Function at 0x4223c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa00
mov dword [esp + 0x58], 0xe3bfe1bd
mov dword [esp + 0x5c], 0xe772e571
mov dword [esp + 0x60], 0xdb46d941
mov dword [esp + 0x64], 0xdf4add45
mov dword [esp + 0x68], 0xd38fd159
mov dword [esp + 0x6c], 0xd743d547
mov dword [esp + 0x70], 0xcb97c96a
mov dword [esp + 0x74], 0xcf47cd58
mov dword [esp + 0x78], 0xc367c150
mov dword [esp + 0x7c], 0xc758c589
mov dword [esp + 0x80], 0x3bae399d
mov dword [esp + 0x84], 0x3fa13dab
mov dword [esp + 0x88], 0x33a931a2
mov dword [esp + 0x8c], 0x37ab356a
mov dword [esp + 0x90], 0x2bb029b7
mov dword [esp + 0x94], 0x2fb32db3
mov dword [esp + 0x98], 0x239c217e
mov dword [esp + 0x9c], 0x27b22581
mov dword [esp + 0xa0], 0x1b85198f
mov dword [esp + 0xa4], 0x1f851d8e
mov dword [esp + 0xa8], 0x13b711a3
mov dword [esp + 0xac], 0x17801586
mov dword [esp + 0xb0], 0xba90991
mov dword [esp + 0xb4], 0xf0e0da9
mov word [esp + 0xb8], 0
lea eax, [esp + 0xb8]
mov ecx, 0x359563d8
mov edx, 0xca6a9c27
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x35956380]
mov esi, edx
and esi, 0x8a689f5d
mov edi, ecx
and edi, 0x358440a2
or edi, esi
xor ebx, 0x8a79bf5d
mov esi, ebx
and esi, edi
add ebx, edi
add esi, esi
sub ebx, esi
add bl, 0xc8
mov byte [esp + ecx - 0x35956380], bl
inc ecx
dec edx
cmp ecx, 0x3595643a
jne 0x4224e0
lea edi, [esp + 0x498]
lea esi, [esp + 0x58]
mov edx, esi
mov ecx, 0x18
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x4f8]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x58], 0x101f1e1d
mov word [esp + 0x5c], 0
mov edx, 0xc5
movzx eax, byte [esp + edx - 0x6d]
mov ebx, eax
mov edi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xcd
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x27
mov byte [esp + edx - 0x6d], al
inc edx
cmp edx, 0xcb
jne 0x422560
mov eax, dword [esp + 0x58]
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x4225f4
xor edx, edx
mov edi, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x9abdb589
je 0x4225d0
inc edx
cmp ecx, edx
jne 0x4225c0
jmp 0x4225f4
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4225f4
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 5
push 4
push ecx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x1c
mov dword [esp + 0x58], 0xa1e6e7f8
mov word [esp + 0x5c], 0
mov ecx, 0x56
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esi]
lea ebx, [ecx - 0x76fa5b00]
or ebx, edi
and edi, ecx
lea edx, [ebx + ebx]
not edx
add edx, ebx
or edx, edi
lea edi, [edx + 0x32]
mov ebx, 0x4d
sub ebx, edx
and edx, 1
and ebx, 0x8d
and edi, 0x72
or edi, ebx
xor edi, 0x8c
lea edx, [edi + edx*2]
mov byte [esi], dl
inc esi
dec ecx
cmp ecx, 0x50
jne 0x422610
cmp eax, dword [esp + 0x58]
jne 0x422700
push dword [esp + 0x24]
call fcn.0043e0d0
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x24]
mov dword [esp + 0x58], 0x101f1e1d
mov word [esp + 0x5c], 0
mov esi, 0xc5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x6d]
mov ebx, edx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xcd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x27
mov byte [esp + esi - 0x6d], al
inc esi
cmp esi, 0xcb
jne 0x422690
mov eax, dword [esp + 0x58]
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x422730
xor edx, edx
mov esi, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x42270e
inc edx
cmp ecx, edx
jne 0x4226f0
jmp 0x422730
xor ecx, ecx
xor edx, edx
xor esi, esi
mov ebx, dword [ebp + 0x14]
jmp 0x422caf
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x422730
push 0
push edi
push dword [esp + 0x24]
push 5
push 4
push ecx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x1c
test eax, eax
mov ebx, dword [ebp + 0x14]
js 0x422c7f
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
jmp 0x422771
mov ecx, ebx
call fcn.0043e620
mov eax, dword [esi]
test eax, eax
je 0x422c97
mov ecx, dword [esi + eax + 0x3c]
add esi, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx + eax]
mov edi, dword [ebp + 8]
movzx edi, word [edi + eax]
test dx, dx
je 0x422798
add eax, 2
cmp dx, di
je 0x422780
cmp dx, di
jne 0x422767
mov eax, dword [esi + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xc], eax
mov ecx, ebx
push 0x410
call fcn.0043e4c0
test eax, eax
js 0x422767
mov dword [esp + 0x20], 0
mov eax, dword [ebx]
mov dword [esp + 8], eax
mov dword [esp + 0x58], 0x101f1e1d
mov word [esp + 0x5c], 0
mov edi, 0xc5
nop
nop
movzx edx, byte [esp + edi - 0x6d]
mov ebx, edx
and ebx, edi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xcd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edi
add al, 0x27
mov byte [esp + edi - 0x6d], al
inc edi
cmp edi, 0xcb
jne 0x4227e0
mov eax, dword [esp + 0x58]
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x422880
xor edx, edx
mov edi, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xae6e2b0b
je 0x422850
inc edx
cmp ecx, edx
jne 0x422840
jmp 0x422880
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x422880
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x2b
push dword [esp + 0x18]
push 5
push ecx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x58], 0xa96a6b60
mov word [esp + 0x5c], 0
xor ecx, ecx
mov ebx, dword [ebp + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xe7
xor dl, byte [esp + ecx + 0x58]
add dl, 0x7d
mov byte [esp + ecx + 0x58], dl
inc ecx
cmp ecx, 6
jne 0x4228a0
cmp eax, dword [esp + 0x58]
jne 0x422c38
mov eax, dword [esp + 0x20]
add eax, 2
push eax
call fcn.0043e0d0
add esp, 4
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
mov dword [esp + 0x58], 0x101f1e1d
mov word [esp + 0x5c], 0
mov edx, 0xc5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0x6d]
mov ebx, edi
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xcd
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x27
mov byte [esp + edx - 0x6d], al
inc edx
cmp edx, 0xcb
jne 0x422900
mov eax, dword [esp + 0x58]
mov ecx, dword [0x451b44]
test ecx, ecx
je 0x422996
mov edi, dword [esp]
add edi, 2
xor edx, edx
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xae6e2b0b
je 0x422970
inc edx
cmp ecx, edx
jne 0x422960
jmp 0x422996
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x422996
push 0
push edi
push dword [esp + 0x10]
push 0x2b
push dword [esp + 0x28]
push 5
push ecx
push dword [0x451b4c]
call fcn.00441940
add esp, 0x20
test eax, eax
mov ebx, dword [ebp + 0x14]
js 0x422c2c
mov ecx, dword [esp + 8]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
cmp eax, edx
je 0x4229cb
mov edi, dword [ebp + 0xc]
movzx edi, word [edi + edx*2]
cmp di, word [ecx + edx*2]
jne 0x422c2c
inc edx
test di, di
jne 0x4229b0
mov ecx, ebx
call fcn.0043eb20
cmp eax, 2
jne 0x422c2c
mov ecx, ebx
push 0
push 0x30
lea eax, [esp + 0x30]
push eax
push 0
call fcn.0043e920
test eax, eax
js 0x422c2c
mov ecx, ebx
push 0
push 0
push 0x28
lea eax, [esp + 0x67c]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.0043eec0
test eax, eax
js 0x422c2c
mov ecx, ebx
push 0
push 0
push 0x80
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0043eec0
test eax, eax
js 0x422c2c
movzx eax, word [esp + 0xca]
push eax
call fcn.0043e0d0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0xca]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0xe4]
push dword [esp + 0xe4]
call fcn.0043eec0
test eax, eax
js 0x422c23
mov eax, edi
movzx edi, word [esp + 0x498]
mov dword [esp + 4], eax
mov dword [esp], eax
test di, di
je 0x422ae5
lea ecx, [esp + 0x498]
mov edx, dword [esp + 4]
mov eax, edx
mov dword [esp], edx
jmp 0x422ab8
movzx edi, word [ecx]
test di, di
je 0x422ae5
movzx ebx, word [eax]
test bx, bx
je 0x422c1c
add eax, 2
add ecx, 2
mov edx, dword [esp]
add edx, 2
cmp bx, di
je 0x422ada
mov dword [esp], edx
mov eax, edx
je 0x422ab0
lea ecx, [esp + 0x498]
jmp 0x422ab0
cmp dword [esp], 0
je 0x422c1c
mov ebx, dword [ebp + 0x14]
mov ecx, ebx
push 0
push 0
push 0x20
lea eax, [esp + 0x624]
push eax
push dword [esp + 0x69c]
push dword [esp + 0x69c]
call fcn.0043eec0
test eax, eax
js 0x422c1f
mov eax, dword [esp + 0x688]
mov ecx, dword [esp + 0x68c]
add eax, 0x10
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x628]
mov edx, dword [esp + 0x62c]
mov dword [esp + 0x4fc], edx
mov dword [esp + 0x4f8], eax
jmp 0x422b89
cmp cx, dx
je 0x422c53
push edi
call fcn.0043e170
add esp, 4
mov eax, dword [esp + 0x4f8]
mov edx, dword [esp + 0x4fc]
mov ecx, edx
xor ecx, dword [esp + 0x18]
mov edi, eax
xor edi, dword [esp]
or edi, ecx
je 0x422c1f
mov ecx, ebx
push 0
push 0
push 0x68
lea edi, [esp + 0x504]
push edi
push edx
push eax
call fcn.0043eec0
test eax, eax
js 0x422c1f
movzx eax, word [esp + 0x552]
push eax
call fcn.0043e0d0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x552]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0x56c]
push dword [esp + 0x56c]
call fcn.0043eec0
test eax, eax
js 0x422b5f
xor eax, eax
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x422bf3
or ecx, 0x20
movzx edx, word [edi + eax]
lea ebx, [edx - 0x41]
cmp bx, 0x1a
jae 0x422c03
or edx, 0x20
mov ebx, dword [ebp + 0x14]
test cx, cx
je 0x422b56
add eax, 2
cmp cx, dx
je 0x422be0
jmp 0x422b56
mov ebx, dword [ebp + 0x14]
mov edi, dword [esp + 4]
push edi
call fcn.0043e170
add esp, 4
push dword [esp + 8]
call fcn.0043e170
add esp, 4
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x10]
je 0x422760
cmp dword [esp + 0xc], 0
je 0x422760
jmp 0x422c97
mov eax, dword [esp + 0x528]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x52c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x538]
mov dword [esp + 0xc], eax
push edi
call fcn.0043e170
add esp, 4
jmp 0x422c1f
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
push dword [esp + 0x1c]
call fcn.0043e170
add esp, 4
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, ebx
call fcn.0043e610
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret