Function at 0x41d5b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov dword [esp + 0x60], 0x71817f83
mov dword [esp + 0x64], 0x75c673c7
mov dword [esp + 0x68], 0x49ca77cf
mov dword [esp + 0x6c], 0x4dfe4bf3
mov dword [esp + 0x70], 0x41b14fc7
mov dword [esp + 0x74], 0x45f543f5
mov dword [esp + 0x78], 0x59b947e6
mov dword [esp + 0x7c], 0x5dd15bec
mov dword [esp + 0x80], 0x51f95fec
mov dword [esp + 0x84], 0x55ec539f
mov dword [esp + 0x88], 0x29e257f3
mov dword [esp + 0x8c], 0x2d9b2ba1
mov dword [esp + 0x90], 0x21932f9e
mov dword [esp + 0x94], 0x259d23de
mov dword [esp + 0x98], 0x399c2795
mov dword [esp + 0x9c], 0x3d853b89
mov dword [esp + 0xa0], 0x31e03fc2
mov dword [esp + 0xa4], 0x35863397
mov dword [esp + 0xa8], 0x98737bd
mov dword [esp + 0xac], 0xdb70bba
mov dword [esp + 0xb0], 0x1a90fd9
mov dword [esp + 0xb4], 0x5b403b2
mov dword [esp + 0xb8], 0x19a307bf
mov dword [esp + 0xbc], 0x1d1a1bbf
mov byte [esp + 0xc0], 0
lea edx, [esp + 0xc0]
mov esi, 0x6b1e1c95
mov ecx, 0x6a
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi - 0x6b1e1c35]
mov ebx, ecx
and ebx, 0x65
mov eax, esi
and eax, 0x9a
or eax, ebx
xor eax, esi
xor eax, edi
xor eax, 0x65
and eax, edi
xor eax, esi
add al, 0x17
mov byte [esp + esi - 0x6b1e1c35], al
inc esi
dec ecx
cmp esi, 0x6b1e1cf6
jne 0x41d6d0
lea edi, [esp + 0x4a0]
lea esi, [esp + 0x60]
mov eax, esi
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x500]
xor eax, eax
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x60], 0x585b5a45
mov word [esp + 0x64], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x60]
mov edx, eax
and edx, 5
mov edi, eax
and edi, 2
mov ebx, eax
or ebx, 2
imul ebx, edi
xor edi, 2
imul edi, edx
mov edx, eax
xor edx, 0x9e680ef
add edx, ebx
add edx, edi
mov edi, edx
and edi, ecx
add edx, ecx
add edi, edi
sub edx, edi
mov ecx, edx
and ecx, 0x54
xor edx, 0x54
lea ecx, [edx + ecx*2]
inc cl
mov byte [esp + eax + 0x60], cl
inc eax
cmp eax, 6
jne 0x41d750
mov eax, dword [esp + 0x60]
mov ecx, dword [0x449ea0]
test ecx, ecx
je 0x41d7e4
xor edx, edx
mov edi, dword [0x449ea4]
cmp dword [edi + edx*8], 0x9abdb589
je 0x41d7c0
inc edx
cmp ecx, edx
jne 0x41d7b0
jmp 0x41d7e4
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x41d7e4
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 5
push 4
push ecx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x1c
mov dword [esp + 0x60], 0xb7f60904
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
mov ecx, 0x5e369881
nop
nop
nop
movzx edi, byte [esi]
mov edx, ecx
or edx, edi
lea ebx, [ecx - 0x5e369800]
and ebx, edi
not edx
or edx, ebx
mov ebx, edx
and ebx, 9
add ebx, ebx
xor edx, 0x76
sub ebx, edx
mov byte [esi], bl
inc esi
dec ecx
cmp ecx, 0x5e36987a
jne 0x41d800
cmp eax, dword [esp + 0x60]
jne 0x41d8d0
push dword [esp + 0x2c]
call fcn.00437fb0
add esp, 4
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x60], 0x585b5a45
mov word [esp + 0x64], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x60]
mov esi, eax
and esi, 5
mov edi, eax
and edi, 2
mov ebx, eax
or ebx, 2
imul ebx, edi
xor edi, 2
imul edi, esi
mov esi, eax
xor esi, 0x9e680ef
add esi, ebx
add esi, edi
mov edi, esi
and edi, edx
add esi, edx
add edi, edi
sub esi, edi
mov edx, esi
and edx, 0x54
xor esi, 0x54
lea edx, [esi + edx*2]
inc dl
mov byte [esp + eax + 0x60], dl
inc eax
cmp eax, 6
jne 0x41d860
mov eax, dword [esp + 0x60]
mov edx, dword [0x449ea0]
test edx, edx
je 0x41d900
xor esi, esi
mov edi, dword [0x449ea4]
cmp dword [edi + esi*8], 0x9abdb589
je 0x41d8de
inc esi
cmp edx, esi
jne 0x41d8c0
jmp 0x41d900
xor ecx, ecx
xor edx, edx
xor esi, esi
mov ebx, dword [ebp + 0x14]
jmp 0x41debe
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x41d900
push 0
push ecx
push dword [esp + 0x28]
push 5
push 4
push edx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x1c
test eax, eax
mov ebx, dword [ebp + 0x14]
js 0x41de8e
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov dword [esp + 0x18], 0
mov edi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
jmp 0x41d93e
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x41dea6
mov esi, edi
mov ecx, dword [edi + eax + 0x3c]
add eax, edi
mov dword [esp + 4], eax
xor eax, eax
mov esi, dword [ebp + 8]
nop
movzx edx, word [ecx + eax]
movzx edi, word [esi + eax]
test dx, dx
je 0x41d965
add eax, 2
cmp dx, di
je 0x41d950
cmp dx, di
jne 0x41d930
mov edi, dword [esp + 4]
mov eax, dword [edi + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xdc]
mov dword [ebx + 0xc], eax
mov ecx, ebx
push 0x410
call fcn.00438380
test eax, eax
js 0x41d934
mov dword [esp + 0x28], 0
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 0x60], 0x585b5a45
mov word [esp + 0x64], 0
xor ecx, ecx
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x60]
mov edx, ecx
and edx, 5
mov eax, ecx
and eax, 2
mov ebx, ecx
or ebx, 2
imul ebx, eax
xor eax, 2
imul eax, edx
mov edi, ecx
xor edi, 0x9e680ef
add edi, ebx
add edi, eax
mov eax, edi
and eax, esi
add edi, esi
add eax, eax
sub edi, eax
mov eax, edi
and eax, 0x54
xor edi, 0x54
lea eax, [edi + eax*2]
inc al
mov byte [esp + ecx + 0x60], al
inc ecx
cmp ecx, 6
jne 0x41d9b0
mov eax, dword [esp + 0x60]
mov edx, dword [0x449ea0]
test edx, edx
je 0x41da50
xor edi, edi
mov ecx, dword [0x449ea4]
cmp dword [ecx + edi*8], 0xae6e2b0b
je 0x41da20
inc edi
cmp edx, edi
jne 0x41da10
jmp 0x41da50
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x41da50
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0x2b
push dword [esp + 0x1c]
push 5
push ecx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x60], 0x511e1f18
mov dword [esp + 0x64], 0
xor ecx, ecx
mov ebx, dword [ebp + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x45
xor dl, byte [esp + ecx + 0x60]
add dl, 0xa7
mov byte [esp + ecx + 0x60], dl
inc ecx
cmp ecx, 8
jne 0x41da70
cmp eax, dword [esp + 0x60]
jne 0x41db50
mov eax, dword [esp + 0x28]
add eax, 2
push eax
call fcn.00437fb0
add esp, 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], 0x585b5a45
mov word [esp + 0x64], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x60]
mov eax, ecx
and eax, 5
mov edx, ecx
and edx, 2
mov esi, ecx
or esi, 2
imul esi, edx
xor edx, 2
imul edx, eax
mov eax, ecx
xor eax, 0x9e680ef
add eax, esi
add eax, edx
mov edx, eax
and edx, edi
add eax, edi
add edx, edx
sub eax, edx
mov edx, eax
and edx, 0x54
xor eax, 0x54
lea eax, [eax + edx*2]
inc al
mov byte [esp + ecx + 0x60], al
inc ecx
cmp ecx, 6
jne 0x41dad0
mov eax, dword [esp + 0x60]
mov edi, dword [0x449ea0]
test edi, edi
je 0x41db7f
mov esi, dword [esp + 0x24]
add esi, 2
xor ecx, ecx
mov edx, dword [0x449ea4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xae6e2b0b
je 0x41db59
inc ecx
cmp edi, ecx
jne 0x41db40
jmp 0x41db7f
mov edi, dword [esp + 4]
jmp 0x41dca3
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, eax
je 0x41db7f
push 0
push esi
push dword [esp + 0x14]
push 0x2b
push dword [esp + 0x2c]
push 5
push ecx
push dword [0x449ea8]
call fcn.0043b0a0
add esp, 0x20
test eax, eax
js 0x41dc93
mov ecx, dword [esp + 0xc]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, edx
je 0x41dbbb
mov esi, dword [ebp + 0xc]
movzx edi, word [esi + edx*2]
cmp di, word [ecx + edx*2]
jne 0x41dc93
inc edx
test di, di
jne 0x41dba0
mov ecx, ebx
call fcn.004389d0
cmp eax, 2
mov edi, dword [esp + 4]
jne 0x41dc97
mov ecx, ebx
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.00438810
test eax, eax
js 0x41dc97
mov ecx, ebx
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.00438d30
test eax, eax
js 0x41dc97
mov ecx, ebx
push 0
push 0
push 0x80
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.00438d30
test eax, eax
js 0x41dc97
movzx eax, word [esp + 0xd2]
push eax
call fcn.00437fb0
add esp, 4
mov esi, eax
movzx eax, word [esp + 0xd2]
mov ecx, ebx
push 0
push 0
push eax
push esi
push dword [esp + 0xec]
push dword [esp + 0xec]
call fcn.00438d30
test eax, eax
js 0x41de54
movzx edi, word [esp + 0x4a0]
mov dword [esp + 8], esi
test di, di
je 0x41dd01
lea ecx, [esp + 0x4a0]
mov esi, dword [esp + 8]
mov eax, esi
jmp 0x41dcd8
mov edi, dword [esp + 4]
push dword [esp + 0xc]
call fcn.00438060
add esp, 4
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
je 0x41dcb9
test eax, eax
jne 0x41dea6
mov ecx, ebx
call fcn.004384d0
jmp 0x41d934
movzx edi, word [ecx]
test di, di
je 0x41dd01
movzx ebx, word [eax]
test bx, bx
je 0x41de49
add eax, 2
add ecx, 2
lea edx, [esi + 2]
cmp bx, di
je 0x41dcf6
mov esi, edx
mov eax, edx
je 0x41dcd0
lea ecx, [esp + 0x4a0]
jmp 0x41dcd0
test esi, esi
mov edi, dword [esp + 4]
mov ebx, dword [ebp + 0x14]
je 0x41de50
mov ecx, ebx
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.00438d30
test eax, eax
js 0x41de50
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 0x24], eax
adc ecx, 0
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x41ddad
cmp cx, dx
je 0x41de62
push edi
call fcn.00438060
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 0x1c]
mov esi, eax
xor esi, dword [esp + 0x24]
or esi, ecx
mov edi, dword [esp + 4]
je 0x41de50
mov ecx, ebx
push 0
push 0
push 0x68
lea esi, [esp + 0x50c]
push esi
push edx
push eax
call fcn.00438d30
test eax, eax
js 0x41de50
movzx eax, word [esp + 0x55a]
push eax
call fcn.00437fb0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x55a]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.00438d30
test eax, eax
js 0x41dd7e
xor eax, eax
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x41de23
or ecx, 0x20
movzx edx, word [edi + eax]
lea esi, [edx - 0x41]
cmp si, 0x1a
jae 0x41de33
or edx, 0x20
test cx, cx
je 0x41dd75
add eax, 2
cmp cx, dx
je 0x41de10
jmp 0x41dd75
mov ebx, dword [ebp + 0x14]
mov edi, dword [esp + 4]
mov esi, dword [esp + 8]
push esi
call fcn.00438060
add esp, 4
jmp 0x41dc97
mov eax, dword [esp + 0x530]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0x18], eax
push edi
call fcn.00438060
add esp, 4
jmp 0x41de4c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
push dword [esp + 0x20]
call fcn.00438060
add esp, 4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, ebx
call fcn.004384c0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret