Function at 0x40b5b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov dword [esp + 0x28], 0xbe766261
mov dword [esp + 0x2c], 0x62606c68
lea eax, [esp + 0x30]
mov dword [esp + 0x9c], eax
mov byte [esp + 0x30], 0xc8
mov dword [esp + 0x35], 0
mov dword [esp + 0x31], 0
mov edx, 0xa41d9df
mov ecx, 0x1483b3be
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 8], ecx
movzx esi, byte [esp + edx - 0xa41d9b7]
mov edi, dword [esp + 8]
and edi, 2
mov eax, edx
xor eax, 1
add eax, edi
mov edi, eax
and edi, esi
mov ecx, edi
and ecx, 0xfffffffd
mov ebx, edi
or ebx, 0xfffffffd
inc ebx
imul ebx, ecx
mov ecx, edi
and ecx, 2
or edi, 2
imul edi, ecx
sub ebx, edi
add eax, esi
add eax, ebx
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x10]
mov eax, esi
not eax
mov ecx, eax
and ecx, 0x9dfceaa9
or eax, 0x62031556
lea edi, [esi + eax]
inc edi
or edi, ecx
mov eax, esi
and eax, 0xdd
lea ecx, [eax + 2]
and esi, 2
imul ecx, esi
xor esi, 2
imul esi, eax
add esi, ecx
sub esi, edi
and edi, 9
lea eax, [esi + edi*2]
mov ecx, dword [esp + 8]
add al, 0x77
mov byte [esp + edx - 0xa41d9b7], al
inc edx
add ecx, 2
cmp edx, 0xa41d9f0
jne 0x40b600
lea eax, [esp + 0xa3]
lea edx, [esp + 0x28]
mov edi, eax
mov ecx, 2
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xab]
xor ecx, ecx
mov edx, dword [esp + 0x9c]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x30]
mov byte [esp + 0xab], cl
mov dword [esp + 0x28], 0xd341d19b
mov dword [esp + 0x2c], 0xdf40dd44
mov dword [esp + 0x30], 0xdb4ed971
mov dword [esp + 0x34], 0xc793c546
mov dword [esp + 0x38], 0xc35bc17a
mov dword [esp + 0x3c], 0xcf63cd52
mov dword [esp + 0x40], 0xcba8c994
mov dword [esp + 0x44], 0x37a43569
mov dword [esp + 0x48], 0x33a431a6
mov dword [esp + 0x4c], 0x3f913d99
mov dword [esp + 0x50], 0x3ba4399d
mov dword [esp + 0x54], 0x27b52591
mov dword [esp + 0x58], 0x237121b0
mov dword [esp + 0x5c], 0x2f7b2dba
mov dword [esp + 0x60], 0x2bb129b7
mov dword [esp + 0x64], 0x174315b3
mov dword [esp + 0x68], 0x138111b8
mov dword [esp + 0x6c], 0x1f8b1d80
mov dword [esp + 0x70], 0x1b871949
mov dword [esp + 0x74], 0x7900588
mov dword [esp + 0x78], 0x39601a9
mov dword [esp + 0x7c], 0xf9d0daf
mov dword [esp + 0x80], 0xba709a2
mov dword [esp + 0x84], 0x770375a6
mov dword [esp + 0x88], 0x7370717c
mov word [esp + 0x94], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x8c], 0
mov ecx, 0xfc102c63
mov edi, 0x9c
nop
movzx edx, byte [esp + ecx + 0x3efd3c5]
mov esi, edi
xor esi, ecx
and esi, edx
xor esi, ecx
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x10]
add dl, 0x4b
mov byte [esp + ecx + 0x3efd3c5], dl
movzx edx, byte [esp + ecx + 0x3efd3c6]
lea esi, [ecx + 1]
lea ebx, [edi - 1]
xor ebx, esi
and ebx, edx
xor ebx, esi
mov dword [esp + 0x10], ebx
mov edx, dword [esp + 0x10]
add dl, 0x4b
mov byte [esp + ecx + 0x3efd3c6], dl
add ecx, 2
add edi, 0xfffffffe
cmp edi, 0x2e
jne 0x40b7d0
mov dword [esp + 0x10], 0xd373d187
mov dword [esp + 0x14], 0xdf77dd42
mov word [esp + 0x18], 0xd9de
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x10]
mov esi, ecx
and esi, 9
xor esi, 0xdbce8069
mov edi, ecx
and edi, 0x16
sub edi, esi
mov esi, 0x33
sub esi, edi
add edi, 0xab5c59cc
xor esi, edi
and esi, edx
xor esi, edi
mov dword [esp + 4], esi
mov edi, dword [esp + 4]
mov edx, 0x441585eb
sub edx, edi
and edx, 0xace0f1b5
add edi, 0x3bea7a14
not edi
or edi, 0xace0f1b5
add edi, edx
mov edx, edi
not edx
and edx, 0xeb
and edi, 0x14
sub edx, edi
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, 0x13
jne 0x40b860
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push 0
push ecx
push 8
push eax
lea eax, [esp + 0x38]
push eax
push edx
push dword [ebp + 8]
call fcn.0040c5e0
add esp, 0x1c
test al, al
je 0x40ba46
mov word [esp + 0x28], 0x8497
mov byte [esp + 0x2a], pe_nt_image_headers32
mov dword [esp + 0x2b], 0
mov byte [esp + 0x2f], 0
mov eax, 0x90749daf
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6f8b6279]
mov edx, eax
and edx, ecx
mov esi, edx
and esi, 0xffffffbd
mov edi, edx
or edi, 0xfffffffd
inc edi
imul edi, esi
mov esi, edx
and esi, 2
sub esi, edx
add esi, 0xfffffffe
shr edx, 1
and edx, 1
imul edx, esi
lea edx, [edi + edx*2]
add ecx, eax
add ecx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
lea edx, [ecx + ecx]
and edx, 0x199f606c
mov esi, ecx
xor esi, edx
xor ecx, 0x36
and ecx, edx
xor esi, 0xc9
add ecx, ecx
sub ecx, esi
mov byte [esp + eax + 0x6f8b6279], cl
inc eax
cmp eax, 0x90749db7
jne 0x40b910
xor ecx, ecx
mov eax, dword [esp + 0xc]
nop
nop
nop
nop
movzx edx, byte [eax + ecx]
mov dh, byte [esp + ecx + 0x28]
test dl, dl
je 0x40b991
inc ecx
cmp dl, dh
je 0x40b980
mov bl, 1
cmp dl, dh
je 0x40bda0
mov dword [esp + 0x28], 0xb7a5a0b3
mov dword [esp + 0x2c], 0x57a4baa1
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov eax, 0xfb1b209
mov ecx, 0xf04e4df5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xfb1b1e1]
mov esi, edx
xor esi, edx
not esi
and esi, ecx
xor esi, edx
not esi
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x10]
add dl, 0xba
mov byte [esp + eax - 0xfb1b1e1], dl
inc eax
dec ecx
cmp eax, 0xfb1b219
jne 0x40b9d0
mov eax, dword [esp + 0xc]
movzx ebx, byte [esp + 0x28]
mov esi, eax
test bl, bl
je 0x40ba4d
lea edx, [esp + 0x28]
mov esi, eax
mov edi, eax
jmp 0x40ba27
movzx ebx, byte [edx]
test bl, bl
je 0x40ba4d
mov bh, byte [edi]
test bh, bh
je 0x40bb86
inc edi
inc edx
lea ecx, [esi + 1]
cmp bh, bl
je 0x40ba3e
mov edi, ecx
mov esi, ecx
je 0x40ba20
lea edx, [esp + 0x28]
jmp 0x40ba20
xor ebx, ebx
jmp 0x40bda9
test esi, esi
je 0x40bb86
mov dword [esp + 0x28], 0x10273224
mov dword [esp + 0x2c], 0x1b0fcf29
mov dword [esp + 0x30], 0xc3ca101f
mov dword [esp + 0x34], 0x6c1c0668
mov dword [esp + 0x38], 0xfbc2261d
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov eax, 0xe823259d
mov ecx, 0x17dcda62
nop
movzx esi, byte [esp + eax + 0x17dcda8b]
lea edi, [ecx - 0x17dcda00]
mov ebx, eax
and ebx, 0xe0022488
and edi, 0x77
or edi, ebx
xor edi, esi
xor edi, 0x8210177
mov ebx, eax
or ebx, esi
not ebx
or ebx, edi
mov edi, ebx
not edi
lea edx, [ebx + edi*2]
mov ebx, 0xfffffffe
sub ebx, edx
mov edx, ebx
not edx
and ebx, 2
and edx, 0xfffffffd
imul edx, ebx
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
add edi, edx
mov ebx, ecx
sub ebx, esi
and ebx, edi
lea edx, [edi + edi]
not edx
add edx, edi
add esi, eax
and edx, esi
sub edx, ebx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0xb5
mov byte [esp + eax + 0x17dcda8b], dl
inc eax
dec ecx
cmp eax, 0xe82325b9
jne 0x40baa0
lea edx, [esp + 0x28]
lea eax, [esp + 0x10]
mov edi, eax
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x24]
xor ecx, ecx
mov edx, dword [esp + 8]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov esi, dword [esp + 0xc]
movzx ebx, byte [esp + 0x10]
test bl, bl
je 0x40bb8d
mov ecx, eax
mov edx, esi
jmp 0x40bb67
movzx ebx, byte [ecx]
test bl, bl
je 0x40bb8d
mov bh, byte [edx]
test bh, bh
je 0x40bd8b
inc edx
inc ecx
lea edi, [esi + 1]
cmp bh, bl
je 0x40bb7e
mov edx, edi
mov esi, edi
je 0x40bb60
lea ecx, [esp + 0x10]
jmp 0x40bb60
xor ebx, ebx
jmp 0x40bda0
test esi, esi
je 0x40bd8b
mov word [esp + 0x28], 0xafb2
mov byte [esp + 0x2a], 0x6a
mov dword [esp + 0x2b], 0
mov word [esp + 0x2f], 0
mov dword [esp + 4], 0x7bfe8a80
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x28], cl
movzx ecx, byte [esp + 0x29]
lea edx, [ecx + ecx]
and edx, 0x66
neg edx
add ecx, edx
add ecx, 0x7bfe8a33
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x29], cl
movzx ecx, byte [esp + 0x2a]
lea edx, [ecx + ecx]
and edx, 0x68
neg edx
add ecx, edx
add ecx, 0x7bfe8a34
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x2a], cl
movzx ecx, byte [esp + 0x2b]
lea edx, [ecx + ecx]
and edx, 0x6a
neg edx
add ecx, edx
add ecx, 0x7bfe8a35
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x2b], cl
movzx ecx, byte [esp + 0x2c]
lea edx, [ecx + ecx]
and edx, 0x6c
neg edx
add ecx, edx
add ecx, 0x7bfe8a36
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x2c], cl
movzx ecx, byte [esp + 0x2d]
lea edx, [ecx + ecx]
and edx, 0x6e
neg edx
add ecx, edx
add ecx, 0x7bfe8a37
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x2d], cl
movzx ecx, byte [esp + 0x2e]
lea edx, [ecx + ecx]
and edx, 0x70
neg edx
add ecx, edx
add ecx, 0x7bfe8a38
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x2e], cl
movzx ecx, byte [esp + 0x2f]
lea edx, [ecx + ecx]
and edx, 0x72
neg edx
add ecx, edx
add ecx, 0x7bfe8a39
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x2f], cl
movzx ecx, byte [esp + 0x30]
lea edx, [ecx + ecx]
and edx, 0x74
neg edx
add ecx, edx
add ecx, 0x7bfe8a3a
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xa2
mov byte [esp + 0x30], cl
movzx ebx, byte [esp + 0x28]
test bl, bl
je 0x40bd24
add esi, 0x13
lea ecx, [esp + 0x28]
mov edi, esi
mov edx, esi
jmp 0x40bd09
movzx ebx, byte [ecx]
test bl, bl
mov edi, eax
je 0x40bd32
mov bh, byte [edx]
test bh, bh
je 0x40bd8b
inc edx
inc ecx
mov eax, edi
inc edi
cmp bh, bl
je 0x40bd1c
mov edx, edi
mov eax, edi
je 0x40bd00
lea ecx, [esp + 0x28]
jmp 0x40bd00
mov byte [0x44c418], 1
mov eax, 0x44c41a
jmp 0x40bd95
test edi, edi
je 0x40bd8b
mov byte [0x44c418], 1
mov dword [esp + 0x28], 0
mov eax, 0x44c41a
cmp esi, edi
jae 0x40bd95
xor ebx, ebx
cmp byte [esi], 0
je 0x40bd8f
lea eax, [esp + 0x28]
push eax
push edi
push esi
call fcn.0040d6b0
add esp, 0xc
movzx edx, word [esp + 0x28]
lea ecx, [ebx + 2]
mov word [ebx + 0x44c41a], dx
cmp ebx, 0x1fb
ja 0x40bd83
add esi, eax
mov ebx, ecx
cmp esi, edi
jb 0x40bd50
lea eax, [ecx + 0x44c41a]
jmp 0x40bd95
xor ebx, ebx
jmp 0x40bd9c
lea eax, [ebx + 0x44c41a]
mov word [eax], 0
mov bl, 1
mov eax, dword [esp + 0xc]
push eax
call fcn.0043bcf0
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret