Function at 0x40ea42
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [0x44f3f8]
mov dword [esp + 0x10c], 0x41464f44
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x11
xor dl, byte [esp + ecx + 0x10c]
add dl, 0xab
mov byte [esp + ecx + 0x10c], dl
inc ecx
cmp ecx, 4
jne 0x40e700
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0xc], 0x39ad3ba5
mov dword [esp + 0x10], 0x258e27aa
mov dword [esp + 0x14], 0x21be23b8
mov dword [esp + 0x18], 0x2d7c2fb0
mov dword [esp + 0x1c], 0x29be2b80
mov dword [esp + 0x20], 0x151617bc
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0xc]
mov ebx, edx
and ebx, 9
mov edi, edx
and edi, 2
mov ebp, edi
xor ebp, 2
imul ebp, ebx
or ebx, 2
imul ebx, edi
mov edi, edx
xor edi, 0x31a7f70b
add edi, ebp
add edi, ebx
mov ebx, esi
xor ebx, 0x20c5ccdc
mov ebp, edi
xor ebp, 0xdc
xor esi, 0xdf3a3323
and esi, ebp
xor edi, 0xdf3a3323
and edi, ebx
or edi, esi
add edi, 0xd3f43271
mov esi, edi
and esi, 0x48
xor edi, 0xc8
lea ebx, [edi + esi*2]
add bl, 0x90
mov byte [esp + edx + 0xc], bl
inc edx
cmp edx, 0x1b
jne case.default.0x40e7f4
lea edx, [esp + 0xc]
push ecx
push 0
push edx
call eax
mov ecx, 0x44f3c0
push eax
call fcn.0043fc20
movzx eax, al
jmp dword [eax*4 + 0x449968]
xor eax, eax
jmp 0x40eb31
push 0xf2ffbc90
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3c8], eax
push 0x5c21b65e
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3cc], eax
push 0xc2eb3b71
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3d0], eax
push 0xa645cf1f
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3d4], eax
push 0xf379b9d8
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3d8], eax
push 0xd225aa76
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3dc], eax
push 0xa373434b
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3e0], eax
push 0xce21043e
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3e4], eax
push 0x7eecc3d7
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3e8], eax
push 0x2c692ac4
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3ec], eax
push 0xf13635ff
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3f0], eax
push 0x8040f1d2
push dword [0x44f3c0]
call fcn.00443ee0
add esp, 8
mov dword [0x44f3f4], eax
xor ebx, ebx
xor eax, eax
cmp ebx, 0x24
setne al
xor ebp, ebp
jmp dword [eax*4 + 0x449970]
mov edi, dword [ebp + 0x4479a4]
lea esi, [esp + 0x10c]
jmp dword [0x44998c]
push esi
push edi
call fcn.0043c700
add esp, 8
nop
nop
nop
push esi
push edi
call fcn.0043c700
add esp, 8
jmp dword [0x449990]
push 0
push esi
push 0x80
lea esi, [esp + 0x18]
push esi
call case.0x40e7f4.14
add esp, 0x10
push esi
call fcn.0040f360
add esp, 4
movzx ecx, al
mov eax, 1
lea esi, [esp + 0xe]
jmp dword [ecx*4 + 0x4499a8]
jmp dword [eax*4 + 0x4499c0]
add ebp, 4
xor eax, eax
cmp ebp, 0x24
setne al
jmp dword [eax*4 + 0x449970]
jmp dword [0x4499b4]
movzx ecx, word [esp + 0xc]
mov eax, 0x44f3fc
test cx, cx
je 0x40e9f1
mov edx, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x40e9e0
mov word [eax], 0
jmp case.0x40e7f4.18
mov word [eax], 0
xor eax, eax
mov bl, 1
jmp dword [0x4499b8]
movzx ecx, word [esp + 0xc]
mov eax, 0x44f3fc
test cx, cx
je 0x40ea00
mov edx, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x40ea20
jmp 0x40ea00
mov eax, dword [case.0x40e7f4.5]
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, ebx
and al, 1
movzx ecx, al
jmp dword [ecx*4 + 0x4499c8]
lea ebp, [esp + 0xc]
jmp dword [0x4499d0]
jmp 0x40eb2c
test al, al
setne al
add esp, 0x18c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0xb72a8960
