Function at 0x41d260
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov dword [esp + 0x60], 0x29792b77
mov dword [esp + 0x64], 0x2dba2fb3
mov dword [esp + 0x68], 0x513e5343
mov dword [esp + 0x6c], 0x55c2573f
mov dword [esp + 0x70], 0x59095bcb
mov dword [esp + 0x74], 0x5dc55fcd
mov dword [esp + 0x78], 0x4111433a
mov dword [esp + 0x7c], 0x45d947d4
mov dword [esp + 0x80], 0x49214bd4
mov dword [esp + 0x84], 0x4ddc4f0b
mov dword [esp + 0x88], 0x71e67327
mov dword [esp + 0x8c], 0x75e777e9
mov dword [esp + 0x90], 0x79177be2
mov dword [esp + 0x94], 0x7ded7f2a
mov dword [esp + 0x98], 0x610c63ed
mov dword [esp + 0x9c], 0x65f567f1
mov dword [esp + 0xa0], 0x69186b36
mov dword [esp + 0xa4], 0x6dfa6f03
mov dword [esp + 0xa8], 0x910393f5
mov dword [esp + 0xac], 0x95fb9706
mov dword [esp + 0xb0], 0x99f19be1
mov dword [esp + 0xb4], 0x9d049f0e
mov dword [esp + 0xb8], 0x81e783f3
mov dword [esp + 0xbc], 0x858687eb
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0x6e
mov edx, ecx
xor edx, 0x37
add edx, edi
xor dl, byte [esp + ecx + 0x60]
add dl, 0xed
mov byte [esp + ecx + 0x60], dl
inc ecx
add eax, 2
cmp ecx, 0x60
jne 0x41d370
lea edi, [esp + 0x4a0]
lea eax, [esp + 0x60]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x500]
lea edx, [esp + 0xc0]
xor eax, eax
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x60], 0xc0c7c6c5
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x31
xor cl, byte [esp + eax + 0x60]
add cl, 0xb
mov byte [esp + eax + 0x60], cl
inc eax
cmp eax, 7
jne 0x41d3e0
mov eax, dword [esp + 0x60]
mov ecx, dword [0x44ae04]
test ecx, ecx
je 0x41d444
xor edx, edx
mov edi, dword [0x44ae08]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x9abdb589
je 0x41d420
inc edx
cmp ecx, edx
jne 0x41d410
jmp 0x41d444
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x41d444
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 5
push 4
push ecx
push dword [0x44ae0c]
call fcn.0043bd80
add esp, 0x1c
mov dword [esp + 0xc], eax
mov dword [esp + 0x60], 0x97d6c9c4
mov dword [esp + 0x64], 0
mov ecx, 0x2561ff2e
mov edi, 0x5a9e00d1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx - 0x2561fece]
mov ebx, ecx
xor ebx, eax
lea esi, [edi - 0x80000000]
or esi, ebx
mov ebx, esi
not ebx
and esi, 2
mov edx, ebx
and edx, 0x3d
imul edx, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
add ebx, edx
mov edx, ebx
xor edx, ecx
add edx, eax
and ebx, edi
add ebx, ebx
sub ebx, edx
mov eax, ebx
and eax, 0x67
add eax, eax
xor ebx, 0x18
sub ebx, eax
add bl, 2
mov byte [esp + ecx - 0x2561fece], bl
inc ecx
dec edi
cmp ecx, 0x2561ff36
jne 0x41d470
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x60]
jne 0x41d550
push dword [esp + 0x2c]
call fcn.004389f0
add esp, 4
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x60], 0xc0c7c6c5
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
xor eax, eax
mov esi, dword [ebp + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x31
xor dl, byte [esp + eax + 0x60]
add dl, 0xb
mov byte [esp + eax + 0x60], dl
inc eax
cmp eax, 7
jne 0x41d510
mov eax, dword [esp + 0x60]
mov edx, dword [0x44ae04]
test edx, edx
je 0x41d580
xor edi, edi
mov ebx, dword [0x44ae08]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x9abdb589
je 0x41d55e
inc edi
cmp edx, edi
