Function at 0x41cf70
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov esi, dword [ebp + 0x14]
mov dword [esp + 0x60], 0xf330935
mov dword [esp + 0x64], 0x3f60df9
mov dword [esp + 0x68], 0x7fa01f9
mov dword [esp + 0x6c], 0x1bee05fd
mov dword [esp + 0x70], 0x1f231991
mov dword [esp + 0x74], 0x13e71deb
mov dword [esp + 0x78], 0x172b11f6
mov dword [esp + 0x7c], 0x2ba315e0
mov dword [esp + 0x80], 0x2fcb29d8
mov dword [esp + 0x84], 0x23d02de1
mov dword [esp + 0x88], 0x27d221c5
mov dword [esp + 0x8c], 0x3bc925af
mov dword [esp + 0x90], 0x3fc139ce
mov dword [esp + 0x94], 0x33cf3d0e
mov dword [esp + 0x98], 0x37c831c3
mov dword [esp + 0x9c], 0xcb3735c7
mov dword [esp + 0xa0], 0xcf1cc9fa
mov dword [esp + 0xa4], 0xc336cd29
mov dword [esp + 0xa8], 0xc735c14b
mov dword [esp + 0xac], 0xdb25c532
mov dword [esp + 0xb0], 0xdf3bd90f
mov dword [esp + 0xb4], 0xd358dd2a
mov dword [esp + 0xb8], 0xd731d129
mov dword [esp + 0xbc], 0xebead531
mov byte [esp + 0xc2], 0
mov word [esp + 0xc0], 0
lea eax, [esp + 0xc0]
mov dword [esp + 4], eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x60]
mov edi, ecx
and edi, 0x40
mov eax, ecx
and eax, 2
mov ebx, eax
xor ebx, 2
imul ebx, edi
or edi, 2
imul edi, eax
mov eax, ecx
xor eax, 0x7ad25a42
add eax, ebx
add eax, edi
xor eax, edx
mov edx, eax
and edx, 0x35
xor eax, 0xb5
lea eax, [eax + edx*2]
inc al
mov byte [esp + ecx + 0x60], al
inc ecx
cmp ecx, 0x63
jne 0x41d0a0
lea edi, [esp + 0x4a0]
lea eax, [esp + 0x60]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x500]
xor ecx, ecx
mov eax, dword [esp + 4]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x60], 0x94959697
mov byte [esp + 0x64], 0
mov eax, 0x23
mov ecx, 0xd67bf7db
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax - 0x6b3dfbff]
mov edi, ecx
and edi, 0x3b
and edx, 4
or edx, edi
xor dl, byte [esp + eax + 0x3d]
xor dl, 0x3b
add dl, 0x4c
mov byte [esp + eax + 0x3d], dl
inc eax
dec ecx
cmp eax, 0x28
jne 0x41d130
mov eax, dword [esp + 0x60]
mov ecx, dword [0x44c3b8]
test ecx, ecx
je 0x41d1a4
xor edx, edx
mov edi, dword [0x44c3bc]
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x9abdb589
je 0x41d180
inc edx
cmp ecx, edx
jne 0x41d170
jmp 0x41d1a4
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x41d1a4
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 5
push 4
push ecx
push dword [0x44c3c0]
call fcn.0043ce20
add esp, 0x1c
mov dword [esp + 0x60], 0xff3e393c
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xa
xor dl, byte [esp + ecx + 0x60]
add dl, 0xce
mov byte [esp + ecx + 0x60], dl
add ecx, 0x8f31b037
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov edx, ecx
not edx
and edx, 0x37
and ecx, 0x48
sub ecx, edx
cmp ecx, 7
jb 0x41d1c0
cmp eax, dword [esp + 0x60]
jne 0x41d280
push dword [esp + 0x28]
call fcn.00439c70
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x60], 0x94959697
mov byte [esp + 0x64], 0
mov eax, 0x23
mov edx, 0xd67bf7db
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ebx, [eax - 0x6b3dfbff]
mov edi, edx
and edi, 0x3b
and ebx, 4
or ebx, edi
xor bl, byte [esp + eax + 0x3d]
xor bl, 0x3b
add bl, 0x4c
mov byte [esp + eax + 0x3d], bl
inc eax
dec edx
cmp eax, 0x28
jne 0x41d230
mov eax, dword [esp + 0x60]
mov edx, dword [0x44c3b8]
test edx, edx
je 0x41d2ad
xor edi, edi
mov ebx, dword [0x44c3bc]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x9abdb589
je 0x41d28b
inc edi
cmp edx, edi
jne 0x41d270
jmp 0x41d2ad
xor ecx, ecx
xor edx, edx
xor edi, edi
jmp 0x41d881
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x41d2ad
push 0
push ecx
push dword [esp + 0x24]
push 5
push 4
push edx
push dword [0x44c3c0]
call fcn.0043ce20
add esp, 0x1c
test eax, eax
mov ebx, dword [ebp + 8]
js 0x41d851
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov dword [esp + 0x10], 0
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
jmp 0x41d2ee
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x41d869
mov edx, edi
mov ecx, dword [edi + eax + 0x3c]
add eax, edi
mov dword [esp + 4], eax
xor eax, eax
nop
nop
nop
nop
movzx edx, word [ecx + eax]
movzx edi, word [ebx + eax]
test dx, dx
je 0x41d315
add eax, 2
cmp dx, di
je 0x41d300
cmp dx, di
jne 0x41d2e0
mov edi, dword [esp + 4]
mov eax, dword [edi + 0x44]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xdc]
mov dword [esi + 0xc], eax
mov ecx, esi
push 0x410
call fcn.0043a030
test eax, eax
js 0x41d2e4
mov dword [esp + 0x24], 0
mov ecx, dword [esi]
mov dword [esp + 0x60], 0x94959697
mov byte [esp + 0x64], 0
mov eax, 0x23
mov edx, 0xd67bf7db
nop
nop
lea ebx, [eax - 0x6b3dfbff]
mov edi, edx
and edi, 0x3b
and ebx, 4
or ebx, edi
xor bl, byte [esp + eax + 0x3d]
xor bl, 0x3b
add bl, 0x4c
mov byte [esp + eax + 0x3d], bl
inc eax
dec edx
cmp eax, 0x28
jne 0x41d360
mov eax, dword [esp + 0x60]
mov edx, dword [0x44c3b8]
test edx, edx
je 0x41d3e0
xor edi, edi
mov ebx, dword [0x44c3bc]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xae6e2b0b
je 0x41d3b0
inc edi
cmp edx, edi
jne 0x41d3a0
jmp 0x41d3e0
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x41d3e0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x2b
push ecx
push 5
push edx
push dword [0x44c3c0]
call fcn.0043ce20
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x60], 0xcf0e090c
mov byte [esp + 0x64], 0
xor edx, edx
mov ecx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x60]
mov esi, 0x4b0595fd
sub esi, edx
or esi, edi
not edi
lea ebx, [edx + 2]
or ebx, edi
and ebx, esi
lea esi, [ebx*2 + 2]
inc ebx
and esi, 0x16
xor ebx, 0xf4
sub ebx, esi
add bl, 2
mov byte [esp + edx + 0x60], bl
mov esi, edx
xor ecx, 1
add ecx, edx
and edx, 1
and esi, 6
sub ecx, esi
add ecx, edx
mov edx, ecx
cmp ecx, 5
jb 0x41d400
cmp eax, dword [esp + 0x60]
jne 0x41d4e0
mov eax, dword [esp + 0x24]
add eax, 2
push eax
call fcn.00439c70
add esp, 4
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x24]
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp + 0x60], 0x94959697
mov byte [esp + 0x64], 0
mov eax, 0x23
mov edi, 0xd67bf7db
nop
nop
nop
nop
nop
lea ebx, [eax - 0x6b3dfbff]
mov ecx, edi
and ecx, 0x3b
and ebx, 4
or ebx, ecx
xor bl, byte [esp + eax + 0x3d]
xor bl, 0x3b
add bl, 0x4c
mov byte [esp + eax + 0x3d], bl
inc eax
dec edi
cmp eax, 0x28
jne 0x41d490
mov eax, dword [esp + 0x60]
mov edi, dword [0x44c3b8]
test edi, edi
je 0x41d515
add edx, 2
xor ebx, ebx
mov ecx, dword [0x44c3bc]
nop
nop
cmp dword [ecx + ebx*8], 0xae6e2b0b
je 0x41d4ef
inc ebx
cmp edi, ebx
jne 0x41d4d0
jmp 0x41d515
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov edi, dword [esp + 4]
jmp 0x41d644
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, eax
je 0x41d515
push 0
push edx
push dword [esp + 0x28]
push 0x2b
push dword [esp + 0x18]
push 5
push ecx
push dword [0x44c3c0]
call fcn.0043ce20
add esp, 0x20
test eax, eax
mov ebx, dword [ebp + 0xc]
js 0x41d631
mov ecx, dword [esp + 0x20]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
nop
cmp eax, edx
je 0x41d548
movzx edi, word [ebx + edx*2]
cmp di, word [ecx + edx*2]
jne 0x41d631
inc edx
test di, di
jne 0x41d530
mov ecx, esi
call fcn.0043a6c0
cmp eax, 2
mov ebx, dword [ebp + 8]
mov edi, dword [esp + 4]
jne 0x41d638
mov ecx, esi
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.0043a4f0
test eax, eax
js 0x41d638
mov ecx, esi
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.0043aa60
test eax, eax
js 0x41d638
mov ecx, esi
push 0
push 0
push 0x80
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.0043aa60
test eax, eax
js 0x41d638
movzx eax, word [esp + 0xd2]
push eax
call fcn.00439c70
add esp, 4
movzx edx, word [esp + 0xd2]
mov ecx, esi
push 0
push 0
push edx
mov dword [esp + 0x18], eax
push eax
push dword [esp + 0xec]
push dword [esp + 0xec]
call fcn.0043aa60
test eax, eax
js 0x41d813
movzx edi, word [esp + 0x4a0]
mov eax, dword [esp + 0xc]
mov dword [esp + 8], eax
test di, di
je 0x41d6a7
lea ecx, [esp + 0x4a0]
mov edx, dword [esp + 0xc]
mov eax, edx
mov dword [esp + 8], edx
jmp 0x41d678
mov ebx, dword [ebp + 8]
mov edi, dword [esp + 4]
push dword [esp + 0x20]
call fcn.00439cf0
add esp, 4
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x14]
je 0x41d659
cmp dword [esp + 0x10], 0
jne 0x41d869
mov ecx, esi
call fcn.0043a1b0
jmp 0x41d2e4
movzx edi, word [ecx]
test di, di
je 0x41d6a7
movzx ebx, word [eax]
test bx, bx
je 0x41d80c
add eax, 2
add ecx, 2
mov edx, dword [esp + 8]
add edx, 2
cmp bx, di
je 0x41d69c
mov dword [esp + 8], edx
mov eax, edx
je 0x41d670
lea ecx, [esp + 0x4a0]
jmp 0x41d670
cmp dword [esp + 8], 0
mov ebx, dword [ebp + 8]
mov edi, dword [esp + 4]
je 0x41d813
mov ecx, esi
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0043aa60
test eax, eax
js 0x41d813
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 8], eax
adc ecx, 0
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x41d764
movzx eax, cx
movzx ecx, dx
mov edx, ecx
xor edx, eax
not ecx
and ecx, eax
add ecx, ecx
cmp ecx, edx
je 0x41d825
push edi
call fcn.00439cf0
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 0x2c]
mov esi, eax
xor esi, dword [esp + 8]
or esi, ecx
mov esi, dword [ebp + 0x14]
je 0x41d80f
mov ecx, esi
push 0
push 0
push 0x68
lea edi, [esp + 0x50c]
push edi
push edx
push eax
call fcn.0043aa60
test eax, eax
js 0x41d80f
movzx eax, word [esp + 0x55a]
push eax
call fcn.00439c70
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x55a]
mov ecx, esi
push 0
push 0
push eax
push edi
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.0043aa60
test eax, eax
js 0x41d736
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x41d7e3
or ecx, 0x20
movzx edx, word [edi + eax]
lea esi, [edx - 0x41]
cmp si, 0x1a
jae 0x41d7f3
or edx, 0x20
mov esi, dword [ebp + 0x14]
test cx, cx
je 0x41d71e
add eax, 2
cmp cx, dx
je 0x41d7d0
jmp 0x41d71e
mov ebx, dword [ebp + 8]
mov edi, dword [esp + 4]
mov eax, dword [esp + 0xc]
push eax
call fcn.00439cf0
add esp, 4
jmp 0x41d638
mov eax, dword [esp + 0x530]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0x10], eax
push edi
call fcn.00439cf0
add esp, 4
jmp 0x41d80f
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push dword [esp + 0x1c]
call fcn.00439cf0
add esp, 4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], edi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, esi
call fcn.0043a1a0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret