0x445760
and edi, 3
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx eax, byte [ecx + ebx]
xor eax, edx
imul eax, ebp
inc ebx
mov edx, eax
cmp edi, ebx
jne 0x445750
xor ecx, ecx
cmp eax, dword [esp + 0x30]
sete cl
jmp dword [ecx*4 + 0x451950]
mov esi, dword [esp + 0x10]
add esi, 4
add dword [esp + 8], 4
mov ecx, 1
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
jmp dword [ecx*4 + 0x451958]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [edx + 0x3c]
lea ebx, [edx + eax]
mov eax, dword [edx + eax]
mov dword [esp], 0x1064854
mov byte [esp + 4], 0
mov ebp, 0x81
mov ecx, 0x7e
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ebp - 0x81]
mov esi, edx
not esi
or esi, ecx
or edx, ebp
and edx, esi
add dl, 0x7b
mov byte [esp + ebp - 0x81], dl
inc ebp
dec ecx
cmp ebp, 0x86
jne case.default.0x44582e
xor ecx, ecx
cmp eax, dword [esp]
setne cl
jmp dword [ecx*4 + 0x451968]
movzx eax, word [ebx + 0x14]
lea esi, [ebx + eax]
add esi, 0x18
movzx ecx, word [ebx + 6]
xor ebp, ebp
xor eax, eax
mov word [esp + 0xa], cx
cmp bp, cx
setb al
jmp dword [eax*4 + 0x451980]
mov eax, dword [case.0x4458e2.8]
mov ecx, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
xor eax, eax
xor ecx, ecx
test eax, 0
sete cl
jmp dword [ecx*4 + 0x451998]
inc ebp
add esi, 0x28
xor eax, eax
cmp bp, word [esp + 0xa]
setb al
jmp dword [eax*4 + 0x451980]
mov ecx, 8
mov edi, dword [esp + 0x24]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, 1
jb 0x445880
movzx ebx, byte [edi]
inc edi
movzx edx, byte [eax]
inc eax
cmp bl, dl
je case.default.0x4458e2
mov eax, ebx
not eax
and eax, edx
not edx
and edx, ebx
xor ecx, ecx
sub edx, eax
sete cl
jmp dword [ecx*4 + 0x451998]
xor eax, eax
mov ecx, dword [esp + 0x28]
test ecx, ecx
setne al
mov edx, dword [esp + 0x20]
jmp dword [eax*4 + 0x4519a0]
jmp dword [0x4519a8]
mov eax, dword [esi + 0xc]
add eax, edx
mov dword [ecx], eax
jmp dword [0x4519b0]
mov eax, dword [esi + 0xc]
add eax, edx
mov dword [ecx], eax
mov eax, dword [esi + 0xc]
add eax, edx
mov dword [ecx], eax
jmp dword [0x4519b0]
xor eax, eax
mov edx, dword [esp + 0x2c]
test edx, edx
setne al
xor ecx, ecx
jmp dword [eax*4 + 0x4519b8]
mov eax, dword [esi + 0x10]
jmp dword [0x4519c0]
mov dword [edx], eax
jmp dword [0x4519cc]
mov dword [edx], eax
mov dword [edx], eax
jmp dword [0x4519cc]
mov al, 1
jmp dword [ecx*4 + 0x4519d0]
xor eax, eax
jmp case.0x44582e.4
mov ecx, dword [case.0x44582e.4]
xor eax, eax
nop
jmp ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret