Function at 0x421680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [esp + 0x6c]
mov ebx, dword [eax + 4]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
cmp word [ebx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4216a0
mov eax, dword [esp + 0x70]
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4216c0
sar edx, 1
sar eax, 1
lea ecx, [edx + eax]
mov dword [esp + 0x44], eax
add eax, edx
add eax, 0x1b
test eax, eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x48], edx
jns 0x4216ee
mov eax, 0xffffffff
jmp 0x4216f5
lea eax, [ecx*2 + 0x36]
push eax
call fcn.0040ccd0
add esp, 4
mov dword [esp + 4], 0x23de21cc
mov dword [esp + 8], 0x27c525bb
mov dword [esp + 0xc], 0xdb46d939
mov dword [esp + 0x10], 0xdf1bddfc
mov dword [esp + 0x14], 0xd346d158
mov dword [esp + 0x18], 0xd748d531
mov dword [esp + 0x1c], 0xcb53c95b
mov dword [esp + 0x20], 0xcf50cd53
mov dword [esp + 0x24], 0xc331c1e0
mov dword [esp + 0x28], 0xc752c521
mov dword [esp + 0x2c], 0xfb63f96c
mov dword [esp + 0x30], 0xff19fd62
mov dword [esp + 0x34], 0xf31ef163
mov dword [esp + 0x38], 0xf5f4
mov byte [esp + 0x3c], 0
mov edi, pe_nt_image_headers32
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edi - 0x74]
mov edx, ecx
not edx
and edx, 0x68
xor ecx, 0x68
or ecx, edx
xor ecx, edi
xor cl, 0x68
add cl, 0xa8
mov byte [esp + edi - 0x74], cl
inc edi
cmp edi, 0xb1
jne 0x421780
movzx ecx, word [ebx]
mov edi, eax
test cx, cx
je 0x4217d1
add ebx, 2
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4217c0
mov word [edi], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x421801
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4217f0
mov word [edi], 0
movzx ecx, word [esi]
test cx, cx
mov dword [esp + 0x4c], eax
je 0x421831
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x421820
mov word [edi], 0
mov eax, dword [esp + 0x6c]
mov edi, dword [eax]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x421850
mov ecx, dword [esp + 0x6c]
mov ebx, dword [ecx + 8]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x421870
mov edx, dword [esp + 0x70]
mov ebp, dword [edx]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edx + 2], 0
lea edx, [edx + 2]
jne 0x421890
sar eax, 1
sar ecx, 1
sar edx, 1
add ecx, eax
lea eax, [edx + ecx]
add eax, 0x13
test eax, eax
jns 0x4218b4
mov eax, 0xffffffff
jmp 0x4218bd
add ecx, edx
lea eax, [ecx*2 + 0x26]
push eax
call fcn.0040ccd0
add esp, 4
movzx ecx, word [edi]
mov dword [esp + 0x40], eax
mov esi, eax
test cx, cx
je 0x4218f1
add edi, 2
mov esi, dword [esp + 0x40]
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4218e0
mov word [esi], 0x2f
mov dword [esp + 4], 0x99519bad
mov dword [esp + 8], 0xa55aa760
mov dword [esp + 0xc], 0xa150a34f
mov dword [esp + 0x10], 0xad59af5d
mov dword [esp + 0x14], 0xa958ab5d
mov dword [esp + 0x18], 0xb587b755
mov word [esp + 0x1c], 0xb3b4
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
mov eax, 0xdb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xd7]
lea edx, [eax - 0x6f4b4f00]
mov edi, eax
and edi, ecx
or edx, ecx
not edx
or edx, edi
lea ecx, [edx + edx]
not ecx
add ecx, edx
add cl, 0xb9
mov byte [esp + eax - 0xd7], cl
inc eax
cmp eax, 0xfb
jne 0x421950
add esi, 2
movzx eax, word [ebx]
test ax, ax
je 0x4219a1
add ebx, 2
nop
mov word [esi], ax
add esi, 2
movzx eax, word [ebx]
add ebx, 2
test ax, ax
jne 0x421990
mov word [esi], 0
movzx eax, word [esp + 4]
test ax, ax
je 0x4219d1
lea ecx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi], ax
add esi, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4219c0
mov word [esi], 0
movzx eax, word [ebp]
test ax, ax
je 0x421a02
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi], ax
add esi, 2
movzx eax, word [ebp]
add ebp, 2
test ax, ax
jne 0x4219f0
mov word [esi], 0
mov dword [esp + 4], 0xcfcec996
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
xor ecx, 0x2d
mov edx, eax
or edx, 2
and edx, ecx
mov edi, eax
and edi, 5
mov ecx, eax
xor ecx, 0xd2
add ecx, edx
sub ecx, edi
add ecx, eax
xor cl, byte [esp + eax + 4]
add cl, 0xe6
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 7
jne 0x421a20
lea eax, [esp + 4]
push 0
push 0
push 0xc00000
push eax
mov edi, dword [esp + 0x5c]
push edi
push dword [esp + 0x54]
push dword [esp + 0x80]
call fcn.00424f00
add esp, 0x1c
mov byte [esp + 3], al
jmp dword [0x44abc4]