Function at 0x470310
Capabilities:
Encode data using xor
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4eafd8
push eax
mov eax, 0xd498
mov dword fs:[0], esp
call fcn.004b3e50
lea eax, [esp + 0xd4a8]
push ebp
push eax
call fcn.00443850
mov ebp, dword [esp + 0xd4b0]
add esp, 4
cmp word [ebp], 0
jne 0x470368
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xd498]
mov dword fs:[0], ecx
add esp, 0xd4a4
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
push 0x4efd50
call ebx
lea esi, [eax + eax + 2]
lea ecx, [esi + 2]
push ecx
call fcn.00449130
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x4efd50
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x18], eax
push 0x4efd50
mov dword [esp + 0xd4b4], 0
call ebx
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
push eax
call fcn.00449130
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x4efd50
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x1c], eax
mov si, word [ebp]
test si, si
mov byte [esp + 0xd4b0], 1
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 8
je 0x470652
nop
mov eax, ebp
mov ecx, 0x4f6ec0
mov edx, 1
lea esp, [esp]
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x470471
dec edx
jns 0x470410
mov ax, word [ebp + 4]
cmp ax, 9
jb 0x470437
cmp ax, 0xd
jbe 0x47043d
cmp ax, 0x20
jne 0x470471
add ebp, 4
mov byte [esp + 0x13], 1
mov dword [esp + 0xd4b8], ebp
je 0x470622
mov ax, word [ebp]
cmp ax, 9
jb 0x470462
cmp ax, 0xd
jbe 0x47046c
cmp ax, 0x20
jne 0x47061b
add ebp, 2
jmp 0x470452
mov eax, ebp
mov ecx, 0x4f6da4
mov edx, 1
lea ecx, [ecx]
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x4704d8
dec edx
jns 0x470480
mov ax, word [ebp + 4]
cmp ax, 9
lea ecx, [ebp + 4]
jb 0x4704aa
cmp ax, 0xd
jbe 0x4704b0
cmp ax, 0x20
jne 0x4704d8
lea eax, [esp + 0xd4b8]
push eax
mov byte [esp + 0x16], 2
mov dword [esp + 0xd4bc], ecx
call fcn.00443850
mov ebp, dword [esp + 0xd4bc]
add esp, 4
jmp 0x470622
mov eax, ebp
mov ecx, 0x4fa384
mov edx, 1
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x47053c
dec edx
jns 0x4704e4
mov ax, word [ebp + 4]
cmp ax, 9
lea ecx, [ebp + 4]
jb 0x47050e
cmp ax, 0xd
jbe 0x470514
cmp ax, 0x20
jne 0x47053c
mov dword [esp + 0xd4b8], ecx
lea ecx, [esp + 0xd4b8]
push ecx
mov byte [esp + 0x16], 1
call fcn.00443850
mov ebp, dword [esp + 0xd4bc]
add esp, 4
jmp 0x470622
mov eax, ebp
mov ecx, 0x4fa380
mov edx, 1
jmp 0x470550
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x4705a5
dec edx
jns 0x470550
mov ax, word [ebp + 4]
cmp ax, 9
lea ecx, [ebp + 4]
jb 0x47057a
cmp ax, 0xd
jbe 0x470580
cmp ax, 0x20
jne 0x4705a5
lea edx, [esp + 0xd4b8]
push edx
mov byte [esp + 0x16], 0x10
mov dword [esp + 0xd4bc], ecx
call fcn.00443850
mov ebp, dword [esp + 0xd4bc]
add esp, 4
jmp 0x470622
mov eax, ebp
mov ecx, 0x4f3dd4
mov edx, 1
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x4705de
dec edx
jns 0x4705b1
mov ax, word [ebp + 4]
cmp ax, 9
jb 0x4705d8
cmp ax, 0xd
jbe 0x470631
cmp ax, 0x20
je 0x470631
cmp si, 0x2d
jne 0x470652
lea eax, [esp + 0xd4b8]
push eax
call fcn.00417de5
mov ebp, dword [esp + 0xd4bc]
add esp, 4
test ebp, ebp
je 0x470622
nop
mov ax, word [ebp]
cmp ax, 9
jb 0x470610
cmp ax, 0xd
jbe 0x470616
cmp ax, 0x20
jne 0x47061b
add ebp, 2
jmp 0x470600
mov dword [esp + 0xd4b8], ebp
mov si, word [ebp]
test si, si
jne 0x470400
jmp 0x470652
lea ecx, [esp + 0xd4b8]
add ebp, 4
push ecx
mov dword [esp + 0xd4bc], ebp
call fcn.00443850
mov ebp, dword [esp + 0xd4bc]
add esp, 4
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0xd4c0]
push eax
mov dword [esp + 0x4c], ebp
call fcn.0044c770
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00422077
mov edx, dword [esp + 0xd4c8]
add esp, 0x10
cmp word [edx], 0x2c
mov edi, eax
jne 0x4706c4
mov esi, edx
lea eax, [esp + 0xd4b8]
add esi, 2
push eax
mov dword [esp + 0xd4bc], esi
call fcn.00443850
push 0x2c
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xd4c4]
push edx
call fcn.0044c770
mov ebx, dword [esp + 0x2c]
push ebx
call fcn.00422077
add esp, 0x14
mov ebp, eax
jmp 0x470734
push 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x20], 0
call fcn.00428699
mov edx, dword [esp + 0x20]
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x40]
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.00449600
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], esi
call fcn.00443850
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00428699
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x50]
add esp, 0x10
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.00449600
mov ebx, dword [esp + 0x1c]
mov ebp, ebx
cmp word [ebp], 0
je 0x470d5b
cmp word [edi], 0
je 0x470d5b
mov al, byte [esp + 0x12]
xor ebx, ebx
cmp al, 2
je 0x4707ad
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea esp, [esp]
push 0
call fcn.004b63ba
add esp, 4
mov ebx, eax
call fcn.00445d10
add ebx, eax
call esi
add ebx, eax
mov eax, dword [0x51d628]
mov ecx, eax
shl ecx, 4
add ebx, ecx
mov edx, ebx
xor eax, ebx
and edx, 3
cmp dl, 3
mov dword [esp + 0x44], ebx
mov dword [0x51d628], eax
jne 0x470760
test bh, bh
je 0x470760
mov eax, ebx
shr eax, 0x10
test al, al
je 0x470760
mov al, ah
and al, 0x88
cmp al, 0x80
jne 0x470760
cmp byte [esp + 0x12], 0x10
je 0x470acb
lea ecx, [esp + 0x4c]
call fcn.0044d980
lea ecx, [esp + 0x20]
call fcn.0044d980
push 0
push 0x80
push 3
push 0
push 7
push 1
push edi
lea ecx, [esp + 0x6c]
mov byte [esp + 0xd4cc], 3
call fcn.00417e55
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x470812
mov esi, 0x4f9468
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], esi
call fcn.0044d910
mov dword [esp + 0x4c], esi
lea ecx, [esp + 0x50]
jmp 0x470b22
push 0
push 0x80
push 2
push 0
push 7
push 0x40000001
push ebp
lea ecx, [esp + 0x40]
call fcn.00417e55
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4707f3
push 0
push 0
lea ecx, [esp + 0x74]
mov byte [esp + 0x3c], 1
call fcn.004440d0
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4b0], 4
mov dword [esp + 0xd4a0], eax
mov dword [esp + 0xd4a4], ecx
mov esi, 0x4f80d0
mov edi, 7
xor edx, edx
mov dl, byte [esi]
lea ecx, [esp + 0x20]
push edx
call fcn.00446a30
inc esi
dec edi
jne 0x470870
cmp byte [esp + 0x12], 8
mov byte [esp + 0x14], 0x53
jne 0x470893
mov byte [esp + 0x14], 0x41
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.00446a30
mov ecx, ebx
and ecx, 0xfffffff
test ebx, ebx
mov dword [esp + 0x3c], 8
mov dword [esp + 0x38], ecx
je 0x4708bf
xor ebx, 0x5aa59669
cmp byte [esp + 0x12], 8
mov dword [esp + 0x14], ebx
jne 0x4708d2
xor ebx, 8
mov word [esp + 0x14], bx
lea esi, [esp + 0x14]
mov edi, 4
jmp 0x4708e0
xor edx, edx
mov dl, byte [esi]
lea ecx, [esp + 0x20]
push edx
call fcn.00446a30
inc esi
dec edi
jne 0x4708e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x3c], 0xc
mov dword [esp + 0x1066], 0
xor esi, esi
mov ebp, 1
lea eax, [esp + 0x14]
push eax
push ebp
lea ecx, [esp + 0x1a]
push ecx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1e], 0
mov dword [esp + 0x20], 0
call fcn.00446960
mov edi, eax
call ebx
test edi, edi
je 0x47096c
cmp dword [esp + 0x14], ebp
jb 0x47096c
movzx eax, byte [esp + 0x12]
cmp eax, 0xffffffff
je 0x47096c
movsx edx, si
mov byte [esp + edx + 0x1066], al
mov cl, byte [esp + 0x1089]
inc esi
inc cl
cmp si, 4
mov byte [esp + 0x1089], cl
jl 0x470912
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1066]
mov edi, 4
mov cl, byte [esp + 0x13]
test cl, cl
je 0x47098e
mov dl, byte [esi]
jmp 0x470990
xor dl, dl
inc dword [esp + 0x3c]
mov ecx, eax
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov byte [eax + ecx], dl
mov eax, dword [esp + 0x2c]
cmp eax, 0x1000
jl 0x4709c7
mov edx, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x48]
push ecx
push eax
mov eax, dword [esp + 0x30]
push edx
push eax
call ebx
xor eax, eax
mov dword [esp + 0x2c], eax
inc esi
dec edi
jne 0x470982
lea ecx, [esp + 0x6c]
mov dword [esp + 0x3c], 0x10
call fcn.00444370
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, byte [esp + 0x34]
test al, al
mov esi, 0x4f9468
mov dword [esp + 0x20], esi
je 0x470a14
mov eax, dword [esp + 0x2c]
test eax, eax
jle 0x470a14
mov ecx, dword [esp + 0x24]
push 0
lea edx, [esp + 0x48]
push edx
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call ebx
mov eax, dword [esp + 0x28]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x2c], 0
je 0x470a39
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call ebp
mov eax, dword [esp + 0x24]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], 0
je 0x470a57
cmp eax, 0xffffffff
je 0x470a57
push eax
call edi
mov al, byte [esp + 0x60]
test al, al
mov dword [esp + 0x24], 0
mov dword [esp + 0x4c], esi
je 0x470a87
mov eax, dword [esp + 0x58]
test eax, eax
jle 0x470a87
mov edx, dword [esp + 0x54]
push 0
lea ecx, [esp + 0x48]
push ecx
push eax
mov eax, dword [esp + 0x5c]
push edx
push eax
call ebx
mov eax, dword [esp + 0x54]
test eax, eax
mov dword [esp + 0x58], 0
je 0x470aa6
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call ebp
mov eax, dword [esp + 0x50]
test eax, eax
mov dword [esp + 0x54], 0
je 0x470d29
cmp eax, 0xffffffff
je 0x470d29
push eax
call edi
jmp 0x470d29
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], ebx
call fcn.0044da60
lea ecx, [esp + 0x4c]
call fcn.0044da60
push ebx
push 0x80
push 3
push ebx
push 7
push 1
push edi
lea ecx, [esp + 0x40]
mov byte [esp + 0xd4cc], 6
call fcn.00417e55
cmp dword [esp + 0x24], ebx
jne 0x470b3e
mov esi, 0x4f9478
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], esi
call fcn.0044d910
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x24]
call fcn.0044d910
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
jmp 0x470d8a
mov esi, 8
lea ecx, [esp + 0x20]
call fcn.00446a90
dec esi
jne 0x470b43
xor esi, esi
mov edi, 1
inc dword [esp + 0x3c]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x1b]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x1f], 0
mov dword [esp + 0x20], ebx
call fcn.00446960
cmp eax, ebx
je 0x470b88
cmp dword [esp + 0x14], edi
jb 0x470b88
movzx eax, byte [esp + 0x13]
jmp 0x470b8b
or eax, 0xffffffff
mov byte [esp + esi + 0x44], al
inc esi
cmp esi, 4
jl 0x470b56
cmp dword [esp + 0x44], ebx
je 0x470bf3
mov esi, 0x4f9478
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], esi
call fcn.0044d910
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], esi
call fcn.0044d910
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x470bd6
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x470bec
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, edi
jmp 0x470d8f
push ebx
push 0x80
push 2
push ebx
push 7
push 0x40000001
push ebp
lea ecx, [esp + 0x6c]
call fcn.00417e55
cmp dword [esp + 0x50], ebx
jne 0x470c6a
mov esi, 0x4f9478
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], esi
call fcn.0044d910
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], esi
call fcn.0044d910
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x470c4d
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push ebx
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x470c63
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, edi
jmp 0x470d8f
mov byte [esp + 0x60], 1
mov byte [esp + 0x1089], 0
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov byte [esp + 0x78], 0
mov dword [esp + 0x108c], ebx
mov dword [esp + 0x1090], ebx
lea eax, [esp + 0x4c]
mov dword [esp + 0xd4a4], eax
mov eax, dword [esp + 0x38]
cmp eax, ebx
lea edx, [esp + 0x20]
mov byte [esp + 0xd4b0], 7
mov dword [esp + 0xd4a0], edx
je 0x470cc5
xor eax, 0x5aa59669
mov dword [esp + 0x38], eax
mov esi, 4
lea ebx, [ebx]
mov ebp, dword [esp + 0x3c]
lea ecx, [esp + 0x44]
push ecx
push edi
lea edx, [esp + 0x1b]
inc ebp
push edx
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], ebp
call fcn.00446960
dec esi
jne 0x470cd0
lea ecx, [esp + 0x6c]
call fcn.00444670
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, 0x4f9478
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], esi
call fcn.0044d910
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], esi
call fcn.0044d910
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x470d40
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call ebp
mov eax, dword [esp + 0x18]
test eax, eax
je 0x470d57
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call ebp
xor eax, eax
jmp 0x470d8f
test ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x470d73
mov eax, dword [0x51d3c8]
add ebx, 0xfffffff8
push ebx
push 0
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x470d8a
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, 1
mov ecx, dword [esp + 0xd4a8]
pop edi
pop esi
pop ebx
pop ebp
mov dword fs:[0], ecx
add esp, 0xd4a4
ret 8