Function at 0x417f10
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
mov edi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x417f30
mov esi, dword [ecx + 4]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
cmp word [esi + edx + 2], 0
lea edx, [edx + 2]
jne 0x417f50
mov ecx, eax
sar ecx, 1
sar edx, 1
and eax, 0x36
mov dword [esp + 0x44], ecx
xor ecx, 0x1b
add ecx, eax
add ecx, edx
mov dword [esp + 0x48], edx
jns 0x417f7e
mov ecx, 0xffffffff
jmp 0x417f80
add ecx, ecx
push ecx
call fcn.00408350
add esp, 4
mov dword [esp + 8], 0x21722780
mov dword [esp + 0xc], 0x3d9f2391
mov dword [esp + 0x10], 0x398a3f9f
mov dword [esp + 0x14], 0x35653b58
mov dword [esp + 0x18], 0x31ba37bc
mov dword [esp + 0x1c], 0xd84338f
mov dword [esp + 0x20], 0x9b50f81
mov dword [esp + 0x24], 0x5bc0bb9
mov dword [esp + 0x28], 0x1ab0764
mov dword [esp + 0x2c], 0x1d8e03bf
mov dword [esp + 0x30], 0x19a51f90
mov dword [esp + 0x34], 0x15a31bae
mov dword [esp + 0x38], 0x11b21799
mov dword [esp + 0x3c], 0x1310
mov ebp, 9
mov ecx, 0x76
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
and ebx, 0x44
mov edx, ebp
and edx, 0x3b
or edx, ebx
xor dl, byte [esp + ebp - 1]
xor dl, 0xc4
add dl, 0x53
mov byte [esp + ebp - 1], dl
inc ebp
dec ecx
cmp ebp, 0x41
jne 0x418010
movzx ecx, word [edi]
mov ebx, eax
test cx, cx
je 0x418051
add edi, 2
mov ebx, eax
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x418040
mov word [ebx], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x418081
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418070
mov word [ebx], 0
movzx ecx, word [esi]
test cx, cx
mov dword [esp], eax
je 0x4180b1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4180a0
mov word [ebx], 0
mov eax, dword [esp + 0x64]
mov ebp, dword [eax]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x4180d0
mov ecx, dword [esp + 0x64]
mov esi, dword [ecx + 8]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x4180f0
mov edx, dword [esp + 0x68]
mov edi, dword [edx]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + edx + 2], 0
lea edx, [edx + 2]
jne 0x418110
sar eax, 1
sar ecx, 1
sar edx, 1
add ecx, eax
lea eax, [edx + ecx]
add eax, 0x13
test eax, eax
jns 0x418134
mov eax, 0xffffffff
jmp 0x41813d
add ecx, edx
lea eax, [ecx*2 + 0x26]
mov dword [esp + 4], edi
push eax
call fcn.00408350
add esp, 4
movzx ecx, word [ebp]
mov ebx, eax
test cx, cx
je 0x418172
add ebp, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [ebp]
add ebp, 2
test cx, cx
jne 0x418160
mov dword [esp + 0x40], eax
mov word [ebx], 0x2f
mov dword [esp + 8], 0xe327e1df
mov dword [esp + 0xc], 0xe712e56c
mov dword [esp + 0x10], 0xfb04f91d
mov dword [esp + 0x14], 0xff07fd0f
mov dword [esp + 0x18], 0xf30cf10f
mov dword [esp + 0x1c], 0xf7c9f507
mov dword [esp + 0x20], 0x8988
xor eax, eax
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edi + 8]
mov edx, eax
and edx, 0x10
mov ecx, edi
xor ecx, 0x6cf53ea8
add ecx, edx
mov edx, ecx
and edx, ebp
add edx, edx
sub edx, ecx
mov ecx, edx
xor ecx, ebp
not edx
and edx, ebp
add edx, edx
sub edx, ecx
add edx, 0xe09e070d
mov ecx, edx
xor ecx, 0x1684056
and edx, 0xfe97bfa9
add edx, edx
sub edx, ecx
lea ecx, [edx + edx]
and ecx, 2
mov ebp, ecx
and ebp, edx
xor ecx, edx
xor ecx, 1
lea ecx, [ecx + ebp*2]
mov byte [esp + edi + 8], cl
inc edi
add eax, 2
cmp edi, 0x1c
jne 0x4181c0
add ebx, 2
movzx eax, word [esi]
test ax, ax
je 0x418253
add esi, 2
mov edi, dword [esp + 0x40]
mov ebp, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x418240
jmp 0x41825a
mov edi, dword [esp + 0x40]
mov ebp, dword [esp]
mov word [ebx], 0
movzx eax, word [esp + 8]
test ax, ax
je 0x418293
lea ecx, [esp + 0xa]
mov esi, dword [esp + 0x68]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418280
jmp 0x418297
mov esi, dword [esp + 0x68]
mov word [ebx], 0
mov ecx, dword [esp + 4]
movzx eax, word [ecx]
test ax, ax
je 0x4182c1
add ecx, 2
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4182b0
mov word [ebx], 0
mov dword [esp + 8], 0x797a7b2a
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov eax, 0x6b
nop
movzx ecx, byte [esp + eax - 0x63]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xe9
mov byte [esp + eax - 0x63], cl
inc eax
cmp eax, 0x72
jne 0x4182e0
lea eax, [esp + 8]
push 0
push 0
push 0xc00000
push eax
push ebp
push edi
push dword [esp + 0x78]
call fcn.0041c310
add esp, 0x1c
mov byte [esp + 4], al
jmp dword [0x443df0]