jne 0x41d540
jmp 0x41d580
xor ecx, ecx
xor edx, edx
xor edi, edi
mov esi, dword [ebp + 0x14]
jmp 0x41dafd
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x41d580
push 0
push ecx
push dword [esp + 0x28]
push 5
push 4
push edx
push dword [0x44ae0c]
call fcn.0043bd80
add esp, 0x1c
test eax, eax
js 0x41dacd
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov dword [esp + 0x1c], 0
mov ebx, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
jmp 0x41d5be
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x41dae5
mov ecx, dword [ebx + eax + 0x3c]
add eax, ebx
mov dword [esp + 0xc], eax
xor eax, eax
mov ebx, dword [ebp + 8]
nop
nop
nop
movzx edx, word [ecx + eax]
movzx edi, word [ebx + eax]
test dx, dx
je 0x41d5e5
add eax, 2
cmp dx, di
je 0x41d5d0
cmp dx, di
jne 0x41d5b0
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x44]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xdc]
mov dword [esi + 0xc], eax
mov ecx, esi
push 0x410
call fcn.00438d80
test eax, eax
js 0x41d5b4
mov dword [esp + 0x28], 0
mov esi, dword [esi]
mov dword [esp + 0x60], 0xc0c7c6c5
lea eax, [esp + 0x64]
mov byte [eax + 2], 0
mov word [eax], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x31
xor cl, byte [esp + eax + 0x60]
add cl, 0xb
mov byte [esp + eax + 0x60], cl
inc eax
cmp eax, 7
jne 0x41d630
mov eax, dword [esp + 0x60]
mov edx, dword [0x44ae04]
test edx, edx
je 0x41d6a0
xor edi, edi
mov ecx, dword [0x44ae08]
nop
nop
nop
nop
cmp dword [ecx + edi*8], 0xae6e2b0b
je 0x41d670
inc edi
cmp edx, edi
jne 0x41d660
jmp 0x41d6a0
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x41d6a0
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0x2b
push esi
push 5
push ecx
push dword [0x44ae0c]
call fcn.0043bd80
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x60], 0x5312110c
mov dword [esp + 0x64], 0
mov ecx, 0xfb
mov edi, 0x5faa7f03
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x9b]
lea ebx, [ecx - 0x2fd53fff]
mov edx, edi
xor edx, ebx
and edx, esi
xor edx, ebx
add dl, 0x14
mov byte [esp + ecx - 0x9b], dl
inc ecx
dec edi
cmp ecx, 0x103
jne 0x41d6c0
cmp eax, dword [esp + 0x60]
jne 0x41d780
mov eax, dword [esp + 0x28]
add eax, 2
push eax
call fcn.004389f0
add esp, 4
mov dword [esp + 0x24], eax
mov esi, dword [ebp + 0x14]
mov edx, dword [esi]
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 0x60], 0xc0c7c6c5
lea eax, [esp + 0x64]
mov byte [eax + 2], 0
mov word [eax], 0
xor eax, eax
mov ebx, dword [esp + 0xc]
mov ecx, eax
add cl, 0x31
xor cl, byte [esp + eax + 0x60]
add cl, 0xb
mov byte [esp + eax + 0x60], cl
inc eax
cmp eax, 7
jne 0x41d730
mov eax, dword [esp + 0x60]
mov edi, dword [0x44ae04]
test edi, edi
je 0x41d7b5
mov dword [esp + 4], edx
add dword [esp + 8], 2
xor ecx, ecx
mov edx, dword [0x44ae08]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xae6e2b0b
je 0x41d78c
inc ecx
cmp edi, ecx
jne 0x41d770
jmp 0x41d7b5
mov esi, dword [ebp + 0x14]
mov ebx, dword [esp + 0xc]
jmp 0x41daaf
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, eax
je 0x41d7b5
push 0
push dword [esp + 0xc]
push dword [esp + 0x2c]
push 0x2b
push dword [esp + 0x14]
push 5
push ecx
push dword [0x44ae0c]
call fcn.0043bd80
add esp, 0x20
test eax, eax
js 0x41daa3
mov ecx, dword [esp + 0x24]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
nop
nop
nop
nop
cmp eax, edx
je 0x41d7eb
mov edi, dword [ebp + 0xc]
movzx edi, word [edi + edx*2]
cmp di, word [ecx + edx*2]
jne 0x41daa3
inc edx
test di, di
jne 0x41d7d0
mov ecx, esi
call fcn.00439460
cmp eax, 2
jne 0x41daa3
mov ecx, esi
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.00439250
test eax, eax
js 0x41daa3
mov ecx, esi
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.00439880
test eax, eax
js 0x41daa3
mov ecx, esi
push 0
push 0
push 0x80
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.00439880
test eax, eax
js 0x41daa3
movzx eax, word [esp + 0xd2]
push eax
call fcn.004389f0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0xd2]
mov ecx, esi
push 0
push 0
push eax
push edi
push dword [esp + 0xec]
push dword [esp + 0xec]
call fcn.00439880
test eax, eax
js 0x41da9a
mov eax, edi
movzx edi, word [esp + 0x4a0]
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
test di, di
je 0x41d90f
lea edx, [esp + 0x4a0]
mov eax, dword [esp + 0x10]
mov ecx, eax
mov dword [esp + 4], eax
jmp 0x41d8d8
movzx edi, word [edx]
test di, di
je 0x41d90f
movzx eax, word [ecx]
test ax, ax
je 0x41da96
add ecx, 2
add edx, 2
mov dword [esp + 8], edx
mov edx, dword [esp + 4]
add edx, 2
cmp ax, di
je 0x41d900
mov dword [esp + 4], edx
mov ecx, edx
mov edx, dword [esp + 8]
je 0x41d8d0
lea edx, [esp + 0x4a0]
jmp 0x41d8d0
cmp dword [esp + 4], 0
je 0x41da96
mov ecx, esi
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.00439880
test eax, eax
js 0x41da96
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 8], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x41d9c5
movzx eax, cx
movzx ecx, dx
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
cmp ecx, edx
je 0x41da6c
push edi
call fcn.00438a60
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 4]
mov esi, eax
xor esi, dword [esp + 8]
or esi, ecx
mov esi, dword [ebp + 0x14]
je 0x41da96
mov ecx, esi
push 0
push 0
push 0x68
lea edi, [esp + 0x50c]
push edi
push edx
push eax
call fcn.00439880
test eax, eax
js 0x41da96
movzx eax, word [esp + 0x55a]
push eax
call fcn.004389f0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x55a]
mov ecx, esi
push 0
push 0
push eax
push edi
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.00439880
test eax, eax
js 0x41d997
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x41da43
or ecx, 0x20
movzx edx, word [edi + eax]
lea esi, [edx - 0x41]
cmp si, 0x1a
jae 0x41da53
or edx, 0x20
mov esi, dword [ebp + 0x14]
test cx, cx
je 0x41d97f
add eax, 2
cmp cx, dx
je 0x41da30
jmp 0x41d97f
mov eax, dword [esp + 0x530]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0x1c], eax
push edi
call fcn.00438a60
add esp, 4
mov edi, dword [esp + 0x10]
push edi
call fcn.00438a60
add esp, 4
push dword [esp + 0x24]
call fcn.00438a60
add esp, 4
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
je 0x41dac1
test eax, eax
jne 0x41dae5
mov ecx, esi
call fcn.00438f00
jmp 0x41d5b4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push dword [esp + 0x20]
call fcn.00438a60
add esp, 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], edi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, esi
call fcn.00438ef0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret