Function at 0x4659c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [edx + 8]
movsd xmm0, qword [edx + 0x10]
movsd xmm1, qword [edx + 0x18]
mov dword [esp + 0x18], ecx
mov esi, edx
mov dword [esp + 0x14], eax
movzx eax, byte [edx + 0xc]
movsd qword [esp + 0x28], xmm1
movsd qword [esp + 0x20], xmm0
mov byte [esp + 7], al
movzx eax, byte [0x5da16c]
mov eax, dword [0x5da100]
test eax, eax
jne 0x465a1c
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x465df1
mov dword [0x5da100], eax
push 0x2f8
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x465df1
push 0x2f8
push 0
mov dword [esp + 0x10], eax
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edx, 0xe414a674
mov ecx, 0xf0de7325
mov eax, dword [esi + 0x30]
mov dword [esp + 0x10], esi
movd xmm1, edx
movd xmm0, ecx
punpckldq xmm0, xmm1
movapd xmm1, xmmword [0x55fd10]
mov dword [esp + 0xc], eax
nop
mov eax, 1
mov edx, 0
mov edi, 0x70656462
mov ebx, 0x70656462
lock xadd dword [0x5da080], eax
mov dword [esp + 0x1c], eax
xor eax, 0x79746573
mov ecx, eax
mov esi, eax
add ecx, 0x6e657261
adc edx, 0xdcdecbc7
shld esi, edi, 0x10
shld ebx, eax, 0x10
xor esi, ecx
xor ebx, edx
mov edi, esi
mov ecx, ebx
mov edx, esi
add edi, 0xd7dedfc6
adc ecx, 0xded7d4e2
shld edx, ebx, 0x15
shld ebx, esi, 0x15
add eax, 0xc19fead0
mov esi, 0
movd xmm2, edi
movd xmm6, edx
movd xmm3, ebx
mov edx, dword [esp + 0x1c]
adc esi, 0x1671bdd1
punpckldq xmm6, xmm3
movd xmm3, ecx
movd xmm5, esi
xor ecx, 0x4000000
xor esi, 0xff
punpckldq xmm2, xmm3
movd xmm3, eax
punpcklqdq xmm6, xmm0
movd xmm4, esi
movdqa xmm7, xmm3
punpcklqdq xmm3, xmm4
punpckldq xmm7, xmm5
xor edx, edi
movd xmm5, ecx
punpcklqdq xmm2, xmm7
pxor xmm2, xmm6
movd xmm6, edx
punpcklqdq xmm5, xmm6
movdqa xmm7, xmm2
movdqa xmm4, xmm2
shufps xmm3, xmm2, 0xe2
shufps xmm7, xmm5, 0x24
movdqa xmm5, xmm2
psrlq xmm2, 0x30
psllq xmm4, 0x10
psllq xmm5, 0xd
shufpd xmm2, xmm1, 2
paddq xmm3, xmm7
movsd xmm5, xmm4
orpd xmm2, xmm5
xorpd xmm2, xmm3
pshufd xmm3, xmm3, 0x4b
movapd xmm4, xmm2
movapd xmm5, xmm2
paddq xmm3, xmm2
psrlq xmm4, 0x2b
psrlq xmm5, 0x2f
movsd xmm5, xmm4
movdqa xmm4, xmm2
psllq xmm2, 0x11
psllq xmm4, 0x15
movsd xmm2, xmm4
orpd xmm2, xmm5
xorpd xmm2, xmm3
pshufd xmm3, xmm3, 0x4b
movapd xmm4, xmm2
movapd xmm5, xmm2
paddq xmm3, xmm2
psrlq xmm4, 0x30
psrlq xmm5, 0x33
movsd xmm5, xmm4
movdqa xmm4, xmm2
psllq xmm2, 0xd
psllq xmm4, 0x10
movsd xmm2, xmm4
orpd xmm2, xmm5
xorpd xmm2, xmm3
pshufd xmm3, xmm3, 0x4b
movapd xmm4, xmm2
movapd xmm5, xmm2
paddq xmm3, xmm2
psrlq xmm4, 0x2b
psrlq xmm5, 0x2f
movsd xmm5, xmm4
movdqa xmm4, xmm2
psllq xmm2, 0x11
psllq xmm4, 0x15
movsd xmm2, xmm4
orpd xmm2, xmm5
xorpd xmm2, xmm3
pshufd xmm3, xmm3, 0x4b
movapd xmm4, xmm2
movapd xmm5, xmm2
paddq xmm3, xmm2
psrlq xmm4, 0x30
psrlq xmm5, 0x33
movsd xmm5, xmm4
movdqa xmm4, xmm2
psllq xmm2, 0xd
psllq xmm4, 0x10
movsd xmm2, xmm4
orpd xmm2, xmm5
xorpd xmm2, xmm3
pshufd xmm4, xmm2, 0xee
paddq xmm4, xmm3
pshufd xmm3, xmm4, 0x55
movd esi, xmm4
movdqa xmm4, xmm2
movd eax, xmm3
movdqa xmm3, xmm2
psrlq xmm4, 0x2f
psrlq xmm3, 0x2b
xor esi, eax
movsd xmm4, xmm3
movdqa xmm3, xmm2
psllq xmm2, 0x11
psllq xmm3, 0x15
movsd xmm2, xmm3
orpd xmm2, xmm4
pshufd xmm3, xmm2, 0xee
pxor xmm3, xmm2
movd edx, xmm3
pshufd xmm2, xmm3, 0x55
movd eax, xmm2
xor edx, esi
xor eax, esi
mov ecx, edx
or ecx, eax
je 0x465a70
movsd xmm0, qword [esp + 0x20]
mov esi, dword [esp + 0x18]
movsd xmm1, qword [esp + 0x28]
mov ecx, dword [esp + 0x14]
movsd xmm2, qword [esp + 0x80]
movsd qword [esi + 0x98], xmm1
movsd qword [esi + 0x90], xmm0
mov dword [esi + 0xa0], ecx
movzx ecx, byte [esp + 7]
movsd xmm1, qword [esp + 0x70]
movsd xmm0, qword [esp + 0x68]
mov byte [esi + 0xa4], cl
mov ecx, dword [esp + 8]
mov dword [esi], 0
mov dword [esi + 4], ecx
movsd qword [esi + 0x10], xmm1
movsd xmm1, qword [esp + 0x78]
movsd qword [esi + 0x20], xmm2
movsd xmm2, qword [esp + 0x90]
movsd qword [esi + 8], xmm0
movsd qword [esi + 0x18], xmm1
movsd xmm1, qword [esp + 0x88]
movsd qword [esi + 0x30], xmm2
movsd xmm2, qword [esp + 0x30]
movsd qword [esi + 0x28], xmm1
movsd xmm1, qword [esp + 0x98]
movsd qword [esi + 0x38], xmm1
movsd xmm1, qword [esp + 0x38]
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], ecx
movsd qword [esi + 0x48], xmm2
movsd xmm2, qword [esp + 0x48]
mov ecx, dword [esp + 0xc]
movsd qword [esi + 0x50], xmm1
movsd xmm1, qword [esp + 0x40]
movsd qword [esi + 0x60], xmm2
movsd xmm2, qword [esp + 0x58]
movsd qword [esi + 0x58], xmm1
movsd xmm1, qword [esp + 0x50]
movsd qword [esi + 0x70], xmm2
movsd qword [esi + 0x68], xmm1
movsd xmm1, qword [esp + 0x60]
movsd qword [esi + 0x78], xmm1
mov dword [esi + 0x88], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x84], eax
mov dword [esi + 0x80], edx
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x8c], eax
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x465de9
cmp dword [ecx + 0x28], 0
je 0x465de9
push eax
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 0x2f8
call dbg.handle_alloc_error
ud2