Function at 0x372520
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa00
mov dword [esp + 0x58], 0x61b167b3
mov dword [esp + 0x5c], 0x5dee63ef
mov dword [esp + 0x60], 0x59ca5fc7
mov dword [esp + 0x64], 0x55d65bc3
mov dword [esp + 0x68], 0x518157df
mov dword [esp + 0x6c], 0x4ddd53dd
mov dword [esp + 0x70], 0x49994fee
mov dword [esp + 0x74], 0x45c14bc4
mov dword [esp + 0x78], 0x41d947d4
mov dword [esp + 0x7c], 0x3dd44387
mov dword [esp + 0x80], 0x39b23fa3
mov dword [esp + 0x84], 0x35ab3bb1
mov dword [esp + 0x88], 0x31a337a6
mov dword [esp + 0x8c], 0x2da533e6
mov dword [esp + 0x90], 0x29b42fbd
mov dword [esp + 0x94], 0x25bd2bb9
mov dword [esp + 0x98], 0x219027f2
mov dword [esp + 0x9c], 0x1dae23bf
mov dword [esp + 0xa0], 0x198f1f95
mov dword [esp + 0xa4], 0x158f1b8a
mov dword [esp + 0xa8], 0x118917b9
mov dword [esp + 0xac], 0xd9c1382
mov dword [esp + 0xb0], 0x9930f97
mov dword [esp + 0xb4], 0x50a0b97
mov dword [esp + 0xb8], 0
lea eax, [esp + 0xb8]
mov dword [esp + 8], eax
mov ecx, 0x19
mov edx, 0xe6
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x3f]
mov esi, edx
or esi, edi
lea eax, [edi + edi]
not eax
add eax, edi
or eax, ecx
and eax, esi
mov bl, 0x82
sub bl, al
mov byte [esp + ecx + 0x3f], bl
inc ecx
dec edx
cmp ecx, 0x7d
jne 0x372640
lea edi, [esp + 0x498]
lea eax, [esp + 0x58]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x4f8]
xor edx, edx
xor ecx, ecx
mov eax, dword [esp + 8]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x58], 0xf4f5f6f7
mov eax, 0x2b
movzx ecx, byte [esp + edx + 0x58]
mov esi, ecx
not esi
or esi, eax
or ecx, edx
or ecx, 0xd4
and ecx, esi
add cl, 0xdc
mov byte [esp + edx + 0x58], cl
inc edx
dec eax
cmp edx, 4
jne 0x3726a0
mov eax, dword [esp + 0x58]
mov ecx, dword [0x3a0374]
test ecx, ecx
je 0x372714
xor edx, edx
mov esi, dword [0x3a0378]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x3726f0
inc edx
cmp ecx, edx
jne 0x3726e0
jmp 0x372714
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x372714
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 5
push 4
push dword [0x3a037c]
push ecx
call fcn.00390f10
add esp, 0x1c
mov dword [esp + 0x58], 0x77363924
mov dword [esp + 0x5c], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x58]
mov ebx, ecx
and ebx, 0xc
mov esi, edx
xor esi, 0x7333fef6
add esi, ebx
xor esi, edi
mov edi, esi
not edi
and edi, 0xcf
and esi, 0x33300530
sub esi, edi
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
mov byte [esp + edx + 0x58], bl
inc edx
add ecx, 2
cmp edx, 8
jne 0x372730
cmp eax, dword [esp + 0x58]
jne 0x3727f0
push dword [esp + 0x24]
call fcn.0038e1b0
add esp, 4
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x24]
mov dword [esp + 0x58], 0xf4f5f6f7
xor eax, eax
mov edx, 0x2b
mov ebx, dword [ebp + 0x14]
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x58]
mov edi, ecx
not edi
or edi, edx
or ecx, eax
or ecx, 0xd4
and ecx, edi
add cl, 0xdc
mov byte [esp + eax + 0x58], cl
inc eax
dec edx
cmp eax, 4
jne 0x3727a0
mov eax, dword [esp + 0x58]
mov edx, dword [0x3a0374]
test edx, edx
je 0x372820
xor ecx, ecx
mov edi, dword [0x3a0378]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ecx*8], 0x9abdb589
je 0x3727fe
inc ecx
cmp edx, ecx
jne 0x3727e0
jmp 0x372820
xor ecx, ecx
xor edx, edx
xor esi, esi
mov ebx, dword [ebp + 0x14]
jmp 0x372daa
mov ecx, dword [edi + ecx*8 + 4]
cmp ecx, eax
je 0x372820
push 0
push esi
push dword [esp + 0x20]
push 5
push 4
push dword [0x3a037c]
push ecx
call fcn.00390f10
add esp, 0x1c
test eax, eax
js 0x372d7a
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
jmp 0x372861
mov ecx, ebx
call fcn.0038e650
mov eax, dword [esi]
test eax, eax
je 0x372d92
mov ecx, dword [esi + eax + 0x3c]
add esi, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx + eax]
mov edi, dword [ebp + 8]
movzx edi, word [edi + eax]
test dx, dx
je 0x372888
add eax, 2
cmp dx, di
je 0x372870
cmp dx, di
jne 0x372857
mov eax, dword [esi + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xc], eax
mov ecx, ebx
push 0x410
call fcn.0038e510
test eax, eax
js 0x372857
mov dword [esp + 0x20], 0
mov ebx, dword [ebx]
mov dword [esp + 0x58], 0xf4f5f6f7
xor eax, eax
mov edx, 0x2b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x58]
mov edi, ecx
not edi
or edi, edx
or ecx, eax
or ecx, 0xd4
and ecx, edi
add cl, 0xdc
mov byte [esp + eax + 0x58], cl
inc eax
dec edx
cmp eax, 4
jne 0x3728d0
mov eax, dword [esp + 0x58]
mov edx, dword [0x3a0374]
test edx, edx
je 0x372950
xor ecx, ecx
mov edi, dword [0x3a0378]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ecx*8], 0xae6e2b0b
je 0x372920
inc ecx
cmp edx, ecx
jne 0x372910
jmp 0x372950
mov ecx, dword [edi + ecx*8 + 4]
cmp ecx, eax
je 0x372950
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x2b
push ebx
push 5
push dword [0x3a037c]
push ecx
call fcn.00390f10
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x58], 0x17d6c9c4
lea ecx, [esp + 0x5c]
mov byte [ecx + 2], 0
mov word [ecx], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x58]
mov ebx, ecx
and ebx, 2
xor ebx, 0xf7a3c32
mov edi, ecx
and edi, 5
sub edi, ebx
mov ebx, edx
not ebx
or ebx, edi
or edi, edx
add ebx, edx
mov edx, 0xfffffffe
sub edx, ebx
and edx, edi
mov edi, 1
sub edi, edx
add edx, 0xfe
and edi, 4
and edx, 0xfb
sub edx, edi
mov byte [esp + ecx + 0x58], dl
inc ecx
cmp ecx, 7
jne 0x372970
cmp eax, dword [esp + 0x58]
jne 0x372a50
mov eax, dword [esp + 0x20]
add eax, 2
push eax
call fcn.0038e1b0
add esp, 4
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
mov dword [esp], eax
mov dword [esp + 0x58], 0xf4f5f6f7
xor eax, eax
mov edi, 0x2b
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x58]
mov edx, ecx
not edx
or edx, edi
or ecx, eax
or ecx, 0xd4
and ecx, edx
add cl, 0xdc
mov byte [esp + eax + 0x58], cl
inc eax
dec edi
cmp eax, 4
jne 0x372a00
mov eax, dword [esp + 0x58]
mov edi, dword [0x3a0374]
test edi, edi
je 0x372a81
add dword [esp + 4], 2
xor ecx, ecx
mov edx, dword [0x3a0378]
nop
nop
cmp dword [edx + ecx*8], 0xae6e2b0b
je 0x372a58
inc ecx
cmp edi, ecx
jne 0x372a40
jmp 0x372a81
mov ebx, dword [ebp + 0x14]
jmp 0x372d5f
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, eax
je 0x372a81
push 0
push dword [esp + 8]
push dword [esp + 0x24]
push 0x2b
push dword [esp + 0x10]
push 5
push dword [0x3a037c]
push ecx
call fcn.00390f10
add esp, 0x20
test eax, eax
js 0x372d53
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, edx
je 0x372abb
mov edi, dword [ebp + 0xc]
movzx edi, word [edi + edx*2]
cmp di, word [ecx + edx*2]
jne 0x372d53
inc edx
test di, di
jne 0x372aa0
mov ecx, ebx
call fcn.0038eba0
cmp eax, 2
jne 0x372d53
mov ecx, ebx
push 0
push 0x30
lea eax, [esp + 0x30]
push eax
push 0
call fcn.0038e9d0
test eax, eax
js 0x372d53
mov ecx, ebx
push 0
push 0
push 0x28
lea eax, [esp + 0x67c]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.0038eeb0
test eax, eax
js 0x372d53
mov ecx, ebx
push 0
push 0
push 0x80
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0038eeb0
test eax, eax
js 0x372d53
movzx eax, word [esp + 0xca]
push eax
call fcn.0038e1b0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0xca]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0xe4]
push dword [esp + 0xe4]
call fcn.0038eeb0
test eax, eax
js 0x372d4a
mov eax, edi
movzx edi, word [esp + 0x498]
mov dword [esp + 0xc], eax
mov dword [esp], eax
test di, di
je 0x372bdd
lea edx, [esp + 0x498]
mov eax, dword [esp + 0xc]
mov ecx, eax
mov dword [esp], eax
jmp 0x372ba8
movzx edi, word [edx]
test di, di
je 0x372bdd
movzx eax, word [ecx]
test ax, ax
je 0x372d46
add ecx, 2
add edx, 2
mov dword [esp + 4], edx
mov edx, dword [esp]
add edx, 2
cmp ax, di
je 0x372bce
mov dword [esp], edx
mov ecx, edx
mov edx, dword [esp + 4]
je 0x372ba0
lea edx, [esp + 0x498]
jmp 0x372ba0
cmp dword [esp], 0
je 0x372d46
mov ecx, ebx
push 0
push 0
push 0x20
lea eax, [esp + 0x624]
push eax
push dword [esp + 0x69c]
push dword [esp + 0x69c]
call fcn.0038eeb0
test eax, eax
js 0x372d46
mov eax, dword [esp + 0x688]
mov ecx, dword [esp + 0x68c]
add eax, 0x10
mov dword [esp + 4], eax
adc ecx, 0
mov dword [esp], ecx
mov eax, dword [esp + 0x628]
mov edx, dword [esp + 0x62c]
mov dword [esp + 0x4fc], edx
mov dword [esp + 0x4f8], eax
jmp 0x372c7e
cmp cx, dx
je 0x372d1c
push edi
call fcn.0038e210
add esp, 4
mov eax, dword [esp + 0x4f8]
mov edx, dword [esp + 0x4fc]
mov ecx, edx
xor ecx, dword [esp]
mov edi, eax
xor edi, dword [esp + 4]
or edi, ecx
je 0x372d46
mov ecx, ebx
push 0
push 0
push 0x68
lea edi, [esp + 0x504]
push edi
push edx
push eax
call fcn.0038eeb0
test eax, eax
js 0x372d46
movzx eax, word [esp + 0x552]
push eax
call fcn.0038e1b0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x552]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0x56c]
push dword [esp + 0x56c]
call fcn.0038eeb0
test eax, eax
js 0x372c54
xor eax, eax
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x372cf3
or ecx, 0x20
movzx edx, word [edi + eax]
lea ebx, [edx - 0x41]
cmp bx, 0x1a
jae 0x372d03
or edx, 0x20
mov ebx, dword [ebp + 0x14]
test cx, cx
je 0x372c4b
add eax, 2
cmp cx, dx
je 0x372ce0
jmp 0x372c4b
mov eax, dword [esp + 0x528]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x52c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x538]
mov dword [esp + 0x10], eax
push edi
call fcn.0038e210
add esp, 4
mov edi, dword [esp + 0xc]
push edi
call fcn.0038e210
add esp, 4
push dword [esp + 0x1c]
call fcn.0038e210
add esp, 4
mov eax, dword [esp + 8]
or eax, dword [esp + 0x14]
je 0x372850
cmp dword [esp + 0x10], 0
je 0x372850
jmp 0x372d92
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
push dword [esp + 0x18]
call fcn.0038e210
add esp, 4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
mov esi, dword [esp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, ebx
call fcn.0038e640
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret