Function at 0x41d990
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov dword [esp + 0x60], 0x7f537955
mov dword [esp + 0x64], 0x63f67de9
mov dword [esp + 0x68], 0x670a6109
mov dword [esp + 0x6c], 0x6bfe650d
mov dword [esp + 0x70], 0x6f4369f1
mov dword [esp + 0x74], 0x93076dfb
mov dword [esp + 0x78], 0x97bb91f6
mov dword [esp + 0x7c], 0x9b039500
mov dword [esp + 0x80], 0x9ffb9908
mov dword [esp + 0x84], 0x83109dc1
mov dword [esp + 0x88], 0x871281e5
mov dword [esp + 0x8c], 0x8b19851f
mov dword [esp + 0x90], 0x8fe1891e
mov dword [esp + 0x94], 0xb3df8dde
mov dword [esp + 0x98], 0xb7d8b123
mov dword [esp + 0x9c], 0xbbd7b527
mov dword [esp + 0xa0], 0xbfccb9ea
mov dword [esp + 0xa4], 0xa336bdd9
mov dword [esp + 0xa8], 0xa735a13b
mov dword [esp + 0xac], 0xabc5a532
mov dword [esp + 0xb0], 0xafcba9df
mov dword [esp + 0xb4], 0xd348ad3a
mov dword [esp + 0xb8], 0xd7b1d1b9
mov dword [esp + 0xbc], 0xdbdad5b1
mov dword [esp + 0xc0], 0
lea esi, [esp + 0xc0]
xor edx, edx
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
or eax, 0x419d646a
add eax, edx
mov edi, edx
xor edi, 0x419d646a
lea eax, [edi + eax*2]
add eax, 2
movzx edi, byte [esp + edx + 0x60]
xor eax, edi
mov edi, eax
xor edi, 0x13
and eax, 0x6c
add eax, eax
sub eax, edi
inc al
mov byte [esp + edx + 0x60], al
inc edx
dec ecx
cmp edx, 0x64
jne 0x41dab0
lea edi, [esp + 0x4a0]
lea eax, [esp + 0x60]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x500]
xor edx, edx
xor ecx, ecx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x60], 0x40474645
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx + 0x60]
lea eax, [edx - 0x7d4c3d6f]
mov esi, 0x3d4c3d6e
sub esi, edx
and esi, 0x3d48040a
and eax, 0x82830015
or eax, esi
xor eax, ecx
mov ecx, eax
and ecx, 1
xor eax, 0x8b
lea eax, [eax + ecx*2]
add al, 0x2a
mov byte [esp + edx + 0x60], al
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, 7
jb 0x41db30
mov eax, dword [esp + 0x60]
mov ecx, dword [0x44c2b0]
test ecx, ecx
je 0x41dbc4
xor edx, edx
mov esi, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x41dba0
inc edx
cmp ecx, edx
jne 0x41db90
jmp 0x41dbc4
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x41dbc4
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 5
push 4
push ecx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x1c
mov dword [esp + 0x60], 0x77363924
mov word [esp + 0x64], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x60]
lea edx, [ecx + 0x76]
lea edi, [esi + esi]
not edi
add edi, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
and ebx, edx
or edx, esi
xor edx, ebx
add dl, 0xb2
mov byte [esp + ecx + 0x60], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 6
jb 0x41dbe0
cmp eax, dword [esp + 0x60]
jne 0x41dccd
push dword [esp + 0x28]
call fcn.004394f0
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x60], 0x40474645
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x60]
lea edx, [eax - 0x7d4c3d6f]
mov edi, 0x3d4c3d6e
sub edi, eax
and edi, 0x3d48040a
and edx, 0x82830015
or edx, edi
xor edx, esi
mov esi, edx
and esi, 1
xor edx, 0x8b
lea edx, [edx + esi*2]
add dl, 0x2a
mov byte [esp + eax + 0x60], dl
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, 7
jb 0x41dc50
mov eax, dword [esp + 0x60]
mov edx, dword [0x44c2b0]
test edx, edx
mov ebx, dword [ebp + 8]
je 0x41dcfd
xor esi, esi
mov edi, dword [0x44c2b4]
cmp dword [edi + esi*8], 0x9abdb589
je 0x41dcdb
mov ebx, esi
and ebx, 1
xor esi, 1
lea esi, [esi + ebx*2]
mov ebx, dword [ebp + 8]
cmp esi, edx
jb 0x41dcb0
jmp 0x41dcfd
xor ecx, ecx
xor edx, edx
xor esi, esi
mov edi, dword [ebp + 0x14]
jmp 0x41e2ea
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x41dcfd
push 0
push ecx
push dword [esp + 0x24]
push 5
push 4
push edx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x1c
test eax, eax
mov edi, dword [ebp + 0x14]
js 0x41e2ba
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov dword [esp + 0xc], 0
mov edx, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
jmp 0x41dd45
mov ecx, edi
call fcn.00439950
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
test eax, eax
je 0x41e2d2
mov ecx, dword [edx + eax + 0x3c]
add eax, edx
mov dword [esp + 0x18], eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx + eax]
movzx esi, word [ebx + eax]
test dx, dx
je 0x41dd75
add eax, 2
cmp dx, si
je 0x41dd60
cmp dx, si
jne 0x41dd37
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x44]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xdc]
mov dword [edi + 0xc], eax
mov ecx, edi
push 0x410
call fcn.00439820
test eax, eax
js 0x41dd37
mov dword [esp + 0x24], 0
mov ebx, dword [edi]
mov dword [esp + 0x60], 0x40474645
lea eax, [esp + 0x64]
mov byte [eax + 2], 0
mov word [eax], 0
xor eax, eax
nop
nop
movzx ecx, byte [esp + eax + 0x60]
lea edx, [eax - 0x7d4c3d6f]
mov esi, 0x3d4c3d6e
sub esi, eax
and esi, 0x3d48040a
and edx, 0x82830015
or edx, esi
xor edx, ecx
mov ecx, edx
and ecx, 1
xor edx, 0x8b
lea ecx, [edx + ecx*2]
add cl, 0x2a
mov byte [esp + eax + 0x60], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 7
jb 0x41ddc0
mov eax, dword [esp + 0x60]
mov edx, dword [0x44c2b0]
test edx, edx
je 0x41de60
xor edi, edi
mov ecx, dword [0x44c2b4]
nop
nop
nop
cmp dword [ecx + edi*8], 0xae6e2b0b
je 0x41de30
inc edi
cmp edx, edi
jne 0x41de20
jmp 0x41de60
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x41de60
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x2b
push ebx
push 5
push ecx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x60], 0x579699e4
lea ecx, [esp + 0x64]
mov byte [ecx + 2], 0
mov word [ecx], 0
mov edi, 0x7420a6
mov edx, 0x5f8bdf59
nop
movzx esi, byte [esp + edi - 0x742046]
mov ebx, edx
and ebx, 0x59815a45
mov ecx, edi
and ecx, 0x60200a
or ecx, ebx
xor ecx, 0x1a
or ecx, esi
lea ebx, [edx - 0x5f8bdf00]
and ebx, esi
not ecx
or ecx, ebx
add cl, 0xc2
mov byte [esp + edi - 0x742046], cl
inc edi
dec edx
cmp edi, 0x7420ad
jne 0x41de80
cmp eax, dword [esp + 0x60]
jne 0x41df90
mov eax, dword [esp + 0x24]
add eax, 2
push eax
call fcn.004394f0
add esp, 4
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov esi, dword [eax]
mov dword [esp + 0x60], 0x40474645
lea eax, [esp + 0x64]
mov byte [eax + 2], 0
mov word [eax], 0
xor eax, eax
mov ebx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x60]
lea edi, [eax - 0x7d4c3d6f]
mov edx, 0x3d4c3d6e
sub edx, eax
and edx, 0x3d48040a
and edi, 0x82830015
or edi, edx
xor edi, ecx
mov ecx, edi
and ecx, 1
xor edi, 0x8b
lea ecx, [edi + ecx*2]
add cl, 0x2a
mov byte [esp + eax + 0x60], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 7
jb 0x41df10
mov eax, dword [esp + 0x60]
mov edi, dword [0x44c2b0]
test edi, edi
je 0x41dfc1
add dword [esp + 4], 2
xor ecx, ecx
mov edx, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xae6e2b0b
je 0x41df9b
inc ecx
cmp edi, ecx
jne 0x41df80
jmp 0x41dfc1
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
jmp 0x41e29f
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, eax
je 0x41dfc1
push 0
push dword [esp + 8]
push dword [esp + 0x28]
push 0x2b
push esi
push 5
push ecx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x20
test eax, eax
mov edi, dword [ebp + 0x14]
js 0x41e293
mov ecx, dword [esp + 0x20]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
nop
nop
nop
nop
nop
cmp eax, edx
je 0x41dffb
mov esi, dword [ebp + 0xc]
movzx esi, word [esi + edx*2]
cmp si, word [ecx + edx*2]
jne 0x41e293
inc edx
test si, si
jne 0x41dfe0
mov ecx, edi
call fcn.00439de0
cmp eax, 2
jne 0x41e293
mov ecx, edi
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.00439c60
test eax, eax
js 0x41e293
mov ecx, edi
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.0043a170
test eax, eax
js 0x41e293
mov ecx, edi
push 0
push 0
push 0x80
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.0043a170
test eax, eax
js 0x41e293
movzx eax, word [esp + 0xd2]
push eax
call fcn.004394f0
add esp, 4
mov esi, eax
movzx eax, word [esp + 0xd2]
mov ecx, edi
push 0
push 0
push eax
push esi
push dword [esp + 0xec]
push dword [esp + 0xec]
call fcn.0043a170
test eax, eax
js 0x41e28a
movzx edi, word [esp + 0x4a0]
mov dword [esp + 8], esi
mov dword [esp + 4], esi
test di, di
je 0x41e117
lea ecx, [esp + 0x4a0]
mov edx, dword [esp + 8]
mov eax, edx
mov dword [esp + 4], edx
jmp 0x41e0e8
movzx edi, word [ecx]
test di, di
je 0x41e117
movzx esi, word [eax]
test si, si
je 0x41e283
add eax, 2
add ecx, 2
mov edx, dword [esp + 4]
add edx, 2
cmp si, di
je 0x41e10c
mov dword [esp + 4], edx
mov eax, edx
je 0x41e0e0
lea ecx, [esp + 0x4a0]
jmp 0x41e0e0
cmp dword [esp + 4], 0
je 0x41e283
mov edi, dword [ebp + 0x14]
mov ecx, edi
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0043a170
test eax, eax
js 0x41e286
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 4], eax
adc ecx, 0
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x41e1c1
cmp cx, dx
je 0x41e259
push edi
call fcn.004395a0
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 0x2c]
mov esi, eax
xor esi, dword [esp + 4]
or esi, ecx
mov edi, dword [ebp + 0x14]
je 0x41e286
mov ecx, edi
push 0
push 0
push 0x68
lea esi, [esp + 0x50c]
push esi
push edx
push eax
call fcn.0043a170
test eax, eax
js 0x41e286
movzx eax, word [esp + 0x55a]
push eax
call fcn.004394f0
add esp, 4
mov ecx, edi
mov edi, eax
movzx eax, word [esp + 0x55a]
push 0
push 0
push eax
push edi
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.0043a170
test eax, eax
js 0x41e193
xor eax, eax
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x41e233
or ecx, 0x20
movzx edx, word [edi + eax]
lea esi, [edx - 0x41]
cmp si, 0x1a
jae 0x41e243
or edx, 0x20
test cx, cx
je 0x41e18a
add eax, 2
cmp cx, dx
je 0x41e220
jmp 0x41e18a
mov eax, dword [esp + 0x530]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0xc], eax
push edi
call fcn.004395a0
add esp, 4
mov edi, dword [ebp + 0x14]
mov esi, dword [esp + 8]
push esi
call fcn.004395a0
add esp, 4
push dword [esp + 0x20]
call fcn.004395a0
add esp, 4
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x10]
je 0x41dd30
cmp dword [esp + 0xc], 0
je 0x41dd30
jmp 0x41e2d2
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
push dword [esp + 0x1c]
call fcn.004395a0
add esp, 4
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, edi
call fcn.00439940
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret