Function at 0x409a80
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x110
cmp dword [ecx + 0x20], 0
je 0x409f17
mov esi, ecx
lea eax, [ecx + 0x10]
push eax
call fcn.00406050
add esp, 4
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x48]
mov dword [esp + 8], eax
movzx eax, byte [esi]
imul ecx, eax, 0xcd
shr ecx, 0xa
and ecx, 0xfffffffe
lea ecx, [ecx + ecx*4]
sub al, cl
movzx eax, al
movzx eax, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov byte [esp + 2], al
mov byte [esp + 3], 0
mov dword [esp + 0xc], edx
lea eax, [edx + 0x400]
push eax
call fcn.00408220
add esp, 4
mov edi, eax
mov dword [esp + 0x74], 0x676b7668
mov byte [esp + 0x78], 4
mov dword [esp + 0x79], 0
xor eax, eax
mov ecx, 0xe9a46fff
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x74]
mov edx, ecx
or edx, ebx
not ebx
or ebx, eax
and ebx, edx
mov edx, 0x931c5529
sub edx, ebx
mov ebx, edx
xor ebx, 0x2a
and edx, 0x55
add edx, edx
sub edx, ebx
mov byte [esp + eax + 0x74], dl
inc eax
dec ecx
cmp eax, 9
jne 0x409b10
lea ebp, [esp + 0x74]
mov ecx, esi
push 0x44bad4
push ebp
push edi
call fcn.004092d0
mov dword [esp + 0x74], 0x9f6fcfc
mov dword [esp + 0x78], 0
mov eax, 0x42a90743
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x42a906cf]
xor ecx, eax
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, 0xb0
xor ecx, edx
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x42a906cf], cl
inc eax
cmp eax, 0x42a9074b
jne 0x409b70
lea eax, [esp + 2]
mov ecx, esi
push eax
push ebp
push edi
call fcn.004092d0
mov eax, dword [str.tLYMe5__111new]
mov dword [esp + 0x74], 0xe346787c
mov byte [esp + 0x78], 0
xor ecx, ecx
nop
nop
mov edx, ecx
and dl, 0x17
xor dl, byte [esp + ecx + 0x74]
xor dl, 0x58
add dl, 0x48
mov byte [esp + ecx + 0x74], dl
inc ecx
cmp ecx, 5
jne 0x409bc0
mov ecx, esi
push eax
push ebp
mov dword [esp + 0xc], edi
push edi
call fcn.004092d0
mov dword [esp + 0x74], 0xc7bcc4b3
mov dword [esp + 0x78], 0xb4c3b8cb
mov dword [esp + 0x7c], 0x3e3d384b
mov byte [esp + 0x80], 0xdc
mov word [esp + 0x81], 0
mov byte [esp + 0x83], 0
mov edx, pe_nt_image_headers32
nop
nop
movzx edi, byte [esp + edx - 4]
mov ebx, edi
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0xa8
mov byte [esp + edx - 4], al
inc edx
cmp edx, 0x88
jne 0x409c20
mov dword [esp + 0x14], 0x19a6b6b3
mov word [esp + 0x18], 0
xor eax, eax
mov ecx, eax
add cl, 0x3b
xor cl, byte [esp + eax + 0x14]
add cl, 0xd9
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 6
jne 0x409c70
lea eax, [esp + 0x14]
mov dword [esp + 0x10], esi
mov ecx, esi
push ebp
push eax
push dword [esp + 0xc]
call fcn.004092d0
mov dword [esp + 0x74], 0x206040e
mov byte [esp + 0x78], 0xe8
mov dword [esp + 0x79], 0
mov word [esp + 0x7d], 0
mov eax, 0xc724e0a7
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x38db1fcd]
mov edx, eax
and edx, ebx
mov edi, edx
and edi, 0xffffffbd
mov esi, edx
and esi, 2
mov ecx, edx
or ecx, 0xfffffffd
inc ecx
imul ecx, edi
or edx, 2
imul edx, esi
add ecx, ebx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0xc51a6dda
xor ecx, 0xc51a6dda
lea ecx, [ecx + edx*2]
mov edx, ecx
and edx, 0x3c
xor ecx, 0xbc
lea ecx, [ecx + edx*2]
add cl, 0x27
mov byte [esp + eax + 0x38db1fcd], cl
inc eax
cmp eax, 0xc724e0b2
jne 0x409cc0
mov edi, dword [esp + 0x10]
mov ecx, edi
push dword [esp + 0xc]
push dword [esp + 0xc]
push ebp
push dword [esp + 0x10]
call fcn.004095b0
mov dword [esp + 0x14], 0x33a53173
mov dword [esp + 0x18], 0x2fa22dba
mov dword [esp + 0x1c], 0x2bbc29b5
mov dword [esp + 0x20], 0x277325a8
mov dword [esp + 0x24], 0x23ab218c
mov dword [esp + 0x28], 0x1f831d8c
mov dword [esp + 0x2c], 0x1b7a1952
mov dword [esp + 0x30], 0x179b1581
mov dword [esp + 0x34], 0x139e1184
mov dword [esp + 0x38], 0xf9e0d95
mov dword [esp + 0x3c], 0xb9809a9
mov dword [esp + 0x40], 0x7510588
mov dword [esp + 0x44], 0x395019e
mov dword [esp + 0x48], 0x7feb7dee
mov dword [esp + 0x4c], 0x7be6792d
mov dword [esp + 0x50], 0x77fa75d5
mov dword [esp + 0x54], 0x733971d1
mov dword [esp + 0x58], 0x6fcc6d0c
mov dword [esp + 0x5c], 0x6be769ff
mov dword [esp + 0x60], 0x67fa65f2
mov dword [esp + 0x64], 0x63f061c1
mov dword [esp + 0x68], 0x5f1b5dd5
mov word [esp + 0x6c], 0x5958
mov byte [esp + 0x72], 0
mov dword [esp + 0x6e], 0
mov eax, 0xa47bec8c
nop
nop
nop
movzx ecx, byte [esp + eax + 0x5b841388]
mov edx, eax
and edx, ecx
lea esi, [eax + ecx]
not esi
and esi, 1
add edx, edx
sub ecx, edx
add ecx, eax
add ecx, 0x43
or ecx, 1
add ecx, esi
mov byte [esp + eax + 0x5b841388], cl
inc eax
cmp eax, 0xa47beceb
jne 0x409e00
movzx eax, word [esp + 0x14]
test ax, ax
je 0x409e62
lea ebp, [esp + 0x74]
lea ecx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebp], ax
add ebp, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409e50
mov word [ebp], 0
movzx ecx, byte [edi + 0x60]
test cl, cl
je 0x409e92
lea eax, [edi + 0x61]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, cl
mov word [ebp], cx
add ebp, 2
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x409e80
mov dword [ebp], 0xa000d
mov word [ebp + 4], 0
mov eax, dword [edi + 0x80]
mov dword [esp + 0x14], 0x99759bad
mov dword [esp + 0x18], 0xa551a768
mov dword [esp + 0x1c], 0xa3a4
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x5b
xor dl, byte [esp + ecx + 0x14]
add dl, 0x39
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 0xc
jne 0x409ec0
lea ecx, [esp + 0x74]
push 0x493e0
push eax
mov esi, dword [esp + 0xc]
push esi
push 0
push 0
push ecx
lea eax, [esp + 0x2c]
push eax
call fcn.0040c200
add esp, 0x1c
mov ebx, eax
push esi
call fcn.00408230
add esp, 4
mov eax, dword [edi + 0x80]
add dword [edi + 4], eax
mov dword [edi + 0x80], 0
jmp 0x409f19
mov bl, 1
mov eax, ebx
add esp, 0x110
pop esi
pop edi
pop ebx
pop ebp
ret