Function at 0x46dcd0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e6bd8
push eax
mov eax, 0xd498
mov dword fs:[0], esp
call fcn.004af1d0
lea eax, [esp + 0xd4a8]
push ebp
push eax
call fcn.0043f2e0
mov ebp, dword [esp + 0xd4b0]
add esp, 4
cmp word [ebp], 0
jne 0x46dd28
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xd498]
mov dword fs:[0], ecx
add esp, 0xd4a4
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
push 0x4ebd38
call ebx
lea esi, [eax + eax + 2]
lea ecx, [esi + 2]
push ecx
call fcn.00445f00
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x4ebd38
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x18], eax
push 0x4ebd38
mov dword [esp + 0xd4b4], 0
call ebx
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
push eax
call fcn.00445f00
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x4ebd38
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x1c], eax
mov si, word [ebp]
test si, si
mov byte [esp + 0xd4b0], 1
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 8
je 0x46e012
nop
mov eax, ebp
mov ecx, 0x4f2810
mov edx, 1
lea esp, [esp]
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x46de31
dec edx
jns 0x46ddd0
mov ax, word [ebp + 4]
cmp ax, 9
jb 0x46ddf7
cmp ax, 0xd
jbe 0x46ddfd
cmp ax, 0x20
jne 0x46de31
add ebp, 4
mov byte [esp + 0x13], 1
mov dword [esp + 0xd4b8], ebp
je 0x46dfe2
mov ax, word [ebp]
cmp ax, 9
jb 0x46de22
cmp ax, 0xd
jbe 0x46de2c
cmp ax, 0x20
jne 0x46dfdb
add ebp, 2
jmp 0x46de12
mov eax, ebp
mov ecx, 0x4f26f4
mov edx, 1
lea ecx, [ecx]
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x46de98
dec edx
jns 0x46de40
mov ax, word [ebp + 4]
cmp ax, 9
lea ecx, [ebp + 4]
jb 0x46de6a
cmp ax, 0xd
jbe 0x46de70
cmp ax, 0x20
jne 0x46de98
lea eax, [esp + 0xd4b8]
push eax
mov byte [esp + 0x16], 2
mov dword [esp + 0xd4bc], ecx
call fcn.0043f2e0
mov ebp, dword [esp + 0xd4bc]
add esp, 4
jmp 0x46dfe2
mov eax, ebp
mov ecx, 0x4f5ee4
mov edx, 1
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x46defc
dec edx
jns 0x46dea4
mov ax, word [ebp + 4]
cmp ax, 9
lea ecx, [ebp + 4]
jb 0x46dece
cmp ax, 0xd
jbe 0x46ded4
cmp ax, 0x20
jne 0x46defc
mov dword [esp + 0xd4b8], ecx
lea ecx, [esp + 0xd4b8]
push ecx
mov byte [esp + 0x16], 1
call fcn.0043f2e0
mov ebp, dword [esp + 0xd4bc]
add esp, 4
jmp 0x46dfe2
mov eax, ebp
mov ecx, 0x4f5ee0
mov edx, 1
jmp 0x46df10
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x46df65
dec edx
jns 0x46df10
mov ax, word [ebp + 4]
cmp ax, 9
lea ecx, [ebp + 4]
jb 0x46df3a
cmp ax, 0xd
jbe 0x46df40
cmp ax, 0x20
jne 0x46df65
lea edx, [esp + 0xd4b8]
push edx
mov byte [esp + 0x16], 0x10
mov dword [esp + 0xd4bc], ecx
call fcn.0043f2e0
mov ebp, dword [esp + 0xd4bc]
add esp, 4
jmp 0x46dfe2
mov eax, ebp
mov ecx, 0x4ef7b4
mov edx, 1
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x46df9e
dec edx
jns 0x46df71
mov ax, word [ebp + 4]
cmp ax, 9
jb 0x46df98
cmp ax, 0xd
jbe 0x46dff1
cmp ax, 0x20
je 0x46dff1
cmp si, 0x2d
jne 0x46e012
lea eax, [esp + 0xd4b8]
push eax
call fcn.0041676d
mov ebp, dword [esp + 0xd4bc]
add esp, 4
test ebp, ebp
je 0x46dfe2
nop
mov ax, word [ebp]
cmp ax, 9
jb 0x46dfd0
cmp ax, 0xd
jbe 0x46dfd6
cmp ax, 0x20
jne 0x46dfdb
add ebp, 2
jmp 0x46dfc0
mov dword [esp + 0xd4b8], ebp
mov si, word [ebp]
test si, si
jne 0x46ddc0
jmp 0x46e012
lea ecx, [esp + 0xd4b8]
add ebp, 4
push ecx
mov dword [esp + 0xd4bc], ebp
call fcn.0043f2e0
mov ebp, dword [esp + 0xd4bc]
add esp, 4
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0xd4c0]
push eax
mov dword [esp + 0x4c], ebp
call fcn.00449370
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042063d
mov edx, dword [esp + 0xd4c8]
add esp, 0x10
cmp word [edx], 0x2c
mov edi, eax
jne 0x46e084
mov esi, edx
lea eax, [esp + 0xd4b8]
add esi, 2
push eax
mov dword [esp + 0xd4bc], esi
call fcn.0043f2e0
push 0x2c
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xd4c4]
push edx
call fcn.00449370
mov ebx, dword [esp + 0x2c]
push ebx
call fcn.0042063d
add esp, 0x14
mov ebp, eax
jmp 0x46e0f4
push 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x20], 0
call fcn.0042723f
mov edx, dword [esp + 0x20]
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x40]
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.004463d0
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], esi
call fcn.0043f2e0
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0042723f
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x50]
add esp, 0x10
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.004463d0
mov ebx, dword [esp + 0x1c]
mov ebp, ebx
cmp word [ebp], 0
je 0x46e71b
cmp word [edi], 0
je 0x46e71b
mov al, byte [esp + 0x12]
xor ebx, ebx
cmp al, 2
je 0x46e16d
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea esp, [esp]
push 0
call fcn.004b171a
add esp, 4
mov ebx, eax
call fcn.00441790
add ebx, eax
call esi
add ebx, eax
mov eax, dword [0x519528]
mov ecx, eax
shl ecx, 4
add ebx, ecx
mov edx, ebx
xor eax, ebx
and edx, 3
cmp dl, 3
mov dword [esp + 0x44], ebx
mov dword [0x519528], eax
jne 0x46e120
test bh, bh
je 0x46e120
mov eax, ebx
shr eax, 0x10
test al, al
je 0x46e120
mov al, ah
and al, 0x88
cmp al, 0x80
jne 0x46e120
cmp byte [esp + 0x12], 0x10
je 0x46e48b
lea ecx, [esp + 0x4c]
call fcn.0044a5a0
lea ecx, [esp + 0x20]
call fcn.0044a5a0
push 0
push 0x80
push 3
push 0
push 7
push 1
push edi
lea ecx, [esp + 0x6c]
mov byte [esp + 0xd4cc], 3
call fcn.004167bc
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x46e1d2
mov esi, 0x4f4b68
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], esi
call fcn.0044a530
mov dword [esp + 0x4c], esi
lea ecx, [esp + 0x50]
jmp 0x46e4e2
push 0
push 0x80
push 2
push 0
push 7
push 0x40000001
push ebp
lea ecx, [esp + 0x40]
call fcn.004167bc
mov eax, dword [esp + 0x24]
test eax, eax
je 0x46e1b3
push 0
push 0
lea ecx, [esp + 0x74]
mov byte [esp + 0x3c], 1
call fcn.0043fb50
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4b0], 4
mov dword [esp + 0xd4a0], eax
mov dword [esp + 0xd4a4], ecx
mov esi, 0x4f3810
mov edi, 7
xor edx, edx
mov dl, byte [esi]
lea ecx, [esp + 0x20]
push edx
call fcn.00442430
inc esi
dec edi
jne 0x46e230
cmp byte [esp + 0x12], 8
mov byte [esp + 0x14], 0x53
jne 0x46e253
mov byte [esp + 0x14], 0x41
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.00442430
mov ecx, ebx
and ecx, 0xfffffff
test ebx, ebx
mov dword [esp + 0x3c], 8
mov dword [esp + 0x38], ecx
je 0x46e27f
xor ebx, 0x5aa59669
cmp byte [esp + 0x12], 8
mov dword [esp + 0x14], ebx
jne 0x46e292
xor ebx, 8
mov word [esp + 0x14], bx
lea esi, [esp + 0x14]
mov edi, 4
jmp 0x46e2a0
xor edx, edx
mov dl, byte [esi]
lea ecx, [esp + 0x20]
push edx
call fcn.00442430
inc esi
dec edi
jne 0x46e2a0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x3c], 0xc
mov dword [esp + 0x1066], 0
xor esi, esi
mov ebp, 1
lea eax, [esp + 0x14]
push eax
push ebp
lea ecx, [esp + 0x1a]
push ecx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1e], 0
mov dword [esp + 0x20], 0
call fcn.00442360
mov edi, eax
call ebx
test edi, edi
je 0x46e32c
cmp dword [esp + 0x14], ebp
jb 0x46e32c
movzx eax, byte [esp + 0x12]
cmp eax, 0xffffffff
je 0x46e32c
movsx edx, si
mov byte [esp + edx + 0x1066], al
mov cl, byte [esp + 0x1089]
inc esi
inc cl
cmp si, 4
mov byte [esp + 0x1089], cl
jl 0x46e2d2
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1066]
mov edi, 4
mov cl, byte [esp + 0x13]
test cl, cl
je 0x46e34e
mov dl, byte [esi]
jmp 0x46e350
xor dl, dl
inc dword [esp + 0x3c]
mov ecx, eax
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov byte [eax + ecx], dl
mov eax, dword [esp + 0x2c]
cmp eax, 0x1000
jl 0x46e387
mov edx, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x48]
push ecx
push eax
mov eax, dword [esp + 0x30]
push edx
push eax
call ebx
xor eax, eax
mov dword [esp + 0x2c], eax
inc esi
dec edi
jne 0x46e342
lea ecx, [esp + 0x6c]
mov dword [esp + 0x3c], 0x10
call fcn.0043fdf0
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, byte [esp + 0x34]
test al, al
mov esi, 0x4f4b68
mov dword [esp + 0x20], esi
je 0x46e3d4
mov eax, dword [esp + 0x2c]
test eax, eax
jle 0x46e3d4
mov ecx, dword [esp + 0x24]
push 0
lea edx, [esp + 0x48]
push edx
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call ebx
mov eax, dword [esp + 0x28]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x2c], 0
je 0x46e3f9
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push edx
call ebp
mov eax, dword [esp + 0x24]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], 0
je 0x46e417
cmp eax, 0xffffffff
je 0x46e417
push eax
call edi
mov al, byte [esp + 0x60]
test al, al
mov dword [esp + 0x24], 0
mov dword [esp + 0x4c], esi
je 0x46e447
mov eax, dword [esp + 0x58]
test eax, eax
jle 0x46e447
mov edx, dword [esp + 0x54]
push 0
lea ecx, [esp + 0x48]
push ecx
push eax
mov eax, dword [esp + 0x5c]
push edx
push eax
call ebx
mov eax, dword [esp + 0x54]
test eax, eax
mov dword [esp + 0x58], 0
je 0x46e466
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push ecx
call ebp
mov eax, dword [esp + 0x50]
test eax, eax
mov dword [esp + 0x54], 0
je 0x46e6e9
cmp eax, 0xffffffff
je 0x46e6e9
push eax
call edi
jmp 0x46e6e9
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], ebx
call fcn.0044a680
lea ecx, [esp + 0x4c]
call fcn.0044a680
push ebx
push 0x80
push 3
push ebx
push 7
push 1
push edi
lea ecx, [esp + 0x40]
mov byte [esp + 0xd4cc], 6
call fcn.004167bc
cmp dword [esp + 0x24], ebx
jne 0x46e4fe
mov esi, 0x4f4b78
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], esi
call fcn.0044a530
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x24]
call fcn.0044a530
lea ecx, [esp + 0x1c]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
jmp 0x46e74a
mov esi, 8
lea ecx, [esp + 0x20]
call fcn.004424b0
dec esi
jne 0x46e503
xor esi, esi
mov edi, 1
inc dword [esp + 0x3c]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x1b]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x1f], 0
mov dword [esp + 0x20], ebx
call fcn.00442360
cmp eax, ebx
je 0x46e548
cmp dword [esp + 0x14], edi
jb 0x46e548
movzx eax, byte [esp + 0x13]
jmp 0x46e54b
or eax, 0xffffffff
mov byte [esp + esi + 0x44], al
inc esi
cmp esi, 4
jl 0x46e516
cmp dword [esp + 0x44], ebx
je 0x46e5b3
mov esi, 0x4f4b78
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], esi
call fcn.0044a530
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], esi
call fcn.0044a530
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x46e596
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x46e5ac
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, edi
jmp 0x46e74f
push ebx
push 0x80
push 2
push ebx
push 7
push 0x40000001
push ebp
lea ecx, [esp + 0x6c]
call fcn.004167bc
cmp dword [esp + 0x50], ebx
jne 0x46e62a
mov esi, 0x4f4b78
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], esi
call fcn.0044a530
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], esi
call fcn.0044a530
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x46e60d
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x46e623
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, edi
jmp 0x46e74f
mov byte [esp + 0x60], 1
mov byte [esp + 0x1089], 0
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov byte [esp + 0x78], 0
mov dword [esp + 0x108c], ebx
mov dword [esp + 0x1090], ebx
lea eax, [esp + 0x4c]
mov dword [esp + 0xd4a4], eax
mov eax, dword [esp + 0x38]
cmp eax, ebx
lea edx, [esp + 0x20]
mov byte [esp + 0xd4b0], 7
mov dword [esp + 0xd4a0], edx
je 0x46e685
xor eax, 0x5aa59669
mov dword [esp + 0x38], eax
mov esi, 4
lea ebx, [ebx]
mov ebp, dword [esp + 0x3c]
lea ecx, [esp + 0x44]
push ecx
push edi
lea edx, [esp + 0x1b]
inc ebp
push edx
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], ebp
call fcn.00442360
dec esi
jne 0x46e690
lea ecx, [esp + 0x6c]
call fcn.004400f0
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, 0x4f4b78
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], esi
call fcn.0044a530
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], esi
call fcn.0044a530
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x46e700
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push ecx
call ebp
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46e717
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push edx
call ebp
xor eax, eax
jmp 0x46e74f
test ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x46e733
mov eax, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46e74a
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, 1
mov ecx, dword [esp + 0xd4a8]
pop edi
pop esi
pop ebx
pop ebp
mov dword fs:[0], ecx
add esp, 0xd4a4
ret 8