Function at 0x411d30
Capabilities:
Encode data using xor
Move file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x448
mov eax, dword [0x45e490]
xor eax, esp
mov dword [esp + 0x444], eax
mov eax, dword [esp + 0x454]
mov edx, dword [esp + 0x458]
push ebx
mov ebx, dword [esp + 0x454]
push ebp
push esi
push edi
mov edi, dword [esp + 0x45c]
xor esi, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x46c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x34], 1
mov dword [esp + 0x48], 1
mov dword [esp + 0x2c], 0
mov dword [0x469f10], 0
mov dword [esp + 0x18], 0
test ebx, ebx
je 0x411f18
mov ecx, dword [ebx + 0x74]
mov dword [esp + 0x10], ecx
test cl, cl
jns 0x411df7
test byte [edi + 0xc4], 2
je 0x411df7
movzx edx, word [edi + 8]
xor ecx, ecx
mov eax, dword [edi]
test edx, edx
jle 0x411def
add eax, 0xc
mov edi, edi
test byte [eax], 1
jne 0x411def
inc ecx
add eax, 0x88
cmp ecx, edx
jl 0x411de0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 0x10]
test dword [eax + 0x74], 0x40000
je 0x411e13
test byte [edi + 0xc4], 2
jne 0x411e13
mov ecx, 1
jmp 0x411e16
and ecx, 1
push ecx
push edx
push edi
mov dword [esp + 0x1c], ecx
call fcn.00411a30
mov ebp, eax
add esp, 0xc
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x20], ebp
test dword [eax + 0x74], 0x800
je 0x411f2a
cmp dword [esp + 0x30], esi
je 0x411ee5
mov eax, ebp
shl eax, 4
push eax
call fcn.0040db80
add esp, 4
xor edx, edx
mov esi, eax
test ebp, ebp
jle 0x411e94
mov edi, dword [esp + 0x14]
lea ecx, [esi + 4]
mov eax, dword [edi + edx*4]
lea ecx, [ecx + 0x10]
add eax, 0x68
mov dword [ecx - 0xc], 0
mov dword [ecx - 0x14], eax
mov eax, dword [edi + edx*4]
mov eax, dword [eax + 4]
mov dword [ecx - 0x10], eax
mov eax, dword [edi + edx*4]
inc edx
movzx eax, word [eax + 0x82]
mov dword [ecx - 8], eax
cmp edx, ebp
jl 0x411e62
mov edi, dword [esp + 0x1c]
push esi
push ebp
push 1
push 0x180
push dword [esp + 0x34]
call fcn.00418210
mov esi, eax
add esp, 0x14
xor ecx, ecx
or dword [esi + 0x10c], 0x20
test ebp, ebp
jle 0x411ed6
mov ebx, dword [esp + 0x14]
xor edx, edx
mov edi, edi
mov eax, dword [esi]
add eax, edx
add edx, 0x88
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, ebp
jl 0x411ec0
mov ebx, dword [esp + 0x38]
movzx eax, word [esi + 8]
mov ecx, dword [esp + 0x14]
mov dword [ecx + eax*4], 0
mov eax, 8
sub eax, dword [esp + 0x14]
mov dword [esp + 0x50], eax
test ebx, ebx
je 0x411f8e
mov ecx, dword [ebx + 0x10]
test dword [ecx + 0x74], 0x800
je 0x411f90
mov edi, 1
mov dword [esp + 0x18], edi
jmp 0x411feb
mov dword [esp + 0x10], esi
xor ebp, ebp
mov edi, edi
inc ebp
cmp dword [edx + ebp*4], esi
jne 0x411f20
mov dword [esp + 0x20], ebp
cmp dword [0x46df20], esi
jne 0x411e3b
mov eax, dword [0x45d86c]
mov ecx, 0x100000
cmp eax, 0x80000
cmovl eax, ecx
mov dword [0x46df74], eax
add eax, 0xfffffffc
push eax
call fcn.0040db80
mov edx, eax
add esp, 4
mov dword [0x46df20], edx
test edx, edx
jne 0x411e3b
mov dword [0x469f10], 0x15
xor eax, eax
mov ecx, dword [esp + 0x454]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420704
add esp, 0x448
ret
xor ecx, ecx
push dword [esp + 0x10]
mov edx, dword [0x46df20]
lea eax, [esp + 0x4c]
push eax
mov eax, dword [0x46df74]
add eax, 0xfffffff8
add eax, edx
push eax
push edx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x2c]
push eax
xor eax, eax
cmp dword [esp + 0x48], eax
push ecx
cmovne eax, esi
push eax
push edi
call fcn.004125e0
mov ecx, dword [esp + 0x4c]
add esp, 0x24
mov dword [esp + 0x4c], eax
test ecx, ecx
je 0x411fe7
dec ecx
lea ecx, [eax + ecx*4]
push ecx
push eax
push dword [esp + 0x1c]
call fcn.00418e70
add esp, 0xc
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x34], 0
je 0x4121eb
xor eax, eax
mov dword [esp + 0x34], eax
test esi, esi
jne 0x412184
test ebx, ebx
je 0x412013
cmp dword [esp + 0x10], eax
jne 0x412013
lea ecx, [eax + 1]
jmp 0x412015
xor ecx, ecx
test ebx, ebx
je 0x412037
test dword [ebx + 0x74], 0x100
jne 0x412033
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x74]
test eax, 0x800
jne 0x412033
test al, 0x20
je 0x412037
xor eax, eax
jmp 0x412039
mov eax, edi
mov edi, dword [esp + 0x1c]
push ecx
push edi
push eax
push 0x180
push dword [esp + 0x34]
call fcn.00410aa0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x411f73
mov eax, dword [edi]
xor ebp, ebp
mov edx, dword [esi]
xor ecx, ecx
cmp bp, word [edi + 8]
mov ebp, dword [esp + 0x20]
jae 0x4120a3
mov ebp, dword [esp + 0x1c]
lea edi, [eax + 0x7e]
add edx, 0x7e
jmp 0x412080
mov ax, word [edi]
lea edx, [edx + 0x88]
mov word [edx - 0x88], ax
lea edi, [edi + 0x88]
movzx eax, word [ebp + 8]
inc ecx
cmp ecx, eax
jl 0x412080
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
lea eax, [eax + ebp*4]
add eax, dword [esp + 0x50]
push eax
call fcn.0040db80
add esp, 4
mov edi, eax
mov dword [esp + 0x44], edi
test ebp, ebp
jle 0x41212c
mov eax, dword [esp + 0x14]
mov ebx, edi
sub eax, edi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], eax
mov edi, eax
mov eax, dword [edi + ebx]
add eax, 0x68
push eax
push esi
call fcn.004108e0
mov dword [ebx], eax
lea ebx, [ebx + 4]
mov ecx, dword [edi + ebx - 4]
add esp, 8
mov ecx, dword [ecx + 0x80]
xor ecx, dword [eax + 0x80]
and ecx, 4
xor dword [eax + 0x80], ecx
mov eax, dword [edi + ebx - 4]
mov ecx, dword [ebx - 4]
mov eax, dword [eax + 0x80]
xor eax, dword [ecx + 0x80]
and eax, 8
xor dword [ecx + 0x80], eax
dec ebp
jne 0x4120d3
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
mov dword [eax + ebp*4], 0
test ebx, ebx
je 0x412166
cmp dword [esp + 0x10], 0
jne 0x412166
push str.__u__
push esi
call fcn.004108e0
mov dword [edi + ebp*4], eax
add esp, 8
or dword [eax + 0x80], 8
inc ebp
mov dword [esp + 0x20], ebp
mov dword [edi + ebp*4], 0
push edi
push ebp
push 0
push esi
push esi
call fcn.00415900
push edi
call fcn.0040dc10
mov edi, dword [esp + 0x30]
add esp, 0x18
test edi, edi
jne 0x4121e4
jmp 0x4121d9
test edi, edi
jne 0x4121e4
test byte [esi + 0xc4], 2
je 0x4121d9
push dword [esp + 0x24]
lea eax, [esp + 0x58]
push 0x43d908
push eax
call fcn.004250a1
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x34]
call fcn.00425836
push esi
push edi
push 0x180
push dword [esp + 0x44]
call fcn.00410d80
mov esi, eax
lea eax, [esp + 0x78]
push eax
call fcn.0043afa4
add esp, 0x28
test esi, esi
je 0x411f73
push 1
push esi
call fcn.004176c0
add esp, 8
or dword [esi + 0x10c], 0x20
cmp dword [esp + 0x28], 0
ja 0x412202
test ebx, ebx
je 0x412266
mov eax, dword [ebx + 0x10]
test dword [eax + 0x74], 0x800
je 0x412266
test ebx, ebx
je 0x412219
mov eax, dword [ebx + 0x10]
test dword [eax + 0x74], 0x800
je 0x41221b
mov edx, 1
jmp 0x41221d
xor eax, eax
xor edx, edx
test ebx, ebx
je 0x41222f
cmp dword [esp + 0x10], 0
jne 0x41222f
mov ecx, 1
jmp 0x412231
xor ecx, ecx
push eax
mov eax, dword [esp + 0x2c]
push edx
push ecx
push dword [esp + 0x28]
mov ecx, dword [esp + 0x5c]
push dword [esp + 0x20]
lea eax, [ecx + eax*4]
push eax
push ecx
push esi
call fcn.004122c0
add esp, 0x20
test eax, eax
js 0x411f73
mov ecx, dword [esp + 0x2c]
add ecx, eax
mov dword [esp + 0x2c], ecx
jmp 0x41226a
mov ecx, dword [esp + 0x2c]
test edi, edi
jne 0x412277
mov edi, dword [esp + 0x1c]
jmp 0x411ef2
test ebx, ebx
je 0x4122ac
cmp dword [esp + 0x10], 0
jne 0x4122ac
mov eax, 0xffff
add word [esi + 8], ax
add word [esi + 0x2c], ax
test ecx, ecx
je 0x4122ac
push 0
push 0
push 1
push esi
call fcn.004189d0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411f73
push 0
push esi
call fcn.0040eae0
add esp, 8
mov eax, esi
jmp 0x411f75