Function at 0x41ff10
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
mov eax, dword [esp + 0x58]
cmp eax, 4
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push esi
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
jbe 0x41ff64
cmp word [ebp + eax*2 - 2], 0x6d
lea ecx, [ebp + eax*2 - 2]
jne 0x41ff64
sub ecx, 2
cmp word [ecx], 0x74
jne 0x41ff64
sub ecx, 2
cmp word [ecx], 0x68
jne 0x41ff64
cmp word [ecx - 2], 0x2e
jne 0x41ff64
sub eax, 4
mov dword [esp + 0x68], eax
mov dword [esp + 0x14], 4
xor ecx, ecx
cmp al, 2
mov edi, eax
jbe 0x41ff71
mov cl, al
sub ecx, 2
mov esi, eax
mov eax, dword [esp + 0x6c]
and esi, 0xffffff00
or esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xc
shl esi, 8
or esi, ecx
push 0
mov dword [esp + 0x20], eax
mov eax, dword [eax]
push esi
push eax
mov byte [esp + 0x3c], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], 0
call dword [sym.imp.Kiwilla.dll_JudyLGet]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x420097
lea esp, [esp]
mov eax, dword [ebx]
test eax, eax
mov dword [esp + 0x6c], eax
js 0x4200e2
je 0x420097
mov ecx, dword [esp + 0x18]
inc ecx
cmp edi, 2
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
jbe 0x420038
mov al, byte [esp + 0x30]
test al, al
je 0x41ffff
lea ecx, [edi + edi]
push ecx
push ebp
call fcn.0041fca0
add esp, 8
mov esi, eax
jmp 0x420077
movzx edx, byte [ebp + 1]
movzx ecx, byte [ebp]
lea eax, [ebp + 1]
shl edx, 8
add ecx, edx
cmp edi, 1
jbe 0x42002e
movzx esi, byte [eax + 2]
inc eax
movzx eax, byte [eax]
shl esi, 8
add esi, eax
shl esi, 0x10
add esi, ecx
add ebp, 4
sub edi, 2
jmp 0x420077
add ebp, 4
mov esi, ecx
sub edi, 2
jmp 0x420077
test edi, edi
je 0x420075
movzx edx, byte [ebp + 1]
movzx ecx, byte [ebp]
lea eax, [ebp + 1]
shl edx, 8
add ecx, edx
cmp edi, 1
jbe 0x42006b
movzx esi, byte [eax + 2]
inc eax
movzx eax, byte [eax]
shl esi, 8
add esi, eax
shl esi, 0x10
add esi, ecx
lea ebp, [ebp + edi*2]
xor edi, edi
jmp 0x420077
lea ebp, [ebp + edi*2]
mov esi, ecx
xor edi, edi
jmp 0x420077
xor esi, esi
mov ecx, dword [esp + 0x6c]
push 0
push esi
push ecx
mov byte [esp + 0x3c], 0
call dword [sym.imp.Kiwilla.dll_JudyLGet]
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x41ffc0
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x6c]
push edx
mov edx, dword [esp + 0x6c]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.00420b20
cmp eax, 0xffffffff
mov dword [esp + 0x6c], eax
je 0x4204df
mov eax, dword [esp + 0x58]
test eax, eax
jle 0x420408
mov eax, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
mov ecx, dword [esp + 0x68]
and eax, 0x7fffffff
cmp ecx, 2
mov dword [esp + 0x6c], eax
jbe 0x42035d
mov ebp, dword [esp + 0x70]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x42019c
mov edx, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x1c]
push edx
call fcn.00434cd0
mov edi, eax
test edi, edi
je case.default.0x420159
lea ecx, [esp + 0x70]
push ecx
mov ecx, edi
call fcn.00435480
mov esi, eax
test esi, esi
je case.default.0x420159
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x68]
add eax, ecx
push eax
mov eax, dword [esp + 0x78]
push edx
push eax
push esi
call fcn.004205d0
add eax, 2
add esp, 0x14
cmp eax, 3
ja case.default.0x420159
jmp dword [eax*4 + 0x4205a8]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x1c]
push edx
mov ecx, edi
call fcn.00435410
neg al
sbb al, al
inc al
mov edx, edi
mov ecx, 1
jmp 0x4201c5
xor al, al
mov edx, edi
mov ecx, 1
jmp 0x4201c5
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], eax
jmp 0x4201bb
or ecx, 0xffffffff
jmp 0x4201bd
cmp eax, dword [ebp]
jne 0x4201ad
mov edx, dword [ebp + 0x10]
xor al, al
mov ecx, 1
jmp 0x4201c5
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
xor ecx, ecx
mov edx, dword [esp + 0x24]
mov al, byte [esp + 0x34]
sub ecx, 0
je 0x420208
dec ecx
jne 0x4204df
test al, al
je 0x4201fc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ecx + 0x14]
movzx eax, word [eax + 0x26e]
push eax
push 0x40000000
push edx
call fcn.00434bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0x50
ret 0x10
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x68]
push ebp
mov ebp, dword [esp + 0x18]
push edx
push eax
push ecx
mov ecx, ebp
call fcn.00420b20
mov esi, eax
cmp esi, 0xffffffff
je 0x4204df
mov eax, dword [esp + 0x44]
test eax, eax
mov edi, dword [esp + 0x6c]
jne 0x42027c
mov edx, dword [ebp + 8]
push ebx
push edx
mov edx, dword [esp + 0x20]
mov eax, esi
or eax, 0x80000000
push eax
mov eax, dword [esp + 0x4c]
mov ecx, edi
or ecx, 0x80000000
push ecx
mov ecx, dword [esp + 0x4c]
dec edx
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x40]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00420740
inc dword [0x578118]
mov al, byte [0x578845]
test al, al
je 0x42031e
push 1
push 0x45e114
mov ecx, 0x576188
call fcn.0040c190
push edi
mov ecx, 0x576188
call fcn.0040bd00
push 1
push 0x45e110
mov ecx, eax
call fcn.0040c190
push edi
mov ecx, 0x576188
call fcn.0041bb50
push 1
push 0x45d990
mov ecx, eax
call fcn.0040c190
push 1
push 0x45d050
mov ecx, 0x576188
call fcn.0040c190
push esi
mov ecx, 0x576188
call fcn.0040bd00
push 1
push 0x45e110
mov ecx, eax
call fcn.0040c190
push esi
mov ecx, 0x576188
call fcn.0041bb50
push 1
push 0x45d990
mov ecx, eax
call fcn.0040c190
push 0x40b880
mov ecx, 0x576188
call fcn.0040ba90
mov al, byte [esp + 0x48]
test al, al
je 0x42034f
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx + 0x14]
xor eax, eax
mov ax, word [edx + 0x26e]
push eax
mov eax, dword [esp + 0x3c]
push 0x40000000
push eax
call fcn.00434bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
mov eax, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
mov ecx, dword [esp + 0x6c]
mov edi, dword [esp + 0x10]
push ecx
mov ecx, dword [edi + 0x1c]
call fcn.00434cd0
mov esi, eax
test esi, esi
je case.0x4203af.1
lea edx, [esp + 0x70]
push edx
mov ecx, esi
call fcn.00435480
test eax, eax
je case.0x4203af.1
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x6c]
add edx, ecx
mov ecx, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x6c]
push edx
push ecx
push eax
call fcn.004205d0
add eax, 2
add esp, 0x14
cmp eax, 3
ja case.0x4203af.1
jmp dword [eax*4 + 0x4205b8]
mov edx, dword [edi + 0x1c]
push edx
mov ecx, esi
call fcn.00435410
neg al
sbb al, al
inc al
jmp 0x4203d5
xor al, al
jmp 0x4203d5
mov esi, dword [esp + 0x4c]
mov al, byte [esp + 0x5c]
test al, al
je 0x4203fc
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx + 0x14]
movzx eax, word [eax + 0x26e]
push eax
push 0x40000000
push esi
call fcn.00434bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
mov eax, dword [ebx + 8]
mov ecx, dword [esp + 0x1c]
push esi
push eax
push ecx
call fcn.00413d40
add esp, 0xc
test eax, eax
mov dword [esp + 0x68], eax
je 0x4204df
mov al, byte [esp + 0x30]
test al, al
je 0x4204eb
cmp edi, 2
jbe 0x42047d
lea edx, [edi + edi]
mov eax, edx
shr eax, 2
xor esi, esi
test eax, eax
mov ecx, ebp
je 0x420458
xor esi, dword [ecx]
add ecx, 4
rol esi, 8
imul esi, esi, 0x165667b1
dec eax
jne 0x420447
and edx, 3
dec edx
je 0x420476
dec edx
je 0x42046d
dec edx
jne 0x4204bc
movsx edx, byte [ecx]
shl edx, 0x10
xor esi, edx
inc ecx
movsx eax, byte [ecx]
shl eax, 8
xor esi, eax
inc ecx
movsx ecx, byte [ecx]
xor esi, ecx
jmp 0x4204bc
test edi, edi
je 0x4204ba
movzx edx, byte [ebp + 1]
movzx ecx, byte [ebp]
lea eax, [ebp + 1]
shl edx, 8
add ecx, edx
cmp edi, 1
jbe 0x4204b0
movzx esi, byte [eax + 2]
inc eax
movzx eax, byte [eax]
shl esi, 8
add esi, eax
shl esi, 0x10
add esi, ecx
lea ebp, [ebp + edi*2]
xor edi, edi
jmp 0x4204bc
lea ebp, [ebp + edi*2]
mov esi, ecx
xor edi, edi
jmp 0x4204bc
xor esi, esi
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x68]
push esi
push ecx
push edx
mov byte [esp + 0x3c], 0
call fcn.00413d40
add esp, 0xc
test eax, eax
mov dword [esp + 0x68], eax
jne 0x420426
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret 0x10
mov al, byte [ebx + 0xb0]
test al, al
je 0x420564
cmp dword [esp + 0x18], 2
jae 0x420564
mov edi, dword [esp + 0x20]
cmp edi, 0xffff
ja 0x420564
push 0xa
lea ecx, [ebx + 0x98]
call fcn.0042e740
test eax, eax
je 0x420564
mov ecx, dword [esp + 0x6c]
or ecx, 0x80000000
mov dword [eax + 6], ecx
mov word [eax], di
mov dword [eax + 2], esi
mov ecx, dword [ebx + 0xac]
mov al, byte [ebx + 0xb8]
inc ecx
test al, al
mov dword [ebx + 0xac], ecx
je 0x420564
mov eax, dword [ebx + 0x90]
xor edx, edx
mov dx, di
mov ecx, dword [eax + edx*4 + 0x1010]
inc ecx
mov dword [eax + edx*4 + 0x1010], ecx
lea eax, [eax + edx*4 + 0x1010]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
or eax, 0x80000000
mov dword [ecx], eax
mov al, byte [esp + 0x5c]
test al, al
je 0x4200d4
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ecx + 0x14]
xor eax, eax
mov ax, word [edx + 0x26e]
push eax
mov eax, dword [esp + 0x50]
push 0x40000000
push eax
call fcn.00434bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10