Function at 0x49ec00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x7b0
mov esi, esp
mov dword [esi + 0x798], ebp
mov dword [esi + 0x79c], esp
mov dword [esi + 0x7a8], 0xffffffff
mov dword [esi + 0x7a4], 0x5389b0
mov ebx, ecx
mov eax, dword fs:[0]
mov dword [esi + 0x7a0], eax
lea eax, [esi + 0x7a0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x49ec70
shl eax, 4
mov edi, edx
lea ecx, [edx + eax]
mov dword [esi], ecx
mov ecx, edx
nop
test eax, eax
je 0x49ec8a
add eax, 0xfffffff0
cmp dword [ecx + 8], 0
lea ecx, [ecx + 0x10]
jne 0x49ec60
mov dword [ebx], 0x80000007
mov eax, dword [esi + 0x7a0]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esi + 4], ebx
cmp eax, 1
jne 0x49ecae
mov eax, dword [edi + 8]
mov edx, dword [edi + 4]
cmp eax, 1
jne 0x49ecec
movzx eax, byte [edx]
mov dword [ebx], 0x80000000
mov byte [ebx + 4], al
jmp 0x49ec76
cmp eax, 2
jne 0x49ed53
xor eax, eax
cmp dword [edi + 8], 1
jne 0x49ed99
cmp dword [edi + 0x18], 1
mov ecx, 0
jne 0x49ed9b
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0x14]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
mov dword [ebx], 0x80000001
mov byte [ebx + 4], al
mov byte [ebx + 5], cl
jmp 0x49ec76
mov dword [esi + 0x7a8], 0xffffffff
lea ecx, [esi + 0x50]
push eax
call fcn.004a5810
add esp, 4
mov edx, dword [esi + 0x8c]
mov edi, dword [esi + 0x90]
cmp dword [esi + 0x88], 0
jne 0x49f4bc
test edi, edi
je 0x49f4a7
mov dword [esi], edx
js 0x49f5fc
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, edi
call fcn.0051b940
mov edx, dword [esi]
mov ebx, eax
test eax, eax
jne 0x49f4ac
mov ecx, 1
mov edx, edi
call fcn.0053b730
mov ecx, eax
xor eax, eax
cmp ecx, 3
jne 0x49ed99
cmp dword [edi + 8], 1
jne 0x49ed99
cmp dword [edi + 0x18], 1
jne 0x49ed99
cmp dword [edi + 0x28], 1
mov ecx, 0
jne 0x49ed9b
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0x24]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
movzx edx, byte [edx]
shl ecx, 0x10
shl eax, 8
shl edx, 0x18
or eax, ecx
mov ecx, 1
or eax, edx
jmp 0x49ed9b
xor ecx, ecx
mov edx, eax
and edx, 1
or edx, ecx
je 0x49edbe
mov ecx, eax
shr eax, 0x18
mov dword [ebx], 0x80000002
shr ecx, 8
mov byte [ebx + 6], al
mov word [ebx + 4], cx
jmp 0x49ec76
mov eax, dword [ebp + 8]
mov ebx, dword [edi + 8]
xor ecx, ecx
mov dword [esi + 8], edi
lea edx, [eax + 0xfffffff]
mov eax, edx
and eax, 0xfffffff
cmp eax, 8
jb 0x49ef14
movd xmm0, ebx
and edx, 7
mov ecx, eax
add edi, 0x88
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x5473a0]
sub ecx, edx
mov ebx, ecx
movdqa xmm2, xmm1
nop word cs:[eax + eax]
nop dword [eax]
movd xmm3, dword [edi - 0x40]
movd xmm5, dword [edi - 0x50]
movd xmm4, dword [edi - 0x70]
movd xmm6, dword [edi - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [edi - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [edi]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edi - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [edi - 0x30]
sub edi, 0xffffff80
add ebx, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x49ee10
movdqa xmm4, xmm1
movdqa xmm3, xmm2
mov edi, dword [esi + 8]
test edx, edx
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ebx, xmm0
je 0x49ef2d
sub eax, ecx
shl ecx, 4
lea ecx, [ecx + edi + 0x18]
nop dword [eax]
mov edx, dword [ecx]
cmp ebx, edx
cmovae ebx, edx
add ecx, 0x10
dec eax
jne 0x49ef20
mov ecx, dword [esi]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x238], 0x2020100
mov word [esi + 0x23c], 2
mov dword [esi + 0x214], 0
mov dword [esi + 0x218], 4
mov dword [esi + 0x21c], 0
mov dword [esi + 0x220], 0
mov dword [esi + 0x224], 4
mov dword [esi + 0x228], 0
mov dword [esi + 0x22c], 0xffffffff
mov dword [esi + 0x230], 0
mov byte [esi + 0x234], 0
xor eax, eax
mov ebx, edi
test al, al
jne 0x49f0c9
jmp 0x49efbf
movzx eax, byte [esi + 0x23d]
test al, al
jne 0x49f0c9
mov edi, dword [esi + 0x21c]
mov dword [esi + 0xc], ebx
cmp edi, 0x80
jb 0x49f030
mov byte [esi + 0x23d], 1
mov byte [esi + 0x234], 0
mov ebx, dword [esi + 0x218]
mov dword [esi + 0x21c], 0
add ebx, 4
jmp 0x49f00a
add ebx, 0xc
dec edi
je 0x49f0b0
cmp dword [ebx - 4], 0
je 0x49f000
push dword [ebx]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x49f000
mov eax, dword [ebx + 8]
test eax, eax
je 0x49f05a
mov edx, dword [ebx + 4]
lea ecx, [esi + 0x214]
mov dword [esi + 0x7a8], 0
push eax
call fcn.0044a200
mov ebx, dword [esi + 0xc]
add esp, 4
mov ecx, dword [esi]
jmp 0x49f0c9
mov byte [esi + 0x23d], 1
mov byte [esi + 0x234], 0
test edi, edi
mov ebx, dword [esi + 0x218]
mov dword [esi + 0x21c], 0
je 0x49f0b0
add ebx, 4
jmp 0x49f096
add ebx, 0xc
dec edi
je 0x49f0b0
cmp dword [ebx - 4], 0
je 0x49f090
push dword [ebx]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x49f090
mov ecx, dword [esi]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x228], 0
mov dword [esi + 0x22c], 0xffffffff
add ebx, 0x10
cmp ebx, ecx
jne 0x49efb0
lea ecx, [esi + 0x378]
lea edx, [esi + 0x214]
mov dword [esi + 0x7a8], 0
call fcn.00447c10
mov eax, dword [esi + 0x378]
cmp eax, 0x80000000
jne 0x49f155
mov eax, dword [esi + 0x218]
mov ebx, dword [esi + 0x21c]
mov dword [esi + 0x50], 0x80000000
mov dword [esi], eax
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x49f1e1
mov ecx, dword [esi]
lea edi, [ecx + 4]
jmp 0x49f13a
add edi, 0xc
dec ebx
je 0x49f1e1
cmp dword [edi - 4], 0
je 0x49f130
push dword [edi]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x49f130
movsd xmm2, qword [esi + 0x394]
movsd xmm1, qword [esi + 0x38c]
mov ecx, dword [esi + 0x3a4]
movq xmm0, qword [esi + 0x39c]
mov ebx, dword [esi + 0x21c]
movsd qword [esi + 0x3c], xmm2
movsd qword [esi + 0x34], xmm1
movq xmm2, qword [esi + 0x37c]
movq xmm1, qword [esi + 0x384]
mov dword [esi + 0x4c], ecx
movq qword [esi + 0x44], xmm0
test ebx, ebx
movq qword [esi + 0x2c], xmm1
movq qword [esi + 0x24], xmm2
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x218]
mov dword [esi], eax
mov eax, dword [ebp + 8]
je 0x49f226
mov ecx, dword [esi]
lea edi, [ecx + 4]
jmp 0x49f1c6
add edi, 0xc
dec ebx
je 0x49f226
cmp dword [edi - 4], 0
je 0x49f1c0
push dword [edi]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x49f1c0
cmp dword [esi + 0x214], 0
je 0x49f1fd
push dword [esi]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
cmp dword [esi + 0x220], 0
mov edi, dword [esi + 4]
je 0x49f35e
push dword [esi + 0x224]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x49f35b
cmp dword [esi + 0x214], 0
je 0x49f242
push dword [esi]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
cmp dword [esi + 0x220], 0
mov edi, dword [esi + 8]
je 0x49f26f
push dword [esi + 0x224]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov dword [esi + 0x7a8], 1
mov dword [esi + 0x10], 3
mov byte [esi + 0x16], 0
mov word [esi + 0x14], 1
mov word [esi + 0x18], 0x102
mov dword [esi + 0x7a8], 1
lea ecx, [esi + 0x378]
lea edx, [esi + 0x10]
push eax
push edi
call fcn.004d0e20
add esp, 8
cmp dword [esi + 0x378], 0
lea edi, [esi + 0x214]
jne 0x49f33b
lea eax, [esi + 0x37c]
push 0x164
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esi + 0x18]
movzx eax, byte [esi + 0x19]
mov dword [esi + 0x7a8], 2
lea ecx, [esi + 0x4e0]
push edi
push eax
call fcn.00439600
add esp, 8
lea eax, [esi + 0x214]
mov dword [esi + 0x7a8], 1
push eax
call fcn.004a02e0
add esp, 4
cmp dword [esi + 0x4e0], 0
jne 0x49f33b
mov edi, dword [esi + 0x4e4]
lea ebx, [esi + 0x640]
lea eax, [esi + 0x4e8]
push 0x158
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 0x80000000
jne 0x49f597
lea eax, [esi + 0x20]
mov dword [esi + 0x50], 0x80000000
