Function at 0xd695d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov esi, esp
mov edi, ecx
mov dword [esi + 0xdc], 0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd0], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 2
mov dword [esi + 0xc8], 1
push 0x565577c1
push dword [0xfcd98328]
call fcn.00d8bcb0
add esp, 8
lea ecx, [esi + 0x3c]
lea edx, [esi + 0xc0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
je 0xd6966b
cmp dword [edi], 0xffffffff
jne 0xd69717
jmp 0xd69b46
push 0xb646c33f
push dword [0xfcd98328]
call fcn.00d8bcb0
add esp, 8
mov dword [esi + 0xc], eax
push 0xe7db718c
push dword [0xfcd98328]
call fcn.00d8bcb0
add esp, 8
mov dword [esi + 0x10], eax
push 0xa3d60213
push dword [0xfcd98328]
call fcn.00d8bcb0
add esp, 8
mov dword [esi + 0x14], eax
mov ebx, dword [esi + 0x3c]
jmp 0xd696c3
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0xd696f6
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0xd696c0
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 0x10]
cmp eax, 0xffffffff
jne 0xd696f6
push dword [edi]
call dword [esi + 0x14]
mov dword [edi], 0xffffffff
jmp 0xd696c0
push 0xeb17dc3b
push dword [0xfcd98328]
call fcn.00d8bcb0
add esp, 8
push dword [esi + 0x3c]
call eax
cmp dword [edi], 0xffffffff
je 0xd69b46
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
nop
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0xd69720
mov ecx, dword [ebp + 8]
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0xd69730
mov dword [esi + 0x28], edi
mov ecx, dword [ebp + 0xc]
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0xd69740
add eax, 3
and eax, 0xfffffffc
call fcn.00d58180
mov eax, esp
and eax, 0xfffffff0
mov dword [esi + 0x10], eax
mov esp, eax
mov dword [esi + 0x40], 0xefeed930
mov dword [esi + 0x44], 0xc9cfcaec
mov dword [esi + 0x48], 0xd3102cc9
mov dword [esi + 0x4c], 0xdd9a9693
mov word [esi + 0x50], 0x120
mov dword [esi + 0x52], 0
mov word [esi + 0x56], 0
xor eax, eax
nop
movzx ecx, byte [esi + eax + 0x40]
lea ebx, [eax + 0x1f51a544]
mov edi, 0x60ae5abb
sub edi, eax
and edi, 0x60284a95
mov edx, ebx
and edx, 0x2a
or edx, edi
mov edi, 0xe0ae5abb
sub edi, eax
xor edx, 0x8086102a
and edx, edi
mov edi, edx
not edi
or edi, ecx
sub edx, ecx
add edx, edi
mov edi, ecx
not edi
and edi, ebx
mov dword [esi + 0xc], edi
xor ebx, ecx
lea edi, [edx + edx]
not edi
add edi, edx
lea ecx, [ebx + eax]
add ecx, 0x1f51a544
mov ebx, ecx
not ebx
add ebx, dword [esi + 0xc]
or ebx, edi
sub ecx, dword [esi + 0xc]
and ecx, edx
not ebx
or ebx, ecx
add bl, 0xac
mov byte [esi + eax + 0x40], bl
mov ecx, eax
not ecx
or ecx, 1
add ecx, eax
xor eax, 1
lea eax, [eax + ecx*2]
add eax, 2
cmp eax, 0x18
jb 0xd69790
mov dword [esi + 0x18], 0xe3d6c4c7
mov byte [esi + 0x1c], 0x84
mov word [esi + 0x1d], 0
mov byte [esi + 0x1f], 0
mov eax, 0x20
mov edx, 0x4770d0df
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esi + eax - 8]
lea ecx, [edx - 0x4770d000]
and ecx, edi
mov dword [esi + 0xc], ecx
mov ebx, eax
and ebx, edi
mov ecx, edx
xor ecx, edi
sub ecx, edi
add ecx, dword [esi + 0xc]
or ecx, ebx
mov edi, ecx
not edi
and edi, 0x5f
xor ecx, 0xa0
lea ecx, [ecx + edi*2]
inc cl
mov byte [esi + eax - 8], cl
inc eax
dec edx
cmp eax, 0x28
jne 0xd69840
movzx eax, byte [esi + 0x18]
mov ebx, dword [esi + 0x10]
test al, al
je 0xd6989b
lea edx, [esi + 0x19]
mov ebx, dword [esi + 0x10]
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0xd69890
mov byte [ebx], 0
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ecx]
test al, al
je 0xd698bd
