Function at 0x420850
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0xc904973f
push dword [0x44bb40]
call fcn.0043f1e0
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
je 0x4208eb
cmp dword [edi], 0xffffffff
jne 0x420996
jmp 0x420e24
push 0x39be051d
push dword [0x44bb40]
call fcn.0043f1e0
add esp, 8
mov dword [esi + 4], eax
push 0x847b02a2
push dword [0x44bb40]
call fcn.0043f1e0
add esp, 8
mov dword [esi + 8], eax
push 0x2e775759
push dword [0x44bb40]
call fcn.0043f1e0
add esp, 8
mov dword [esi + 0xc], eax
mov ebx, dword [esi + 0x28]
jmp 0x420943
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x420975
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi + 4]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x420940
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 8]
test eax, eax
je 0x420975
push dword [edi]
call dword [esi + 0xc]
mov dword [edi], 0xffffffff
jmp 0x420940
push 0x18c354a9
push dword [0x44bb40]
call fcn.0043f1e0
add esp, 8
push dword [esi + 0x28]
call eax
cmp dword [edi], 0xffffffff
je 0x420e24
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
nop
nop
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x4209a0
mov edx, dword [ebp + 8]
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x4209b0
mov edx, dword [ebp + 0xc]
nop
nop
nop
nop
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x4209c0
mov dword [esi + 0x20], edi
add eax, 3
and eax, 0xfffffffc
call fcn.00408610
mov eax, esp
and eax, 0xfffffff0
mov dword [esi + 4], eax
mov esp, eax
mov dword [esi + 0x30], 0xd7d6d980
mov dword [esi + 0x34], 0xb9b7bad4
mov dword [esi + 0x38], 0xe3a0a489
mov dword [esi + 0x3c], 0x95cacec3
mov word [esi + 0x40], 0x51b0
mov dword [esi + 0x42], 0
xor eax, eax
nop
nop
nop
nop
mov edx, eax
add dl, 0x98
xor dl, byte [esi + eax + 0x30]
add dl, 8
mov byte [esi + eax + 0x30], dl
inc eax
cmp eax, 0x16
jne 0x420a10
mov dword [esi + 0x10], 0x9dee0ed
mov byte [esi + 0x14], 0x28
mov dword [esi + 0x15], 0
mov dword [esi + 0x18], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + eax + 0x10]
mov edx, 0x95e83d08
sub edx, eax
or edx, ebx
mov edi, 8
sub edi, eax
and edi, ebx
lea ebx, [edi + edi]
not ebx
add ebx, edi
mov edi, edx
not edi
or edi, ebx
add edi, edx
mov ebx, 0xfffffffe
sub ebx, edi
mov edx, ebx
xor edx, 0xd3
or ebx, 0x2c
and edx, ebx
add edx, ebx
inc dl
mov byte [esi + eax + 0x10], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 0xc
jb 0x420a50
movzx eax, byte [esi + 0x10]
mov ebx, dword [esi + 4]
test al, al
je 0x420acb
lea edx, [esi + 0x11]
mov ebx, dword [esi + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420ac0
mov byte [ebx], 0
movzx eax, byte [ecx]
test al, al
je 0x420aed
inc ecx
mov edx, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420ae0
jmp 0x420af0
mov edx, dword [ebp + 0xc]
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x420b0b
lea ecx, [esi + 0x31]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420b00
mov byte [ebx], 0
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
test al, al
je 0x420b2b
inc ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420b20
mov byte [ebx], 0x3a
mov dword [esi + 0x30], 0xf1c99d93
mov dword [esi + 0x34], 0xc1c1f1f9
mov dword [esi + 0x38], 0xd0be95c3
mov dword [esi + 0x3c], 0xc4d7f9c7
mov dword [esi + 0x40], 0xddc9c2c9
mov dword [esi + 0x44], 0xdcefa9a7
mov dword [esi + 0x48], 0xd4d1d9da
mov dword [esi + 0x4c], 0xd3dbd0c4
mov dword [esi + 0x50], 0xd1e9a78e
mov dword [esi + 0x54], 0xa1e1d1d9
mov dword [esi + 0x58], 0x94c4c8a3
mov dword [esi + 0x5c], 0x9ceda6a7
mov dword [esi + 0x60], 0xa09b95ab
mov dword [esi + 0x64], 0xa1ada6ad
mov dword [esi + 0x68], 0xa2b19afb
mov dword [esi + 0x6c], 0x8892cbe2
mov dword [esi + 0x70], 0xf1bbb5b3
mov dword [esi + 0x74], 0xb6b694ad
mov dword [esi + 0x78], 0xa0dd8ab3
mov dword [esi + 0x7c], 0xa4d58c8f
mov dword [esi + 0x80], 0xc3af87a4
mov dword [esi + 0x84], 0xa4abb0a8
mov dword [esi + 0x88], 0xf3f9c899
mov dword [esi + 0x8c], 0xd29794a5
mov dword [esi + 0x90], 0xaca498ad
mov dword [esi + 0x94], 0x62979e91
mov dword [esi + 0x98], 0x66502870
mov dword [esi + 0x9c], 0x6461766a
mov dword [esi + 0xa0], 0x22163d62
mov dword [esi + 0xa4], 0x1a08043d
mov word [esi + 0xa8], 0xef16
mov dword [esi + 0xaa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x99
xor cl, byte [esi + eax + 0x30]
add cl, 3
mov byte [esi + eax + 0x30], cl
inc eax
cmp eax, 0x7e
jne 0x420c40
inc ebx
movzx eax, byte [edx]
test al, al
je 0x420c6b
inc edx
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420c60
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x420c8b
lea ecx, [esi + 0x31]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420c80
mov byte [ebx], 0
mov edi, dword [esi + 4]
sub ebx, edi
push 0xd0026952
push dword [0x44bb40]
call fcn.0043f1e0
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x20]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x420cf8
cmp dword [edi], 0xffffffff
je 0x420cf8
push 0x59ea2086
push dword [0x44bb40]
call fcn.0043f1e0
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44bb40]
call fcn.0043f1e0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x421007
cmp eax, 0xffffffff
je 0x420e24
push 0x400
call fcn.00408730
add esp, 4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
add eax, 0x400
mov dword [esi + 0x18], eax
lea eax, [esi + 0x10]
mov ecx, edi
push eax
call fcn.004212e0
mov cl, 1
mov dword [esi + 0xc], ecx
test al, al
je 0x420fef
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x18]
jne 0x420f12
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
lea eax, [ebx + 1]
mov edi, ebx
shr edi, 1
add edi, ebx
cmp edi, eax
ja 0x420d5c
mov edi, eax
push edi
call fcn.00408730
add esp, 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x420f04
mov dword [esi + 0x24], edi
cmp eax, ecx
mov edx, dword [esi + 8]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], eax
jbe 0x420e2b
cmp edx, eax
jbe 0x420e2b
test ebx, ebx
je 0x420ef0
mov edx, dword [esi + 0xc]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x1c]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x420dbf
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x420dac
add eax, edx
add ecx, edx
add edx, dword [esi + 0xc]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
cmp edi, 0xfffffff8
ja 0x420ef0
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420dd2
jmp 0x420ef0
xor eax, eax
jmp 0x421007
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add eax, edx
add edx, dword [esi + 4]
mov ecx, ebx
and ecx, 3
mov edi, ecx
not edi
or edi, 1
add edi, ecx
mov dword [esi + 4], edi
shr ecx, 1
mov dword [esi + 8], edx
mov edi, eax
mov ebx, dword [esi + 8]
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ebx, dword [esi + 4]
inc ebx
je 0x420ef0
mov ecx, dword [esi + 0xc]
and ecx, 2
add eax, ecx
add edx, ecx
mov ecx, ebx
and ecx, 7
je 0x420e9b
mov dword [esi + 8], ebx
xor edi, edi
movzx ebx, byte [edx + edi]
mov byte [eax + edi], bl
inc edi
cmp ecx, edi
jne 0x420e86
add edx, edi
add eax, edi
mov ebx, dword [esi + 8]
sub ebx, edi
cmp dword [esi + 4], 7
jb 0x420ef0
xor edi, edi
movzx ecx, byte [edx + edi]
mov byte [eax + edi], cl
movzx ecx, byte [edx + edi + 1]
mov byte [eax + edi + 1], cl
movzx ecx, byte [edx + edi + 2]
mov byte [eax + edi + 2], cl
movzx ecx, byte [edx + edi + 3]
mov byte [eax + edi + 3], cl
movzx ecx, byte [edx + edi + 4]
mov byte [eax + edi + 4], cl
movzx ecx, byte [edx + edi + 5]
mov byte [eax + edi + 5], cl
movzx ecx, byte [edx + edi + 6]
mov byte [eax + edi + 6], cl
movzx ecx, byte [edx + edi + 7]
mov byte [eax + edi + 7], cl
add edi, 8
cmp ebx, edi
jne 0x420ea3
push dword [esi + 0x10]
call fcn.00408740
add esp, 4
mov ebx, dword [esi + 0xc]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x10], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x14], ecx
add edi, eax
mov dword [esi + 0x18], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
inc ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x30], 0xf9feffec
mov dword [esi + 0x34], 0xdadcd8d9
mov dword [esi + 0x38], 0xc6c2c4cc
mov byte [esi + 0x3c], 0x30
mov dword [esi + 0x3d], 0
mov byte [esi + 0x41], 0
xor ecx, ecx
xor edi, edi
nop
nop
nop
nop
nop
mov ebx, ecx
and ebx, 0xe
mov edx, edi
xor edx, 0x17e5bec7
add edx, ebx
movzx ebx, byte [esi + edi + 0x30]
xor edx, ebx
mov ebx, edx
xor ebx, 0xe4
and edx, 0x1b
add edx, edx
sub edx, ebx
inc dl
mov byte [esi + edi + 0x30], dl
inc edi
add ecx, 2
cmp edi, 0x12
jne 0x420f50
movzx edx, byte [esi + 0x30]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
test dl, dl
mov ecx, dword [esi + 0x20]
je 0x420fd8
lea ebx, [esi + 0x30]
mov edi, dword [esi + 8]
mov eax, edi
mov dword [esi + 0xc], edi
jmp 0x420fba
movzx edx, byte [ebx]
test dl, dl
mov ecx, dword [esi + 0x20]
je 0x420fd8
mov dh, byte [eax]
test dh, dh
je 0x420fde
inc eax
inc ebx
mov ecx, dword [esi + 0xc]
lea edi, [ecx + 1]
cmp dh, dl
je 0x420fd1
mov eax, edi
mov dword [esi + 0xc], edi
je 0x420fb0
lea ebx, [esi + 0x30]
jmp 0x420fb0
cmp dword [esi + 0xc], 0
jne 0x42102d
push 0x3ea
call fcn.00420340
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x421004
cmp eax, dword [esi + 0x14]
je 0x421004
push eax
call fcn.00408740
add esp, 4
mov eax, dword [esi + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
not bl
movsx eax, bl
inc ecx
add ecx, eax
mov ecx, dword [esi + 0x20]
je 0x420fef
mov eax, dword [esi + 8]
mov edx, eax
mov ebx, dword [esi + 4]
sub edx, ebx
je 0x42105e
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov edi, eax
xor ecx, ecx
mov ebx, dword [esi + 0xc]
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
xor ecx, ecx
mov edi, eax
mov eax, dword [esi + 4]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 0x20]
add dword [esi + 0x14], edx
lea eax, [esi + 0x10]
push eax
call fcn.004212e0
test al, al
je 0x420fe8
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x18]
jne 0x42125f
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
lea eax, [ebx + 1]
mov edi, ebx
shr edi, 1
add edi, ebx
cmp edi, eax
ja 0x42109a
mov edi, eax
push edi
call fcn.00408730
add esp, 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x421251
mov dword [esi + 0x2c], edi
cmp eax, ecx
mov edx, dword [esi + 8]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], eax
jbe 0x421172
cmp edx, eax
jbe 0x421172
test ebx, ebx
je 0x42123d
mov edx, dword [esi + 0x1c]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x24]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x421103
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x4210f0
add eax, edx
add ecx, edx
add edx, dword [esi + 0x1c]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
cmp edi, 0xfffffff8
ja 0x42123d
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x421120
jmp 0x42123d
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add eax, edx
add edx, dword [esi + 4]
mov ecx, ebx
and ecx, 3
mov edi, ecx
not edi
or edi, 1
add edi, ecx
mov dword [esi + 4], edi
shr ecx, 1
mov dword [esi + 8], edx
mov edi, eax
mov ebx, dword [esi + 8]
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ebx, dword [esi + 4]
inc ebx
je 0x42123d
mov ecx, dword [esi + 0x1c]
and ecx, 2
add eax, ecx
add edx, ecx
mov ecx, ebx
and ecx, 7
je 0x4211e5
mov dword [esi + 8], ebx
xor edi, edi
nop
nop
nop
movzx ebx, byte [edx + edi]
mov byte [eax + edi], bl
inc edi
cmp ecx, edi
jne 0x4211d0
add edx, edi
add eax, edi
mov ebx, dword [esi + 8]
sub ebx, edi
cmp dword [esi + 4], 7
jb 0x42123d
xor edi, edi
nop
nop
nop
movzx ecx, byte [edx + edi]
mov byte [eax + edi], cl
movzx ecx, byte [edx + edi + 1]
mov byte [eax + edi + 1], cl
movzx ecx, byte [edx + edi + 2]
mov byte [eax + edi + 2], cl
movzx ecx, byte [edx + edi + 3]
mov byte [eax + edi + 3], cl
movzx ecx, byte [edx + edi + 4]
mov byte [eax + edi + 4], cl
movzx ecx, byte [edx + edi + 5]
mov byte [eax + edi + 5], cl
movzx ecx, byte [edx + edi + 6]
mov byte [eax + edi + 6], cl
movzx ecx, byte [edx + edi + 7]
mov byte [eax + edi + 7], cl
add edi, 8
cmp ebx, edi
jne 0x4211f0
push dword [esi + 0x10]
call fcn.00408740
add esp, 4
mov ebx, dword [esi + 0x1c]
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x10], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x14], ecx
add edi, eax
mov dword [esi + 0x18], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0x10]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
inc eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x30], 0x4e4543
mov ecx, 0x6d
mov edx, 0x92
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esi + ecx - 0x3d]
mov ebx, ecx
xor ebx, edx
and ebx, edi
xor ebx, edx
mov al, 0xde
sub al, bl
mov byte [esi + ecx - 0x3d], al
inc ecx
dec edx
cmp ecx, 0x71
jne 0x421290
xor edx, edx
mov eax, dword [esi + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [eax + edx]
movzx ebx, byte [esi + edx + 0x30]
test ecx, ecx
je 0x421020
inc edx
cmp cl, bl
je 0x4212c0
jmp 0x421020