Function at 0x420cf0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0xc904973f
push dword [0x34bab0]
call fcn.0043fdc0
add esp, 8
lea ecx, [esi + 0x2c]
lea edx, [esi + 0xb0]
push ecx
push edx
push ebx
push dword [ebp + 8]
call eax
test eax, eax
je 0x420d8c
cmp dword [edi], 0xffffffff
jne 0x420e38
jmp 0x421237
push 0x39be051d
push dword [0x34bab0]
call fcn.0043fdc0
add esp, 8
mov dword [esi + 4], eax
push 0x847b02a2
push dword [0x34bab0]
call fcn.0043fdc0
add esp, 8
mov dword [esi], eax
push 0x2e775759
push dword [0x34bab0]
call fcn.0043fdc0
add esp, 8
mov dword [esi + 0x14], eax
mov ebx, dword [esi + 0x2c]
jmp 0x420de3
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x420e14
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi + 4]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x420de0
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi]
test eax, eax
je 0x420e14
push dword [edi]
call dword [esi + 0x14]
mov dword [edi], 0xffffffff
jmp 0x420de0
push 0x18c354a9
push dword [0x34bab0]
call fcn.0043fdc0
add esp, 8
push dword [esi + 0x2c]
call eax
mov ebx, dword [ebp + 0xc]
cmp dword [edi], 0xffffffff
je 0x421237
mov dword [esi + 0x20], edi
mov edi, dword [ebp + 0x10]
mov eax, 0x8d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edi + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x420e50
mov ecx, dword [ebp + 8]
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x420e60
mov ecx, ebx
nop
nop
nop
nop
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x420e70
add eax, 3
and eax, 0xfffffffc
call fcn.004085c0
mov eax, esp
and eax, 0xfffffff0
mov dword [esi + 4], eax
mov esp, eax
mov dword [esi + 0x30], 0xdbdad1e8
mov dword [esi + 0x34], 0xf1f3fedc
mov dword [esi + 0x38], 0xdf989cf1
mov dword [esi + 0x3c], 0xd52e3237
mov word [esi + 0x40], 0x99f8
mov dword [esi + 0x42], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax + 0x30]
lea edx, [eax + 0x22]
or edx, ecx
add ecx, eax
neg ecx
add ecx, edx
add ecx, 0xdd
and ecx, edx
add cl, 0x56
mov byte [esi + eax + 0x30], cl
mov ecx, eax
xor ecx, 0xfffffffe
or eax, 1
and ecx, eax
add eax, ecx
cmp eax, 0x16
jb 0x420ec0
mov dword [esi + 8], 0x6f5a4c53
mov byte [esi + 0xc], 0x8c
mov dword [esi + 0xd], 0
mov byte [esi + 0x11], 0
mov eax, 0xad1f3c62
mov edx, 0x52e0c39d
mov ecx, eax
xor ecx, 0xc8093915
mov ebx, eax
or ebx, 0x2516046a
and ebx, ecx
mov ecx, edx
and ecx, 0x40000115
add ebx, ecx
movzx ecx, byte [esi + eax + 0x52e0c3a6]
xor ebx, ecx
mov ecx, ebx
not ecx
and ebx, 0xeb
xor ebx, 0xea
and ecx, 0x14
sub ecx, ebx
inc cl
mov byte [esi + eax + 0x52e0c3a6], cl
inc eax
dec edx
cmp eax, 0xad1f3c6c
jne 0x420f10
movzx eax, byte [esi + 8]
mov ebx, dword [esi + 4]
test al, al
je 0x420f7b
lea edx, [esi + 9]
mov ebx, dword [esi + 4]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420f70
mov byte [ebx], 0
movzx eax, byte [edi]
test al, al
je 0x420f9d
inc edi
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edi]
inc edi
test al, al
jne 0x420f90
jmp 0x420fa0
mov edx, dword [ebp + 8]
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x420fbb
lea ecx, [esi + 0x31]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420fb0
mov byte [ebx], 0
movzx eax, byte [edx]
test al, al
je 0x420fdb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420fd0
mov dword [esi], ebx
mov byte [ebx], 0x3a
mov dword [esi + 0x30], 0xa3bf0b05
mov dword [esi + 0x34], 0x534f5f53
mov dword [esi + 0x38], 0x640a2355
mov dword [esi + 0x3c], 0x50554759
mov dword [esi + 0x40], 0x6f5f5a43
mov dword [esi + 0x44], 0x483de7e9
mov dword [esi + 0x48], 0x58474f4e
mov dword [esi + 0x4c], 0x41414c78
mov dword [esi + 0x50], 0x435f113a
mov dword [esi + 0x54], 0x736f7f73
mov dword [esi + 0x58], 0x18d0dc75
mov dword [esi + 0x5c], 0x68336679
mov dword [esi + 0x60], 0x7411637d
mov dword [esi + 0x64], 0x5363667f
mov dword [esi + 0x68], 0x5267022d
mov dword [esi + 0x6c], 0x40e351e
mov dword [esi + 0x70], 0x23716365
mov dword [esi + 0x74], 0x61a781f
mov dword [esi + 0x78], 0x746b1205
mov dword [esi + 0x7c], 0x706b1011
mov dword [esi + 0x80], 0x517d1170
mov dword [esi + 0x84], 0x10611c64
mov dword [esi + 0x88], 0xa1af7c03
mov dword [esi + 0x8c], 0x42150867
mov dword [esi + 0x90], 0x60100c1f
mov dword [esi + 0x94], 0x32352e3b
mov dword [esi + 0x98], 0x36247c04
mov dword [esi + 0x9c], 0x303f3636
mov dword [esi + 0xa0], 0x72624b36
mov dword [esi + 0xa4], 0x8a84886f
mov word [esi + 0xa8], 0x9982
mov word [esi + 0xae], 0
mov dword [esi + 0xaa], 0
xor ebx, ebx
xor ecx, ecx
movzx edi, byte [esi + ecx + 0x30]
mov eax, ebx
and eax, 0xf8
mov edx, ecx
xor edx, 0xab220b7c
add edx, eax
xor edx, edi
mov edi, 0x6c
sub edi, edx
not edx
mov eax, edx
or eax, 0xfe
or edi, 1
and edi, eax
not edi
and edx, 1
lea eax, [edi + edx*2]
mov byte [esi + ecx + 0x30], al
inc ecx
add ebx, 2
cmp ecx, 0x80
jne 0x4210f0
mov edx, dword [esi]
inc edx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x42115b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x421150
mov byte [edx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x42117b
lea ecx, [esi + 0x31]
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x421170
mov byte [edx], 0
mov edi, edx
mov ebx, dword [esi + 4]
sub edi, ebx
push 0xd0026952
push dword [0x34bab0]
call fcn.0043fdc0
add esp, 8
push 0
push edi
push ebx
mov edi, dword [esi + 0x20]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x4211ea
cmp dword [edi], 0xffffffff
je 0x4211ea
push 0x59ea2086
push dword [0x34bab0]
call fcn.0043fdc0
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x34bab0]
call fcn.0043fdc0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x42147b
cmp eax, 0xffffffff
je 0x421237
push 0x400
call fcn.004086e0
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
add eax, 0x400
mov dword [esi + 0x10], eax
lea eax, [esi + 8]
mov ecx, edi
push eax
call fcn.004216c0
mov cl, 1
mov dword [esi], ecx
test al, al
je 0x421464
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
mov edx, edi
sub edx, ebx
cmp edi, dword [esi + 0x10]
je 0x42123e
mov eax, ebx
jmp 0x421398
xor eax, eax
jmp 0x42147b
mov eax, edi
xor eax, ebx
mov ecx, ebx
not ecx
and ecx, edi
mov dword [esi + 0x24], ecx
add ecx, ecx
sub ecx, eax
mov eax, ecx
shr eax, 1
add eax, ecx
mov ecx, eax
mov dword [esi], edx
lea eax, [edx + 1]
cmp ecx, eax
ja 0x421262
mov ecx, eax
mov dword [esi + 0x14], ecx
push ecx
call fcn.004086e0
add esp, 4
test ebx, ebx
je 0x421385
not edi
and edi, ebx
mov edx, dword [esi + 0x24]
sub edx, edi
cmp eax, ebx
mov dword [esi + 0x18], eax
jbe 0x421332
lea ecx, [ebx + edx]
cmp ecx, eax
jbe 0x421332
test edx, edx
je 0x421377
lea eax, [ebx + edx]
dec eax
mov ecx, dword [esi + 0x18]
add ecx, edx
dec ecx
mov ebx, edx
and ebx, 7
mov dword [esi + 4], ebx
je 0x4212cf
mov dword [esi + 0x1c], edx
neg dword [esi + 4]
xor ebx, ebx
movzx edx, byte [eax + ebx]
mov byte [ecx + ebx], dl
dec ebx
cmp dword [esi + 4], ebx
jne 0x4212b9
add eax, ebx
add ecx, ebx
mov edx, dword [esi + 0x1c]
add edx, ebx
sub edi, dword [esi + 0x24]
cmp edi, 0xfffffff8
ja 0x421377
neg edx
xor edi, edi
mov ebx, edx
movzx edx, byte [eax + edi]
mov byte [ecx + edi], dl
movzx edx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], dl
movzx edx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], dl
movzx edx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], dl
movzx edx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], dl
movzx edx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], dl
movzx edx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], dl
movzx edx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], dl
mov edx, ebx
add edi, 0xfffffff8
cmp ebx, edi
jne 0x4212df
jmp 0x421377
mov dword [esi + 0x1c], edx
mov edx, eax
mov ecx, dword [esi + 0x1c]
shr ecx, 2
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, dword [esi + 0x1c]
and eax, 0xfffffffc
lea ecx, [edx + eax]
add eax, ebx
mov ebx, ecx
mov ecx, dword [esi + 0x1c]
shr ecx, 1
and ecx, 1
mov edx, eax
mov edi, ebx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov ecx, dword [esi + 0x1c]
test cl, 1
je 0x421377
and ecx, 2
movzx eax, byte [eax + ecx]
mov byte [ebx + ecx], al
push dword [esi + 8]
call fcn.004086f0
add esp, 4
mov eax, dword [esi + 0x18]
mov dword [esi + 8], eax
mov edx, dword [esi]
lea ecx, [eax + edx]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 0x14]
add ecx, eax
mov dword [esi + 0x10], ecx
mov byte [eax + edx], 0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
inc ecx
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x30], 0xc1babb44
mov dword [esi + 0x34], 0x261c2021
mov dword [esi + 0x38], 0x2a262414
mov byte [esi + 0x3c], pe_nt_image_headers32
mov dword [esi + 0x3d], 0
mov dword [esi + 0x40], 0
xor ebx, ebx
mov ecx, dword [esi + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
add dl, 0xbd
xor dl, byte [esi + ebx + 0x30]
add dl, 0x4f
mov byte [esi + ebx + 0x30], dl
inc ebx
cmp ebx, 0x14
jne 0x4213e0
movzx ebx, byte [esi + 0x30]
mov edx, eax
mov dword [esi + 0x14], eax
test bl, bl
je 0x42144e
lea edx, [esi + 0x30]
mov dword [esi], edx
mov edx, eax
mov edi, eax
mov dword [esi + 0x14], eax
mov edi, dword [esi]
jmp 0x42142a
movzx ebx, byte [edi]
test bl, bl
mov ecx, dword [esi + 0x20]
je 0x42144e
mov bh, byte [edx]
test bh, bh
je 0x421454
inc edx
inc edi
mov dword [esi], edi
mov ecx, dword [esi + 0x14]
lea edi, [ecx + 1]
cmp bh, bl
je 0x421445
mov ecx, edi
mov dword [esi + 0x14], edi
mov edx, edi
mov edi, dword [esi]
je 0x421420
lea edi, [esi + 0x30]
jmp 0x421420
cmp dword [esi + 0x14], 0
jne 0x421494
push 0x3ea
call fcn.00420760
mov dword [esi], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x421479
cmp eax, dword [esi + 0xc]
je 0x421479
push eax
call fcn.004086f0
add esp, 4
mov eax, dword [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
cmp bl, bh
je 0x421464
mov ebx, eax
mov edx, dword [esi + 4]
sub ebx, edx
je 0x4214c0
mov dword [esi + 4], edx
mov dword [esi], edx
xor ecx, ecx
mov edi, eax
mov edx, dword [esi]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
xor ecx, ecx
mov edi, eax
mov eax, dword [esi + 4]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 0x20]
add dword [esi + 0xc], ebx
lea eax, [esi + 8]
push eax
call fcn.004216c0
test al, al
je 0x42145e
mov dword [esi], eax
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
mov edx, edi
sub edx, ebx
cmp edi, dword [esi + 0x10]
je 0x4214f0
mov eax, ebx
jmp 0x42165a
mov eax, edi
xor eax, ebx
mov ecx, ebx
not ecx
and ecx, edi
mov dword [esi + 0x1c], ecx
add ecx, ecx
sub ecx, eax
mov eax, ecx
shr eax, 1
add eax, ecx
mov ecx, eax
mov dword [esi + 0x14], edx
lea eax, [edx + 1]
cmp ecx, eax
ja 0x421515
mov ecx, eax
mov dword [esi + 0x24], ecx
push ecx
call fcn.004086e0
add esp, 4
test ebx, ebx
je 0x421646
not edi
and edi, ebx
mov edx, dword [esi + 0x1c]
sub edx, edi
cmp eax, ebx
mov dword [esi + 0x28], eax
jbe 0x4215f3
lea ecx, [ebx + edx]
cmp ecx, eax
jbe 0x4215f3
test edx, edx
je 0x421638
lea eax, [ebx + edx]
dec eax
mov ecx, dword [esi + 0x28]
add ecx, edx
dec ecx
mov ebx, edx
and ebx, 7
mov dword [esi + 4], ebx
je 0x421586
mov dword [esi + 0x18], edx
neg dword [esi + 4]
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [eax + ebx]
mov byte [ecx + ebx], dl
dec ebx
cmp dword [esi + 4], ebx
jne 0x421570
add eax, ebx
add ecx, ebx
mov edx, dword [esi + 0x18]
add edx, ebx
sub edi, dword [esi + 0x1c]
cmp edi, 0xfffffff8
ja 0x421638
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
movzx edx, byte [eax + edi]
mov byte [ecx + edi], dl
movzx edx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], dl
movzx edx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], dl
movzx edx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], dl
movzx edx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], dl
movzx edx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], dl
movzx edx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], dl
movzx edx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], dl
mov edx, ebx
add edi, 0xfffffff8
cmp ebx, edi
jne 0x4215a0
jmp 0x421638
mov dword [esi + 0x18], edx
mov edx, eax
mov ecx, dword [esi + 0x18]
shr ecx, 2
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, dword [esi + 0x18]
and eax, 0xfffffffc
lea ecx, [edx + eax]
add eax, ebx
mov ebx, ecx
mov ecx, dword [esi + 0x18]
shr ecx, 1
and ecx, 1
mov edx, eax
mov edi, ebx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov ecx, dword [esi + 0x18]
test cl, 1
je 0x421638
and ecx, 2
movzx eax, byte [eax + ecx]
mov byte [ebx + ecx], al
push dword [esi + 8]
call fcn.004086f0
add esp, 4
mov eax, dword [esi + 0x28]
mov dword [esi + 8], eax
mov edx, dword [esi + 0x14]
lea ecx, [eax + edx]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 0x24]
add ecx, eax
mov dword [esi + 0x10], ecx
mov byte [eax + edx], 0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
inc ecx
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ecx
mov word [esi + 0x30], 0x5f5d
mov byte [esi + 0x32], 0x56
mov word [esi + 0x33], 0
xor ebx, ebx
mov ecx, dword [esi + 0x20]
mov edx, ebx
add dl, 0x6e
xor dl, byte [esi + ebx + 0x30]
add dl, 0xda
mov byte [esi + ebx + 0x30], dl
inc ebx
cmp ebx, 5
jne 0x421680
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov bh, byte [esi + edx + 0x30]
test bl, bl
je 0x421490
inc edx
cmp bl, bh
je 0x4216a0
jmp 0x421490