Function at 0x4d93f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x5ff004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, edx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x70], edi
test edi, edi
je 0x4d9de5
test eax, eax
je 0x4d9de5
mov ebx, dword [ebp + 8]
mov dword [edi], 0
cmp ebx, 8
jb 0x4d9de5
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x58]
lea eax, [ebx*8]
mov dword [ebp - 0x50], 0
mov edx, 0x20
mov dword [ebp - 0x54], eax
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x48434100
jne 0x4d9b39
mov edx, 0x10
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
mov esi, eax
mov dword [ebp - 0x50], 0x30
mov edx, 0x10
mov dword [ebp - 0x60], esi
lea ecx, [ebp - 0x58]
mov dword [edi + 4], esi
call fcn.004d9030
mov dword [ebp - 0x50], 0x40
mov dword [edi + 8], eax
cmp esi, 0x101
je 0x4d94c6
cmp esi, 0x102
je 0x4d94c6
cmp esi, 0x103
je 0x4d94c6
cmp esi, 0x200
je 0x4d94c6
cmp esi, 0x300
jne 0x4d9b39
cmp ebx, eax
jb 0x4d9de5
xor edx, edx
xor esi, esi
test eax, eax
je 0x4d9520
mov edi, dword [ebp - 0x68]
mov ebx, eax
jmp 0x4d94e0
movzx ecx, byte [esi + edi]
inc esi
movzx eax, dx
shr eax, 8
xor ecx, eax
shl edx, 8
xor dx, word [ecx*2 + 0x52e6f0]
movzx edx, dx
cmp esi, ebx
jb 0x4d94e0
mov edi, dword [ebp - 0x70]
mov ebx, dword [ebp + 8]
test dx, dx
je 0x4d9520
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
sub ebx, 8
cmp ebx, 0x10
jb 0x4d9b39
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x666d7400
jne 0x4d9b39
mov edx, 8
mov dword [ebp - 0x50], 0x60
lea ecx, [ebp - 0x58]
call fcn.004d9030
mov esi, eax
mov dword [ebp - 0x50], 0x68
mov edx, 0x18
mov dword [edi + 0xc], esi
lea ecx, [ebp - 0x58]
call fcn.004d9030
mov edx, 0x20
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], 0x80
mov dword [edi + 0x10], eax
call fcn.004d9030
mov edx, 0x10
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], 0xa0
mov dword [edi + 0x14], eax
call fcn.004d9030
mov edx, 0x10
mov dword [ebp - 0x50], 0xb0
lea ecx, [ebp - 0x58]
mov dword [edi + 0x18], eax
call fcn.004d9030
mov dword [edi + 0x1c], eax
lea eax, [esi - 1]
mov dword [ebp - 0x50], 0xc0
cmp eax, 0xf
ja 0x4d9b39
cmp dword [ebp - 0x64], 0
je 0x4d9b39
mov eax, dword [ebp - 0x68]
dec eax
cmp eax, 0x7ffffe
ja 0x4d9b39
sub ebx, 0x10
cmp ebx, 0x10
jb 0x4d972c
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x636f6d70
jne 0x4d9735
mov edx, 0x10
mov dword [ebp - 0x50], 0xe0
lea ecx, [ebp - 0x58]
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], 0xf0
mov dword [edi + 0x20], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0xf8
lea ecx, [ebp - 0x58]
mov dword [edi + 0x24], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0x100
lea ecx, [ebp - 0x58]
mov dword [edi + 0x28], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0x108
lea ecx, [ebp - 0x58]
mov dword [edi + 0x2c], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0x110
lea ecx, [ebp - 0x58]
mov dword [edi + 0x30], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], pe_nt_image_headers32
lea ecx, [ebp - 0x58]
mov dword [edi + 0x38], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0x120
lea ecx, [ebp - 0x58]
mov dword [edi + 0x3c], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0x128
lea ecx, [ebp - 0x58]
mov dword [edi + 0x40], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0x130
lea ecx, [ebp - 0x58]
mov dword [edi + 0x44], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0x138
lea ecx, [ebp - 0x58]
mov dword [edi + 0x48], eax
call fcn.004d9030
mov esi, 0x140
mov dword [edi + 0x4c], eax
mov dword [ebp - 0x5c], esi
sub ebx, 0x10
mov dword [ebp - 0x50], esi
jmp 0x4d9840
cmp ebx, 0xc
jb 0x4d9b39
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x64656300
jne 0x4d9b39
mov edx, 0x10
mov dword [ebp - 0x50], 0xe0
lea ecx, [ebp - 0x58]
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], 0xf0
mov dword [edi + 0x20], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0xf8
lea ecx, [ebp - 0x58]
mov dword [edi + 0x24], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], 0x100
lea ecx, [ebp - 0x58]
mov dword [edi + 0x28], eax
call fcn.004d9030
inc eax
mov dword [ebp - 0x50], 0x108
mov edx, 8
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x58]
mov dword [edi + 0x38], eax
call fcn.004d9030
inc eax
mov dword [ebp - 0x50], 0x110
mov edx, 4
mov dword [ebp - 0x6c], eax
lea ecx, [ebp - 0x58]
mov dword [edi + 0x3c], eax
call fcn.004d9030
mov edx, 4
mov dword [ebp - 0x50], 0x114
lea ecx, [ebp - 0x58]
mov dword [edi + 0x2c], eax
call fcn.004d9030
mov edx, 8
mov dword [ebp - 0x50], pe_nt_image_headers32
lea ecx, [ebp - 0x58]
mov dword [edi + 0x30], eax
call fcn.004d9030
mov esi, 0x120
mov dword [edi + 0x34], eax
test eax, eax
mov dword [ebp - 0x5c], esi
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x50], esi
jne 0x4d982e
mov dword [edi + 0x3c], eax
mov ecx, eax
jmp 0x4d9831
mov ecx, dword [ebp - 0x6c]
sub eax, ecx
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], eax
sub ebx, 0xc
cmp ebx, 8
jb 0x4d98b6
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x76627200
jne 0x4d98b6
lea eax, [esi + 0x20]
mov edx, 0x10
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], eax
call fcn.004d9030
lea ecx, [esi + 0x30]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x50], ecx
mov edx, 0x10
lea ecx, [ebp - 0x58]
mov dword [edi + 0x50], eax
call fcn.004d9030
add esi, 0x40
mov dword [edi + 0x54], eax
cmp dword [ebp - 0x68], 0
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x50], esi
jne 0x4d9b39
mov eax, dword [ebp - 0x6c]
add eax, 0xfffffff7
cmp eax, 0x1f6
ja 0x4d9b39
sub ebx, 8
jmp 0x4d98c4
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
cmp ebx, 6
jb 0x4d9900
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x61746800
jne 0x4d9900
lea eax, [esi + 0x20]
mov edx, 0x10
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], eax
call fcn.004d9030
add esi, 0x30
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x50], esi
jmp 0x4d990b
cmp dword [ebp - 0x60], 0x200
sbb eax, eax
neg eax
mov dword [edi + 0x58], eax
cmp ebx, 0x10
jb 0x4d99c8
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x6c6f6f70
jne 0x4d99c8
lea eax, [esi + 0x20]
mov edx, 0x20
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], eax
call fcn.004d9030
mov ecx, dword [ebp - 0x5c]
mov esi, eax
add ecx, 0x40
mov dword [edi + 0x5c], esi
mov dword [ebp - 0x50], ecx
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
mov ecx, dword [ebp - 0x5c]
mov edx, eax
add ecx, 0x60
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x58]
mov dword [edi + 0x60], edx
mov edx, 0x10
call fcn.004d9030
mov ecx, dword [ebp - 0x5c]
mov edx, 0x10
add ecx, 0x70
mov dword [edi + 0x64], eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x58]
call fcn.004d9030
mov ecx, dword [ebp - 0x5c]
sub ecx, 0xffffff80
mov dword [edi + 0x68], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x50], ecx
mov dword [edi + 0x6c], 1
cmp esi, eax
ja 0x4d9b39
cmp eax, dword [ebp - 0x64]
jae 0x4d9b39
sub ebx, 0x10
jmp 0x4d99eb
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
cmp ebx, 6
jb 0x4d9a3f
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x63697068
jne 0x4d9a3f
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
mov edx, 0x10
lea eax, [esi + 0x20]
mov dword [ebp - 0x50], eax
call fcn.004d9030
add esi, 0x30
mov dword [edi + 0x70], eax
mov dword [ebp - 0x50], esi
test eax, eax
je 0x4d9a3a
cmp eax, 1
je 0x4d9a3a
cmp eax, 0x38
jne 0x4d9b39
sub ebx, 6
jmp 0x4d9a49
mov esi, dword [ebp - 0x5c]
mov dword [edi + 0x70], 0
cmp ebx, 8
jb 0x4d9a8b
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x72766100
jne 0x4d9a8b
lea eax, [esi + 0x20]
mov edx, 0x20
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], eax
call fcn.004d9030
add esi, 0x40
mov dword [ebp - 0x60], eax
fld dword [ebp - 0x60]
sub ebx, 8
mov dword [ebp - 0x50], esi
jmp 0x4d9a8d
fld1
fstp dword [edi + 0x80]
cmp ebx, 5
jb 0x4d9b0b
mov edx, 0x20
lea ecx, [ebp - 0x58]
call fcn.004d9030
and eax, 0x7f7f7f7f
cmp eax, 0x636f6d6d
jne 0x4d9b0b
lea eax, [esi + 0x20]
mov edx, 8
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x50], eax
call fcn.004d9030
add esi, 0x28
mov dword [edi + 0x84], eax
mov dword [ebp - 0x50], esi
cmp eax, ebx
ja 0x4d9b39
xor esi, esi
test eax, eax
je 0x4d9b01
lea ebx, [ebx]
mov edx, 8
lea ecx, [ebp - 0x58]
call fcn.004d9030
add dword [ebp - 0x50], 8
mov byte [edi + esi + 0x88], al
inc esi
cmp esi, dword [edi + 0x84]
jb 0x4d9ae0
mov byte [edi + esi + 0x88], 0
jmp 0x4d9b15
mov dword [edi + 0x84], 0
mov eax, dword [edi + 0x20]
sub eax, 8
cmp eax, 0xfff7
ja 0x4d9b39
cmp dword [edi + 4], 0x200
mov ecx, dword [edi + 0x24]
ja 0x4d9b4f
cmp ecx, 1
jne 0x4d9b39
cmp dword [edi + 0x28], 0xf
je 0x4d9b5b
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x28]
cmp ecx, eax
ja 0x4d9b39
cmp eax, 0xf
ja 0x4d9b39
mov eax, dword [edi + 0x2c]
test eax, eax
jne 0x4d9b6e
mov dword [edi + 0x2c], 1
mov eax, 1
cmp eax, dword [edi + 0xc]
ja 0x4d9b39
mov ecx, dword [edi + 0x38]
cmp ecx, 0x80
ja 0x4d9b39
mov edx, dword [edi + 0x3c]
cmp edx, 0x80
ja 0x4d9b39
mov esi, dword [edi + 0x40]
cmp esi, 0x80
ja 0x4d9b39
lea eax, [esi + edx]
cmp eax, 0x80
ja 0x4d9b39
mov ebx, dword [edi + 0x44]
cmp ebx, 0x80
ja 0x4d9b39
sub ecx, esi
sub ecx, edx
cmp ebx, 1
jae 0x4d9bb6
xor ecx, ecx
jmp 0x4d9bc5
mov eax, ecx
xor edx, edx
div ebx
xor ecx, ecx
test edx, edx
setne cl
add ecx, eax
mov eax, dword [edi + 0x58]
lea ebx, [edi + 0x18c]
mov esi, dword [edi + 0x10]
mov dword [edi + 0x188], ecx
mov dword [ebp - 0x60], esi
sub eax, 0
je 0x4d9c27
sub eax, 1
jne 0x4d9b39
xor edx, edx
xor ecx, ecx
lea esp, [esp]
add edx, esi
lea esi, [ecx + ebx]
mov eax, edx
shr eax, 0xd
cmp eax, 0x28e
jae 0x4d9c17
mov al, byte [eax + 0x52e438]
inc ecx
mov byte [esi], al
mov esi, dword [ebp - 0x60]
cmp ecx, 0x80
jb 0x4d9bf0
jmp 0x4d9c37
mov eax, 0x80
sub eax, ecx
push eax
push 0xff
push esi
jmp 0x4d9c2f
push 0x80
push 0
push ebx
call fcn.00504370
add esp, 0xc
push dword [edi + 0x7c]
mov edx, dword [edi + 0x70]
lea ecx, [edi + 0x20c]
push dword [edi + 0x78]
call fcn.004d9360
add esp, 8
test eax, eax
js 0x4d9de8
push 0x40
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.00504370
mov ecx, dword [edi + 0x2c]
add esp, 0xc
cmp dword [edi + 0x40], 0
jbe 0x4d9d6f
mov eax, dword [edi + 0xc]
xor edx, edx
div ecx
mov edx, eax
cmp edx, 1
jbe 0x4d9d6f
xor ebx, ebx
lea esi, [ebp - 0x4c]
test ecx, ecx
je 0x4d9d6f
lea eax, [edx - 2]
mov ecx, 2
shl edx, 2
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x6c], ecx
cmp eax, 6
ja case.default.0x4d9caf
jmp dword [eax*4 + 0x4d9dfc]
mov dword [esi], 1
mov dword [esi + 4], 2
mov ecx, dword [edi + 0x30]
mov edx, ecx
neg edx
sbb edx, edx
xor eax, eax
and edx, 0xfffffffe
add edx, 2
test ecx, ecx
mov ecx, 2
sete al
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x64]
mov dword [esi + 0xc], edx
mov edx, dword [ebp - 0x60]
jmp case.default.0x4d9caf
mov dword [esi], 1
mov dword [esi + 4], 2
mov dword [esi + 8], 0
mov eax, dword [edi + 0x30]
cmp ecx, eax
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 2
cmp dword [ebp - 0x6c], eax
sbb eax, eax
inc eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x64]
mov dword [esi + 0x10], ecx
mov ecx, 2
jmp case.default.0x4d9caf
mov dword [esi + 0x18], 0
jmp case.0x4d9caf.4
mov dword [esi + 0x18], 1
mov dword [esi + 0x1c], 2
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], 2
mov dword [esi + 8], 0
mov dword [esi], 1
mov dword [esi + 4], 2
inc ebx
add esi, edx
cmp ebx, dword [edi + 0x2c]
jb 0x4d9ca6
push 0x29980
lea eax, [edi + 0x310]
push 0
push eax
call fcn.00504370
xor ecx, ecx
add esp, 0xc
cmp dword [edi + 0xc], ecx
jbe 0x4d9db8
lea edx, [edi + 0x314]
mov eax, dword [ebp + ecx*4 - 0x4c]
mov dword [edx - 4], eax
mov esi, dword [edi + 0x3c]
cmp eax, 2
je 0x4d9da8
mov eax, dword [edi + 0x40]
add eax, esi
jmp 0x4d9daa
mov eax, esi
mov dword [edx], eax
inc ecx
add edx, 0x2998
cmp ecx, dword [edi + 0xc]
jb 0x4d9d92
cmp dword [edi + 0x48], 0
mov dword [edi + 0x30c], 1
jne 0x4d9b39
mov dword [edi], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00502eb4
mov esp, ebp
pop ebp
ret