Function at 0x40faa0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x444
mov eax, dword [0x44e080]
mov dword [esp + 0x44], 0x178519ed
mov dword [esp + 0x48], 0x138b1592
mov dword [esp + 0x4c], 0xf9a1184
mov dword [esp + 0x50], 0xbd90ded
mov dword [esp + 0x54], 0x7d409c5
mov dword [esp + 0x58], 0x32205d4
mov dword [esp + 0x5c], 0x3fd501d8
mov dword [esp + 0x60], 0x3ba83da5
mov dword [esp + 0x64], 0x37a539a4
mov dword [esp + 0x68], 0x33bd35bf
mov dword [esp + 0x6c], 0x2fdc3110
mov dword [esp + 0x70], 0x2b0a2dc0
mov dword [esp + 0x74], 0x27f629f9
mov dword [esp + 0x78], 0x23f225f6
mov dword [esp + 0x7c], 0xdffe21e7
mov dword [esp + 0x80], 0xdb43dd37
mov dword [esp + 0x84], 0xd71cd94a
mov dword [esp + 0x88], 0xd315d518
mov dword [esp + 0x8c], 0xcf46d1f0
mov dword [esp + 0x90], 0xcb06cd06
mov dword [esp + 0x94], 0xc7e6c911
mov dword [esp + 0x98], 0xc352c505
mov dword [esp + 0x9c], 0xff6ac150
mov dword [esp + 0xa0], 0xfb11fd61
mov dword [esp + 0xa4], 0xf768f965
mov dword [esp + 0xa8], 0xf36bf503
mov dword [esp + 0xac], 0xef3df17c
mov dword [esp + 0xb0], 0xeb25ed21
mov dword [esp + 0xb4], 0xe734e923
mov dword [esp + 0xb8], 0xe328e52b
mov dword [esp + 0xbc], 0x9f46e1c0
mov dword [esp + 0xc0], 0x9b629d6b
mov dword [esp + 0xc4], 0x97639974
mov dword [esp + 0xc8], 0x93469560
mov dword [esp + 0xcc], 0x8f1a91b0
mov dword [esp + 0xd0], 0x8b1d8d15
mov dword [esp + 0xd4], 0x87a68915
mov dword [esp + 0xd8], 0x831f857f
mov dword [esp + 0xdc], 0xbf29811f
mov dword [esp + 0xe0], 0xbb63bd2f
mov dword [esp + 0xe4], 0xb749b998
mov dword [esp + 0xe8], 0xb33cb52c
mov dword [esp + 0xec], 0xaf3bb123
mov dword [esp + 0xf0], 0xab79ad31
mov dword [esp + 0xf4], 0xa777a979
mov dword [esp + 0xf8], 0xa370a56d
mov dword [esp + 0xfc], 0x5f8ca170
mov dword [esp + 0x100], 0x5b885d8c
mov dword [esp + 0x104], 0x57765988
mov dword [esp + 0x108], 0x53b355bb
mov dword [esp + 0x10c], 0x4faf51ca
mov dword [esp + 0x110], 0x4bd34dc2
mov dword [esp + 0x114], 0x478b499b
mov dword [esp + 0x118], 0x4389458b
mov dword [esp + 0x11c], 0x7fb14192
mov dword [esp + 0x120], 0x7b7a7db6
mov byte [esp + 0x124], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xe0
ja 0x40fd4e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x44]
mov esi, ecx
xor esi, 0x91022f46
and ecx, 0x11022f46
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xa2
mov edx, dword [esp]
mov byte [esp + edx + 0x44], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xe1
jb 0x40fd10
mov esi, dword [esp + 0x470]
mov ebp, dword [esp + 0x46c]
lea edi, [esp + 0x44]
push 0
push 0
push 0
push 0
push edi
call eax
xor ecx, ecx
mov dword [esp + 0x10], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448ed8]
xor ebx, ebx
xor eax, eax
test ebp, ebp
setne al
xor edi, edi
jmp dword [eax*4 + 0x448f48]
jmp dword [0x448f50]
mov dword [ebp], ebx
jmp dword [0x448f58]
mov dword [ebp], ebx
mov dword [ebp], ebx
jmp dword [0x448f58]
mov ecx, dword [esp + 0x458]
mov eax, dword [0x44e084]
mov dword [esp + 0x44], 0x90a1449
mov dword [esp + 0x48], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 7
ja 0x40fe1b
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ebx, dword [esp]
movzx ebx, byte [esp + ebx + 0x44]
mov esi, edx
xor esi, 0xdb05f43
and edx, 0xdb05f43
lea edx, [esi + edx*2]
xor edx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
add dl, 0xb1
mov esi, dword [esp]
mov byte [esp + esi + 0x44], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 8
jb 0x40fde0
movzx edx, word [esp + 0x44]
push 0
push edx
push ecx
push dword [esp + 0x1c]
call eax
xor ecx, ecx
mov dword [esp + 0xc], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448ee0]
xor edi, edi
xor ebx, ebx
mov esi, dword [esp + 0x470]
jmp 0x41021f
mov eax, dword [0x44e088]
mov dword [esp + 4], eax
mov dword [esp + 0x14], 0xf7760908
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x40fed6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x14]
mov esi, ecx
xor esi, 0xd263ecfe
mov ebx, ecx
xor ebx, 0x2d9c1301
or ecx, 0x5263ecfe
and ecx, ebx
lea ecx, [esi + ecx*2]
lea esi, [ecx + edx]
and ecx, edx
mov edx, esi
xor edx, ecx
add edx, ecx
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x44]
add cl, 0xa
mov edx, dword [esp]
mov byte [esp + edx + 0x14], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x40fe80
mov edx, dword [esp + 0x14]
mov dword [esp + 0x44], 0x37e539e8
mov dword [esp + 0x48], 0x33de35db
mov dword [esp + 0x4c], 0x3130
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 0xb
ja 0x40ff64
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov esi, dword [esp + 8]
movzx ebx, byte [esp + esi + 0x44]
mov esi, eax
or esi, 0xb7123009
mov ecx, eax
not ecx
or ecx, 0x48edcff6
and ecx, esi
not ecx
and eax, 0xc8edcff6
lea eax, [ecx + eax*2]
lea ecx, [eax + ebx]
not ebx
or eax, ebx
sub ebx, eax
lea eax, [ecx + ebx*2]
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x32
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x44], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xc
jb 0x40ff10
push edx
push 0
push 0
push 0
push dword [esp + 0x46c]
push edi
push dword [esp + 0x24]
call dword [esp + 0x20]
mov edx, eax
xor eax, eax
test edx, edx
setne al
jmp dword [eax*4 + 0x448ee8]
xor edi, edi
xor ebx, ebx
mov esi, dword [esp + 0x470]
jmp 0x410215
mov ebx, dword [esp + 0x468]
mov ecx, dword [esp + 0x460]
movzx eax, byte [0x44e1b8]
mov esi, dword [esp + 0x470]
jmp dword [eax*4 + 0x448ef0]
mov dword [esp + 0x14], 0x13851153
mov dword [esp + 0x18], 0x1f751d8b
mov dword [esp + 0x1c], 0x1b771971
mov dword [esp + 0x20], 0x726055e
mov dword [esp + 0x24], 0x3650167
mov dword [esp + 0x28], 0xf600d6f
mov dword [esp + 0x2c], 0xb9f096f
mov dword [esp + 0x30], 0x375135ab
mov dword [esp + 0x34], 0x33ab3152
mov dword [esp + 0x38], 0x3f7b3dac
mov word [esp + 0x3c], 0x3938
mov dword [esp + 0x3e], 0
mov byte [esp + 0x42], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x2e
ja 0x41006e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0xf5eaec04
xor eax, ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x44]
add al, 0xec
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x2f
jb 0x410040
movzx eax, word [esp + 0x14]
test ax, ax
je 0x410091
lea edi, [esp + 0x44]
lea ecx, [esp + 0x16]
mov word [edi], ax
add edi, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410080
mov word [edi], 0
movzx eax, word [0x44e1ba]
test ax, ax
je 0x4100c5
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi + ecx], ax
movzx eax, word [ecx + 0x44e1bc]
add ecx, 2
test ax, ax
jne 0x4100b0
add edi, ecx
mov word [edi], 0
lea eax, [esp + 0x44]
push 0x20000000
push 0xffffffffffffffff
push eax
push edx
mov edi, edx
call dword [0x44e094]
mov edx, edi
mov ecx, dword [esp + 0x460]
mov dword [esp + 4], edx
xor edi, edi
mov eax, ecx
neg eax
mov eax, 0
sbb eax, eax
push 0
push ebx
push ebx
push dword [esp + 0x470]
push eax
push ecx
push edx
call dword [0x44e098]
mov edx, dword [esp + 4]
xor ecx, ecx
test eax, eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x448ef8]
push 0
push edx
call dword [0x44e09c]
mov edx, dword [esp + 4]
xor ecx, ecx
test eax, eax
setne cl
xor edi, edi
xor ebx, ebx
jmp dword [ecx*4 + 0x448f00]
mov dword [esp + 0x44], 0
xor edi, edi
xor ebx, ebx
jmp 0x410183
mov dword [esp + 0x14], 0
mov ecx, eax
add ecx, edi
lea edx, [esp + 0x14]
push edx
push dword [esp + 0x48]
push ecx
push dword [esp + 0x10]
mov ebx, eax
call dword [0x44e0a4]
add edi, dword [esp + 0x14]
xor eax, eax
jmp dword [eax*4 + 0x448f28]
mov edx, dword [esp + 4]
lea eax, [esp + 0x44]
push eax
push edx
call dword [0x44e0a0]
test eax, eax
setne cl
mov eax, dword [esp + 0x44]
test eax, eax
setne dl
and dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x448f08]
mov ecx, eax
and ecx, edi
xor eax, edi
lea eax, [eax + ecx*2]
inc eax
push eax
push ebx
call fcn.0043f750
add esp, 8
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x448f10]
jmp dword [0x448f20]
mov eax, 1
jmp dword [eax*4 + 0x448f28]
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x448f30]
jmp dword [0x448f38]
mov byte [ebx + edi], 0
nop
nop
nop
nop
nop
nop
mov byte [ebx + edi], 0
jmp dword [0x448f44]
mov edx, dword [esp + 4]
push edx
call dword [0x44e0ac]
push dword [esp + 0xc]
call dword [0x44e0ac]
push dword [esp + 0x10]
call dword [0x44e0ac]
xor eax, eax
test ebp, ebp
setne al
jmp dword [eax*4 + 0x448f48]
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x448f60]
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x448f68]
push ebx
call fcn.0043c7f0
add esp, 4
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x448f68]
mov dword [esi], edi
mov eax, dword [case.0x40fd76.36]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
test ebx, ebx
setne al
add esp, 0x444
pop esi
pop edi
pop ebx
pop ebp
ret
std
inc eax
add byte [ebp + edi*8 - 0x1c3ffc0], ch
inc eax
add byte [esi + edi*8 + 0x40], cl
add byte [ebx - 0x64ffbf01], cl
inc dword [eax]
call 0xbe44cff5
inc dword [eax]
push cs
add al, byte [ecx]
and dword [ecx], eax
inc ecx
add byte [esi], cl
add al, byte [ecx]
inc eax
add dword [ecx], eax
loop 0x448f0b
inc ecx
add byte [ecx + 0x50004101], ch
add dword [ecx], eax
rol byte [ecx], 1
inc ecx
add al, dl
add dword [ecx], eax
rol byte [ecx], 1
inc ecx
add dh, dl
add dword [ecx], eax
rol byte [ecx], 1
inc ecx
add byte [edi + 1], bh
inc ecx
add dl, ah
add dword [ecx], eax
or al, byte [edx]
inc ecx
add al, dh
add dword [ecx], eax
add byte [edx], al
inc ecx
add dh, dh
add dword [ecx], eax
add byte [edx], al
inc ecx
add byte [edx], cl
add al, byte [ecx]
aaa
add al, byte [ecx]
invalid