Function at 0x4179b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov dword [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [0x444998]
test eax, eax
je 0x417dce
xor ecx, ecx
mov edx, dword [0x44499c]
nop
nop
cmp dword [edx + ecx*8], 0xa896961c
je 0x4179f0
inc ecx
cmp eax, ecx
jne 0x4179e0
jmp 0x417a5f
mov eax, dword [edx + ecx*8 + 4]
cmp eax, 0xffffffff
je 0x417a5f
mov esi, esp
push esi
push 0
push 0x28
push 0xfffffffffffffffe
push 0x10
push eax
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x1c
cmp eax, 0xc000007c
jne 0x417a5f
mov eax, dword [0x444998]
test eax, eax
je 0x417a5f
xor ecx, ecx
mov edx, dword [0x44499c]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb7c1bb11
je 0x417a40
inc ecx
cmp eax, ecx
jne 0x417a30
jmp 0x417a5f
mov eax, dword [edx + ecx*8 + 4]
cmp eax, 0xffffffff
je 0x417a5f
push esi
push 0x28
push 0xffffffffffffffff
push 0xc
push eax
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x18
mov eax, dword [esp]
test eax, eax
je 0x417dce
mov ecx, dword [0x444998]
test ecx, ecx
je 0x417b58
xor edx, edx
mov esi, dword [0x44499c]
cmp dword [esi + edx*8], 0x6e83e51e
je 0x417a93
inc edx
cmp ecx, edx
jne 0x417a80
jmp 0x417b58
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x417b58
lea esi, [esp + 0x14]
push esi
push 0
push 0
push 1
push eax
push 0x14
push ecx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x20
cmp eax, 0xc0000023
jne 0x417b58
push dword [esp + 0x14]
call fcn.00435e00
add esp, 4
mov edi, dword [0x444998]
test edi, edi
je 0x417b4f
mov edx, dword [esp + 0x14]
mov ecx, dword [esp]
xor ebx, ebx
mov ebp, dword [0x44499c]
nop
nop
nop
cmp dword [ebp + ebx*8], 0x6e83e51e
je 0x417b01
inc ebx
cmp edi, ebx
jne 0x417af0
jmp 0x417b4f
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, 0xffffffff
je 0x417b4f
push esi
push edx
push eax
push 1
push ecx
push 0x14
push edi
push dword [0x4449a0]
mov esi, eax
call fcn.004371f0
add esp, 0x20
mov ecx, eax
mov eax, esi
test ecx, ecx
js 0x417b4f
mov ecx, dword [eax]
test ecx, ecx
je 0x417b4f
cmp byte [ecx], 1
jne 0x417b4f
cmp byte [ecx + 1], 0xf
ja 0x417b4f
cmp byte [ecx + 7], 5
jne 0x417b4f
cmp byte [ecx + 8], 0x12
jne 0x417b4f
mov ecx, dword [esp]
mov dword [esp + 0x18], ecx
push eax
call fcn.00435e20
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x417dd0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov eax, dword [0x443670]
mov dword [esp + 0x48], 0x3f9a3d9d
mov dword [esp + 0x4c], 0x3a301b6
mov dword [esp + 0x50], 0x7af05b4
mov dword [esp + 0x54], 0xbf809fb
mov dword [esp + 0x58], 0xfaa0de2
mov dword [esp + 0x5c], 0x13be11bc
mov word [esp + 0x60], 0x1514
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xdc
xor dl, byte [esp + ecx + 0x48]
add dl, 0x20
mov byte [esp + ecx + 0x48], dl
inc ecx
cmp ecx, 0x1a
jne 0x417bc0
lea ebp, [esp + 0x48]
push 0x800
push 0
push ebp
call eax
lea ecx, [esp + 0x40]
push eax
call fcn.00436bf0
test al, al
je 0x417d03
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
push 0x10a6c058
push dword [esp + 0x44]
call fcn.00438950
add esp, 8
mov edi, eax
mov dword [esp + 0x48], 0x4aec48e4
mov dword [esp + 0x4c], 0x4ed04cf2
mov dword [esp + 0x50], 0x42e440df
mov dword [esp + 0x54], 0x46d644d1
mov dword [esp + 0x58], 0x3aa738d8
mov dword [esp + 0x5c], 0x3ea93c9a
mov dword [esp + 0x60], 0x3281309a
mov dword [esp + 0x64], 0x36ac34a1
mov dword [esp + 0x68], 0x2ab028a1
mov dword [esp + 0x6c], 0x2e882cb7
mov dword [esp + 0x70], 0x22842088
mov word [esp + 0x74], 0x2423
mov esi, 0x2f
nop
nop
nop
movzx ecx, byte [esp + esi + 0x19]
mov ebx, ecx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov edx, ebx
and dl, 0x7d
mul dl
mov edx, eax
add dl, cl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub dl, al
movzx eax, dl
add eax, esi
add al, 0x88
mov byte [esp + esi + 0x19], al
inc esi
cmp esi, 0x5d
jne 0x417c80
lea eax, [esp + 0x34]
push eax
push ebp
push 0
call edi
test eax, eax
je 0x417da0
mov ecx, dword [0x444998]
test ecx, ecx
je 0x417da0
mov eax, dword [esp]
xor edx, edx
mov esi, dword [0x44499c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x4b501129
je 0x417d37
inc edx
cmp ecx, edx
jne 0x417cf0
jmp 0x417da0
mov eax, dword [0x444998]
test eax, eax
je 0x417dce
mov ecx, dword [esp]
xor edx, edx
mov esi, dword [0x44499c]
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xb430e561
je 0x417ddb
inc edx
cmp eax, edx
jne 0x417d20
jmp 0x417dce
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x417da0
lea edx, [esp + 0x30]
push 0
push 0
push 0x10
push edx
push 0
push eax
push 0x18
push ecx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x24
test eax, eax
js 0x417da0
push dword [esp + 0x40]
call dword [fcn.00443784]
mov eax, dword [0x444998]
test eax, eax
je 0x418372
mov ecx, dword [esp]
xor edx, edx
mov esi, dword [0x44499c]
cmp dword [esi + edx*8], 0xb430e561
je 0x417dfc
inc edx
cmp eax, edx
jne 0x417d85
mov dword [esp + 0x1c], 0
jmp 0x417e2c
push dword [esp + 0x40]
call dword [fcn.00443784]
mov eax, dword [0x444998]
test eax, eax
je 0x417dce
mov ecx, dword [esp]
xor edx, edx
mov esi, dword [0x44499c]
nop
nop
cmp dword [esi + edx*8], 0xb430e561
je 0x417ddb
inc edx
cmp eax, edx
jne 0x417dc0
xor eax, eax
add esp, 0x94
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esi + edx*8 + 4]
xor eax, eax
cmp edx, 0xffffffff
je 0x417dd0
push ecx
push 4
push edx
push dword [0x4449a0]
call fcn.004371f0
xor eax, eax
add esp, 0x10
jmp 0x417dd0
mov edx, dword [esi + edx*8 + 4]
cmp edx, 0xffffffff
je 0x417e1c
push ecx
push 4
push edx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x10
mov eax, dword [0x444998]
mov dword [esp + 0x1c], 0
test eax, eax
je 0x418372
xor ecx, ecx
mov edx, dword [0x44499c]
cmp dword [edx + ecx*8], 0x67f3d776
je 0x417e47
inc ecx
cmp eax, ecx
jne 0x417e34
jmp 0x418372
mov eax, dword [edx + ecx*8 + 4]
cmp eax, 0xffffffff
je 0x418372
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x1c
cmp eax, 0xc0000004
jne 0x418372
push dword [esp + 0x1c]
call fcn.00435e00
add esp, 4
mov dword [esp + 0x28], eax
mov ecx, dword [0x444998]
test ecx, ecx
je 0x418366
mov eax, dword [esp + 0x1c]
xor edx, edx
mov esi, dword [0x44499c]
cmp dword [esi + edx*8], 0x67f3d776
je 0x417eb8
inc edx
cmp ecx, edx
jne 0x417ea5
jmp 0x418366
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x418366
push 0
push eax
push dword [esp + 0x30]
push 5
push 0x10
push ecx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x1c
test eax, eax
js 0x418366
mov esi, dword [esp + 0x28]
mov ebx, dword [esi]
lea edi, [esp + 0x78]
mov eax, dword [esi + ebx + 0x44]
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov ecx, edi
push 0
push eax
call fcn.00435fc0
mov ecx, edi
push 0x1000
call fcn.00435fe0
test eax, eax
js 0x41834c
mov ecx, dword [0x444998]
test ecx, ecx
je 0x418348
mov eax, dword [esp + 0x78]
xor edx, edx
mov edi, dword [0x44499c]
cmp dword [edi + edx*8], 0xb7c1bb11
je 0x417f66
inc edx
cmp ecx, edx
jne 0x417f53
jmp 0x418348
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x418348
lea edx, [esp + 0x10]
push edx
push 0xa
push eax
push 0xc
push ecx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x18
test eax, eax
js 0x418348
mov ecx, dword [0x444998]
test ecx, ecx
je 0x418348
mov eax, dword [esp + 0x10]
xor edx, edx
mov edi, dword [0x44499c]
cmp dword [edi + edx*8], 0x6e83e51e
je 0x417fc1
inc edx
cmp ecx, edx
jne 0x417fae
jmp 0x418307
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x418307
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 1
push eax
push 0x14
push ecx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x20
cmp eax, 0xc0000023
jne 0x418307
push dword [esp + 0x14]
call fcn.00435e00
add esp, 4
mov dword [esp + 0x24], eax
mov edx, dword [0x444998]
test edx, edx
je 0x4182fb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
xor eax, eax
mov edi, dword [0x44499c]
cmp dword [edi + eax*8], 0x6e83e51e
je 0x41803b
inc eax
cmp edx, eax
jne 0x418028
jmp 0x4182fb
mov edx, dword [edi + eax*8 + 4]
cmp edx, 0xffffffff
je 0x4182fb
lea eax, [esp + 0x14]
push eax
push ecx
push dword [esp + 0x2c]
push 1
push dword [esp + 0x14]
push 0x14
push edx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x20
test eax, eax
js 0x4182fb
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
test eax, eax
je 0x4182fb
cmp byte [eax], 1
jne 0x4182fb
cmp byte [eax + 1], 0xf
ja 0x4182fb
cmp byte [eax + 7], 5
jne 0x4182fb
cmp byte [eax + 8], 0x12
jne 0x4182fb
mov ecx, dword [0x444998]
test ecx, ecx
je 0x4182fb
mov eax, dword [esp + 0x10]
xor edx, edx
mov edi, dword [0x44499c]
cmp dword [edi + edx*8], 0x6e83e51e
je 0x4180d3
inc edx
cmp ecx, edx
jne 0x4180c0
jmp 0x4182fb
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x4182fb
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 3
push eax
push 0x14
push ecx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x20
cmp eax, 0xc0000023
jne 0x4182fb
push dword [esp + 0x2c]
call fcn.00435e00
add esp, 4
mov dword [esp + 4], eax
mov edx, dword [0x444998]
test edx, edx
je 0x4182ef
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov edi, dword [0x44499c]
cmp dword [edi + eax*8], 0x6e83e51e
je 0x41814d
inc eax
cmp edx, eax
jne 0x41813a
jmp 0x4182ef
mov edx, dword [edi + eax*8 + 4]
cmp edx, 0xffffffff
je 0x4182ef
lea eax, [esp + 0x2c]
push eax
push ecx
push dword [esp + 0xc]
push 3
push dword [esp + 0x30]
push 0x14
push edx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x20
test eax, eax
js 0x4182ef
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
test eax, eax
je 0x4182ef
movzx ecx, byte [esp + 0x34]
mov byte [esp + 0xf], cl
mov ah, byte [esp + 0x35]
mov al, byte [esp + 0x36]
mov byte [esp + 0xe], al
mov al, byte [esp + 0x37]
mov byte [esp + 0xd], al
mov al, byte [esp + 0x38]
mov byte [esp + 0xc], al
mov al, byte [esp + 0x39]
mov byte [esp + 0xb], al
mov al, byte [esp + 0x3a]
mov byte [esp + 0xa], al
xor edx, edx
mov al, byte [esp + 0x3b]
mov byte [esp + 9], al
jmp 0x4181eb
mov ecx, edx
and ecx, 1
xor edx, 1
lea edx, [edx + ecx*2]
cmp edx, dword [esp + 0x20]
jae 0x4182ef
lea ecx, [edx + edx*2]
mov edi, dword [esp + 4]
mov al, byte [esp + 0xf]
cmp byte [edi + ecx*4 + 4], al
jne 0x4181d6
mov edi, dword [esp + 4]
lea ecx, [edi + ecx*4]
add ecx, 4
cmp byte [ecx + 1], ah
jne 0x4181d6
mov al, byte [esp + 0xe]
cmp byte [ecx + 2], al
jne 0x4181d6
mov al, byte [esp + 0xd]
cmp byte [ecx + 3], al
jne 0x4181d6
mov al, byte [esp + 0xc]
cmp byte [ecx + 4], al
jne 0x4181d6
mov al, byte [esp + 0xb]
cmp byte [ecx + 5], al
jne 0x4181d6
mov al, byte [esp + 0xa]
cmp byte [ecx + 6], al
jne 0x4181d6
mov al, byte [esp + 9]
cmp byte [ecx + 7], al
jne 0x4181d6
mov dword [esp + 0x88], 0xc
mov dword [esp + 0x8c], 2
mov word [esp + 0x90], 1
mov dword [esp + 0x48], 0x18
lea eax, [esp + 0x4c]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
lea eax, [esp + 0x88]
mov dword [esp + 0x5c], eax
mov ecx, dword [0x444998]
test ecx, ecx
je 0x4182e7
mov eax, dword [esp + 0x10]
xor edx, edx
mov edi, dword [0x44499c]
cmp dword [edi + edx*8], 0x4d7e2c49
je 0x4182b9
inc edx
cmp ecx, edx
jne 0x4182a9
jmp 0x4182e7
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x4182e7
lea edx, [esp + 0x18]
push edx
push 2
push 0
push ebp
push 0x2000000
push eax
push 0x18
push ecx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x24
test eax, eax
jns 0x4182ef
mov dword [esp + 0x18], 0
push dword [esp + 4]
call fcn.00435e20
add esp, 4
push dword [esp + 0x24]
call fcn.00435e20
add esp, 4
mov ecx, dword [0x444998]
test ecx, ecx
je 0x418348
mov eax, dword [esp + 0x10]
xor edx, edx
mov edi, dword [0x44499c]
cmp dword [edi + edx*8], 0xb430e561
je 0x41832d
inc edx
cmp ecx, edx
jne 0x41831d
jmp 0x418348
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x418348
push eax
push 4
push ecx
push dword [0x4449a0]
call fcn.004371f0
add esp, 0x10
lea edi, [esp + 0x78]
mov ecx, edi
call fcn.004360a0
cmp dword [esp + 0x18], 0
jne 0x418366
add esi, ebx
mov ebx, dword [esi]
test ebx, ebx
jne 0x417ef1
push dword [esp + 0x28]
call fcn.00435e20
add esp, 4
mov eax, dword [esp + 0x18]
jmp 0x417dd0