mov dword [esi + 0x7a8], 0xffffffff
push eax
call fcn.004c8770
add esp, 4
mov edi, dword [esi + 4]
mov eax, dword [ebp + 8]
cmp dword [esi + 0x50], 0x80000000
jne 0x49f454
mov edi, dword [esi + 8]
pxor xmm0, xmm0
shl eax, 4
xor ecx, ecx
movdqa xmmword [esi + 0x140], xmm0
movdqa xmmword [esi + 0x130], xmm0
movdqa xmmword [esi + 0x120], xmm0
movdqa xmmword [esi + 0x110], xmm0
movdqa xmmword [esi + 0x100], xmm0
movdqa xmmword [esi + 0xf0], xmm0
movdqa xmmword [esi + 0xe0], xmm0
movdqa xmmword [esi + 0xd0], xmm0
movdqa xmmword [esi + 0xc0], xmm0
movdqa xmmword [esi + 0xb0], xmm0
movdqa xmmword [esi + 0xa0], xmm0
movdqa xmmword [esi + 0x90], xmm0
movdqa xmmword [esi + 0x80], xmm0
movdqa xmmword [esi + 0x70], xmm0
movdqa xmmword [esi + 0x60], xmm0
movdqa xmmword [esi + 0x50], xmm0
nop
cmp dword [edi + ecx + 8], 1
jne 0x49f46b
mov edx, dword [edi + ecx + 4]
add ecx, 0x10
cmp eax, ecx
movzx edx, byte [edx]
mov byte [esi + edx + 0x50], 1
lea edx, [esi + 0x378]
jne 0x49f3f0
movzx ebx, byte [esi + 0x50]
lea eax, [esi + 0x51]
push 0xff
push eax
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp bl, 2
je 0x49f475
mov edi, dword [esi + 4]
lea eax, [edi + 5]
push 0xff
lea ecx, [esi + 0x378]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi], 0x80000005
mov byte [edi + 4], bl
jmp 0x49ec76
lea eax, [esi + 0x50]
push 0x190
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x49ec76
mov dword [esi + 0x7a8], 0xffffffff
mov dword [esi + 0x7a8], 0xffffffff
lea ecx, [esi + 0x50]
mov edx, edi
push dword [ebp + 8]
call fcn.004d0750
add esp, 4
cmp byte [esi + 0x59], 3
jne 0x49f579
mov eax, dword [esi + 4]
mov dword [eax], 0x80000007
jmp 0x49ec76
mov ebx, 1
push edi
push edx
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, ebx
mov ebx, dword [esi + 4]
movq xmm0, qword [esi + 0x50]
movq xmm1, qword [esi + 0x58]
movq xmm2, qword [esi + 0x60]
movq xmm3, qword [esi + 0x68]
movq xmm4, qword [esi + 0x70]
mov eax, dword [esi + 0x80]
movq xmm5, qword [esi + 0x78]
mov dword [ebx], 0x80000003
movq qword [esi + 0x74], xmm4
movq qword [esi + 0x6c], xmm3
movq qword [esi + 0x64], xmm2
movq qword [esi + 0x5c], xmm1
movq qword [esi + 0x54], xmm0
movq qword [esi + 0x1e8], xmm0
movq qword [esi + 0x1f0], xmm1
movq qword [esi + 0x1f8], xmm2
movq qword [esi + 0x200], xmm3
movq qword [esi + 0x208], xmm4
movsd xmm6, qword [esi + 0x50]
mov ecx, dword [esi + 0x78]
movq xmm7, qword [esi + 0x70]
movsd qword [ebx + 4], xmm6
movsd xmm6, qword [esi + 0x58]
mov dword [ebx + 0x2c], ecx
movq qword [ebx + 0x24], xmm7
movsd qword [ebx + 0xc], xmm6
movsd xmm6, qword [esi + 0x60]
movsd qword [ebx + 0x14], xmm6
movq xmm6, qword [esi + 0x68]
movq qword [ebx + 0x1c], xmm6
movq qword [ebx + 0x30], xmm5
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x40], 1
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edi
jmp 0x49ec76
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 4]
movq xmm0, qword [esi + 0x50]
mov dword [ecx + 0xc], eax
movq qword [ecx + 4], xmm0
mov dword [ecx], 0x80000006
jmp 0x49ec76
lea eax, [esi + 0x84]
push 0x158
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esi + 0x28]
movsd xmm2, qword [esi + 0x30]
movq xmm0, qword [esi + 0x20]
mov eax, dword [esi + 0x1c]
movsd qword [esi + 0x58], xmm1
movsd xmm1, qword [esi + 0x38]
movsd qword [esi + 0x60], xmm2
movq xmm2, qword [esi + 0x40]
movq qword [esi + 0x50], xmm0
movsd qword [esi + 0x68], xmm1
movq xmm1, qword [esi + 0x48]
movq qword [esi + 0x70], xmm2
movq qword [esi + 0x78], xmm1
mov dword [esi + 0x80], edi
mov dword [esi + 0x1dc], eax
jmp 0x49f358
call fcn.0044e3c0
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
sub esp, 0xc
lea esi, [ebp - 0x7ac]
mov ebp, dword [esi + 0x798]
lea eax, [esi + 0x214]
push eax
call fcn.004a02e0
add esp, 0x10
pop ebp
ret