Function at 0x463000
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1d8
mov edi, edx
mov edx, dword [ebp + 0x10]
mov esi, ecx
mov eax, 0x1445247
mov ecx, 0x4e574f44
mov ebx, dword [ebp + 8]
mov dword [esp], edi
movsd xmm1, qword [edx + 0x24]
movq xmm0, qword [edx + 0x2c]
movq xmm2, qword [edx + 0x14]
movsd qword [edi + 0x80], xmm1
movq xmm1, qword [edx + 0x1c]
movq qword [edi + 0x88], xmm0
movq qword [edi + 0x70], xmm2
movq qword [edi + 0x78], xmm1
xor eax, dword [edi + 0x8c]
xor ecx, dword [edi + 0x88]
or ecx, eax
mov ah, byte [ebp + 0x14]
sete cl
test cl, ah
je 0x46316d
mov word [esp + 0x10c], 4
mov dword [esp + 0x90], 0x80000001
mov dword [esp + 0x94], 0xd0001
xor eax, eax
lea edx, [esp + 0x90]
mov ecx, ebx
cmp byte [ebx + 0x31], 2
sete al
push eax
call fcn.0044f0f0
add esp, 4
mov byte [ebx + 0x249], 1
mov word [esi], 9
mov esi, dword [edi + 0xc0]
xor ebx, ebx
lock dec dword [esi]
jne 0x4630cf
lea ecx, [edi + 0xc0]
call fcn.004a0e30
xor eax, eax
cmp eax, dword [edi + 8]
seto al
or bl, al
jne 0x4630e2
mov ecx, edi
call fcn.00459cc0
cmp byte [edi + 0xac], 0
jne 0x46310b
test dword [edi + 0xb0], 0x7fffffff
je 0x46310b
push dword [edi + 0xb4]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [edi + 0xa4]
mov edi, dword [edi + 0xa8]
mov eax, dword [edi]
test eax, eax
je 0x463123
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x463141
cmp dword [edi + 8], 9
jb 0x463132
mov esi, dword [esi - 4]
push esi
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp]
test dword [eax + 0x90], 0x7fffffff
je 0x4635d1
push dword [eax + 0x94]
push 0
push dword [0x776180]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4635d1
mov ecx, dword [edx + 8]
mov eax, dword [edx + 4]
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x4631e6
lea esi, [ecx*4]
lea edx, [eax + 0x10]
mov edi, 0x3f7f
lea esi, [esi + esi*4]
jmp 0x463198
add edx, 0x14
add esi, 0xffffffec
je 0x4631e6
movzx ebx, word [edx - 0x10]
bt edi, ebx
jb 0x463190
cmp ebx, 0xe
jne 0x4631ac
cmp word [edx], 0x13
jne 0x463190
mov edi, dword [esp]
mov dl, 1
mov dword [esp + 0xc], edx
mov byte [edi + 0xc4], 1
mov esi, dword [edi + 0xc0]
test ecx, ecx
mov dword [esp + 4], esi
jne 0x463276
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
jmp 0x463303
mov edi, dword [esp]
mov byte [edi + 0xc4], 0
mov esi, dword [edi + 0xc0]
cmp byte [esi + 0xb7], 0
je 0x463262
mov ebx, dword [ebp + 8]
mov word [esp + 0x10c], 4
mov dword [esp + 0x90], 0x80000001
mov dword [esp + 0x94], 0x60001
xor eax, eax
lea edx, [esp + 0x90]
cmp byte [ebx + 0x31], 2
mov ecx, ebx
sete al
push eax
call fcn.0044f0f0
add esp, 4
mov eax, dword [esp + 0x10]
mov byte [ebx + 0x249], 1
mov byte [eax], 8
mov dword [eax + 4], 0x80000002
xor ebx, ebx
lock dec dword [esi]
jne 0x4630cf
jmp 0x4630c4
mov dword [esp + 0xc], 0
test ecx, ecx
mov dword [esp + 4], esi
je 0x4631ce
shl ecx, 2
lea esi, [eax + 0x10]
lea edi, [ecx + ecx*4]
jmp 0x463298
add esi, 0x14
add edi, 0xffffffec
je 0x4632b8
movzx ebx, word [esi - 0x10]
lea edx, [ebx - 3]
cmp edx, 0xb
jb 0x463290
cmp ebx, 2
jb 0x463290
mov dl, 1
cmp ebx, 0xe
jne 0x4632ba
cmp word [esi], 0x15
jne 0x463290
jmp 0x4632ba
xor edx, edx
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x10]
add eax, 0x10
lea ecx, [ecx + ecx*4]
mov esi, 0x3eff
jmp 0x4632d8
add eax, 0x14
add ecx, 0xffffffec
je 0x4632f4
movzx edi, word [eax - 0x10]
mov bl, 1
mov dword [esp + 8], ebx
bt esi, edi
jb 0x4632d0
cmp edi, 0xe
jne 0x4632fc
cmp word [eax], 5
jne 0x4632d0
jmp 0x4632fc
mov dword [esp + 8], 0
mov edi, dword [esp]
mov esi, dword [esp + 4]
lea eax, [edi + 0x50]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
xor eax, eax
cmp eax, dword [edi + 8]
jo 0x463469
mov esi, edi
lea edi, [esp + 0x110]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x154]
cmp eax, dword [edx + 0x54]
jne 0x463456
lea edi, [edx + 0x34]
test eax, eax
je 0x4635d9
lea ecx, [eax - 0x21]
cmp ecx, 0xffffffe0
jb 0x4639ff
xor edx, edx
cmp eax, 8
mov ecx, 0
jb 0x463439
xor edx, edx
cmp eax, 0x10
jae 0x4633c9
mov esi, ecx
mov ecx, eax
movzx edx, dl
and ecx, 0x38
movd xmm0, edx
nop word cs:[eax + eax]
nop
movq xmm1, qword [esp + esi + 0x134]
movq xmm2, qword [edi + esi]
add esi, 8
cmp ecx, esi
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x463380
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd edx, xmm1
jmp 0x463447
mov ecx, eax
pxor xmm0, xmm0
xor edx, edx
and ecx, 0x30
nop word cs:[eax + eax]
nop
movdqu xmm1, xmmword [esp + edx + 0x134]
movdqu xmm2, xmmword [edi + edx]
add edx, 0x10
cmp ecx, edx
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x4633e0
pshufd xmm1, xmm0, 0xee
cmp eax, ecx
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd edx, xmm0
je 0x46344b
test al, 8
jne 0x463366
movzx ebx, byte [edi + ecx]
xor bl, byte [esp + ecx + 0x134]
inc ecx
or dl, bl
cmp eax, ecx
jne 0x463439
mov ebx, dword [ebp + 0xc]
test dl, dl
je 0x4635d9
lea ecx, [esp + 0x110]
call fcn.00459cc0
mov edi, dword [esp]
mov esi, dword [esp + 4]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, 0xf0
mov byte [eax + 0x24f], 0
movzx eax, byte [0x77618d]
call fcn.00490be0
test eax, eax
je 0x4639ff
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], 0x80000000
mov edx, dword [ebp + 0x10]
movsd xmm0, qword [ecx + 0x38]
movsd qword [eax + 0x88], xmm0
movsd xmm0, qword [ecx + 0x30]
movsd qword [eax + 0x80], xmm0
movsd xmm0, qword [ecx + 0x28]
movsd qword [eax + 0x78], xmm0
movsd xmm0, qword [ecx + 0x20]
movsd qword [eax + 0x70], xmm0
movsd xmm0, qword [ecx + 0x18]
movsd qword [eax + 0x68], xmm0
movsd xmm0, qword [ecx + 0x10]
movsd qword [eax + 0x60], xmm0
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [eax + 0x58], xmm1
movsd qword [eax + 0x50], xmm0
movsd xmm0, qword [edi + 0x90]
movsd xmm1, qword [edi + 0x98]
movsd qword [eax + 0x90], xmm0
movsd qword [eax + 0x98], xmm1
movsd xmm0, qword [edi + 0xa0]
movsd qword [eax + 0xa0], xmm0
mov ecx, dword [edi + 0xa8]
mov dword [eax + 0xa8], ecx
movsd xmm1, qword [edi + 0xb4]
movsd xmm0, qword [edi + 0xac]
movsd qword [eax + 0xb4], xmm1
mov ecx, dword [edi + 0xbc]
movsd qword [eax + 0xac], xmm0
mov dword [eax + 0xbc], ecx
mov dword [eax + 0xc0], esi
mov dword [eax + 0xc4], ebx
mov ecx, dword [edx + 0x54]
mov dword [eax + 0xe8], ecx
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [edx + 0x4c]
movsd qword [eax + 0xe0], xmm0
movsd xmm0, qword [edx + 0x44]
movsd qword [eax + 0xd8], xmm0
movq xmm0, qword [edx + 0x34]
movq xmm1, qword [edx + 0x3c]
mov edx, dword [esp + 0x10]
movq qword [eax + 0xd0], xmm1
movq qword [eax + 0xc8], xmm0
mov byte [eax + 0xec], cl
mov ecx, dword [esp + 8]
mov byte [eax + 0xed], cl
mov ecx, dword [esp + 0x14]
mov byte [eax + 0xee], cl
mov dword [edx + 4], eax
mov dword [edx + 8], 0x7352e8
mov byte [edx], 0x16
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x130]
mov al, 0x2c
movzx edx, word [ecx + 0x28]
cmp dx, word [ebx + 0x28]
jne 0x4638bf
mov dword [esp + 8], edi
mov edi, dword [esp]
mov esi, dword [esp + 4]
movzx edx, dx
cmp edx, 0x178
jne 0x463614
movzx ecx, word [ecx + 0x2a]
cmp cx, word [ebx + 0x2a]
jne 0x4638c6
mov ecx, dword [esp + 0xc]
mov al, 0x2d
cmp byte [esp + 0x158], cl
jne 0x4638c6
cmp dword [esp + 0x120], 0x30
jne 0x4639ff
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0x20]
movsd xmm0, qword [edx + 0x38]
movsd xmm1, qword [edx + 8]
movsd qword [esp + 0x58], xmm0
movsd xmm0, qword [edx + 0x30]
movsd qword [esp + 0x28], xmm1
movsd qword [esp + 0x50], xmm0
movsd xmm0, qword [edx + 0x28]
movsd qword [esp + 0x48], xmm0
movsd xmm0, qword [edx + 0x20]
movsd qword [esp + 0x40], xmm0
movsd xmm0, qword [edx + 0x18]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [esp + 0x30], xmm0
movsd xmm0, qword [edx]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [ecx + 0x28]
movsd qword [esp + 0x88], xmm0
movsd xmm0, qword [ecx + 0x20]
movsd qword [esp + 0x80], xmm0
movsd xmm0, qword [ecx + 0x18]
movsd qword [esp + 0x78], xmm0
movsd xmm0, qword [ecx + 0x10]
movsd qword [esp + 0x70], xmm0
movsd xmm0, qword [ecx]
movq xmm1, qword [ecx + 8]
movq qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm0
mov ecx, dword [esi + 0x90]
mov edx, dword [esi + 0x8c]
mov esi, dword [ecx + 8]
dec esi
and esi, 0xfffffff8
lea edx, [edx + esi + 8]
lea esi, [esp + 0x60]
push 0x30
push esi
push 0x20
push eax
push 0xd
push str.CLIENT_RANDOM
push edx
call dword [ecx + 0x18]
add esp, 0x1c
mov esi, dword [ebp + 8]
lea edx, [esp + 0x1c]
mov ecx, esi
call fcn.00471fe0
mov eax, dword [esp + 0x128]
lea ebx, [esp + 0x90]
mov ecx, ebx
mov edx, dword [eax + 0xc]
push dword [eax + 0x10]
call fcn.00467580
add esp, 4
lea ecx, [esp + 0x160]
mov edx, ebx
call fcn.0044ef30
lea ecx, [esi + 0x220]
call fcn.0044eff0
mov eax, dword [esp + 0x168]
cmp byte [esp + 0x14], 0
lea ebx, [edi + 0xac]
mov dword [esi + 0x228], eax
movq xmm0, qword [esp + 0x160]
movq qword [esi + 0x220], xmm0
mov byte [esi + 0x24f], 2
je 0x4638ec
mov edx, edi
lea edi, [esp + 0x90]
mov ecx, 0x14
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x160]
lea esi, [esp + 0x1c]
mov ecx, 0x1d
movsd xmm1, qword [ebx + 8]
mov eax, dword [ebx + 0x10]
movq xmm0, qword [ebx]
movq xmm2, qword [edx + 0x90]
movsd qword [esp + 0x104], xmm1
movsd xmm1, qword [edx + 0x98]
mov dword [esp + 0x10c], eax
movq qword [esp + 0xfc], xmm0
mov eax, dword [edx + 0xa8]
movq qword [esp + 0xe0], xmm2
movsd qword [esp + 0xe8], xmm1
movq xmm1, qword [edx + 0xa0]
mov dword [esp + 0xf8], eax
mov edx, 0x120
movq qword [esp + 0xf0], xmm1
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [0x77618d]
xor ecx, ecx
call fcn.00490be0
test eax, eax
je 0x4639ff
lea esi, [esp + 0x90]
mov ecx, 0x20
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
lea esi, [esp + 0x160]
mov ecx, dword [esp + 4]
add edi, 0x84
mov dword [eax + 0x80], ecx
mov ecx, 0x1d
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 8]
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x118], ecx
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [edx + 0x18]
movsd qword [eax + 0x110], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [eax + 0x108], xmm0
movq xmm0, qword [edx]
movq xmm1, qword [edx + 8]
movq qword [eax + 0x100], xmm1
movq qword [eax + 0xf8], xmm0
mov byte [eax + 0x11c], cl
mov byte [eax + 0x11d], 1
mov ecx, 0x7352c4
jmp 0x4639f0
mov edi, dword [esp]
mov esi, dword [esp + 4]
mov ecx, dword [esp + 0x10]
mov byte [ecx], 9
mov byte [ecx + 1], al
lea ecx, [esp + 0x110]
call fcn.00459cc0
mov bl, 1
lock dec dword [esi]
je 0x4630c4
jmp 0x4630cf
lea edi, [esp + 0x90]
lea esi, [esp + 0x1c]
mov ecx, 0x1d
mov edx, 0x128
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [0x77618d]
xor ecx, ecx
call fcn.00490be0
test eax, eax
je 0x4639ff
mov edx, dword [esp]
mov ecx, 0x14
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x50], 0
mov edi, eax
lea esi, [esp + 0x90]
movsd xmm0, qword [edx + 0x90]
movsd xmm1, qword [edx + 0x98]
add edi, 0x8c
movsd qword [eax + 0x58], xmm0
movsd qword [eax + 0x60], xmm1
movsd xmm0, qword [edx + 0xa0]
movsd qword [eax + 0x68], xmm0
mov ecx, dword [edx + 0xa8]
mov dword [eax + 0x70], ecx
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
movsd qword [eax + 0x74], xmm0
movsd qword [eax + 0x7c], xmm1
mov ecx, dword [ebx + 0x10]
mov dword [eax + 0x84], ecx
mov ecx, dword [esp + 4]
mov dword [eax + 0x88], ecx
mov ecx, 0x1d
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 8]
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x120], ecx
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [edx + 0x18]
movsd qword [eax + 0x118], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [eax + 0x110], xmm0
movq xmm0, qword [edx]
movq xmm1, qword [edx + 8]
movq qword [eax + 0x108], xmm1
movq qword [eax + 0x100], xmm0
mov byte [eax + 0x124], cl
mov ecx, 0x7352a0
mov byte [eax + 0x125], 1
mov edx, dword [esp + 0x10]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
jmp 0x4635ce
ud2