Function at 0x41fad0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0xc904973f
push dword [0x44bb2c]
call fcn.0043f1c0
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
je 0x41fb6b
cmp dword [edi], 0xffffffff
jne 0x41fc15
jmp 0x4200e0
push 0x39be051d
push dword [0x44bb2c]
call fcn.0043f1c0
add esp, 8
mov dword [esi], eax
push 0x847b02a2
push dword [0x44bb2c]
call fcn.0043f1c0
add esp, 8
mov dword [esi + 4], eax
push 0x2e775759
push dword [0x44bb2c]
call fcn.0043f1c0
add esp, 8
mov dword [esi + 8], eax
mov ebx, dword [esi + 0x28]
jmp 0x41fbc3
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x41fbf4
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x41fbc0
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 4]
test eax, eax
je 0x41fbf4
push dword [edi]
call dword [esi + 8]
mov dword [edi], 0xffffffff
jmp 0x41fbc0
push 0x18c354a9
push dword [0x44bb2c]
call fcn.0043f1c0
add esp, 8
push dword [esi + 0x28]
call eax
cmp dword [edi], 0xffffffff
je 0x4200e0
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
nop
nop
nop
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x41fc20
mov edx, dword [ebp + 8]
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41fc30
mov dword [esi + 0x1c], edi
mov edx, dword [ebp + 0xc]
nop
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41fc40
add eax, 3
and eax, 0xfffffffc
call fcn.00408100
mov eax, esp
and eax, 0xfffffff0
mov dword [esi], eax
mov esp, eax
mov dword [esi + 0x30], 0xa5a6b3ec
mov dword [esi + 0x34], 0x978996b8
mov dword [esi + 0x38], 0xb9f4f08b
mov dword [esi + 0x3c], 0xbb727251
mov dword [esi + 0x40], 0xfbdc
mov byte [esi + 0x44], 0
mov ecx, 0x18c6253
mov edx, 0xfe739dac
nop
nop
movzx ebx, byte [esi + ecx - 0x18c6223]
mov edi, ebx
not edi
and edi, 0xee
mov eax, ebx
xor eax, 0xee
or ebx, 0x11
and ebx, eax
or ebx, edi
mov edi, edx
and edi, 0xae
mov eax, ecx
and eax, 0x11
or eax, edi
xor eax, ebx
add al, 0x61
mov byte [esi + ecx - 0x18c6223], al
inc ecx
dec edx
cmp ecx, 0x18c6268
jne 0x41fc90
mov dword [esi + 0xc], 0x11bac8c5
mov byte [esi + 0x10], 0xf0
mov dword [esi + 0x11], 0
mov word [esi + 0x15], 0
mov eax, 0xc4d71e7d
mov edi, 0x3b28e182
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + eax + 0x3b28e18f]
mov ecx, eax
and ecx, 0xc0571840
mov edx, edi
and edx, 0x2900e1bf
or edx, ecx
mov ecx, eax
or ecx, ebx
xor edx, ebx
xor edx, 0x40
and edx, ecx
lea ecx, [edi - 0x3b28e100]
not ebx
and ebx, ecx
xor ebx, edx
mov cl, 0x8e
sub cl, bl
mov byte [esi + eax + 0x3b28e18f], cl
inc eax
dec edi
cmp eax, 0xc4d71e88
jne 0x41fd00
movzx eax, byte [esi + 0xc]
mov ebx, dword [esi]
test al, al
je 0x41fd6b
lea edx, [esi + 0xd]
mov ebx, dword [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41fd60
mov byte [ebx], 0
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ecx]
test al, al
je 0x41fd8d
inc ecx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41fd80
jmp 0x41fd90
mov edx, dword [ebp + 8]
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x41fdab
lea ecx, [esi + 0x31]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41fda0
mov byte [ebx], 0
movzx eax, byte [edx]
test al, al
je 0x41fdcb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41fdc0
mov byte [ebx], 0x3a
mov dword [esi + 0x30], 0xc1a96563
mov dword [esi + 0x34], 0xd1d1c1c9
mov dword [esi + 0x38], 0xc096bdd3
mov dword [esi + 0x3c], 0xfcffe9ef
mov dword [esi + 0x40], 0xf5e9f2e9
mov dword [esi + 0x44], 0xf487595f
mov dword [esi + 0x48], 0xfce1f9fa
mov dword [esi + 0x4c], 0xe3ebe0ec
mov dword [esi + 0x50], 0xe189bf96
mov dword [esi + 0x54], 0xf1f1e1e9
mov dword [esi + 0x58], 0xfc4c48f3
mov dword [esi + 0x5c], 0x84d58e8f
mov dword [esi + 0x60], 0x90fb8d8b
mov dword [esi + 0x64], 0x91859e85
mov dword [esi + 0x68], 0xb281fadb
mov dword [esi + 0x6c], 0xe8e2dbf2
mov dword [esi + 0x70], 0xc19b8d83
mov dword [esi + 0x74], 0x9e8eec85
mov dword [esi + 0x78], 0xd0f58ae3
mov dword [esi + 0x7c], 0xdcfdb4b7
mov dword [esi + 0x80], 0xf3d7bfdc
mov dword [esi + 0x84], 0xacdba0d8
mov dword [esi + 0x88], 0x319c8b9
mov dword [esi + 0x8c], 0xe2bfbccd
mov dword [esi + 0x90], 0xc4bcb8b5
mov dword [esi + 0x94], 0xb2afb6a1
mov dword [esi + 0x98], 0x4ec0e8a0
mov dword [esi + 0x9c], 0x5c515e5a
mov dword [esi + 0xa0], 0x120e2552
mov dword [esi + 0xa4], 0xfaf8fc15
mov word [esi + 0xa8], 0xe7fe
mov byte [esi + 0xac], 0
mov word [esi + 0xaa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax + 0x30]
mov edx, eax
and edx, 0x6b
xor edx, 0x2153db6b
mov edi, eax
and edi, 0x14
sub edi, edx
lea edx, [edi + edi]
not edx
add edx, edi
xor edx, edi
and edx, ecx
xor edx, edi
add dl, 0x17
mov byte [esi + eax + 0x30], dl
inc eax
cmp eax, 0x7d
jne 0x41fee0
inc ebx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x41ff2b
inc ecx
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ff20
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x41ff4b
lea ecx, [esi + 0x31]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ff40
mov byte [ebx], 0
mov edi, dword [esi]
sub ebx, edi
push 0xd0026952
push dword [0x44bb2c]
call fcn.0043f1c0
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x1c]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x41ffb7
cmp dword [edi], 0xffffffff
je 0x41ffb7
push 0x59ea2086
push dword [0x44bb2c]
call fcn.0043f1c0
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44bb2c]
call fcn.0043f1c0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x420483
cmp eax, 0xffffffff
je 0x4200e0
push 0x400
call fcn.00408220
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add eax, 0x400
mov dword [esi + 0x14], eax
lea eax, [esi + 0xc]
mov ecx, edi
push eax
call fcn.00420490
mov cl, 1
mov dword [esi + 4], ecx
test al, al
je 0x42046b
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x420148
mov dword [esi + 4], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x20], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x42001e
mov edi, eax
push edi
call fcn.00408220
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x42013a
mov dword [esi + 0x24], edi
cmp eax, ecx
mov dword [esi + 8], ebx
mov edx, dword [esi + 4]
mov dword [esi + 0x18], eax
jbe 0x4200e7
cmp edx, eax
jbe 0x4200e7
test ebx, ebx
je 0x420126
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x18]
add eax, edx
dec eax
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x42007f
neg edi
xor edx, edx
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
dec edx
cmp edi, edx
jne 0x42006c
add ecx, edx
add eax, edx
add edx, dword [esi + 8]
mov edi, dword [esi]
sub edi, dword [esi + 4]
cmp edi, 0xfffffff8
ja 0x420126
neg edx
xor edi, edi
movzx ebx, byte [ecx + edi]
mov byte [eax + edi], bl
movzx ebx, byte [ecx + edi - 1]
mov byte [eax + edi - 1], bl
movzx ebx, byte [ecx + edi - 2]
mov byte [eax + edi - 2], bl
movzx ebx, byte [ecx + edi - 3]
mov byte [eax + edi - 3], bl
movzx ebx, byte [ecx + edi - 4]
mov byte [eax + edi - 4], bl
movzx ebx, byte [ecx + edi - 5]
mov byte [eax + edi - 5], bl
movzx ebx, byte [ecx + edi - 6]
mov byte [eax + edi - 6], bl
movzx ebx, byte [ecx + edi - 7]
mov byte [eax + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420091
jmp 0x420126
xor eax, eax
jmp 0x420483
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x20]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x420126
mov ecx, dword [esi + 8]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.00408230
add esp, 4
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x18]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x30], 0xf9feffec
mov dword [esi + 0x34], 0xdadcd8d9
mov dword [esi + 0x38], 0xc6c2c4cc
mov byte [esi + 0x3c], 0x30
mov dword [esi + 0x3d], 0
mov byte [esi + 0x41], 0
xor ecx, ecx
nop
nop
mov edi, ecx
and edi, 5
mov ebx, ecx
and ebx, 2
mov edx, ebx
xor edx, 2
imul edx, edi
or edi, 2
imul edi, ebx
mov ebx, ecx
xor ebx, 0xc7
add ebx, edx
add ebx, edi
xor bl, byte [esi + ecx + 0x30]
add bl, 0x1d
mov byte [esi + ecx + 0x30], bl
inc ecx
cmp ecx, 0x12
jne 0x420180
mov dh, byte [esi + 0x30]
mov ecx, eax
mov dword [esi + 8], eax
test dh, dh
mov ecx, dword [esi + 0x1c]
je 0x420213
lea edi, [esi + 0x30]
mov dword [esi + 4], edi
mov ebx, eax
mov edi, eax
mov dword [esi + 8], eax
mov edi, dword [esi + 4]
jmp 0x4201e9
mov dh, byte [edi]
test dh, dh
mov ecx, dword [esi + 0x1c]
je 0x420213
mov dl, byte [ebx]
test dl, dl
je 0x42045a
inc edi
mov dword [esi + 4], edi
inc ebx
mov ecx, dword [esi + 8]
lea edi, [ecx + 1]
cmp dl, dh
je 0x420209
mov ecx, edi
mov dword [esi + 8], edi
mov ebx, edi
mov edi, dword [esi + 4]
je 0x4201e0
lea edi, [esi + 0x30]
jmp 0x4201e0
cmp dword [esi + 8], 0
je 0x42045a
mov edx, dword [esi]
jmp 0x42023d
cmp bl, bh
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi]
je 0x42046b
mov ebx, eax
sub ebx, edx
je 0x420266
mov dword [esi], edx
mov dword [esi + 4], edx
mov edi, eax
xor ecx, ecx
mov edx, dword [esi + 4]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, eax
xor ecx, ecx
mov eax, dword [esi]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 0x1c]
add dword [esi + 0x10], ebx
lea eax, [esi + 0xc]
push eax
call fcn.00420490
test al, al
je 0x420464
mov dword [esi + 4], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x4203e0
mov dword [esi + 8], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x24], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x4202a5
mov edi, eax
push edi
call fcn.00408220
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x4203d2
mov dword [esi + 0x2c], edi
cmp eax, ecx
mov dword [esi + 0x18], ebx
mov edx, dword [esi + 8]
mov dword [esi + 0x20], eax
jbe 0x42037f
cmp edx, eax
jbe 0x42037f
test ebx, ebx
je 0x4203be
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x20]
add eax, edx
dec eax
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x420313
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
dec edx
cmp edi, edx
jne 0x420300
add ecx, edx
add eax, edx
add edx, dword [esi + 0x18]
mov edi, dword [esi]
sub edi, dword [esi + 8]
cmp edi, 0xfffffff8
ja 0x4203be
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + edi]
mov byte [eax + edi], bl
movzx ebx, byte [ecx + edi - 1]
mov byte [eax + edi - 1], bl
movzx ebx, byte [ecx + edi - 2]
mov byte [eax + edi - 2], bl
movzx ebx, byte [ecx + edi - 3]
mov byte [eax + edi - 3], bl
movzx ebx, byte [ecx + edi - 4]
mov byte [eax + edi - 4], bl
movzx ebx, byte [ecx + edi - 5]
mov byte [eax + edi - 5], bl
movzx ebx, byte [ecx + edi - 6]
mov byte [eax + edi - 6], bl
movzx ebx, byte [ecx + edi - 7]
mov byte [eax + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420330
jmp 0x4203be
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x24]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x4203be
mov ecx, dword [esi + 0x18]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.00408230
add esp, 4
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov word [esi + 0x30], 0x7775
mov byte [esi + 0x32], 0x7e
lea ecx, [esi + 0x33]
mov byte [ecx + 2], 0
mov word [ecx], 0
mov ecx, 0x78341aea
nop
nop
nop
nop
nop
movzx edx, byte [esi + ecx - 0x78341aba]
xor edx, ecx
mov edi, edx
and edi, 0x6d
xor edx, 0x6d
lea edx, [edx + edi*2]
inc dl
mov byte [esi + ecx - 0x78341aba], dl
inc ecx
cmp ecx, 0x78341af0
jne 0x420410
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + ecx]
mov bh, byte [esi + ecx + 0x30]
test bl, bl
je 0x420230
inc ecx
cmp bl, bh
je 0x420440
jmp 0x420230
push 0x3ea
call fcn.0041f4a0
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x420480
cmp eax, dword [esi + 0x10]
je 0x420480
push eax
call fcn.00408230
add esp, 4
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc