Function at 0x4230f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov dword [esp + 0x60], 0xe1b1e7b3
mov dword [esp + 0x64], 0xdd6ee36f
mov dword [esp + 0x68], 0xd94adf47
mov dword [esp + 0x6c], 0xd556db43
mov dword [esp + 0x70], 0xd181d75f
mov dword [esp + 0x74], 0xcd5dd35d
mov dword [esp + 0x78], 0xc999cf6e
mov dword [esp + 0x7c], 0xc541cb44
mov dword [esp + 0x80], 0xc159c754
mov dword [esp + 0x84], 0x3d54c387
mov dword [esp + 0x88], 0x39b23fa3
mov dword [esp + 0x8c], 0x35ab3bb1
mov dword [esp + 0x90], 0x31a337a6
mov dword [esp + 0x94], 0x2da53366
mov dword [esp + 0x98], 0x29b42fbd
mov dword [esp + 0x9c], 0x25bd2bb9
mov dword [esp + 0xa0], 0x21902772
mov dword [esp + 0xa4], 0x1dae23bf
mov dword [esp + 0xa8], 0x198f1f95
mov dword [esp + 0xac], 0x158f1b8a
mov dword [esp + 0xb0], 0x118917b9
mov dword [esp + 0xb4], 0xd9c1382
mov dword [esp + 0xb8], 0x9930f97
mov dword [esp + 0xbc], 0x50a0b97
mov byte [esp + 0xc2], 0
mov word [esp + 0xc0], 0
lea eax, [esp + 0xc0]
mov dword [esp + 0xc], eax
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0x14], ecx
movzx edi, byte [esp + ebx + 0x60]
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x14]
and ecx, 0xc0
mov edx, ebx
xor edx, 0xfb27fe60
lea eax, [ecx + edx]
add eax, 0x8c821679
lea esi, [ecx + edx]
add esi, 0x79
and esi, edi
mov edi, eax
or edi, dword [esp + 0x10]
not edi
or edi, esi
add ecx, edx
add ecx, 0xc821679
and ecx, edi
add ecx, ecx
sub eax, ecx
add eax, dword [esp + 0x10]
mov ecx, eax
xor ecx, 0x3e
and eax, 0x41
add eax, eax
sub eax, ecx
mov ecx, dword [esp + 0x14]
inc al
mov byte [esp + ebx + 0x60], al
inc ebx
add ecx, 2
cmp ebx, 0x63
jne 0x423210
lea edi, [esp + 0x4a0]
lea eax, [esp + 0x60]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x500]
xor ecx, ecx
mov eax, dword [esp + 0xc]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x60], 0x94959a9b
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
mov eax, 0x213a0566
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x213a0506]
lea edx, [eax - 0x213a0500]
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, 0xfe
sub edx, ecx
inc ecx
and edx, 0xaa
and ecx, 0x55
sub ecx, edx
add cl, 0xab
mov byte [esp + eax - 0x213a0506], cl
inc eax
cmp eax, 0x213a056d
jne 0x4232d0
mov eax, dword [esp + 0x60]
mov ecx, dword [0x4528cc]
test ecx, ecx
mov edi, dword [ebp + 0x14]
je 0x423340
xor edx, edx
mov esi, dword [0x4528d0]
mov ebx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xc85f7986
je 0x423345
inc edx
cmp ecx, edx
jne 0x423330
jmp 0x423369
mov ebx, dword [ebp + 8]
jmp 0x423369
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x423369
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 5
push 4
push dword [0x4528d4]
push ecx
call fcn.004428e0
add esp, 0x1c
cmp eax, 0xc0000004
jne 0x423413
push dword [esp + 0x28]
call fcn.0043fce0
add esp, 4
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x60], 0x94959a9b
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
mov eax, 0x213a0566
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x213a0506]
lea esi, [eax - 0x213a0500]
and esi, edx
or edx, eax
xor edx, esi
mov esi, 0xfe
sub esi, edx
inc edx
and esi, 0xaa
and edx, 0x55
sub edx, esi
add dl, 0xab
mov byte [esp + eax - 0x213a0506], dl
inc eax
cmp eax, 0x213a056d
jne 0x4233b0
mov eax, dword [esp + 0x60]
mov edx, dword [0x4528cc]
test edx, edx
je 0x423443
xor esi, esi
mov edi, dword [0x4528d0]
nop
cmp dword [edi + esi*8], 0xc85f7986
je 0x42341e
inc esi
cmp edx, esi
jne 0x423400
mov edi, dword [ebp + 0x14]
jmp 0x423443
xor ecx, ecx
xor edx, edx
xor esi, esi
jmp 0x4239db
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
mov edi, dword [ebp + 0x14]
je 0x423443
push 0
push ecx
push dword [esp + 0x28]
push 5
push 4
push dword [0x4528d4]
push edx
call fcn.004428e0
add esp, 0x1c
test eax, eax
js 0x4239ab
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
jmp 0x42347d
mov edi, dword [ebp + 0x14]
mov eax, dword [esi]
test eax, eax
je 0x4239c3
mov ecx, dword [esi + eax + 0x3c]
add esi, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx + eax]
movzx edi, word [ebx + eax]
test dx, dx
je 0x4234a5
add eax, 2
cmp dx, di
je 0x423490
cmp dx, di
jne 0x423470
mov eax, dword [esi + 0x44]
mov edi, dword [ebp + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xdc]
mov dword [edi + 0xc], eax
mov ecx, edi
push 0x410
call fcn.00440030
test eax, eax
js 0x423473
mov dword [esp + 0x24], 0
mov eax, dword [edi]
mov dword [esp + 0xc], eax
mov dword [esp + 0x60], 0x94959a9b
lea eax, [esp + 0x64]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0x213a0566
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x213a0506]
lea ecx, [eax - 0x213a0500]
and ecx, edx
or edx, eax
xor edx, ecx
mov ecx, 0xfe
sub ecx, edx
inc edx
and ecx, 0xaa
and edx, 0x55
sub edx, ecx
add dl, 0xab
mov byte [esp + eax - 0x213a0506], dl
inc eax
cmp eax, 0x213a056d
jne 0x423500
mov eax, dword [esp + 0x60]
mov edx, dword [0x4528cc]
test edx, edx
je 0x423590
xor edi, edi
mov ecx, dword [0x4528d0]
nop
cmp dword [ecx + edi*8], 0x62429966
je 0x423563
inc edi
cmp edx, edi
jne 0x423550
mov edi, dword [ebp + 0x14]
jmp 0x423590
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
mov edi, dword [ebp + 0x14]
je 0x423590
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x2b
push dword [esp + 0x1c]
push 5
push dword [0x4528d4]
push ecx
call fcn.004428e0
add esp, 0x20
nop
nop
cmp eax, 0xc0000004
jne 0x4237f1
mov eax, dword [esp + 0x24]
add eax, 2
push eax
call fcn.0043fce0
add esp, 4
mov dword [esp + 0xc], eax
mov edi, dword [edi]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x60], 0x94959a9b
lea eax, [esp + 0x64]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0x213a0566
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x213a0506]
lea edx, [eax - 0x213a0500]
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, 0xfe
sub edx, ecx
inc ecx
and edx, 0xaa
and ecx, 0x55
sub ecx, edx
add cl, 0xab
mov byte [esp + eax - 0x213a0506], cl
inc eax
cmp eax, 0x213a056d
jne 0x4235e0
mov eax, dword [esp + 0x60]
mov ecx, dword [0x4528cc]
test ecx, ecx
je 0x423679
mov dword [esp + 4], edi
add dword [esp + 0x18], 2
xor edi, edi
mov edx, dword [0x4528d0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + edi*8], 0x62429966
je 0x423650
inc edi
cmp ecx, edi
jne 0x423640
jmp 0x423679
mov ecx, dword [edx + edi*8 + 4]
cmp ecx, eax
je 0x423679
push 0
push dword [esp + 0x1c]
push dword [esp + 0x14]
push 0x2b
push dword [esp + 0x14]
push 5
push dword [0x4528d4]
push ecx
call fcn.004428e0
add esp, 0x20
test eax, eax
js 0x4237e2
mov ecx, dword [esp + 0xc]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
cmp eax, edx
je 0x4236ab
movzx edi, word [ecx + edx*2]
mov ebx, dword [ebp + 0xc]
cmp word [ebx + edx*2], di
jne 0x4237df
inc edx
test di, di
jne 0x423690
mov edi, dword [ebp + 0x14]
mov ecx, edi
call fcn.00440720
cmp eax, 2
mov ebx, dword [ebp + 8]
jne 0x4237e5
mov ecx, edi
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.00440500
test eax, eax
js 0x4237e5
mov ecx, edi
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.00440a70
test eax, eax
js 0x4237e5
mov ecx, edi
push 0
push 0
push 0x80
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.00440a70
test eax, eax
js 0x4237e5
movzx eax, word [esp + 0xd2]
push eax
call fcn.0043fce0
add esp, 4
movzx edx, word [esp + 0xd2]
mov ecx, edi
push 0
push 0
push edx
mov dword [esp + 0x14], eax
push eax
push dword [esp + 0xec]
push dword [esp + 0xec]
call fcn.00440a70
test eax, eax
js 0x423999
movzx edi, word [esp + 0x4a0]
mov eax, dword [esp + 8]
mov dword [esp + 4], eax
test di, di
je 0x423812
lea edx, [esp + 0x4a0]
mov eax, dword [esp + 8]
mov ecx, eax
mov dword [esp + 4], eax
jmp 0x4237a8
movzx edi, word [edx]
test di, di
je 0x423812
movzx eax, word [ecx]
test ax, ax
je 0x423996
add ecx, 2
add edx, 2
mov dword [esp + 0x18], edx
mov edx, dword [esp + 4]
add edx, 2
cmp ax, di
je 0x4237d0
mov dword [esp + 4], edx
mov ecx, edx
mov edx, dword [esp + 0x18]
je 0x4237a0
lea edx, [esp + 0x4a0]
jmp 0x4237a0
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
push dword [esp + 0xc]
call fcn.0043fd50
add esp, 4
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x10]
je 0x423806
cmp dword [esp + 0x1c], 0
jne 0x4239c3
mov ecx, edi
call fcn.004401c0
jmp 0x423473
cmp dword [esp + 4], 0
je 0x423996
mov edi, dword [ebp + 0x14]
mov ecx, edi
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.00440a70
test eax, eax
js 0x423999
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 4], eax
adc ecx, 0
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x4238bc
cmp cx, dx
je 0x42396c
push edi
call fcn.0043fd50
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 0x2c]
mov edi, eax
xor edi, dword [esp + 4]
or edi, ecx
mov edi, dword [ebp + 0x14]
je 0x423999
mov dword [esp + 0x18], eax
mov ecx, edi
push 0
push 0
push 0x68
lea eax, [esp + 0x50c]
push eax
push edx
push dword [esp + 0x2c]
call fcn.00440a70
test eax, eax
js 0x423999
movzx eax, word [esp + 0x55a]
push eax
call fcn.0043fce0
add esp, 4
mov ecx, edi
mov edi, eax
movzx eax, word [esp + 0x55a]
push 0
push 0
push eax
push edi
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.00440a70
test eax, eax
js 0x42388e
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x423943
or ecx, 0x20
movzx edx, word [edi + eax]
lea ebx, [edx - 0x41]
cmp bx, 0x1a
jae 0x423953
or edx, 0x20
test cx, cx
mov ebx, dword [ebp + 8]
je 0x423885
add eax, 2
cmp cx, dx
je 0x423930
jmp 0x423885
mov eax, dword [esp + 0x530]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0x1c], eax
push edi
call fcn.0043fd50
add esp, 4
mov edi, dword [ebp + 0x14]
mov eax, dword [esp + 8]
push eax
call fcn.0043fd50
add esp, 4
jmp 0x4237e5
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
push dword [esp + 0x20]
call fcn.0043fd50
add esp, 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, edi
call fcn.004401b0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret