Function at 0x4225f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov dword [esp + 0x60], 0xf783f98d
mov dword [esp + 0x64], 0xf37ef579
mov dword [esp + 0x68], 0xcf7af149
mov dword [esp + 0x6c], 0xcb46cd75
mov dword [esp + 0x70], 0xc7b3c941
mov dword [esp + 0x74], 0xc34fc54b
mov dword [esp + 0x78], 0xdfabc17e
mov dword [esp + 0x7c], 0xdb53dd50
mov dword [esp + 0x80], 0xd76bd968
mov dword [esp + 0x84], 0xd360d591
mov dword [esp + 0x88], 0x2fa2d16d
mov dword [esp + 0x8c], 0x2b992da7
mov dword [esp + 0x90], 0x279129a6
mov dword [esp + 0x94], 0x23972556
mov dword [esp + 0x98], 0x3f882193
mov dword [esp + 0x9c], 0x3b8f3d8f
mov dword [esp + 0xa0], 0x3764394a
mov dword [esp + 0xa4], 0x33be3589
mov dword [esp + 0xa8], 0xfbd31bb
mov dword [esp + 0xac], 0xbbd0d82
mov dword [esp + 0xb0], 0x7bb09a7
mov dword [esp + 0xb4], 0x388058a
mov dword [esp + 0xb8], 0x1fa101b9
mov dword [esp + 0xbc], 0x1b1a1da1
mov byte [esp + 0xc0], 0
lea eax, [esp + 0xc0]
mov dword [esp + 4], eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x60]
mov edi, eax
and edi, 0x2a
xor edi, 0x99d128aa
mov esi, eax
and esi, 0x55
sub esi, edi
lea ebx, [esi + esi]
not ebx
add ebx, esi
xor ebx, esi
and ebx, ecx
xor ebx, esi
add bl, 0x52
mov byte [esp + eax + 0x60], bl
inc eax
cmp eax, 0x61
jne 0x422710
lea edi, [esp + 0x4a0]
lea eax, [esp + 0x60]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x500]
xor edx, edx
xor ecx, ecx
mov eax, dword [esp + 4]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x60], 0x60676665
xor ecx, ecx
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x60]
mov dword [esp + 4], eax
mov edi, edx
and edi, 2
mov esi, ecx
xor esi, 0xc11c8ee9
add esi, edi
mov edi, esi
not edi
or edi, eax
add edi, esi
inc edi
mov eax, edi
or eax, 0xfd
inc eax
mov ebx, edi
and ebx, 0xfd
imul ebx, eax
mov eax, edi
and eax, 2
or edi, 2
imul edi, eax
sub ebx, edi
add ebx, esi
add bl, byte [esp + 4]
add bl, 0x73
mov byte [esp + ecx + 0x60], bl
inc ecx
add edx, 2
cmp ecx, 4
jne 0x422780
mov eax, dword [esp + 0x60]
mov ecx, dword [0x451e48]
test ecx, ecx
mov edi, dword [ebp + 0x14]
je 0x422824
xor edx, edx
mov esi, dword [0x451e4c]
cmp dword [esi + edx*8], 0x9abdb589
je 0x422800
inc edx
cmp ecx, edx
jne 0x4227f0
jmp 0x422824
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x422824
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 5
push 4
push ecx
push dword [0x451e50]
call fcn.00441a80
add esp, 0x1c
mov dword [esp + 0x60], 0x995a5b40
mov word [esp + 0x64], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x6f
xor dl, byte [esp + ecx + 0x60]
add dl, 0xd5
mov byte [esp + ecx + 0x60], dl
inc ecx
cmp ecx, 6
jne 0x422840
cmp eax, dword [esp + 0x60]
jne 0x422910
push dword [esp + 0x2c]
call fcn.0043e5b0
add esp, 4
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x60], 0x60676665
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx + 0x60]
mov dword [esp + 4], eax
mov esi, ecx
and esi, 2
mov edi, edx
xor edi, 0xc11c8ee9
add edi, esi
mov esi, edi
not esi
or esi, eax
add esi, edi
inc esi
mov eax, esi
or eax, 0xfd
inc eax
mov ebx, esi
and ebx, 0xfd
imul ebx, eax
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
sub ebx, esi
add ebx, edi
add bl, byte [esp + 4]
add bl, 0x73
mov byte [esp + edx + 0x60], bl
inc edx
add ecx, 2
cmp edx, 4
jne 0x422890
mov eax, dword [esp + 0x60]
mov ecx, dword [0x451e48]
test ecx, ecx
je 0x42291b
xor edx, edx
mov esi, dword [0x451e4c]
mov ebx, dword [ebp + 8]
cmp dword [esi + edx*8], 0x9abdb589
je 0x422920
inc edx
cmp ecx, edx
jne 0x422900
jmp 0x422945
xor ecx, ecx
xor edx, edx
xor esi, esi
jmp 0x422f68
mov ebx, dword [ebp + 8]
jmp 0x422945
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x422945
push 0
push dword [esp + 0x10]
push dword [esp + 0x28]
push 5
push 4
push ecx
push dword [0x451e50]
call fcn.00441a80
add esp, 0x1c
test eax, eax
mov edi, dword [ebp + 0x14]
js 0x422f38
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov dword [esp + 0x14], 0
mov edx, ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
jmp 0x422995
mov ecx, edi
call fcn.0043eaa0
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x422f50
mov ecx, dword [edx + eax + 0x3c]
add eax, edx
mov dword [esp + 0xc], eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx + eax]
movzx esi, word [ebx + eax]
test dx, dx
je 0x4229c5
add eax, 2
cmp dx, si
je 0x4229b0
cmp dx, si
jne 0x422987
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0x44]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xdc]
mov dword [edi + 0xc], eax
mov ecx, edi
push 0x410
call fcn.0043e950
test eax, eax
js 0x422987
mov dword [esp + 0x28], 0
mov eax, dword [edi]
mov dword [esp + 0x10], eax
mov dword [esp + 0x60], 0x60676665
xor ecx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edi + 0x60]
mov dword [esp + 4], eax
mov esi, ecx
and esi, 2
mov edx, edi
xor edx, 0xc11c8ee9
add edx, esi
mov esi, edx
not esi
or esi, eax
add esi, edx
inc esi
mov eax, esi
or eax, 0xfd
inc eax
mov ebx, esi
and ebx, 0xfd
imul ebx, eax
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
sub ebx, esi
add ebx, edx
add bl, byte [esp + 4]
add bl, 0x73
mov byte [esp + edi + 0x60], bl
inc edi
add ecx, 2
cmp edi, 4
jne 0x422a10
mov eax, dword [esp + 0x60]
mov ecx, dword [0x451e48]
test ecx, ecx
je 0x422ac0
xor edx, edx
mov esi, dword [0x451e4c]
nop
nop
nop
cmp dword [esi + edx*8], 0xae6e2b0b
je 0x422a90
inc edx
cmp ecx, edx
jne 0x422a80
jmp 0x422ac0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x422ac0
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0x2b
push dword [esp + 0x20]
push 5
push ecx
push dword [0x451e50]
call fcn.00441a80
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x60], 0x5392919c
lea ecx, [esp + 0x64]
mov byte [ecx + 2], 0
mov word [ecx], 0
mov ecx, 0x97300324
mov edx, 3
nop
movzx edi, byte [esp + ecx + 0x68cffd3c]
mov esi, edx
and esi, 4
mov ebx, ecx
xor ebx, 0x740bab94
or ebx, esi
xor edi, 0x740bab94
mov esi, edi
and esi, ebx
add edi, ebx
add esi, esi
sub edi, esi
add edi, 0xeb38cd96
mov esi, edi
and esi, 0x20d722b5
xor edi, 0x20d722b5
lea esi, [edi + esi*2]
mov ebx, esi
or ebx, 1
add ebx, esi
not esi
or esi, 1
add ebx, esi
inc bl
mov byte [esp + ecx + 0x68cffd3c], bl
inc ecx
dec edx
cmp ecx, 0x9730032b
jne 0x422ae0
cmp eax, dword [esp + 0x60]
jne 0x422c10
mov eax, dword [esp + 0x28]
add eax, 2
push eax
call fcn.0043e5b0
add esp, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 0x60], 0x60676665
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx + 0x60]
mov dword [esp + 4], eax
mov esi, ecx
and esi, 2
mov edi, edx
xor edi, 0xc11c8ee9
add edi, esi
mov esi, edi
not esi
or esi, eax
add esi, edi
inc esi
mov eax, esi
or eax, 0xfd
inc eax
mov ebx, esi
and ebx, 0xfd
imul ebx, eax
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
sub ebx, esi
add ebx, edi
add bl, byte [esp + 4]
add bl, 0x73
mov byte [esp + edx + 0x60], bl
inc edx
add ecx, 2
cmp edx, 4
jne 0x422b80
mov eax, dword [esp + 0x60]
mov ecx, dword [0x451e48]
test ecx, ecx
je 0x422c1b
mov edi, dword [esp + 0x24]
add edi, 2
xor edx, edx
mov esi, dword [0x451e4c]
mov ebx, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xae6e2b0b
je 0x422c20
inc edx
cmp ecx, edx
jne 0x422c00
jmp 0x422c46
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
jmp 0x422d60
mov ebx, dword [ebp + 0xc]
jmp 0x422c46
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x422c46
push 0
push edi
push dword [esp + 0x18]
push 0x2b
push dword [esp + 0x18]
push 5
push ecx
push dword [0x451e50]
call fcn.00441a80
add esp, 0x20
test eax, eax
mov edi, dword [ebp + 0x14]
js 0x422d51
mov ecx, dword [esp + 0x10]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
cmp eax, edx
je 0x422c78
movzx esi, word [ebx + edx*2]
cmp si, word [ecx + edx*2]
jne 0x422d51
inc edx
test si, si
jne 0x422c60
mov ecx, edi
call fcn.0043f010
cmp eax, 2
mov ebx, dword [ebp + 8]
jne 0x422d54
mov ecx, edi
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.0043ee40
test eax, eax
js 0x422d54
mov ecx, edi
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.0043f390
test eax, eax
js 0x422d54
mov ecx, edi
push 0
push 0
push 0x80
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.0043f390
test eax, eax
js 0x422d54
movzx eax, word [esp + 0xd2]
push eax
call fcn.0043e5b0
add esp, 4
mov esi, eax
movzx eax, word [esp + 0xd2]
mov ecx, edi
push 0
push 0
push eax
push esi
push dword [esp + 0xec]
push dword [esp + 0xec]
call fcn.0043f390
test eax, eax
js 0x422f2a
movzx edi, word [esp + 0x4a0]
mov dword [esp + 8], esi
mov eax, esi
test di, di
je 0x422db4
lea ecx, [esp + 0x4a0]
mov eax, dword [esp + 8]
mov edx, eax
jmp 0x422d8b
mov ebx, dword [ebp + 8]
push dword [esp + 0x10]
call fcn.0043e640
add esp, 4
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x18]
je 0x422980
cmp dword [esp + 0x14], 0
je 0x422980
jmp 0x422f50
movzx edi, word [ecx]
test di, di
mov ebx, dword [ebp + 8]
je 0x422db4
movzx esi, word [edx]
test si, si
je 0x422f23
add ecx, 2
add edx, 2
lea ebx, [eax + 2]
cmp si, di
je 0x422da9
mov eax, ebx
mov edx, ebx
je 0x422d80
lea ecx, [esp + 0x4a0]
jmp 0x422d80
test eax, eax
je 0x422f23
mov edi, dword [ebp + 0x14]
mov ecx, edi
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0043f390
test eax, eax
js 0x422f26
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 4], eax
adc ecx, 0
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x422e5b
cmp cx, dx
je 0x422ef9
push edi
call fcn.0043e640
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 0x24]
mov esi, eax
xor esi, dword [esp + 4]
or esi, ecx
mov edi, dword [ebp + 0x14]
je 0x422f26
mov ecx, edi
push 0
push 0
push 0x68
lea esi, [esp + 0x50c]
push esi
push edx
push eax
call fcn.0043f390
test eax, eax
js 0x422f26
movzx eax, word [esp + 0x55a]
push eax
call fcn.0043e5b0
add esp, 4
mov ecx, edi
mov edi, eax
movzx eax, word [esp + 0x55a]
push 0
push 0
push eax
push edi
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.0043f390
test eax, eax
js 0x422e2d
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x422ed3
or ecx, 0x20
movzx edx, word [edi + eax]
lea esi, [edx - 0x41]
cmp si, 0x1a
jae 0x422ee3
or edx, 0x20
test cx, cx
je 0x422e24
add eax, 2
cmp cx, dx
je 0x422ec0
jmp 0x422e24
mov eax, dword [esp + 0x530]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0x14], eax
push edi
call fcn.0043e640
add esp, 4
mov edi, dword [ebp + 0x14]
mov esi, dword [esp + 8]
push esi
call fcn.0043e640
add esp, 4
jmp 0x422d54
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
push dword [esp + 0x20]
call fcn.0043e640
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, edi
call fcn.0043ea90
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret