Function at 0x441e40
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
movzx eax, word [edi]
mov dword [esp + 4], 0x37365f6d
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x441eb5
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0x622c94b6
and ecx, 0xe22c94b6
lea ecx, [esi + ecx*2]
lea esi, [ecx + edx]
not edx
or ecx, edx
sub edx, ecx
lea ecx, [esi + edx*2]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x72
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x441e70
xor ecx, ecx
cmp dword [esp + 4], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44cfdc]
mov edx, dword [edi + 0x3c]
mov esi, dword [edi + edx]
mov dword [esp + 4], 0x37366468
mov word [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x441f58
nop
nop
nop
nop
nop
mov edi, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
lea ebx, [edi + edi]
and ebx, 0x9836b26c
mov ebp, edi
sub ebp, ebx
mov ebx, edi
xor ebx, 0x33e4a6c9
or edi, 0x4c1b5936
and edi, ebx
lea ebx, [edi*2]
add ebx, ebp
lea edi, [edi*2 + 0x4c1b5936]
add edi, ebp
add ebx, ecx
add ebx, 0x4c1b5936
not ecx
or edi, ecx
sub ecx, edi
lea ecx, [ebx + ecx*2]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xf2
mov edi, dword [esp]
mov byte [esp + edi + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x441ef0
xor ecx, ecx
cmp esi, dword [esp + 4]
setne cl
mov ebx, dword [esp + 0x40]
jmp dword [ecx*4 + 0x44cfe4]
mov esi, dword [ebx + edx + 0x78]
mov ecx, dword [ebx + edx + 0x7c]
mov dword [esp + 0x20], ecx
test ecx, ecx
sete cl
test esi, esi
sete dl
or dl, cl
movzx ecx, dl
mov dword [esp + 0x28], esi
jmp dword [ecx*4 + 0x44cfec]
mov eax, dword [ebx + esi + 0x20]
add eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebx + esi + 0x24]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebx + esi + 0x1c]
add eax, ebx
mov dword [esp + 0x14], eax
xor ecx, ecx
xor eax, eax
cmp ecx, dword [ebx + esi + 0x18]
setb al
mov dword [esp + 0x1c], 1
jmp dword [eax*4 + 0x44cff4]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov edi, dword [eax + ecx*4]
add edi, ebx
mov eax, 0xffffffff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
cmp byte [edi + eax + 1], 0
lea eax, [eax + 1]
lea edx, [edx + 1]
jne 0x441ff0
mov dword [esp + 4], 0xeeeaec71
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x44206d
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov ebp, edx
xor ebp, 0x9643c27
and edx, 0x9643c27
lea edx, [edx*2]
add edx, ebp
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov esi, edx
not esi
and esi, 0xc3
and edx, 0x3c
sub edx, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x442020
test eax, eax
je 0x442090
mov ebp, dword [esp + 4]
lea edx, [eax - 1]
cmp edx, 3
jae 0x4420a0
mov esi, 0xb14a5e2
jmp 0x4420df
mov edx, 0xb14a5e2
jmp 0x442100
mov edx, ecx
and edx, 0xfffffffc
mov esi, 0xb14a5e2
nop
nop
nop
nop
nop
nop
movsx ebx, byte [edi]
xor ebx, esi
imul ebx, ebp
movsx esi, byte [edi + 1]
xor esi, ebx
imul esi, ebp
movsx ebx, byte [edi + 2]
xor ebx, esi
imul ebx, ebp
movsx esi, byte [edi + 3]
add edi, 4
xor esi, ebx
imul esi, ebp
add edx, 0xfffffffc
jne 0x4420b0
mov ebx, dword [esp + 0x40]
mov edx, esi
test al, 3
je 0x442100
and ecx, 3
xor eax, eax
nop
nop
nop
nop
nop
nop
movsx edx, byte [edi + eax]
xor edx, esi
imul edx, ebp
inc eax
mov esi, edx
cmp ecx, eax
jne 0x4420f0
mov eax, dword [0x44d008]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov ecx, dword [esp + 0x1c]
jmp dword [ecx*4 + 0x44d044]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret