Function at 0x10027ca0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov edi, dword [esp + 0x18]
mov al, 0xaf
lea eax, [esp + 0x3ae8]
jmp 0x10028345
push edi
jmp 0x1020c8ed
lea esp, [esp + 4]
mov ah, 0x33
cbw
cwde
push 0x7cf
movzx eax, bp
lea eax, [esp + 0x2b4c]
push eax
bswap eax
mov eax, dword [0x1008e8fc]
jmp 0x1021ae1b
push eax
xchg ah, ah
mov ah, bl
setl al
mov eax, dword [0x1008e8fc]
jmp 0x100142bb
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x6a84
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, esp
mov dword [esp + 0x6a80], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 0xc], eax
mov eax, dword [0x1008e8fc]
push edi
push 0
push 0x100287f0
mov eax, dword [eax + 0x450]
mov dword [esp + 0x28], ecx
mov dword [0x101f340c], 0
call eax
xor ecx, ecx
mov dword [esp + 0x24], ecx
cmp dword [0x101f340c], ecx
jle 0x10027fc7
xor eax, eax
mov dword [esp + 0x2c], eax
mov ebx, dword [ecx*4 + 0x101f3410]
xor ebx, eax
mov eax, 0x51eb851f
imul ecx
mov dword [esp + 0x18], ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
sub ecx, eax
jne 0x10027d2c
call fcn.10026820
mov eax, dword [0x1008e8fc]
lea ecx, [esp + 0x1ba8]
push 0x7cf
push ecx
push ebx
mov eax, dword [eax + 0x41c]
call eax
test eax, eax
jle 0x10027f96
lea eax, [esp + 0x1ba8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
xor esi, esi
test edi, edi
jle 0x10027d8e
jmp 0x10027d70
movzx ecx, word [esp + esi*2 + 0x1ba8]
push ecx
call fcn.10031c91
mov word [esp + esi*2 + 0x1bac], ax
add esp, 4
inc esi
cmp esi, edi
jl 0x10027d70
mov eax, dword [esp + 0x20]
xor ebx, ebx
cmp dword [eax + 0x31cf8], ebx
jbe 0x10027e79
lea edi, [eax + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
test eax, eax
jle 0x10027dcc
mov esi, edi
imul ecx, edx, 0x5e82
lea esi, [esi + 2]
xor cx, word [esi - 2]
mov word [esp + edx*2 + 0x2a8], cx
inc edx
cmp edx, eax
jl 0x10027db2
add eax, eax
cmp eax, 0x190
jae 0x100287dc
xor ecx, ecx
mov word [esp + eax + 0x2a8], cx
mov al, byte [edi + 0x190]
test al, al
jne 0x10027e0b
lea eax, [esp + 0x2a8]
push eax
lea eax, [esp + 0x1bac]
push eax
call fcn.1002992e
add esp, 8
test eax, eax
je 0x10027e62
jmp 0x10027e4f
cmp al, 1
jne 0x10027e62
lea ecx, [esp + 0x2a8]
lea eax, [esp + 0x1ba8]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10027e46
test dx, dx
je 0x10027e42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10027e46
add eax, 4
add ecx, 4
test dx, dx
jne 0x10027e20
xor eax, eax
jmp 0x10027e4b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10027e62
mov ecx, 0xfffffffc
mov eax, edi
mov esi, dword [ecx + eax]
cmp esi, 0xffffffff
jne 0x100286b4
mov eax, dword [esp + 0x20]
inc ebx
add edi, 0x198
cmp ebx, dword [eax + 0x31cf8]
jb 0x10027da3
xor esi, esi
or ebx, 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], esi
cmp dword [0x101d5e78], esi
jle 0x10027f3b
mov ebx, 0x101d5e80
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
xor ecx, ecx
test edi, edi
jle 0x10027ece
mov esi, ebx
jmp 0x10027eb0
imul edx, ecx, 0x5e82
lea esi, [esi + 2]
xor dx, word [esi - 2]
mov word [esp + ecx*2 + 0x118], dx
inc ecx
cmp ecx, edi
jl 0x10027eb0
mov esi, dword [esp + 0x14]
lea eax, [edi + edi]
cmp eax, 0x190
jae 0x100287dc
xor ecx, ecx
mov word [esp + eax + 0x118], cx
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x1bac]
push eax
call fcn.1002992e
add esp, 8
test eax, eax
je 0x10027f06
mov dword [esp + 0x1c], esi
push edi
lea eax, [esp + 0x11c]
push 0
push eax
call fcn.1002a500
add esp, 0xc
cmp dword [esp + 0x1c], 0xffffffff
jne 0x10027f37
inc esi
add ebx, 0x192
mov dword [esp + 0x14], esi
cmp esi, dword [0x101d5e78]
jl 0x10027e97
mov ebx, dword [esp + 0x1c]
mov eax, dword [0x1008e8fc]
lea ecx, [esp + 0x100]
mov edi, dword [esp + 0x18]
push ecx
push edi
mov eax, dword [eax + 0x408]
call eax
test eax, eax
je 0x10027f96
push edi
call fcn.10027c70
test al, al
jne 0x10027f96
mov eax, dword [esp + 0x108]
mov ecx, dword [esp + 0x10c]
sub eax, dword [esp + 0x100]
sub ecx, dword [esp + 0x104]
cmp eax, 0x136
jne 0x1002837e
cmp ecx, 0x1f2
je 0x10028395
mov eax, dword [0x1008e8fc]
push 1
mov eax, dword [eax + 0x39c]
call eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
inc ecx
add eax, 0x56ad1e3d
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], eax
cmp ecx, dword [0x101f340c]
jl 0x10027d02
xor ebx, ebx
mov dword [0x101f340c], 0
cmp dword [0x101c252c], ebx
jle 0x10028367
mov edi, 0x101c26c0
jmp 0x10027ff0
lea esi, [edi - 0x190]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
test eax, eax
jle 0x1002801d
imul ecx, edx, 0x5e82
lea esi, [esi + 2]
xor cx, word [esi - 2]
mov word [esp + edx*2 + 0x438], cx
inc edx
cmp edx, eax
jl 0x10028003
add eax, eax
cmp eax, 0x190
jae 0x100287dc
xor ecx, ecx
push edi
mov word [esp + eax + 0x43c], cx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
test eax, eax
jle 0x1002805d
mov esi, edi
imul ecx, edx, 0x5e82
lea esi, [esi + 2]
xor cx, word [esi - 2]
mov word [esp + edx*2 + 0x118], cx
inc edx
cmp edx, eax
jl 0x10028043
add eax, eax
cmp eax, 0x190
jae 0x100287dc
xor ecx, ecx
mov word [esp + eax + 0x118], cx
lea eax, [esp + 0x118]
movzx edx, word [esp + 0x118]
movzx ecx, word [esp + 0x438]
neg edx
sbb edx, edx
and edx, eax
neg ecx
lea eax, [esp + 0x438]
sbb ecx, ecx
and ecx, eax
mov eax, dword [0x1008e8fc]
push ecx
push edx
mov eax, dword [eax + 0x468]
call eax
mov esi, eax
test esi, esi
je 0x10028354
push esi
call fcn.10027c70
test al, al
jne 0x10028354
push 0x10046bec
jmp 0x1001a6e1
push 0xfa0
jmp 0x100244d1
inc ebx
add edi, 0x322
cmp ebx, dword [0x101c252c]
jl 0x10027ff0
mov ecx, dword [esp + 0x6a8c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10028937
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x371
jne 0x10027f96
cmp ecx, 0x37e
jne 0x10027f96
push 0x7cf
lea eax, [esp + 0x2b4c]
push eax
mov eax, dword [0x1008e8fc]
push edi
mov eax, dword [eax + 0x41c]
call eax
push 0x7cf
lea eax, [esp + 0x3aec]
push eax
mov eax, dword [0x1008e8fc]
push edi
mov eax, dword [eax + 0x460]
call eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [0x1008e8fc]
push edi
mov eax, dword [eax + 0x490]
call eax
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
push ecx
push 0x410
push esi
call fcn.1001fe60
test eax, eax
js 0x10027fa5
mov eax, dword [0x1008e8fc]
lea ecx, [esp + 0xc08]
push 0x7cf
push ecx
push 0
push dword [esp + 0x34]
mov eax, dword [eax + 0x3c8]
call eax
test eax, eax
je 0x10028499
push 0
push 0x18
lea eax, [esp + 0xf0]
mov dword [esp + 0x1c], 0
push eax
push 0
push dword [esp + 0x38]
mov ecx, esi
call fcn.10016360
test eax, eax
jne 0x10028499
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0xf8]
add eax, 8
push eax
push dword [esp + 0x38]
push esi
call fcn.1001fef0
test eax, eax
js 0x10028499
lea eax, [esp + 0x14]
push eax
push 0x1000
lea eax, [esp + 0x4a90]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x38]
push esi
call fcn.1001fef0
push dword [esp + 0x28]
mov ecx, dword [0x1008e8fc]
call fcn.1000c050
push 0x10046bec
jmp 0x10210bd3
push 0x10046bec
jmp 0x100076d4
call fcn.10028ab3
int3