mov dword [esp + 0x10], 0xb322b528
mov dword [esp + 0x14], 0xbf78b12f
mov dword [esp + 0x18], 0xbb69bd6f
mov dword [esp + 0x1c], 0xa73ab927
mov dword [esp + 0x20], 0xa343a549
mov dword [esp + 0x24], 0xaf41a135
mov dword [esp + 0x28], 0xab3fad3f
mov dword [esp + 0x2c], 0x57cba93d
mov dword [esp + 0x30], 0x53bb55c6
mov dword [esp + 0x34], 0x5fc751cc
mov dword [esp + 0x38], 0x5bb55d8e
mov dword [esp + 0x3c], 0x47d359cb
mov dword [esp + 0x40], 0x43d24597
mov dword [esp + 0x44], 0x4fdd41de
mov dword [esp + 0x48], 0x4ba34da6
mov dword [esp + 0x4c], 0x779b49dc
mov dword [esp + 0x50], 0x73a175eb
mov dword [esp + 0x54], 0x7fa471ab
mov dword [esp + 0x58], 0x7ba07da1
mov dword [esp + 0x5c], 0x67b779a9
mov dword [esp + 0x60], 0x63bb65bd
mov dword [esp + 0x64], 0x6fb061bb
mov dword [esp + 0x68], 0x6bb56db0
mov dword [esp + 0x6c], 0x17c769b7
mov dword [esp + 0x70], 0x13c215cd
mov dword [esp + 0x74], 0x1f1e11c0
mov byte [esp + 0x7a], 0
mov word [esp + 0x78], 0
mov eax, 0x99d74ade
mov ecx, 0x6628b521
nop
movzx edx, byte [esp + eax + 0x6628b52e]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, 0xd39e0164
and edx, 0xffffff9b
or edx, esi
mov esi, ecx
and esi, 0x40000024
mov edi, eax
and edi, 0x99434bdb
or edi, esi
xor edi, edx
mov edx, edi
and edx, 0x29
xor edi, 0xe9
lea edx, [edi + edx*2]
inc dl
mov byte [esp + eax + 0x6628b52e], dl
inc eax
dec ecx
cmp eax, 0x99d74b4d
jne 0x40eee0
lea eax, [esp + 4]
mov ecx, esp
push eax
push ecx
push ebp
call fcn.0040f850
add esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0xb72a8960
mov dword [esp + 0x10], 0xb322b528
mov dword [esp + 0x14], 0xbf78b12f
mov dword [esp + 0x18], 0xbb69bd6f
mov dword [esp + 0x1c], 0xa73ab927
mov dword [esp + 0x20], 0xa343a549
mov dword [esp + 0x24], 0xaf41a135
mov dword [esp + 0x28], 0xab3fad3f
mov dword [esp + 0x2c], 0x57cba93d
mov dword [esp + 0x30], 0x53bb55c6
mov dword [esp + 0x34], 0x5fc751cc
mov dword [esp + 0x38], 0x5bb55d8e
mov dword [esp + 0x3c], 0x47d359cb
mov dword [esp + 0x40], 0x43d24597
mov dword [esp + 0x44], 0x4fdd41de
mov dword [esp + 0x48], 0x4ba34da6
mov dword [esp + 0x4c], 0x779b49dc
mov dword [esp + 0x50], 0x73a175eb
mov dword [esp + 0x54], 0x7fa471ab
mov dword [esp + 0x58], 0x7ba07da1
mov dword [esp + 0x5c], 0x67b779a9
mov dword [esp + 0x60], 0x63bb65bd
mov dword [esp + 0x64], 0x6fb061bb
mov dword [esp + 0x68], 0x6bb56db0
mov dword [esp + 0x6c], 0x17c769b7
mov dword [esp + 0x70], 0x13c215cd
mov dword [esp + 0x74], 0x1f1e11c0
mov byte [esp + 0x7a], 0
mov word [esp + 0x78], 0
mov eax, 0x99d74ade
mov ecx, 0x6628b521
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6628b52e]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, 0xd39e0164
and edx, 0xffffff9b
or edx, esi
mov esi, ecx
and esi, 0x40000024
mov edi, eax
and edi, 0x99434bdb
or edi, esi
xor edi, edx
mov edx, edi
and edx, 0x29
xor edi, 0xe9
lea edx, [edi + edx*2]
inc dl
mov byte [esp + eax + 0x6628b52e], dl
inc eax
dec ecx
cmp eax, 0x99d74b4d
jne 0x40f040
lea eax, [esp + 4]
mov ecx, esp
push eax
push ecx
push ebp
call fcn.0040f850
add esp, 0xc
jmp dword [0x4499d8]
out 0x40, eax
add byte [edx], al
call 0xea7799b2
inc eax
add byte [eax - 0x17], al
inc eax
add byte [eax - 0x16], al
inc eax
add byte [eax - 0x16], al
inc eax
add byte [edx - 0x16], al
inc eax
add byte [eax - 0x16], al
inc eax
add byte [ebx - 0x17], dl
inc eax
add byte [eax - 0x17], ah
inc eax
add byte [eax - 0x17], dh
inc eax
add byte [eax - 0x17], ah
inc eax
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add al, ah
invalid