inc ecx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0xd698b0
jmp 0xd698c0
mov edx, dword [ebp + 8]
mov byte [ebx], 0
movzx eax, byte [esi + 0x40]
test al, al
je 0xd698db
lea ecx, [esi + 0x41]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0xd698d0
mov byte [ebx], 0
movzx eax, byte [edx]
test al, al
je 0xd698fb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0xd698f0
mov byte [ebx], 0x3a
mov dword [esi + 0x40], 0x27cbbfbd
mov dword [esi + 0x44], 0xdfd32bdf
mov dword [esi + 0x48], 0x249ef7dd
mov dword [esi + 0x4c], 0x2825d3d1
mov dword [esi + 0x50], 0x3bcb2ed7
mov dword [esi + 0x54], 0x30ed9391
mov dword [esi + 0x58], 0xc0c33332
mov dword [esi + 0x5c], 0x3939c430
mov dword [esi + 0x60], 0x47ab89ee
mov dword [esi + 0x64], 0xbfb34bbf
mov dword [esi + 0x68], 0xa0e8e4bd
mov dword [esi + 0x6c], 0xa08fb2b1
mov dword [esi + 0x70], 0x54b9b7b5
mov dword [esi + 0x74], 0x5faf52ab
mov dword [esi + 0x78], 0x56a3b695
mov dword [esi + 0x7c], 0xb482ed8a
mov dword [esi + 0x80], 0xa799575d
mov dword [esi + 0x84], 0x8a66806b
mov dword [esi + 0x88], 0xb4bf668d
mov dword [esi + 0x8c], 0x88a76869
mov dword [esi + 0x90], 0xb9ad6988
mov dword [esi + 0x94], 0x98a984ac
mov dword [esi + 0x98], 0xd9dba477
mov dword [esi + 0x9c], 0xbe858093
mov dword [esi + 0xa0], 0x68788493
mov dword [esi + 0xa4], 0x7e857a87
mov dword [esi + 0xa8], 0x7264448c
mov dword [esi + 0xac], 0x88738282
mov dword [esi + 0xb0], 0x56265f8a
mov dword [esi + 0xb4], 0x3634305b
mov word [esi + 0xb8], 0x136
mov byte [esi + 0xbc], 0
mov word [esi + 0xba], 0
mov eax, 0x2dc72c1e
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax - 0x2dc72bde]
xor ecx, eax
mov edx, ecx
not edx
or edx, 0x69
add edx, ecx
xor ecx, 0x69
lea ecx, [ecx + edx*2]
add cl, 3
mov byte [esi + eax - 0x2dc72bde], cl
inc eax
cmp eax, 0x2dc72c9b
jne 0xd69a20
inc ebx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0xd69a6b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0xd69a60
mov byte [ebx], 0
movzx eax, byte [esi + 0x40]
test al, al
je 0xd69a8b
lea ecx, [esi + 0x41]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0xd69a80
mov byte [ebx], 0
mov edi, dword [esi + 0x10]
sub ebx, edi
push 0xefae2064
push dword [0xfcd98328]
call fcn.00d8bcb0
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x28]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0xd69af8
cmp dword [edi], 0xffffffff
je 0xd69af8
push 0xea8d1240
push dword [0xfcd98328]
call fcn.00d8bcb0
add esp, 8
push 2
push dword [edi]
call eax
push 0xa3d60213
push dword [0xfcd98328]
call fcn.00d8bcb0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0xd6a053
cmp eax, 0xffffffff
je 0xd69b46
push 0x400
call fcn.00d581b0
add esp, 4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
add eax, 0x400
mov dword [esi + 0x20], eax
lea eax, [esi + 0x18]
mov ecx, edi
push eax
call fcn.00d6a060
mov cl, 1
mov dword [esi + 0x10], ecx
test al, al
je 0xd6a03b
mov ebx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov edi, eax
sub edi, ebx
cmp eax, dword [esi + 0x20]
je 0xd69b4d
mov eax, ebx
jmp 0xd69c9b
xor eax, eax
jmp 0xd6a053
mov edx, eax
not edx
and edx, ebx
mov ecx, ebx
not ecx
and ecx, eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], edx
sub ecx, edx
mov edx, ecx
shr edx, 1
lea eax, [edi + 1]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x2c], edx
add ecx, edx
cmp ecx, eax
ja 0xd69b76
mov ecx, eax
mov dword [esi + 0x10], ecx
push ecx
call fcn.00d581b0
add esp, 4
test ebx, ebx
je 0xd69c8a
cmp eax, ebx
mov edx, dword [esi + 0xc]
mov dword [esi + 0x14], eax
jbe 0xd69c3d
lea ecx, [ebx + edx]
cmp ecx, eax
jbe 0xd69c3d
test edx, edx
je 0xd69c7c
mov dword [esi + 0x24], edi
lea eax, [ebx + edx]
dec eax
mov ecx, dword [esi + 0x14]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0xd69bd6
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0xd69bc3
add eax, edx
add ecx, edx
add dword [esi + 0xc], edx
mov edx, dword [esi + 0x38]
sub edx, dword [esi + 0x34]
cmp edx, 0xfffffff8
mov edi, dword [esi + 0x24]
ja 0xd69c7c
neg dword [esi + 0xc]
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
movzx ebx, byte [eax + edx - 1]
mov byte [ecx + edx - 1], bl
movzx ebx, byte [eax + edx - 2]
mov byte [ecx + edx - 2], bl
movzx ebx, byte [eax + edx - 3]
mov byte [ecx + edx - 3], bl
movzx ebx, byte [eax + edx - 4]
mov byte [ecx + edx - 4], bl
movzx ebx, byte [eax + edx - 5]
mov byte [ecx + edx - 5], bl
movzx ebx, byte [eax + edx - 6]
mov byte [ecx + edx - 6], bl
movzx ebx, byte [eax + edx - 7]
mov byte [ecx + edx - 7], bl
add edx, 0xfffffff8
cmp dword [esi + 0xc], edx
jne 0xd69bed
jmp 0xd69c7c
mov ecx, edx
shr ecx, 2
mov edx, ebx
mov dword [esi + 0x24], edi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, dword [esi + 0x2c]
and ecx, 1
mov edx, dword [esi + 0xc]
and edx, 0xfffffffc
add ebx, edx
add edx, eax
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 0x24]
test al, 1
je 0xd69c7c
and eax, 2
movzx ecx, byte [ebx + eax]
mov byte [edx + eax], cl
push dword [esi + 0x18]
call fcn.00d581c0
add esp, 4
mov eax, dword [esi + 0x14]
mov dword [esi + 0x18], eax
lea ecx, [eax + edi]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x10]
add ecx, eax
mov dword [esi + 0x20], ecx
mov byte [eax + edi], 0
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
inc ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x40], 0xc9cecffc
mov dword [esi + 0x44], 0xeaece8e9
mov dword [esi + 0x48], 0xe6e2e49c
mov byte [esi + 0x4c], 0xb0
mov dword [esi + 0x4d], 0
mov dword [esi + 0x50], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + ecx + 0x40]
mov edx, ecx
xor edx, 0xca0f841f
lea edi, [edx + ecx*2]
mov edx, ebx
not edx
or edx, edi
add edx, ebx
lea edx, [edx*2 + 2]
add edi, ebx
mov ebx, edi
not ebx
and ebx, edx
not edx
and edx, edi
sub edx, ebx
lea edi, [ecx + ecx]
add dl, 0x65
mov byte [esi + ecx + 0x40], dl
and edi, 2
mov edx, edi
and edx, ecx
xor edi, ecx
xor edi, 1
lea ecx, [edi + edx*2]
cmp ecx, 0x14
jb 0xd69ce0
movzx edx, byte [esi + 0x40]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
test dl, dl
mov ecx, dword [esi + 0x28]
je 0xd69d7c
lea ebx, [esi + 0x40]
mov edi, dword [esi + 0x14]
mov eax, edi
mov dword [esi + 0x10], edi
jmp 0xd69d5a
movzx edx, byte [ebx]
test dl, dl
mov ecx, dword [esi + 0x28]
je 0xd69d7c
mov dh, byte [eax]
test dh, dh
je 0xd6a02a
inc eax
inc ebx
mov ecx, dword [esi + 0x10]
lea edi, [ecx + 1]
cmp dh, dl
je 0xd69d75
mov eax, edi
mov dword [esi + 0x10], edi
je 0xd69d50
lea ebx, [esi + 0x40]
jmp 0xd69d50
cmp dword [esi + 0x10], 0
je 0xd6a02a
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 0xc]
jmp 0xd69d9e
cmp dl, dh
mov ecx, dword [esi + 0x28]
mov ebx, dword [esi + 0xc]
je 0xd6a03b
mov edx, eax
sub edx, ebx
je 0xd69dc9
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov edi, eax
xor ecx, ecx
mov ebx, dword [esi + 0x10]
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
xor ecx, ecx
mov edi, eax
mov eax, dword [esi + 0xc]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 0x28]
add dword [esi + 0x1c], edx
lea eax, [esi + 0x18]
push eax
call fcn.00d6a060
test al, al
je 0xd6a034
mov dword [esi + 0x10], eax
mov ebx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov edi, eax
sub edi, ebx
cmp eax, dword [esi + 0x20]
je 0xd69e00
mov eax, ebx
jmp 0xd69f5e
mov edx, eax
not edx
and edx, ebx
mov ecx, ebx
not ecx
and ecx, eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x34], edx
sub ecx, edx
mov edx, ecx
shr edx, 1
lea eax, [edi + 1]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x38], edx
add ecx, edx
cmp ecx, eax
ja 0xd69e29
mov ecx, eax
mov dword [esi + 0x14], ecx
push ecx
call fcn.00d581b0
add esp, 4
test ebx, ebx
je 0xd69f4d
cmp eax, ebx
mov edx, dword [esi + 0xc]
mov dword [esi + 0x2c], eax
jbe 0xd69f00
lea ecx, [ebx + edx]
cmp ecx, eax
jbe 0xd69f00
test edx, edx
je 0xd69f3f
mov dword [esi + 0x30], edi
lea eax, [ebx + edx]
dec eax
mov ecx, dword [esi + 0x2c]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0xd69e93
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0xd69e80
add eax, edx
add ecx, edx
add dword [esi + 0xc], edx
mov edx, dword [esi + 0x34]
sub edx, dword [esi + 0x24]
cmp edx, 0xfffffff8
mov edi, dword [esi + 0x30]
ja 0xd69f3f
neg dword [esi + 0xc]
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
movzx ebx, byte [eax + edx - 1]
mov byte [ecx + edx - 1], bl
movzx ebx, byte [eax + edx - 2]
mov byte [ecx + edx - 2], bl
movzx ebx, byte [eax + edx - 3]
mov byte [ecx + edx - 3], bl
movzx ebx, byte [eax + edx - 4]
mov byte [ecx + edx - 4], bl
movzx ebx, byte [eax + edx - 5]
mov byte [ecx + edx - 5], bl
movzx ebx, byte [eax + edx - 6]
mov byte [ecx + edx - 6], bl
movzx ebx, byte [eax + edx - 7]
mov byte [ecx + edx - 7], bl
add edx, 0xfffffff8
cmp dword [esi + 0xc], edx
jne 0xd69eb0
jmp 0xd69f3f
mov ecx, edx
shr ecx, 2
mov edx, ebx
mov dword [esi + 0x30], edi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, dword [esi + 0x38]
and ecx, 1
mov edx, dword [esi + 0xc]
and edx, 0xfffffffc
add ebx, edx
add edx, eax
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 0x30]
test al, 1
je 0xd69f3f
and eax, 2
movzx ecx, byte [ebx + eax]
mov byte [edx + eax], cl
push dword [esi + 0x18]
call fcn.00d581c0
add esp, 4
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x18], eax
lea ecx, [eax + edi]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x14]
add ecx, eax
mov dword [esi + 0x20], ecx
mov byte [eax + edi], 0
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x1c]
inc eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x40], 0xcec5c3
xor ecx, ecx
nop
nop
nop
nop
nop
mov edi, ecx
neg edi
lea edx, [edi + edi]
and edx, 0x3dd3fa66
xor edi, 0x611602cc
sub edi, edx
lea ebx, [edi + 1]
mov edx, 0x7ffffe
sub edx, edi
and edx, 0x502084
and ebx, 0xa6018839
or ebx, edx
mov edx, SysReAllocString
sub edx, edi
movzx edi, byte [esi + ecx + 0x40]
and edx, 0x59ae5742
or edx, ebx
mov eax, edx
xor eax, 0x84
mov ebx, edi
xor ebx, 0xbd
or ebx, eax
xor edi, 0x42
xor edx, 0x7b
or edx, edi
and edx, ebx
mov al, 0xfe
sub al, dl
mov byte [esi + ecx + 0x40], al
lea eax, [ecx + ecx]
mov edx, eax
and edx, 2
and eax, ecx
or edx, ecx
xor edx, 1
add edx, eax
mov ecx, edx
cmp edx, 4
jb 0xd69f80
xor ecx, ecx
mov eax, dword [esi + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax + ecx]
mov dh, byte [esi + ecx + 0x40]
test dl, dl
je 0xd69d90
inc ecx
cmp dl, dh
je 0xd6a010
jmp 0xd69d90
push 0x3ea
call fcn.00d69370
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0xd6a050
cmp eax, dword [esi + 0x1c]
je 0xd6a050
push eax
call fcn.00d581c0
add esp, 4
mov eax, dword [esi + 0x10]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc