Function at 0x4835e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x35c
mov esi, dword [esp + 0x388]
mov al, byte [esp + 0x394]
mov byte [esp + 0x9f], al
cmp esi, 0xfffff
ja 0x483dbe
mov edx, dword [esp + 0x370]
mov eax, dword [edx]
mov eax, dword [eax]
cmp eax, 0x2a0
je 0x483f9c
jg 0x483674
cmp eax, 4
je 0x484054
cmp eax, 0x40
je 0x483ff8
mov dword [esp + 8], 0x5e08b0
mov dword [esp + 4], 0x1de
mov dword [esp], str.s3_cbc.c
call fcn.004d2910
mov eax, dword [esp + 0x378]
test eax, eax
je 0x483669
mov eax, dword [esp + 0x378]
mov dword [eax], 0xffffffff
add esp, 0x35c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x2a2
je 0x48410c
jl 0x4840b0
cmp eax, 0x2a3
jne 0x483635
lea eax, [esp + 0x278]
mov dword [esp + 0x64], eax
mov dword [esp], eax
call fcn.004f2450
mov eax, 0x2b
mov ebp, 0x33
mov ecx, 0x200
mov byte [esp + 0x1c], 1
mov ebx, 8
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x6c], 0x1c
mov dword [esp + 0x68], 0x4f25f0
mov dword [esp + 0x70], 0x482cf0
cmp byte [esp + 0x9f], 0
je 0x483d1f
mov edi, dword [esp + 0x98]
mov edx, dword [esp + 0x390]
lea edx, [edi + edx + 0xb]
mov dword [esp + 0x30], edx
add esi, edx
mov dword [esp + 0x4c], esi
add eax, esi
xor edx, edx
div dword [esp + 0x28]
mov esi, eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x384]
add edi, eax
mov eax, edi
xor edx, edx
div dword [esp + 0x28]
mov dword [esp + 0x34], edx
mov dword [esp + 0x84], eax
lea eax, [edi + ebx]
xor edx, edx
div dword [esp + 0x28]
mov dword [esp + 0x88], eax
mov eax, 3
mov dword [esp + 0x74], 2
cmp esi, eax
jbe 0x483d0a
mov eax, esi
sub eax, dword [esp + 0x74]
mov dword [esp + 0x58], eax
imul eax, dword [esp + 0x28]
mov dword [esp + 0x54], eax
mov dword [esp + 0x74], esi
lea edx, [edi*8]
cmp byte [esp + 0x9f], 0
je 0x483e1b
lea edi, [esp + 0xf8]
mov dword [esp + 0x7c], edi
cmp byte [esp + 0x1c], 0
je 0x483cc1
lea esi, [ebx - 4]
lea edi, [esp + 0xa8]
mov dword [esp + 0x1c], edi
cmp esi, 4
jb 0x4837be
mov ecx, esi
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, edx
shr eax, 0x18
mov byte [esp + esi + 0xa8], al
mov eax, edx
shr eax, 0x10
mov byte [esp + ebx + 0xa5], al
mov eax, edx
shr eax, 8
mov byte [esp + ebx + 0xa6], al
mov byte [esp + ebx + 0xa7], dl
mov eax, dword [esp + 0x54]
test eax, eax
je 0x4838dd
cmp byte [esp + 0x9f], 0
je 0x483efb
mov ebp, dword [esp + 0x30]
sub ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x37c]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x64]
mov dword [esp], edi
mov eax, dword [esp + 0x68]
call eax
lea eax, [esp + 0x1f8]
mov edi, eax
mov ecx, dword [esp + 0x37c]
mov edx, dword [esp + 0x28]
lea esi, [ecx + edx]
cmp ebp, 4
jae 0x4842d7
xor edx, edx
test ebp, 2
jne 0x4842be
test ebp, 1
jne 0x4842b3
mov esi, dword [esp + 0x28]
sub esi, ebp
mov dword [esp + 0x20], esi
mov edx, esi
lea edi, [eax + ebp]
mov esi, dword [esp + 0x380]
cmp edx, 4
jae 0x48428b
xor ecx, ecx
test dl, 2
jne 0x484275
and edx, 1
jne 0x48426a
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov esi, dword [esp + 0x68]
call esi
mov eax, dword [esp + 0x54]
xor edx, edx
div dword [esp + 0x28]
lea edi, [eax - 1]
cmp edi, 1
jbe 0x4838dd
mov ebp, dword [esp + 0x380]
add ebp, dword [esp + 0x20]
mov esi, 1
mov dword [esp + 4], ebp
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov edx, dword [esp + 0x68]
call edx
inc esi
add ebp, dword [esp + 0x28]
cmp esi, edi
jne 0x4838c3
lea ebp, [esp + 0xb8]
mov ecx, 0x10
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x74]
lea esi, [esp + 0x178]
cmp dword [esp + 0x58], eax
ja 0x483bcb
mov edx, dword [esp + 0x34]
inc edx
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x28]
sub ecx, ebx
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x34]
not edx
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x38]
not ecx
mov dword [esp + 0x40], ecx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x483d98
mov esi, dword [esp + 0x28]
mov dword [esp + 0x8c], esi
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x483d87
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x78], edi
shr edi, 2
mov eax, edi
shl eax, 2
mov dword [esp + 0x80], eax
sete byte [esp + 0x9e]
jne 0x483da8
mov dword [esp + 0x90], 0
lea esi, [esp + 0x178]
sub ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x1c]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x94], edi
nop
lea esi, [esi]
mov edx, dword [esp + 0x58]
xor edx, dword [esp + 0x84]
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov byte [esp + 0x20], dl
mov edx, dword [esp + 0x58]
xor edx, dword [esp + 0x88]
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x60], edx
mov edi, edx
mov cl, dl
not ecx
mov byte [esp + 0x9c], cl
mov al, byte [esp + 0x20]
or byte [esp + 0x9c], al
mov edx, dword [esp + 0x34]
neg edx
mov dword [esp + 0x1c], edx
mov ebx, dword [esp + 0x54]
xor eax, eax
mov edx, ebx
sub edx, dword [esp + 0x30]
add edx, dword [esp + 0x380]
mov dword [esp + 0x5c], edx
mov ecx, dword [esp + 0x37c]
add ecx, ebx
mov dword [esp + 0x48], ecx
movzx edx, byte [esp + 0x60]
not edx
mov dword [esp + 0x44], edx
mov ecx, edi
mov byte [esp + 0x9d], cl
mov dword [esp + 0x2c], esi
jmp 0x483aaa
mov dl, byte [esp + 0x20]
and esi, edx
mov ecx, esi
and ecx, 0xff
not ecx
mov edi, dword [esp + 0x48]
xor edx, edx
mov dl, byte [edi + eax]
and ecx, edx
inc ebx
mov edx, dword [esp + 0x38]
xor edx, eax
mov edi, dword [esp + 0x24]
add edi, eax
or edx, edi
not edx
and esi, 0x80
or ecx, esi
mov esi, dword [esp + 0x40]
and esi, eax
or edx, esi
sar edx, 0x1f
and edx, dword [esp + 0x20]
not edx
and edx, dword [esp + 0x9c]
and edx, ecx
cmp eax, dword [esp + 0x3c]
jb 0x483a98
and edx, dword [esp + 0x44]
mov cl, byte [esp + 0x9d]
mov esi, dword [esp + 0x50]
and cl, byte [esi + eax]
or edx, ecx
mov edi, dword [esp + 0x2c]
mov byte [edi + eax], dl
inc eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x28], eax
jbe 0x483b00
mov esi, dword [esp + 0x34]
xor esi, eax
or esi, dword [esp + 0x1c]
not esi
mov edx, dword [esp + 0x24]
and edx, eax
or esi, edx
sar esi, 0x1f
cmp ebx, dword [esp + 0x30]
jb 0x483a30
cmp ebx, dword [esp + 0x4c]
jb 0x483ae0
mov dl, byte [esp + 0x20]
and esi, edx
xor ecx, ecx
jmp 0x483a4b
mov cl, byte [esp + 0x20]
and esi, ecx
mov ecx, esi
and ecx, 0xff
not ecx
mov edi, dword [esp + 0x5c]
xor edx, edx
mov dl, byte [edi + eax]
and ecx, edx
jmp 0x483a4b
mov esi, edi
movzx edi, byte [esp + 0x9d]
mov dword [esp + 4], esi
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov edx, dword [esp + 0x68]
call edx
mov dword [esp + 4], esi
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov eax, dword [esp + 0x70]
call eax
cmp byte [esp + 0x9e], 0
jne 0x483b8b
xor ecx, ecx
mov edx, edi
mov cl, dl
mov ch, byte [esp + 0x60]
mov eax, edi
and eax, 0xff
mov edx, eax
shl edx, 0x10
and ecx, 0xffff
shl eax, 0x18
or ecx, edx
or ecx, eax
xor eax, eax
mov ebx, dword [esp + 0x94]
lea esi, [esi]
lea edi, [edi]
mov edx, dword [esi + eax*4]
and edx, ecx
or dword [ebp + eax*4], edx
inc eax
cmp ebx, eax
ja 0x483b70
mov ecx, dword [esp + 0x80]
cmp dword [esp + 0x78], ecx
je 0x483bae
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x6c]
lea esi, [esi]
lea edi, [edi]
mov edx, edi
and dl, byte [esi + eax]
or byte [ebp + eax], dl
inc eax
cmp ecx, eax
ja 0x483ba0
inc dword [esp + 0x58]
mov edi, dword [esp + 0x8c]
add dword [esp + 0x54], edi
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x58], eax
jbe 0x4839a0
mov dword [esp], esi
call fcn.004d1550
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x370]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004d1650
cmp byte [esp + 0x9f], 0
jne 0x483ddf
mov edi, dword [esp + 0x28]
test edi, edi
je 0x483db4
mov ebx, dword [esp + 0x28]
mov ecx, ebx
shr ecx, 2
mov eax, ecx
shl eax, 2
je 0x483c30
xor edx, edx
mov edi, dword [esp + 0x7c]
xor dword [edi + edx*4], 0x6a6a6a6a
inc edx
cmp edx, ecx
jb 0x483c20
cmp eax, ebx
je 0x483c49
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x7c]
nop
lea esi, [esi]
xor byte [edx + eax], 0x6a
inc eax
cmp ecx, eax
ja 0x483c40
mov edx, dword [esp + 0x28]
mov dword [esp + 8], edx
mov edi, dword [esp + 0x7c]
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004d1950
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.004d1950
lea eax, [esp + 0xa4]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x374]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004d20c0
mov ebx, dword [esp + 0x378]
test ebx, ebx
je 0x483cae
mov eax, dword [esp + 0xa4]
mov edx, dword [esp + 0x378]
mov dword [edx], eax
mov dword [esp], esi
call fcn.004d1a50
add esp, 0x35c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esp + 0xa8]
mov dword [esp + 0x1c], edi
cmp ebx, 4
jb 0x483cda
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, edx
shr eax, 0x18
mov byte [esp + ebx + 0xa3], al
mov eax, edx
shr eax, 0x10
mov byte [esp + ebx + 0xa2], al
mov eax, edx
shr eax, 8
mov byte [esp + ebx + 0xa1], al
mov byte [esp + ebx + 0xa0], dl
jmp 0x4837e9
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
jmp 0x483777
lea edi, [esi + 0xd]
mov dword [esp + 0x4c], edi
mov edx, dword [esp + 0x28]
lea eax, [edx + esi + 0xc]
add eax, ebx
sub eax, dword [esp + 0x6c]
xor edx, edx
div dword [esp + 0x28]
mov esi, eax
mov edi, dword [esp + 0x384]
add edi, 0xd
sub edi, dword [esp + 0x6c]
mov eax, edi
xor edx, edx
div dword [esp + 0x28]
mov dword [esp + 0x34], edx
mov dword [esp + 0x84], eax
lea eax, [edi + ebx]
xor edx, edx
div dword [esp + 0x28]
mov dword [esp + 0x88], eax
mov eax, 6
mov dword [esp + 0x74], 6
mov dword [esp + 0x30], 0xd
jmp 0x483758
mov dword [esp + 0x78], 1
mov edi, dword [esp + 0x78]
jmp 0x483956
mov dword [esp + 0x8c], 1
jmp 0x483942
mov dword [esp + 0x90], eax
jmp 0x48397e
mov ebx, 1
jmp 0x483c0e
mov dword [esp + 8], str.data_plus_mac_plus_padding_size___10241024
mov dword [esp + 4], 0x1a8
mov dword [esp], str.s3_cbc.c
call fcn.004d2910
jmp 0x48360b
cmp dword [esp + 0x98], 4
jae 0x484250
mov edx, dword [esp + 0x390]
mov dword [esp + 8], edx
mov ecx, dword [esp + 0x38c]
mov dword [esp + 4], ecx
mov dword [esp], esi
call fcn.004d1950
mov edi, dword [esp + 0x98]
mov dword [esp + 8], edi
jmp 0x483c51
add edx, ecx
lea edi, [esp + 0xf8]
mov dword [esp + 0x7c], edi
cmp dword [esp + 0x28], 4
jae 0x48420b
cmp dword [esp + 0x390], 0x80
ja 0x484227
mov edi, dword [esp + 0x7c]
mov esi, dword [esp + 0x38c]
cmp dword [esp + 0x390], 4
jae 0x4841ed
xor eax, eax
test byte [esp + 0x390], 2
jne 0x4841d2
test byte [esp + 0x390], 1
jne 0x4841bf
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4841b5
mov edi, dword [esp + 0x28]
mov esi, edi
shr esi, 2
mov eax, esi
shl eax, 2
je 0x483ec4
xor ecx, ecx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x7c]
jmp 0x483eb0
xor dword [edx + ecx*4], 0x36363636
inc ecx
cmp esi, ecx
ja 0x483eb0
mov edx, dword [esp + 0x20]
cmp edi, eax
je 0x483ed9
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x7c]
lea esi, [esi]
xor byte [ecx + eax], 0x36
inc eax
cmp esi, eax
ja 0x483ed0
mov edi, dword [esp + 0x7c]
mov dword [esp + 4], edi
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x68]
call ecx
mov edx, dword [esp + 0x14]
jmp 0x483797
lea eax, [esp + 0x1f8]
mov ecx, 3
mov edi, eax
mov esi, dword [esp + 0x37c]
rep movsd dword es:[edi], dword [esi]
mov cl, byte [esi]
mov byte [edi], cl
mov edx, ebp
lea edi, [esp + 0x205]
mov esi, dword [esp + 0x380]
cmp ebp, 4
jae 0x484189
xor ecx, ecx
test dl, 2
jne 0x484173
and edx, 1
jne 0x484168
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov esi, dword [esp + 0x68]
call esi
mov eax, dword [esp + 0x54]
xor edx, edx
div dword [esp + 0x28]
mov edi, eax
cmp eax, 1
jbe 0x4838dd
mov ecx, dword [esp + 0x380]
mov edx, dword [esp + 0x28]
lea ebp, [ecx + edx - 0xd]
mov esi, 1
mov dword [esp + 4], ebp
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov edx, dword [esp + 0x68]
call edx
inc esi
add ebp, dword [esp + 0x28]
cmp esi, edi
jne 0x483f7d
jmp 0x4838dd
lea edx, [esp + 0x278]
mov dword [esp + 0x64], edx
mov dword [esp], edx
call fcn.004f24f0
mov eax, 0x27
mov ebp, 0x33
mov ecx, 0x200
mov byte [esp + 0x1c], 1
mov ebx, 8
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x6c], 0x20
mov dword [esp + 0x68], 0x4f25f0
mov dword [esp + 0x70], 0x482cf0
jmp 0x4836e3
lea edi, [esp + 0x278]
mov dword [esp + 0x64], edi
mov dword [esp], edi
call fcn.004f2090
mov eax, 0x33
mov ebp, 0x33
mov ecx, 0x200
mov byte [esp + 0x1c], 1
mov ebx, 8
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x6c], 0x14
mov dword [esp + 0x68], 0x4f1e50
mov dword [esp + 0x70], 0x482c40
jmp 0x4836e3
lea ecx, [esp + 0x278]
mov dword [esp + 0x64], ecx
mov dword [esp], ecx
call fcn.004c78a0
mov eax, 0x37
mov ebp, 0x33
mov ecx, 0x200
mov byte [esp + 0x1c], 0
mov ebx, 8
mov dword [esp + 0x98], 0x30
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x6c], 0x10
mov dword [esp + 0x68], 0x4c7670
mov dword [esp + 0x70], 0x482bb0
jmp 0x4836e3
lea ecx, [esp + 0x278]
mov dword [esp + 0x64], ecx
mov dword [esp], ecx
call fcn.004f2a70
mov eax, 0x5f
mov ebp, 0x73
mov ecx, 0x400
mov byte [esp + 0x1c], 1
mov ebx, 0x10
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], pe_nt_image_headers32
mov dword [esp + 0x6c], 0x30
mov dword [esp + 0x68], 0x4f3510
mov dword [esp + 0x70], 0x482e00
jmp 0x4836e3
lea edi, [esp + 0x278]
mov dword [esp + 0x64], edi
mov dword [esp], edi
call fcn.004f2b20
mov eax, 0x4f
mov ebp, 0x73
mov ecx, 0x400
mov byte [esp + 0x1c], 1
mov ebx, 0x10
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], pe_nt_image_headers32
mov dword [esp + 0x6c], 0x40
mov dword [esp + 0x68], 0x4f3510
mov dword [esp + 0x70], 0x482e00
jmp 0x4836e3
mov dl, byte [esi + ecx]
mov byte [edi + ecx], dl
jmp 0x483f43
mov cx, word [esi]
mov word [edi], cx
mov ecx, 2
and edx, 1
je 0x483f43
jmp 0x484168
test edi, 1
jne 0x484302
test edi, 2
jne 0x4842ee
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
test dl, 2
je 0x483f3a
jmp 0x484173
mov edi, 1
jmp 0x483e8b
mov cl, byte [esi + eax]
mov byte [edi + eax], cl
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4841b5
jmp 0x483e87
mov ax, word [esi]
mov word [edi], ax
mov eax, 2
test byte [esp + 0x390], 1
je 0x483e7b
jmp 0x4841bf
mov ecx, dword [esp + 0x390]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor eax, eax
test byte [esp + 0x390], 2
je 0x483e6d
jmp 0x4841d2
mov ecx, dword [esp + 0x28]
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
cmp dword [esp + 0x390], 0x80
jbe 0x483e44
mov dword [esp + 8], str.mac_secret_length___sizeof_hmac_pad_
mov dword [esp + 4], 0x237
mov dword [esp], str.s3_cbc.c
mov dword [esp + 0x14], edx
call fcn.004d2910
mov edx, dword [esp + 0x14]
jmp 0x483e44
mov ecx, dword [esp + 0x98]
shr ecx, 2
mov eax, 0x5c5c5c5c
mov edi, dword [esp + 0x7c]
rep stosd dword es:[edi], eax
jmp 0x483ded
mov dl, byte [esi + ecx]
mov byte [edi + ecx], dl
jmp 0x483890
mov cx, word [esi]
mov word [edi], cx
mov ecx, 2
and edx, 1
je 0x483890
jmp 0x48426a
test edi, 1
jne 0x48432f
test edi, 2
jne 0x48431b
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
test dl, 2
je 0x483887
jmp 0x484275
mov cl, byte [esi + edx]
mov byte [edi + edx], cl
jmp 0x48385d
mov dx, word [esi]
mov word [edi], dx
mov edx, 2
test ebp, 1
je 0x48385d
jmp 0x4842b3
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor edx, edx
test ebp, 2
je 0x483851
jmp 0x4842be
mov cx, word [esi]
mov word [edi], cx
add edi, 2
add esi, 2
sub edx, 2
jmp 0x4841a1
mov cl, byte [esi]
mov byte [edi], cl
lea edi, [esp + 0x206]
mov esi, dword [esp + 0x380]
inc esi
dec edx
jmp 0x484195
mov cx, word [esi]
mov word [edi], cx
add edi, 2
add esi, 2
sub edx, 2
jmp 0x48429f
mov dl, byte [esi]
mov byte [edi], dl
inc edi
mov esi, dword [esp + 0x380]
inc esi
mov edx, dword [esp + 0x20]
dec edx
jmp 0x484297