Function at 0x420870
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0xc904973f
push dword [0x44bd38]
call fcn.0043f9a0
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
je 0x42090b
cmp dword [edi], 0xffffffff
jne 0x4209b5
jmp 0x420eb2
push 0x39be051d
push dword [0x44bd38]
call fcn.0043f9a0
add esp, 8
mov dword [esi], eax
push 0x847b02a2
push dword [0x44bd38]
call fcn.0043f9a0
add esp, 8
mov dword [esi + 4], eax
push 0x2e775759
push dword [0x44bd38]
call fcn.0043f9a0
add esp, 8
mov dword [esi + 8], eax
mov ebx, dword [esi + 0x28]
jmp 0x420963
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x420994
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x420960
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 4]
test eax, eax
je 0x420994
push dword [edi]
call dword [esi + 8]
mov dword [edi], 0xffffffff
jmp 0x420960
push 0x18c354a9
push dword [0x44bd38]
call fcn.0043f9a0
add esp, 8
push dword [esi + 0x28]
call eax
cmp dword [edi], 0xffffffff
je 0x420eb2
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
nop
nop
nop
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x4209c0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x4209e0
mov dword [esi + 0x20], edi
mov ecx, edx
nop
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x4209f0
add eax, 3
and eax, 0xfffffffc
call fcn.00408190
mov eax, esp
and eax, 0xfffffff0
mov dword [esi + 4], eax
mov esp, eax
mov dword [esi + 0x30], 0xbdba8fe4
mov dword [esi + 0x34], 0x9b9192b0
mov dword [esi + 0x38], 0x81c4f89f
mov dword [esi + 0x3c], 0xaf565659
mov word [esi + 0x40], 0xf7d4
mov dword [esi + 0x42], 0
mov eax, 0xd1
mov edx, 0x2e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + eax - 0xa1]
mov ecx, ebx
not ecx
and ecx, 0x66
mov edi, ebx
xor edi, 0x66
or ebx, 0x99
and ebx, edi
or ebx, ecx
mov edi, edx
and edi, 0x26
mov ecx, eax
and ecx, 0x99
or ecx, edi
xor ecx, ebx
add cl, 0xeb
mov byte [esi + eax - 0xa1], cl
inc eax
dec edx
cmp eax, 0xe7
jne 0x420a50
mov dword [esi + 0xc], 0x11eaf8e5
mov byte [esi + 0x10], 0x30
mov word [esi + 0x11], 0
mov byte [esi + 0x13], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + eax]
mov dword [esi], ecx
and ecx, 0xc
mov edi, eax
xor edi, 0xffadda6
lea ebx, [ecx + edi]
add edi, ecx
add edi, 0xcf
movzx ecx, byte [esi + eax + 0xc]
add ebx, ecx
and edi, ecx
mov edx, edi
or edx, 0xfffffffd
inc edx
mov ecx, edi
and ecx, 0xfffffffd
imul ecx, edx
mov edx, edi
and edx, 2
or edi, 2
imul edi, edx
sub ecx, edi
mov edi, 0x2d56cb32
sub edi, ebx
sub edi, ecx
add ecx, ebx
add ecx, 0xd2a934cf
or edi, 0xfe
or ecx, 1
sub ecx, edi
add cl, 0xb5
mov byte [esi + eax + 0xc], cl
mov ecx, eax
xor ecx, 0x7ffffffe
mov edx, eax
or edx, 1
and edx, ecx
mov ecx, dword [esi]
and ecx, 2
sub eax, ecx
lea eax, [eax + edx*2]
inc eax
cmp eax, 8
jb 0x420ab0
movzx eax, byte [esi + 0xc]
mov ebx, dword [esi + 4]
test al, al
je 0x420b5b
lea edx, [esi + 0xd]
mov ebx, dword [esi + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420b50
mov byte [ebx], 0
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ecx]
test al, al
je 0x420b7d
inc ecx
mov edx, dword [ebp + 0xc]
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420b70
jmp 0x420b80
mov edx, dword [ebp + 0xc]
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x420b9b
lea ecx, [esi + 0x31]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420b90
mov byte [ebx], 0
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
test al, al
je 0x420bbb
inc ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420bb0
mov byte [ebx], 0x3a
mov dword [esi + 0x30], 0xe70b5f5d
mov dword [esi + 0x34], 0xfff3ebff
mov dword [esi + 0x38], 0xe43e17fd
mov dword [esi + 0x3c], 0xe8e5f3f1
mov dword [esi + 0x40], 0x1b0beef7
mov dword [esi + 0x44], 0x10edb3b1
mov dword [esi + 0x48], 0x31312
mov dword [esi + 0x4c], 0x19190410
mov dword [esi + 0x50], 0x7ebc9ee
mov dword [esi + 0x54], 0x1f130b1f
mov dword [esi + 0x58], 0xe0a8a41d
mov dword [esi + 0x5c], 0xe0cf1211
mov dword [esi + 0x60], 0x34d91715
mov dword [esi + 0x64], 0x3f2f322b
mov dword [esi + 0x68], 0x3623d6f5
mov dword [esi + 0x6c], 0xd4c2edca
mov dword [esi + 0x70], 0xe739373d
mov dword [esi + 0x74], 0xca26c02b
mov dword [esi + 0x78], 0xd4df26cd
mov dword [esi + 0x7c], 0xc8e72829
mov dword [esi + 0x80], 0x99ad29c8
mov dword [esi + 0x84], 0xb8a944ac
mov dword [esi + 0x88], 0xf9fba457
mov dword [esi + 0x8c], 0x9e4540b3
mov dword [esi + 0x90], 0xa85844b3
mov dword [esi + 0x94], 0x5e455a47
mov dword [esi + 0x98], 0x52a4844c
mov dword [esi + 0x9c], 0x48534242
mov dword [esi + 0xa0], 0xb6a6bf4a
mov dword [esi + 0xa4], 0xd6d4d0bb
mov word [esi + 0xa8], 0xc1d6
mov byte [esi + 0xae], 0
mov dword [esi + 0xaa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x6e
xor cl, byte [esi + eax + 0x30]
add cl, 0xda
mov byte [esi + eax + 0x30], cl
inc eax
cmp eax, 0x7f
jne 0x420cd0
inc ebx
movzx eax, byte [edx]
test al, al
je 0x420cfb
inc edx
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420cf0
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x420d1b
lea ecx, [esi + 0x31]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420d10
mov byte [ebx], 0
mov edi, dword [esi + 4]
sub ebx, edi
push 0xd0026952
push dword [0x44bd38]
call fcn.0043f9a0
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x20]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x420d88
cmp dword [edi], 0xffffffff
je 0x420d88
push 0x59ea2086
push dword [0x44bd38]
call fcn.0043f9a0
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44bd38]
call fcn.0043f9a0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x421284
cmp eax, 0xffffffff
je 0x420eb2
push 0x400
call fcn.004082b0
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add eax, 0x400
mov dword [esi + 0x14], eax
lea eax, [esi + 0xc]
mov ecx, edi
push eax
call fcn.00421290
mov cl, 1
mov dword [esi + 0x1c], ecx
test al, al
je 0x42126c
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x420f1a
mov dword [esi + 4], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x1c], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x420def
mov edi, eax
push edi
call fcn.004082b0
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x420f0c
mov dword [esi + 0x24], edi
cmp eax, ecx
mov dword [esi + 8], ebx
mov edx, dword [esi + 4]
mov dword [esi + 0x18], eax
jbe 0x420eb9
cmp edx, eax
jbe 0x420eb9
test ebx, ebx
je 0x420ef8
mov edx, dword [esi + 8]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x18]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x420e51
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x420e3e
add eax, edx
add ecx, edx
add edx, dword [esi + 8]
mov edi, dword [esi]
sub edi, dword [esi + 4]
cmp edi, 0xfffffff8
ja 0x420ef8
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420e63
jmp 0x420ef8
xor eax, eax
jmp 0x421284
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x1c]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x420ef8
mov ecx, dword [esi + 8]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.004082c0
add esp, 4
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x18]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov ebx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x30], 0x8f8a8df0
mov dword [esi + 0x34], 0xf2f0ecef
mov dword [esi + 0x38], 0xf6f6f0c0
mov byte [esi + 0x3c], 0x24
mov dword [esi + 0x3d], 0
mov byte [esi + 0x41], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esi + ecx + 0x30]
mov edx, ecx
xor edx, 0xd5a289b5
mov edi, ecx
or edi, 0x2a5d764a
and edx, edi
add edx, edi
xor edx, eax
mov eax, edx
and eax, 0x8d
and edx, 0x72
xor edx, 0x73
sub eax, edx
inc al
mov byte [esi + ecx + 0x30], al
inc ecx
cmp ecx, 0x12
jne 0x420f60
movzx edx, byte [esi + 0x30]
mov dword [esi + 0x18], ebx
mov dword [esi + 4], ebx
test dl, dl
mov ecx, dword [esi + 0x20]
je 0x420ff3
lea edi, [esi + 0x30]
mov eax, dword [esi + 0x18]
mov ebx, eax
mov dword [esi + 4], eax
jmp 0x420fca
movzx edx, byte [edi]
test dl, dl
mov ecx, dword [esi + 0x20]
je 0x420ff3
movzx eax, byte [ebx]
test al, al
je 0x42125b
inc ebx
inc edi
mov dword [esi], edi
mov ecx, dword [esi + 4]
lea edi, [ecx + 1]
cmp al, dl
je 0x420fea
mov eax, edi
mov dword [esi + 4], edi
mov ebx, edi
mov edi, dword [esi]
je 0x420fc0
lea edi, [esi + 0x30]
jmp 0x420fc0
cmp dword [esi + 4], 0
je 0x42125b
mov ebx, dword [esi + 0x18]
jmp 0x42101b
cmp dl, al
mov ecx, dword [esi + 0x20]
je 0x42126c
mov edx, ebx
mov eax, dword [esi + 8]
sub edx, eax
je 0x421045
mov dword [esi + 8], eax
mov dword [esi], eax
mov edi, ebx
xor ecx, ecx
mov eax, dword [esi]
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
xor ecx, ecx
mov edi, ebx
mov eax, dword [esi + 8]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 0x20]
add dword [esi + 0x10], edx
lea eax, [esi + 0xc]
push eax
call fcn.00421290
test al, al
je 0x421265
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x4211c0
mov dword [esi + 4], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x24], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x421084
mov edi, eax
push edi
call fcn.004082b0
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x4211b2
mov dword [esi + 0x2c], edi
cmp eax, ecx
mov dword [esi + 8], ebx
mov edx, dword [esi + 4]
mov dword [esi + 0x18], eax
jbe 0x42115f
cmp edx, eax
jbe 0x42115f
test ebx, ebx
je 0x42119e
mov edx, dword [esi + 8]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x18]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x4210f3
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x4210e0
add eax, edx
add ecx, edx
add edx, dword [esi + 8]
mov edi, dword [esi]
sub edi, dword [esi + 4]
cmp edi, 0xfffffff8
ja 0x42119e
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x421110
jmp 0x42119e
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x24]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x42119e
mov ecx, dword [esi + 8]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.004082c0
add esp, 4
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x18]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov word [esi + 0x30], 0x7775
mov byte [esi + 0x32], 0x4e
lea eax, [esi + 0x33]
mov byte [eax + 4], 0
mov dword [eax], 0
mov edi, 0x8c371211
mov ecx, 0x73c8edee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + edi + 0x73c8ee1f]
lea eax, [edi + 1]
mov dword [esi], eax
and eax, ebx
lea edx, [ecx + eax*2]
mov dword [esi + 4], edx
add eax, eax
mov edx, edi
sub edx, eax
and edx, ebx
not ebx
and ebx, dword [esi + 4]
sub edx, ebx
add dl, 0xa6
mov byte [esi + edi + 0x73c8ee1f], dl
dec ecx
mov eax, dword [esi]
mov edi, eax
cmp eax, 0x8c371219
jne 0x421200
xor ecx, ecx
mov ebx, dword [esi + 0x18]
nop
movzx edx, byte [ebx + ecx]
movzx eax, byte [esi + ecx + 0x30]
test dl, dl
je 0x421010
inc ecx
cmp dl, al
je 0x421240
jmp 0x421010
push 0x3ea
call fcn.004205a0
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x421281
cmp eax, dword [esi + 0x10]
je 0x421281
push eax
call fcn.004082c0
add esp, 4
mov eax, dword [esi + 0x1c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc