Function at 0x468720
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x7a0
mov esi, edx
mov edx, dword [ebp + 8]
mov ebx, ecx
test edx, edx
je 0x468760
mov eax, edx
mov ecx, esi
shl eax, 4
lea edi, [esi + eax]
nop word cs:[eax + eax]
nop
test eax, eax
je 0x46876e
add eax, 0xfffffff0
cmp dword [ecx + 8], 0
lea ecx, [ecx + 0x10]
jne 0x468750
mov dword [ebx], 0x80000007
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp edx, 1
jne 0x46878c
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
cmp eax, 1
jne 0x4687ca
movzx eax, byte [edx]
mov dword [ebx], 0x80000000
mov byte [ebx + 4], al
jmp 0x468766
xor eax, eax
cmp edx, 2
jne 0x46882e
cmp dword [esi + 8], 1
jne 0x468870
cmp dword [esi + 0x18], 1
mov ecx, 0
jne 0x468872
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x14]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
mov dword [ebx], 0x80000001
mov byte [ebx + 4], al
mov byte [ebx + 5], cl
jmp 0x468766
lea ecx, [esp + 0x50]
push eax
call fcn.0046dce0
add esp, 4
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0x90]
cmp dword [esp + 0x88], 0
jne 0x468f9a
test edi, edi
mov dword [esp + 8], ebx
je 0x468f84
js 0x469100
movzx eax, byte [0x537170]
mov ecx, edi
mov edx, 1
call fcn.0040a020
mov ebx, eax
test eax, eax
jne 0x468f89
mov ecx, 1
mov edx, edi
call fcn.004d6180
cmp edx, 3
jne 0x468870
cmp dword [esi + 8], 1
jne 0x468870
cmp dword [esi + 0x18], 1
jne 0x468870
cmp dword [esi + 0x28], 1
mov ecx, 0
jne 0x468872
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x24]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
movzx edx, byte [edx]
shl ecx, 0x10
shl eax, 8
shl edx, 0x18
or eax, ecx
mov ecx, 1
or eax, edx
jmp 0x468872
xor ecx, ecx
mov edx, eax
and edx, 1
or edx, ecx
je 0x468895
mov ecx, eax
shr eax, 0x18
mov dword [ebx], 0x80000002
shr ecx, 8
mov byte [ebx + 6], al
mov word [ebx + 4], cx
jmp 0x468766
mov eax, dword [ebp + 8]
mov edx, dword [esi + 8]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
lea ecx, [eax + 0xfffffff]
mov eax, ecx
and eax, 0xfffffff
cmp eax, 8
jae 0x4688c2
mov ebx, edx
xor ecx, ecx
jmp 0x4689fc
movd xmm0, edx
and ecx, 7
mov edi, eax
add esi, 0x88
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x4de440]
sub edi, ecx
mov dword [esp + 0x10], ecx
mov ecx, edi
movdqa xmm2, xmm1
nop word [eax + eax]
movd xmm3, dword [esi - 0x40]
movd xmm5, dword [esi - 0x50]
movd xmm4, dword [esi - 0x70]
movd xmm6, dword [esi - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [esi - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [esi]
punpcklqdq xmm4, xmm5
movd xmm5, dword [esi - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [esi - 0x30]
sub esi, 0xffffff80
add edi, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x4688f0
movdqa xmm4, xmm1
movdqa xmm3, xmm2
cmp dword [esp + 0x10], 0
mov esi, dword [esp + 4]
mov edi, dword [esp + 0xc]
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ebx, xmm0
je 0x468a1d
sub eax, ecx
shl ecx, 4
lea ecx, [ecx + esi + 0x18]
nop word cs:[eax + eax]
nop
mov edx, dword [ecx]
cmp ebx, edx
cmovae ebx, edx
add ecx, 0x10
dec eax
jne 0x468a10
mov dword [esp + 0x10], ebx
mov dword [esp + 0x238], 0x2020100
mov word [esp + 0x23c], 2
mov dword [esp + 0x214], 0
mov dword [esp + 0x218], 4
mov dword [esp + 0x21c], 0
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 4
mov dword [esp + 0x228], 0
mov dword [esp + 0x22c], 0xffffffff
mov dword [esp + 0x230], 0
mov byte [esp + 0x234], 0
xor eax, eax
mov ebx, esi
test al, al
jne 0x468bba
jmp 0x468ac0
movzx eax, byte [esp + 0x23d]
test al, al
jne 0x468bba
mov edi, dword [esp + 0x21c]
cmp edi, 0x80
jb 0x468b30
mov byte [esp + 0x23d], 1
mov byte [esp + 0x234], 0
mov esi, dword [esp + 0x218]
mov dword [esp + 0x21c], 0
add esi, 4
jmp 0x468b0a
add esi, 0xc
dec edi
je 0x468ba0
cmp dword [esi - 4], 0
je 0x468b00
push dword [esi]
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x468b00
mov eax, dword [ebx + 8]
test eax, eax
je 0x468b4c
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x214]
push eax
call fcn.0041b5c0
add esp, 4
jmp 0x468bb6
mov byte [esp + 0x23d], 1
mov byte [esp + 0x234], 0
test edi, edi
mov esi, dword [esp + 0x218]
mov dword [esp + 0x21c], 0
je 0x468ba0
add esi, 4
jmp 0x468b86
add esi, 0xc
dec edi
je 0x468ba0
cmp dword [esi - 4], 0
je 0x468b80
push dword [esi]
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x468b80
mov dword [esp + 0x228], 0
mov dword [esp + 0x22c], 0xffffffff
mov edi, dword [esp + 0xc]
add ebx, 0x10
cmp ebx, edi
jne 0x468ab0
lea ecx, [esp + 0x378]
lea edx, [esp + 0x214]
call fcn.004195c0
mov eax, dword [esp + 0x378]
cmp eax, 0x80000000
jne 0x468c35
mov edi, dword [esp + 0x21c]
mov esi, dword [esp + 0x218]
mov eax, dword [ebp + 8]
mov dword [esp + 0x50], 0x80000000
test edi, edi
je 0x468cd2
lea ebx, [esi + 4]
jmp 0x468c1a
add ebx, 0xc
dec edi
je 0x468cd2
cmp dword [ebx - 4], 0
je 0x468c10
push dword [ebx]
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x468c10
movsd xmm2, qword [esp + 0x394]
movsd xmm1, qword [esp + 0x38c]
mov esi, dword [esp + 0x21c]
mov ecx, dword [esp + 0x3a4]
movq xmm0, qword [esp + 0x39c]
mov edi, dword [esp + 0x218]
movsd qword [esp + 0x3c], xmm2
movsd qword [esp + 0x34], xmm1
movq xmm2, qword [esp + 0x37c]
movq xmm1, qword [esp + 0x384]
test esi, esi
mov dword [esp + 0x4c], ecx
movq qword [esp + 0x44], xmm0
movq qword [esp + 0x2c], xmm1
movq qword [esp + 0x24], xmm2
mov dword [esp + 0x20], eax
je 0x468d45
lea ebx, [edi + 4]
jmp 0x468cba
add ebx, 0xc
dec esi
je 0x468d45
cmp dword [ebx - 4], 0
je 0x468cb0
push dword [ebx]
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x468cb0
cmp dword [esp + 0x214], 0
je 0x468cee
push esi
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
cmp dword [esp + 0x220], 0
mov ebx, dword [esp + 8]
lea edi, [esp + 0x378]
je 0x468d1b
push dword [esp + 0x224]
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov esi, dword [esp + 4]
cmp dword [esp + 0x50], 0x80000000
je 0x468e6c
lea eax, [esp + 0x50]
push 0x190
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x468766
cmp dword [esp + 0x214], 0
mov ebx, dword [esp + 8]
je 0x468d62
push edi
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x220], 0
mov esi, dword [esp + 4]
je 0x468d85
push dword [esp + 0x224]
push 0
push dword [0x5371d8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x14], 3
mov byte [esp + 0x1a], 0
mov word [esp + 0x18], 1
mov word [esp + 0x1c], 0x102
lea ecx, [esp + 0x378]
lea edx, [esp + 0x14]
push dword [ebp + 8]
push esi
call fcn.004983f0
add esp, 8
cmp dword [esp + 0x378], 0
jne 0x468e3b
lea eax, [esp + 0x37c]
push 0x164
push eax
lea esi, [esp + 0x21c]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x1c]
movzx eax, byte [esp + 0x1d]
lea ecx, [esp + 0x4e0]
push esi
push eax
call fcn.0040b250
add esp, 8
push esi
call fcn.004698b0
add esp, 4
cmp dword [esp + 0x4e0], 0
jne 0x468e3b
mov edi, dword [esp + 0x4e4]
lea esi, [esp + 0x644]
lea eax, [esp + 0x4e8]
push 0x158
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 0x80000000
jne 0x46908b
lea eax, [esp + 0x20]
mov dword [esp + 0x50], 0x80000000
push eax
call fcn.0041dd60
add esp, 4
mov esi, dword [esp + 4]
mov eax, dword [ebp + 8]
lea edi, [esp + 0x378]
cmp dword [esp + 0x50], 0x80000000
jne 0x468d2d
pxor xmm0, xmm0
shl eax, 4
xor ecx, ecx
movdqa xmmword [esp + 0x140], xmm0
movdqa xmmword [esp + 0x130], xmm0
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
movdqa xmmword [esp + 0xb0], xmm0
movdqa xmmword [esp + 0xa0], xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
nop dword [eax]
cmp dword [esi + ecx + 8], 1
jne 0x468f59
mov edx, dword [esi + ecx + 4]
add ecx, 0x10
cmp eax, ecx
movzx edx, byte [edx]
mov byte [esp + edx + 0x50], 1
jne 0x468f00
mov esi, ebx
movzx ebx, byte [esp + 0x50]
lea eax, [esp + 0x51]
push 0xff
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp bl, 2
je 0x468f5b
lea eax, [esi + 5]
push 0xff
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi], 0x80000005
mov byte [esi + 4], bl
jmp 0x468766
mov esi, ebx
mov edx, dword [esp + 4]
lea ecx, [esp + 0x50]
push dword [ebp + 8]
call fcn.00497e50
add esp, 4
cmp byte [esp + 0x59], 3
jne 0x46906e
mov dword [esi], 0x80000007
jmp 0x468766
mov ebx, 1
push edi
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, ebx
mov ebx, dword [esp + 8]
movsd xmm1, qword [esp + 0x50]
movsd xmm2, qword [esp + 0x58]
movsd xmm3, qword [esp + 0x60]
movq xmm4, qword [esp + 0x68]
movq xmm5, qword [esp + 0x70]
mov eax, dword [esp + 0x80]
movq xmm0, qword [esp + 0x78]
mov dword [ebx], 0x80000003
movq qword [esp + 0x74], xmm5
movq qword [esp + 0x6c], xmm4
movsd qword [esp + 0x64], xmm3
movsd qword [esp + 0x5c], xmm2
movsd qword [esp + 0x54], xmm1
movsd qword [esp + 0x1f0], xmm2
movsd qword [esp + 0x1e8], xmm1
movsd qword [esp + 0x1f8], xmm3
movq qword [esp + 0x200], xmm4
movq qword [esp + 0x208], xmm5
movsd xmm2, qword [esp + 0x58]
movq xmm1, qword [esp + 0x50]
movq xmm3, qword [esp + 0x68]
mov ecx, dword [esp + 0x78]
movsd qword [ebx + 0xc], xmm2
movsd xmm2, qword [esp + 0x60]
movq qword [ebx + 4], xmm1
movq qword [ebx + 0x1c], xmm3
mov dword [ebx + 0x2c], ecx
movsd qword [ebx + 0x14], xmm2
movq xmm2, qword [esp + 0x70]
movq qword [ebx + 0x24], xmm2
movq qword [ebx + 0x30], xmm0
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x40], 1
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x48], edi
jmp 0x468766
mov eax, dword [esp + 0x58]
movq xmm0, qword [esp + 0x50]
mov dword [esi + 0xc], eax
movq qword [esi + 4], xmm0
mov dword [esi], 0x80000006
jmp 0x468766
lea eax, [esp + 0x84]
push 0x158
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esp + 0x28]
movsd xmm2, qword [esp + 0x30]
movq xmm0, qword [esp + 0x20]
mov eax, dword [esp + 0x10]
movsd qword [esp + 0x58], xmm1
movsd xmm1, qword [esp + 0x38]
movsd qword [esp + 0x60], xmm2
movq xmm2, qword [esp + 0x40]
movq qword [esp + 0x50], xmm0
movsd qword [esp + 0x68], xmm1
movq xmm1, qword [esp + 0x48]
movq qword [esp + 0x70], xmm2
movq qword [esp + 0x78], xmm1
mov dword [esp + 0x80], edi
mov dword [esp + 0x1dc], eax
jmp 0x468e50
call fcn.0041f600
int3