Function at 0x4b0df0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x7a0
mov esi, edx
mov edx, dword [ebp + 8]
mov ebx, ecx
test edx, edx
je 0x4b0e30
mov eax, edx
mov ecx, esi
shl eax, 4
lea edi, [esi + eax]
nop word cs:[eax + eax]
nop
test eax, eax
je 0x4b0e3e
add eax, 0xfffffff0
cmp dword [ecx + 8], 0
lea ecx, [ecx + 0x10]
jne 0x4b0e20
mov dword [ebx], 0x80000007
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp edx, 1
jne 0x4b0e5c
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
cmp eax, 1
jne 0x4b0e9a
movzx eax, byte [edx]
mov dword [ebx], 0x80000000
mov byte [ebx + 4], al
jmp 0x4b0e36
xor eax, eax
cmp edx, 2
jne 0x4b0efe
cmp dword [esi + 8], 1
jne 0x4b0f40
cmp dword [esi + 0x18], 1
mov ecx, 0
jne 0x4b0f42
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x14]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
mov dword [ebx], 0x80000001
mov byte [ebx + 4], al
mov byte [ebx + 5], cl
jmp 0x4b0e36
lea ecx, [esp + 0x50]
push eax
call fcn.004b61d0
add esp, 4
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0x90]
cmp dword [esp + 0x88], 0
jne 0x4b166a
test edi, edi
mov dword [esp + 8], ebx
je 0x4b1654
js 0x4b17d0
movzx eax, byte [0x5a11e8]
mov ecx, edi
mov edx, 1
call fcn.004329c0
mov ebx, eax
test eax, eax
jne 0x4b1659
mov ecx, 1
mov edx, edi
call fcn.00531970
cmp edx, 3
jne 0x4b0f40
cmp dword [esi + 8], 1
jne 0x4b0f40
cmp dword [esi + 0x18], 1
jne 0x4b0f40
cmp dword [esi + 0x28], 1
mov ecx, 0
jne 0x4b0f42
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x24]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
movzx edx, byte [edx]
shl ecx, 0x10
shl eax, 8
shl edx, 0x18
or eax, ecx
mov ecx, 1
or eax, edx
jmp 0x4b0f42
xor ecx, ecx
mov edx, eax
and edx, 1
or edx, ecx
je 0x4b0f65
mov ecx, eax
shr eax, 0x18
mov dword [ebx], 0x80000002
shr ecx, 8
mov byte [ebx + 6], al
mov word [ebx + 4], cx
jmp 0x4b0e36
mov eax, dword [ebp + 8]
mov edx, dword [esi + 8]
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
lea ecx, [eax + 0xfffffff]
mov eax, ecx
and eax, 0xfffffff
cmp eax, 8
jae 0x4b0f92
mov ebx, edx
xor ecx, ecx
jmp 0x4b10cc
movd xmm0, edx
and ecx, 7
mov edi, eax
add esi, 0x88
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x539440]
sub edi, ecx
mov dword [esp + 0x10], ecx
mov ecx, edi
movdqa xmm2, xmm1
nop word [eax + eax]
movd xmm3, dword [esi - 0x40]
movd xmm5, dword [esi - 0x50]
movd xmm4, dword [esi - 0x70]
movd xmm6, dword [esi - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [esi - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [esi]
punpcklqdq xmm4, xmm5
movd xmm5, dword [esi - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [esi - 0x30]
sub esi, 0xffffff80
add edi, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x4b0fc0
movdqa xmm4, xmm1
movdqa xmm3, xmm2
cmp dword [esp + 0x10], 0
mov esi, dword [esp + 4]
mov edi, dword [esp + 0xc]
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ebx, xmm0
je 0x4b10ed
sub eax, ecx
shl ecx, 4
lea ecx, [ecx + esi + 0x18]
nop word cs:[eax + eax]
nop
mov edx, dword [ecx]
cmp ebx, edx
cmovae ebx, edx
add ecx, 0x10
dec eax
jne 0x4b10e0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x238], 0x2020100
mov word [esp + 0x23c], 2
mov dword [esp + 0x214], 0
mov dword [esp + 0x218], 4
mov dword [esp + 0x21c], 0
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 4
mov dword [esp + 0x228], 0
mov dword [esp + 0x22c], 0xffffffff
mov dword [esp + 0x230], 0
mov byte [esp + 0x234], 0
xor eax, eax
mov ebx, esi
test al, al
jne 0x4b128a
jmp 0x4b1190
movzx eax, byte [esp + 0x23d]
test al, al
jne 0x4b128a
mov edi, dword [esp + 0x21c]
cmp edi, 0x80
jb 0x4b1200
mov byte [esp + 0x23d], 1
mov byte [esp + 0x234], 0
mov esi, dword [esp + 0x218]
mov dword [esp + 0x21c], 0
add esi, 4
jmp 0x4b11da
add esi, 0xc
dec edi
je 0x4b1270
cmp dword [esi - 4], 0
je 0x4b11d0
push dword [esi]
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4b11d0
mov eax, dword [ebx + 8]
test eax, eax
je 0x4b121c
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x214]
push eax
call fcn.00443920
add esp, 4
jmp 0x4b1286
mov byte [esp + 0x23d], 1
mov byte [esp + 0x234], 0
test edi, edi
mov esi, dword [esp + 0x218]
mov dword [esp + 0x21c], 0
je 0x4b1270
add esi, 4
jmp 0x4b1256
add esi, 0xc
dec edi
je 0x4b1270
cmp dword [esi - 4], 0
je 0x4b1250
push dword [esi]
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4b1250
mov dword [esp + 0x228], 0
mov dword [esp + 0x22c], 0xffffffff
mov edi, dword [esp + 0xc]
add ebx, 0x10
cmp ebx, edi
jne 0x4b1180
lea ecx, [esp + 0x378]
lea edx, [esp + 0x214]
call fcn.00441aa0
mov eax, dword [esp + 0x378]
cmp eax, 0x80000000
jne 0x4b1305
mov edi, dword [esp + 0x21c]
mov esi, dword [esp + 0x218]
mov eax, dword [ebp + 8]
mov dword [esp + 0x50], 0x80000000
test edi, edi
je 0x4b13a2
lea ebx, [esi + 4]
jmp 0x4b12ea
add ebx, 0xc
dec edi
je 0x4b13a2
cmp dword [ebx - 4], 0
je 0x4b12e0
push dword [ebx]
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x4b12e0
movsd xmm2, qword [esp + 0x394]
movsd xmm1, qword [esp + 0x38c]
mov esi, dword [esp + 0x21c]
mov ecx, dword [esp + 0x3a4]
movq xmm0, qword [esp + 0x39c]
mov edi, dword [esp + 0x218]
movsd qword [esp + 0x3c], xmm2
movsd qword [esp + 0x34], xmm1
movq xmm2, qword [esp + 0x37c]
movq xmm1, qword [esp + 0x384]
test esi, esi
mov dword [esp + 0x4c], ecx
movq qword [esp + 0x44], xmm0
movq qword [esp + 0x2c], xmm1
movq qword [esp + 0x24], xmm2
mov dword [esp + 0x20], eax
je 0x4b1415
lea ebx, [edi + 4]
jmp 0x4b138a
add ebx, 0xc
dec esi
je 0x4b1415
cmp dword [ebx - 4], 0
je 0x4b1380
push dword [ebx]
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4b1380
cmp dword [esp + 0x214], 0
je 0x4b13be
push esi
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
cmp dword [esp + 0x220], 0
mov ebx, dword [esp + 8]
lea edi, [esp + 0x378]
je 0x4b13eb
push dword [esp + 0x224]
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov esi, dword [esp + 4]
cmp dword [esp + 0x50], 0x80000000
je 0x4b153c
lea eax, [esp + 0x50]
push 0x190
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x4b0e36
cmp dword [esp + 0x214], 0
mov ebx, dword [esp + 8]
je 0x4b1432
push edi
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x220], 0
mov esi, dword [esp + 4]
je 0x4b1455
push dword [esp + 0x224]
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x14], 3
mov byte [esp + 0x1a], 0
mov word [esp + 0x18], 1
mov word [esp + 0x1c], 0x102
lea ecx, [esp + 0x378]
lea edx, [esp + 0x14]
push dword [ebp + 8]
push esi
call fcn.004e0a80
add esp, 8
cmp dword [esp + 0x378], 0
jne 0x4b150b
lea eax, [esp + 0x37c]
push 0x164
push eax
lea esi, [esp + 0x21c]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x1c]
movzx eax, byte [esp + 0x1d]
lea ecx, [esp + 0x4e0]
push esi
push eax
call fcn.00433c50
add esp, 8
push esi
call fcn.00434ea0
add esp, 4
cmp dword [esp + 0x4e0], 0
jne 0x4b150b
mov edi, dword [esp + 0x4e4]
lea esi, [esp + 0x644]
lea eax, [esp + 0x4e8]
push 0x158
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 0x80000000
jne 0x4b175b
lea eax, [esp + 0x20]
mov dword [esp + 0x50], 0x80000000
push eax
call fcn.00446040
add esp, 4
mov esi, dword [esp + 4]
mov eax, dword [ebp + 8]
lea edi, [esp + 0x378]
cmp dword [esp + 0x50], 0x80000000
jne 0x4b13fd
pxor xmm0, xmm0
shl eax, 4
xor ecx, ecx
movdqa xmmword [esp + 0x140], xmm0
movdqa xmmword [esp + 0x130], xmm0
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
movdqa xmmword [esp + 0xb0], xmm0
movdqa xmmword [esp + 0xa0], xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
nop dword [eax]
cmp dword [esi + ecx + 8], 1
jne 0x4b1629
mov edx, dword [esi + ecx + 4]
add ecx, 0x10
cmp eax, ecx
movzx edx, byte [edx]
mov byte [esp + edx + 0x50], 1
jne 0x4b15d0
mov esi, ebx
movzx ebx, byte [esp + 0x50]
lea eax, [esp + 0x51]
push 0xff
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp bl, 2
je 0x4b162b
lea eax, [esi + 5]
push 0xff
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi], 0x80000005
mov byte [esi + 4], bl
jmp 0x4b0e36
mov esi, ebx
mov edx, dword [esp + 4]
lea ecx, [esp + 0x50]
push dword [ebp + 8]
call fcn.004e04e0
add esp, 4
cmp byte [esp + 0x59], 3
jne 0x4b173e
mov dword [esi], 0x80000007
jmp 0x4b0e36
mov ebx, 1
push edi
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, ebx
mov ebx, dword [esp + 8]
movsd xmm1, qword [esp + 0x50]
movsd xmm2, qword [esp + 0x58]
movsd xmm3, qword [esp + 0x60]
movq xmm4, qword [esp + 0x68]
movq xmm5, qword [esp + 0x70]
mov eax, dword [esp + 0x80]
movq xmm0, qword [esp + 0x78]
mov dword [ebx], 0x80000003
movq qword [esp + 0x74], xmm5
movq qword [esp + 0x6c], xmm4
movsd qword [esp + 0x64], xmm3
movsd qword [esp + 0x5c], xmm2
movsd qword [esp + 0x54], xmm1
movsd qword [esp + 0x1f0], xmm2
movsd qword [esp + 0x1e8], xmm1
movsd qword [esp + 0x1f8], xmm3
movq qword [esp + 0x200], xmm4
movq qword [esp + 0x208], xmm5
movsd xmm2, qword [esp + 0x58]
movq xmm1, qword [esp + 0x50]
movq xmm3, qword [esp + 0x68]
mov ecx, dword [esp + 0x78]
movsd qword [ebx + 0xc], xmm2
movsd xmm2, qword [esp + 0x60]
movq qword [ebx + 4], xmm1
movq qword [ebx + 0x1c], xmm3
mov dword [ebx + 0x2c], ecx
movsd qword [ebx + 0x14], xmm2
movq xmm2, qword [esp + 0x70]
movq qword [ebx + 0x24], xmm2
movq qword [ebx + 0x30], xmm0
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x40], 1
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x48], edi
jmp 0x4b0e36
mov eax, dword [esp + 0x58]
movq xmm0, qword [esp + 0x50]
mov dword [esi + 0xc], eax
movq qword [esi + 4], xmm0
mov dword [esi], 0x80000006
jmp 0x4b0e36
lea eax, [esp + 0x84]
push 0x158
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esp + 0x28]
movsd xmm2, qword [esp + 0x30]
movq xmm0, qword [esp + 0x20]
mov eax, dword [esp + 0x10]
movsd qword [esp + 0x58], xmm1
movsd xmm1, qword [esp + 0x38]
movsd qword [esp + 0x60], xmm2
movq xmm2, qword [esp + 0x40]
movq qword [esp + 0x50], xmm0
movsd qword [esp + 0x68], xmm1
movq xmm1, qword [esp + 0x48]
movq qword [esp + 0x70], xmm2
movq qword [esp + 0x78], xmm1
mov dword [esp + 0x80], edi
mov dword [esp + 0x1dc], eax
jmp 0x4b1520
call fcn.004478d0
int3