Function at 0x41abe0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0x565577c1
push dword [0x447ed0]
call fcn.0043bc60
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push edi
push dword [ebp + 8]
call eax
test eax, eax
mov dword [esi + 0x18], ebx
je 0x41ac7f
cmp dword [ebx], 0xffffffff
jne 0x41ad31
jmp 0x41b1d1
push 0xb646c33f
push dword [0x447ed0]
call fcn.0043bc60
add esp, 8
mov dword [esi], eax
push 0xe7db718c
push dword [0x447ed0]
call fcn.0043bc60
add esp, 8
mov dword [esi + 4], eax
push 0xa3d60213
push dword [0x447ed0]
call fcn.0043bc60
add esp, 8
mov dword [esi + 8], eax
mov ebx, dword [esi + 0x28]
jmp 0x41acd3
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x41ad0d
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi]
mov ecx, dword [esi + 0x18]
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x41acd0
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 4]
test eax, eax
je 0x41ad0d
mov edi, dword [esi + 0x18]
push dword [edi]
call dword [esi + 8]
mov dword [edi], 0xffffffff
mov edi, dword [ebp + 0xc]
jmp 0x41acd0
push 0xeb17dc3b
push dword [0x447ed0]
call fcn.0043bc60
add esp, 8
push dword [esi + 0x28]
call eax
mov ebx, dword [esi + 0x18]
cmp dword [ebx], 0xffffffff
je 0x41b1d1
mov ecx, dword [ebp + 0x10]
mov eax, 0x8e
nop
nop
nop
nop
nop
nop
nop
cmp byte [ecx + eax - 0x8e], 0
lea eax, [eax + 1]
jne 0x41ad40
mov edx, dword [ebp + 8]
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41ad50
mov edx, 0xffffffff
nop
nop
cmp byte [edi + edx + 1], 0
lea edx, [edx + 1]
jne 0x41ad60
mov ebx, edx
and ebx, eax
xor edx, eax
lea eax, [edx + ebx*2]
add eax, 3
and eax, 0xfffffffc
call fcn.004081e0
mov edi, esp
and edi, 0xfffffff0
mov esp, edi
mov dword [esi + 0x30], 0x77760920
mov dword [esi + 0x34], 0x29172a74
mov dword [esi + 0x38], 0x3c0c419
mov dword [esi + 0x3c], 0x155a5e63
mov word [esi + 0x40], 0xb150
mov dword [esi + 0x42], 0
mov word [esi + 0x46], 0
mov eax, 0xbce9dfb0
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + eax + 0x43162080]
xor ebx, eax
mov edx, ebx
xor edx, 0x70
or ebx, 0x8f
and edx, ebx
add edx, ebx
inc dl
mov byte [esi + eax + 0x43162080], dl
inc eax
cmp eax, 0xbce9dfc8
jne 0x41adc0
mov dword [esi + 0xc], 0x217a080d
mov byte [esi + 0x10], 0xc0
mov dword [esi + 0x11], 0
mov word [esi + 0x15], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and dl, 1
mov dh, al
and dh, 0xfe
sub dl, dh
movzx ebx, dl
mov edx, eax
xor edx, 0x31
add edx, eax
add edx, ebx
xor dl, byte [esi + eax + 0xc]
add dl, 0xb
mov byte [esi + eax + 0xc], dl
inc eax
cmp eax, 0xb
jne 0x41ae10
movzx eax, byte [esi + 0xc]
mov ebx, edi
test al, al
je 0x41ae5b
lea edx, [esi + 0xd]
mov ebx, edi
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41ae50
mov byte [ebx], 0
movzx eax, byte [ecx]
test al, al
je 0x41ae7d
inc ecx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ae70
jmp 0x41ae80
mov edx, dword [ebp + 8]
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x41ae9b
lea ecx, [esi + 0x31]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ae90
mov byte [ebx], 0
movzx eax, byte [edx]
test al, al
mov dword [esi], edi
je 0x41aebb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41aeb0
mov byte [ebx], 0x3a
mov dword [esi + 0x30], 0x5fbbf7f5
mov dword [esi + 0x34], 0xa7a35b57
mov dword [esi + 0x38], 0x4ce68fa5
mov dword [esi + 0x3c], 0x686da3a1
mov dword [esi + 0x40], 0x6b9b669f
mov dword [esi + 0x44], 0x60b5c3c1
mov dword [esi + 0x48], 0x90936362
mov dword [esi + 0x4c], 0x79796c60
mov dword [esi + 0x50], 0x7f9bc9a6
mov dword [esi + 0x54], 0x87837b77
mov dword [esi + 0x58], 0x90d8dc85
mov dword [esi + 0x5c], 0x70478281
mov dword [esi + 0x60], 0x8c697f7d
mov dword [esi + 0x64], 0x8777827b
mov dword [esi + 0x68], 0x9e736e4d
mov dword [esi + 0x6c], 0x7c72355a
mov dword [esi + 0x70], 0x5f699f95
mov dword [esi + 0x74], 0x6a9e709b
mov dword [esi + 0x78], 0x7c479e75
mov dword [esi + 0x7c], 0x486f9899
mov dword [esi + 0x80], 0x6945a948
mov dword [esi + 0x84], 0x58495c44
mov dword [esi + 0x88], 0x90b7caf
mov dword [esi + 0x8c], 0x764d5043
mov dword [esi + 0x90], 0x58484c43
mov dword [esi + 0x94], 0x46bd4abf
mov dword [esi + 0x98], 0x424c7cb4
mov dword [esi + 0x9c], 0xc8c3b2b2
mov dword [esi + 0xa0], 0xe7e17ca
mov dword [esi + 0xa4], 0x6e6c600b
mov word [esi + 0xa8], 0x516e
mov dword [esi + 0xaa], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0xa4
mov edx, ecx
xor edx, 0xd2
add edx, edi
xor dl, byte [esi + ecx + 0x30]
add dl, 0xe6
mov byte [esi + ecx + 0x30], dl
inc ecx
add eax, 2
cmp ecx, 0x7e
jne 0x41afd0
inc ebx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x41b01d
inc ecx
mov edi, dword [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b010
jmp 0x41b01f
mov edi, dword [esi]
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x41b03b
lea ecx, [esi + 0x31]
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b030
mov byte [ebx], 0
sub ebx, edi
push 0xefae2064
push dword [0x447ed0]
call fcn.0043bc60
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x18]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x41b0a5
cmp dword [edi], 0xffffffff
je 0x41b0a5
push 0xea8d1240
push dword [0x447ed0]
call fcn.0043bc60
add esp, 8
push 2
push dword [edi]
call eax
push 0xa3d60213
push dword [0x447ed0]
call fcn.0043bc60
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x41b5f6
cmp eax, 0xffffffff
je 0x41b1d1
push 0x400
call fcn.004082d0
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add eax, 0x400
mov dword [esi + 0x14], eax
lea eax, [esi + 0xc]
mov ecx, edi
push eax
call fcn.0041b600
mov cl, 1
mov dword [esi + 4], ecx
test al, al
je 0x41b5de
mov ebx, dword [esi + 0xc]
mov edi, dword [esi + 0x10]
mov edx, edi
sub edx, ebx
mov eax, ebx
cmp edi, dword [esi + 0x14]
jne 0x41b239
lea eax, [edx + 1]
mov ecx, edx
shr ecx, 1
mov dword [esi], edx
mov dword [esi + 0x24], ecx
add ecx, edx
cmp ecx, eax
ja 0x41b10a
mov ecx, eax
mov dword [esi + 4], ecx
push ecx
call fcn.004082d0
add esp, 4
test ebx, ebx
je 0x41b226
cmp eax, ebx
mov dword [esi + 8], ebx
mov edx, dword [esi]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
jbe 0x41b1d8
cmp edi, eax
jbe 0x41b1d8
test edx, edx
je 0x41b212
mov ebx, dword [esi + 8]
mov edx, dword [esi]
lea eax, [ebx + edx]
dec eax
mov ecx, dword [esi + 0x1c]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x41b170
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x41b15b
add eax, edx
add ecx, edx
add edx, dword [esi]
mov ebx, dword [esi + 8]
mov edi, ebx
sub edi, dword [esi + 0x20]
cmp edi, 0xfffffff8
ja 0x41b212
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x41b182
jmp 0x41b212
xor eax, eax
jmp 0x41b5f6
mov ecx, edx
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, dword [esi]
and edx, 0xfffffffc
add eax, edx
add edx, ebx
mov ebx, eax
mov ecx, dword [esi + 0x24]
and ecx, 1
mov eax, edx
mov edi, ebx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
test byte [esi], 1
je 0x41b212
mov eax, dword [esi]
and eax, 2
movzx ecx, byte [edx + eax]
mov byte [ebx + eax], cl
push dword [esi + 0xc]
call fcn.004082e0
add esp, 4
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x1c]
mov edi, dword [esi + 0x20]
mov dword [esi + 0xc], eax
mov edx, dword [esi]
lea ecx, [eax + edx]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 4]
add ecx, eax
mov dword [esi + 0x14], ecx
mov ecx, ebx
xor ecx, edi
not ebx
and ebx, edi
add ebx, ebx
sub ebx, ecx
cmp ebx, edx
jae 0x41b267
lea edi, [eax + ebx]
inc edi
mov dword [esi], edi
add eax, ebx
mov edx, eax
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, dword [esi]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esi + 0xc]
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x30], 0xb3b6b588
mov dword [esi + 0x34], 0x96e894eb
mov dword [esi + 0x38], 0x9a9a98e8
mov byte [esi + 0x3c], 0xcc
mov dword [esi + 0x3d], 0
mov ecx, 0xcbc8b8d0
mov eax, 0x1437472f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + ecx + 0x34374760]
mov edi, eax
and edi, 0x1012011c
mov edx, ecx
and edx, 0x8b80b863
or edx, edi
xor edx, 0x63
or edx, ebx
lea edi, [eax - 0x14374700]
and edi, ebx
not edx
or edx, edi
add dl, 0xf0
mov byte [esi + ecx + 0x34374760], dl
inc ecx
dec eax
cmp ecx, 0xcbc8b8e1
jne 0x41b2b0
movzx edx, byte [esi + 0x30]
mov eax, dword [esi + 8]
mov ecx, eax
mov dword [esi + 4], eax
test dl, dl
je 0x41b337
lea ebx, [esi + 0x30]
mov ecx, eax
mov edi, eax
mov dword [esi + 4], eax
jmp 0x41b317
movzx edx, byte [ebx]
test dl, dl
je 0x41b337
mov dh, byte [ecx]
test dh, dh
je 0x41b5ca
inc ecx
inc ebx
mov edi, dword [esi + 4]
inc edi
cmp dh, dl
je 0x41b330
mov ecx, edi
mov dword [esi + 4], edi
je 0x41b310
lea ebx, [esi + 0x30]
jmp 0x41b310
cmp dword [esi + 4], 0
je 0x41b5ca
mov ebx, dword [esi + 0x18]
jmp 0x41b35b
cmp dl, dh
mov ebx, dword [esi + 0x18]
je 0x41b5de
mov edx, eax
mov ecx, dword [esi]
sub edx, ecx
je 0x41b382
mov dword [esi + 8], eax
mov eax, ecx
mov dword [esi], ecx
xor ecx, ecx
mov edi, dword [esi + 8]
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
xor ecx, ecx
mov edi, dword [esi + 8]
mov eax, dword [esi]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
add dword [esi + 0x10], edx
mov ecx, ebx
lea eax, [esi + 0xc]
push eax
call fcn.0041b600
test al, al
je 0x41b5d7
mov dword [esi + 4], eax
mov ebx, dword [esi + 0xc]
mov edi, dword [esi + 0x10]
mov edx, edi
sub edx, ebx
mov eax, ebx
cmp edi, dword [esi + 0x14]
jne 0x41b500
lea eax, [edx + 1]
mov ecx, edx
shr ecx, 1
mov dword [esi], edx
mov dword [esi + 0x2c], ecx
add ecx, edx
cmp ecx, eax
ja 0x41b3c1
mov ecx, eax
mov dword [esi + 8], ecx
push ecx
call fcn.004082d0
add esp, 4
test ebx, ebx
je 0x41b4ed
cmp eax, ebx
mov dword [esi + 0x1c], ebx
mov edx, dword [esi]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
jbe 0x41b49f
cmp edi, eax
jbe 0x41b49f
test edx, edx
je 0x41b4d9
mov ebx, dword [esi + 0x1c]
mov edx, dword [esi]
lea eax, [ebx + edx]
dec eax
mov ecx, dword [esi + 0x20]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x41b435
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x41b420
add eax, edx
add ecx, edx
add edx, dword [esi]
mov ebx, dword [esi + 0x1c]
mov edi, ebx
sub edi, dword [esi + 0x24]
cmp edi, 0xfffffff8
ja 0x41b4d9
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x41b450
jmp 0x41b4d9
mov ecx, edx
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, dword [esi]
and edx, 0xfffffffc
add eax, edx
add edx, ebx
mov ebx, eax
mov ecx, dword [esi + 0x2c]
and ecx, 1
mov eax, edx
mov edi, ebx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
test byte [esi], 1
je 0x41b4d9
mov eax, dword [esi]
and eax, 2
movzx ecx, byte [edx + eax]
mov byte [ebx + eax], cl
push dword [esi + 0xc]
call fcn.004082e0
add esp, 4
mov ebx, dword [esi + 0x1c]
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x24]
mov dword [esi + 0xc], eax
mov edx, dword [esi]
lea ecx, [eax + edx]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 8]
add ecx, eax
mov dword [esi + 0x14], ecx
mov ecx, ebx
xor ecx, edi
not ebx
and ebx, edi
add ebx, ebx
sub ebx, ecx
cmp ebx, edx
jae 0x41b52e
lea edi, [eax + ebx]
inc edi
mov dword [esi], edi
add eax, ebx
mov edx, eax
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, dword [esi]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esi + 0xc]
mov byte [eax + ebx], 0
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov word [esi + 0x30], 0x1715
mov byte [esi + 0x32], 0xe
lea eax, [esi + 0x33]
mov byte [eax + 2], 0
mov word [eax], 0
mov ecx, 0x3e7315c2
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + ecx - 0x3e731592]
mov eax, ecx
and eax, edx
add eax, eax
sub edx, eax
add edx, ecx
mov eax, edx
and eax, 0x35
xor edx, 0xc7c09335
lea eax, [edx + eax*2]
and edx, 1
lea ebx, [edx + edx]
or eax, 1
sub ebx, edx
add ebx, eax
mov byte [esi + ecx - 0x3e731592], bl
inc ecx
cmp ecx, 0x3e7315c8
jne 0x41b560
xor ecx, ecx
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax + ecx]
mov dh, byte [esi + ecx + 0x30]
test dl, dl
je 0x41b350
inc ecx
cmp dl, dh
je 0x41b5b0
jmp 0x41b350
mov ecx, dword [esi + 0x18]
push 0x3ea
call fcn.0041a690
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41b5f3
cmp eax, dword [esi + 0x10]
je 0x41b5f3
push eax
call fcn.004082e0
add esp, 4
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc