Function at 0x41faf0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0xc904973f
push dword [0x44bf94]
call fcn.0043f550
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push ebx
push dword [ebp + 8]
call eax
test eax, eax
je 0x41fb8c
cmp dword [edi], 0xffffffff
jne 0x41fc38
jmp 0x4200e7
push 0x39be051d
push dword [0x44bf94]
call fcn.0043f550
add esp, 8
mov dword [esi + 0x1c], eax
push 0x847b02a2
push dword [0x44bf94]
call fcn.0043f550
add esp, 8
mov dword [esi], eax
push 0x2e775759
push dword [0x44bf94]
call fcn.0043f550
add esp, 8
mov dword [esi + 4], eax
mov ebx, dword [esi + 0x28]
jmp 0x41fbe3
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x41fc14
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi + 0x1c]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x41fbe0
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi]
test eax, eax
je 0x41fc14
push dword [edi]
call dword [esi + 4]
mov dword [edi], 0xffffffff
jmp 0x41fbe0
push 0x18c354a9
push dword [0x44bf94]
call fcn.0043f550
add esp, 8
push dword [esi + 0x28]
call eax
mov ebx, dword [ebp + 0xc]
cmp dword [edi], 0xffffffff
je 0x4200e7
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x41fc40
mov edx, dword [ebp + 8]
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41fc50
mov dword [esi + 0x1c], edi
mov edx, ebx
nop
nop
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41fc60
add eax, 3
and eax, 0xfffffffc
call fcn.00408260
mov eax, esp
and eax, 0xfffffff0
mov dword [esi], eax
mov esp, eax
mov dword [esi + 0x2c], 0xe5e6d32c
mov dword [esi + 0x30], 0x37c936d8
mov dword [esi + 0x34], 0xd91410cb
mov dword [esi + 0x38], 0xdb9292f1
mov word [esi + 0x3c], 0x1b3c
mov dword [esi + 0x3e], 0
mov byte [esi + 0x42], 0
mov eax, 0x25e9d8ac
mov edx, 0x4bd3b158
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
xor edi, 0x53961e9
mov ebx, edx
and ebx, 0x4181302c
sub ebx, edi
movzx edi, byte [esi + eax - 0x25e9d880]
xor ebx, edi
mov edi, ebx
and edi, 0x30
xor ebx, 0x30
lea ebx, [ebx + edi*2]
inc bl
mov byte [esi + eax - 0x25e9d880], bl
inc eax
add edx, 2
cmp eax, 0x25e9d8c3
jne 0x41fcc0
mov dword [esi + 8], 0x2f5a4c53
mov byte [esi + 0xc], 0xc
mov dword [esi + 0xd], 0
mov word [esi + 0x11], 0
mov eax, 0xda75e882
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + eax + 0x258a1786]
xor edx, eax
mov edi, edx
not edi
and edi, 0xb1
and edx, 0x4e
sub edx, edi
add dl, 0x27
mov byte [esi + eax + 0x258a1786], dl
inc eax
cmp eax, 0xda75e88d
jne 0x41fd20
movzx eax, byte [esi + 8]
mov edi, dword [esi]
test al, al
je 0x41fd6b
lea edx, [esi + 9]
mov edi, dword [esi]
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41fd60
mov byte [edi], 0
movzx eax, byte [ecx]
test al, al
je 0x41fd8d
inc ecx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41fd80
jmp 0x41fd90
mov edx, dword [ebp + 8]
mov byte [edi], 0
movzx eax, byte [esi + 0x2c]
test al, al
je 0x41fdab
lea ecx, [esi + 0x2d]
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41fda0
mov byte [edi], 0
movzx eax, byte [edx]
test al, al
je 0x41fdcb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41fdc0
mov byte [edi], 0x3a
mov dword [esi + 0x2c], 0xaf4b1715
mov dword [esi + 0x30], 0xc7c3abb7
mov dword [esi + 0x34], 0xdc061fc5
mov dword [esi + 0x38], 0xd8ddc3c1
mov dword [esi + 0x3c], 0xdbcbc6cf
mov dword [esi + 0x40], 0xc0356361
mov dword [esi + 0x44], 0xd0d3c3c2
mov dword [esi + 0x48], 0xc9c9dcc0
mov dword [esi + 0x4c], 0xcf2b1906
mov dword [esi + 0x50], 0xe7e3cbd7
mov dword [esi + 0x54], 0x10484ce5
mov dword [esi + 0x58], 0x1027e2e1
mov dword [esi + 0x5c], 0xfc19efed
mov dword [esi + 0x60], 0xe7f7e2eb
mov dword [esi + 0x64], 0xeef31e3d
mov dword [esi + 0x68], 0xc12352a
mov dword [esi + 0x6c], 0x2ff9eff5
mov dword [esi + 0x70], 0xfa0e10eb
mov dword [esi + 0x74], 0xece70ef5
mov dword [esi + 0x78], 0xf8df0809
mov dword [esi + 0x7c], 0xd9e519f8
mov dword [esi + 0x80], 0xe8f90ce4
mov dword [esi + 0x84], 0xb9bbcc1f
mov dword [esi + 0x88], 0xd61d10e3
mov dword [esi + 0x8c], 0xe8181ce3
mov dword [esi + 0x90], 0x262d1a0f
mov dword [esi + 0x94], 0x22dcec34
mov dword [esi + 0x98], 0x38233232
mov dword [esi + 0x9c], 0xfeeef73a
mov dword [esi + 0xa0], 0x9e9c80fb
mov word [esi + 0xa4], 0x919e
mov byte [esi + 0xaa], 0
mov dword [esi + 0xa6], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
and ebx, 0x74
mov edx, ecx
xor edx, 0x17b073ba
add edx, ebx
movzx ebx, byte [esi + ecx + 0x2c]
xor edx, ebx
mov ebx, edx
and ebx, 0x5d
add ebx, ebx
xor edx, 0xa2
sub ebx, edx
mov byte [esi + ecx + 0x2c], bl
inc ecx
add eax, 2
cmp ecx, 0x7f
jne 0x41fee0
inc edi
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x41ff2b
inc ecx
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ff20
mov byte [edi], 0
movzx eax, byte [esi + 0x2c]
test al, al
je 0x41ff4b
lea ecx, [esi + 0x2d]
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ff40
mov byte [edi], 0
mov ebx, dword [esi]
sub edi, ebx
push 0xd0026952
push dword [0x44bf94]
call fcn.0043f550
add esp, 8
push 0
push edi
push ebx
mov edi, dword [esi + 0x1c]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x41ffb7
cmp dword [edi], 0xffffffff
je 0x41ffb7
push 0x59ea2086
push dword [0x44bf94]
call fcn.0043f550
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44bf94]
call fcn.0043f550
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x420475
cmp eax, 0xffffffff
je 0x4200e7
push 0x400
call fcn.00408380
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
add eax, 0x400
mov dword [esi + 0x10], eax
lea eax, [esi + 8]
mov ecx, edi
push eax
call fcn.00420480
mov cl, 1
mov dword [esi + 4], ecx
test al, al
je 0x42045d
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x10]
jne 0x420152
mov dword [esi + 0x14], ecx
mov dword [esi], eax
mov ecx, ebx
shr ecx, 1
mov eax, ecx
and eax, ebx
mov dword [esi + 0x24], ecx
xor ecx, ebx
lea ecx, [ecx + eax*2]
lea eax, [ebx + 1]
cmp ecx, eax
ja 0x420024
mov ecx, eax
mov dword [esi + 4], ecx
push ecx
call fcn.00408380
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x420141
cmp eax, ecx
mov dword [esi + 0x18], ebx
mov edx, dword [esi + 0x14]
mov dword [esi + 0x20], eax
jbe 0x4200ee
cmp edx, eax
jbe 0x4200ee
test ebx, ebx
je 0x42012d
mov edx, dword [esi + 0x18]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x20]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x420086
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x420073
add eax, edx
add ecx, edx
add edx, dword [esi + 0x18]
mov edi, dword [esi]
sub edi, dword [esi + 0x14]
cmp edi, 0xfffffff8
ja 0x42012d
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420098
jmp 0x42012d
xor eax, eax
jmp 0x420475
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x24]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x42012d
mov ecx, dword [esi + 0x18]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 8]
call fcn.00408390
add esp, 4
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x18]
mov eax, dword [esi + 0x20]
mov dword [esi + 8], eax
lea ecx, [eax + ebx]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
add ecx, eax
mov dword [esi + 0x10], ecx
mov byte [eax + ebx], 0
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x2c], 0x675a5560
mov dword [esi + 0x30], 0x2000407
mov dword [esi + 0x34], 0x7e7e0010
mov byte [esi + 0x38], 0x4c
mov dword [esi + 0x39], 0
mov word [esi + 0x3d], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov eax, ecx
add al, 0xb6
xor al, byte [esi + ecx + 0x2c]
add al, 0x72
mov byte [esi + ecx + 0x2c], al
inc ecx
cmp ecx, 0x13
jne 0x420190
movzx edx, byte [esi + 0x2c]
mov dword [esi + 0x14], ebx
mov dword [esi + 4], ebx
test dl, dl
je 0x4201ed
lea ebx, [esi + 0x2c]
mov eax, dword [esi + 0x14]
mov ecx, eax
mov dword [esi + 4], eax
jmp 0x4201ca
movzx edx, byte [ebx]
test dl, dl
mov edi, dword [esi + 0x1c]
je 0x4201ed
movzx eax, byte [ecx]
test al, al
je 0x42044a
inc ecx
inc ebx
mov edi, dword [esi + 4]
inc edi
cmp al, dl
je 0x4201e6
mov eax, edi
mov dword [esi + 4], edi
mov ecx, edi
je 0x4201c0
lea ebx, [esi + 0x2c]
jmp 0x4201c0
cmp dword [esi + 4], 0
je 0x42044a
mov ebx, dword [esi + 0x14]
jmp 0x42020b
cmp dl, dh
mov edi, dword [esi + 0x1c]
je 0x42045d
mov edx, ebx
mov ecx, dword [esi]
sub edx, ecx
je 0x420230
mov eax, ecx
mov edi, ebx
mov dword [esi], ecx
xor ecx, ecx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
xor ecx, ecx
mov edi, ebx
mov eax, dword [esi]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [esi + 0x1c]
add dword [esi + 0xc], edx
mov ecx, edi
lea eax, [esi + 8]
push eax
call fcn.00420480
test al, al
je 0x420456
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x10]
jne 0x4203b3
mov dword [esi + 0x14], ecx
mov dword [esi], eax
mov ecx, ebx
shr ecx, 1
mov eax, ecx
and eax, ebx
mov dword [esi + 0x24], ecx
xor ecx, ebx
lea edi, [ecx + eax*2]
lea eax, [ebx + 1]
cmp edi, eax
ja 0x420277
mov edi, eax
push edi
call fcn.00408380
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x4203a5
mov dword [esi + 0xac], edi
cmp eax, ecx
mov dword [esi + 0x18], ebx
mov edx, dword [esi + 0x14]
mov dword [esi + 0x20], eax
jbe 0x42034f
cmp edx, eax
jbe 0x42034f
test ebx, ebx
je 0x42038e
mov edx, dword [esi + 0x18]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x20]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x4202e3
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x4202d0
add eax, edx
add ecx, edx
add edx, dword [esi + 0x18]
mov edi, dword [esi]
sub edi, dword [esi + 0x14]
cmp edi, 0xfffffff8
ja 0x42038e
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420300
jmp 0x42038e
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x24]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x42038e
mov ecx, dword [esi + 0x18]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 8]
call fcn.00408390
add esp, 4
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0xac]
mov eax, dword [esi + 0x20]
mov dword [esi + 8], eax
lea ecx, [eax + ebx]
mov dword [esi + 0xc], ecx
add edi, eax
mov dword [esi + 0x10], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 8]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi], eax
mov dword [esi + 0xc], eax
mov word [esi + 0x2c], 0x2f2d
mov byte [esi + 0x2e], 0x36
mov word [esi + 0x2f], 0
mov ecx, 6
mov eax, 0x1248ea88
mov ebx, ecx
and ebx, 0xb
xor ebx, 0x10080a0b
lea edx, [eax + 1]
or edx, 0xa2c7f4c4
mov edi, eax
sub edi, edx
add edx, ecx
add edx, 0xedb71571
and edi, ebx
xor edx, ebx
add edx, ebx
movzx ebx, byte [esi + ecx + 0x26]
xor ebx, 0x5d380b3b
sub edx, edi
mov edi, ebx
and edi, edx
add edx, ebx
add edi, edi
sub edx, edi
add dl, 0xb2
mov byte [esi + ecx + 0x26], dl
inc ecx
dec eax
cmp ecx, 0xb
jne 0x4203e0
xor ecx, ecx
mov ebx, dword [esi + 0x14]
movzx edx, byte [ebx + ecx]
mov dh, byte [esi + ecx + 0x2c]
test dl, dl
je 0x420200
inc ecx
cmp dl, dh
je 0x420430
jmp 0x420200
mov ecx, edi
push 0x3ea
call fcn.0041f850
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x420472
cmp eax, dword [esi + 0xc]
je 0x420472
push eax
call fcn.00408390
add esp, 4
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc