Function at 0x46e260
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1d8
mov esi, dword [ebp + 0x10]
mov dword [esp + 4], ecx
mov eax, 0x1445247
mov ecx, 0x4e574f44
mov ebx, dword [ebp + 8]
mov edi, edx
mov dword [esp], edi
movsd xmm1, qword [esi + 0x24]
movq xmm0, qword [esi + 0x2c]
movq xmm2, qword [esi + 0x14]
movsd qword [edx + 0x80], xmm1
movq xmm1, qword [esi + 0x1c]
movq qword [edx + 0x88], xmm0
movq qword [edx + 0x70], xmm2
movq qword [edx + 0x78], xmm1
xor eax, dword [edx + 0x8c]
xor ecx, dword [edx + 0x88]
or ecx, eax
movzx ecx, byte [ebp + 0x14]
call 0x46e2cd
pop eax
sete dl
test dl, cl
je 0x46e3da
mov word [esp + 0x10c], 4
mov dword [esp + 0x90], 0x80000001
mov dword [esp + 0x94], 0xd0001
xor eax, eax
lea edx, [esp + 0x90]
mov ecx, ebx
cmp byte [ebx + 0x31], 2
sete al
push eax
call fcn.00459840
add esp, 4
mov byte [ebx + 0x251], 1
mov eax, dword [esp + 4]
mov esi, dword [edi + 0xc0]
mov word [eax], 9
xor ebx, ebx
lock dec dword [esi]
jne 0x46e33c
lea ecx, [edi + 0xc0]
call fcn.00468c10
xor eax, eax
cmp eax, dword [edi + 8]
seto al
or bl, al
jne 0x46e34f
mov ecx, edi
call fcn.00464490
cmp byte [edi + 0xac], 0
jne 0x46e378
test dword [edi + 0xb0], 0x7fffffff
je 0x46e378
push dword [edi + 0xb4]
push 0
push dword [0x903200]
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [edi + 0xa4]
mov edi, dword [edi + 0xa8]
mov eax, dword [edi]
test eax, eax
je 0x46e390
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x46e3ae
cmp dword [edi + 8], 9
jb 0x46e39f
mov esi, dword [esi - 4]
push esi
push 0
push dword [0x903200]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp]
test dword [eax + 0x90], 0x7fffffff
je 0x46e90d
push dword [eax + 0x94]
push 0
push dword [0x903200]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x46e90d
mov edx, dword [esi + 8]
lea ecx, [edi + 0x50]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 4]
shl edx, 2
lea esi, [ecx + 0x10]
lea edi, [edx + edx*4]
mov dword [esp + 0x10], edx
jmp 0x46e40c
test edi, edi
je 0x46e497
movzx edx, byte [esi - 0x10]
mov bx, 0xb
mov edx, dword [edx*4 + 0x46ed44]
add edx, eax
jmp edx
mov edi, dword [esp]
mov byte [edi + 0xc4], 0
mov esi, dword [edi + 0xc0]
cmp byte [esi + 0xb7], 0
je 0x46e513
mov ebx, dword [ebp + 8]
mov word [esp + 0x10c], 4
mov dword [esp + 0x90], 0x80000001
mov dword [esp + 0x94], 0x60001
xor eax, eax
lea edx, [esp + 0x90]
cmp byte [ebx + 0x31], 2
mov ecx, ebx
sete al
push eax
call fcn.00459840
add esp, 4
mov eax, dword [esp + 4]
mov byte [ebx + 0x251], 1
mov byte [eax], 8
mov dword [eax + 4], 0x80000002
xor ebx, ebx
lock dec dword [esi]
je 0x46e331
jmp 0x46e33c
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0
mov edx, dword [esp + 0x10]
lea esi, [ecx + 0x10]
lea ebx, [edx + edx*4]
jmp 0x46e540
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x46e5ac
movzx edx, byte [esi - 0x10]
mov di, 0xb
mov edx, dword [edx*4 + 0x46ed88]
add edx, eax
jmp edx
mov edx, dword [esp + 0x10]
add ecx, 0x10
lea esi, [edx + edx*4]
jmp 0x46e5cc
mov ebx, esi
test esi, esi
je 0x46e636
movzx esi, byte [ecx - 0x10]
mov dx, 0xb
mov esi, dword [esi*4 + 0x46edcc]
add esi, eax
jmp esi
mov esi, dword [esp]
xor eax, eax
cmp eax, dword [esi + 8]
jo 0x46e79d
lea edi, [esp + 0x110]
mov ecx, 0x14
mov eax, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x154]
cmp ecx, dword [eax + 0x54]
jne 0x46e78e
lea edi, [eax + 0x34]
test ecx, ecx
je 0x46e915
mov eax, ecx
add ecx, 0xffffffdf
cmp ecx, 0xffffffe0
jb 0x46ed42
xor edx, edx
cmp eax, 8
mov ecx, 0
jb 0x46e770
xor edx, edx
cmp eax, 0x10
jae 0x46e6fd
mov esi, ecx
mov ecx, eax
movzx edx, dl
and ecx, 0x38
movd xmm0, edx
nop word cs:[eax + eax]
nop dword [eax]
movq xmm1, qword [esp + esi + 0x134]
movq xmm2, qword [edi + esi]
add esi, 8
cmp ecx, esi
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x46e6b0
pshufd xmm1, xmm0, 0x55
cmp eax, ecx
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd edx, xmm1
jne 0x46e770
jmp 0x46e786
mov ecx, eax
pxor xmm0, xmm0
xor edx, edx
and ecx, 0x30
nop dword [eax + eax]
movdqu xmm1, xmmword [esp + edx + 0x134]
movdqu xmm2, xmmword [edi + edx]
add edx, 0x10
cmp ecx, edx
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x46e710
pshufd xmm1, xmm0, 0xee
cmp eax, ecx
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd edx, xmm0
je 0x46e786
test al, 8
jne 0x46e695
nop dword [eax]
mov esi, eax
movzx eax, byte [edi + ecx]
xor al, byte [esp + ecx + 0x134]
inc ecx
or dl, al
mov eax, esi
cmp esi, ecx
jne 0x46e770
test dl, dl
je 0x46e915
lea ecx, [esp + 0x110]
call fcn.00464490
mov esi, dword [esp]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, pe_nt_image_headers32
mov byte [eax + 0x258], 0
movzx eax, byte [0x90320d]
call fcn.0049d570
test eax, eax
je 0x46ed42
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], 0x80000000
test ebx, ebx
mov edx, dword [esp + 4]
movsd xmm0, qword [ecx + 0x38]
movsd qword [eax + 0x88], xmm0
movsd xmm0, qword [ecx + 0x30]
movsd qword [eax + 0x80], xmm0
movsd xmm0, qword [ecx + 0x28]
movsd qword [eax + 0x78], xmm0
movsd xmm0, qword [ecx + 0x20]
movsd qword [eax + 0x70], xmm0
movsd xmm0, qword [ecx + 0x18]
movsd qword [eax + 0x68], xmm0
movsd xmm0, qword [ecx + 0x10]
movsd qword [eax + 0x60], xmm0
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [eax + 0x58], xmm1
movsd qword [eax + 0x50], xmm0
movsd xmm0, qword [esi + 0x90]
movsd xmm1, qword [esi + 0x98]
movsd qword [eax + 0x90], xmm0
movsd qword [eax + 0x98], xmm1
movsd xmm0, qword [esi + 0xa0]
movsd qword [eax + 0xa0], xmm0
mov ecx, dword [esi + 0xa8]
mov dword [eax + 0xa8], ecx
movsd xmm0, qword [esi + 0xac]
movsd xmm1, qword [esi + 0xb4]
movsd qword [eax + 0xac], xmm0
movsd qword [eax + 0xb4], xmm1
mov ecx, dword [esi + 0xbc]
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 0xc0], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xc4], ecx
mov ecx, dword [ebp + 0x10]
movq xmm0, qword [ecx + 0x34]
movq xmm1, qword [ecx + 0x3c]
movq xmm2, qword [ecx + 0x44]
movsd xmm3, qword [ecx + 0x4c]
mov ecx, dword [ecx + 0x54]
setne byte [eax + 0xed]
cmp dword [esp + 0x14], 0
mov dword [eax + 0xe8], ecx
mov ecx, dword [esp + 0xc]
movsd qword [eax + 0xe0], xmm3
movq qword [eax + 0xd8], xmm2
movq qword [eax + 0xd0], xmm1
movq qword [eax + 0xc8], xmm0
mov byte [eax + 0xec], cl
setne byte [eax + 0xee]
mov dword [edx + 4], eax
mov dword [edx + 8], 0x8c3f78
mov byte [edx], 0x16
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x130]
mov ebx, dword [ebp + 0xc]
mov al, 0x2c
movzx edx, word [ecx + 0x28]
cmp dx, word [ebx + 0x28]
jne 0x46ec02
movzx edx, dx
mov dword [esp + 0x10], edi
mov edi, dword [esp]
mov esi, dword [esp + 8]
cmp edx, 0x178
mov edx, dword [esp + 4]
jne 0x46e957
movzx ecx, word [ecx + 0x2a]
cmp cx, word [ebx + 0x2a]
jne 0x46ec0d
mov ecx, dword [esp + 0xc]
mov al, 0x2d
cmp byte [esp + 0x158], cl
jne 0x46ec0d
cmp dword [esp + 0x120], 0x30
jne 0x46ed42
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0x20]
movsd xmm0, qword [edx + 0x38]
movsd xmm1, qword [edx + 8]
movsd qword [esp + 0x58], xmm0
movsd xmm0, qword [edx + 0x30]
movsd qword [esp + 0x28], xmm1
movsd qword [esp + 0x50], xmm0
movsd xmm0, qword [edx + 0x28]
movsd qword [esp + 0x48], xmm0
movsd xmm0, qword [edx + 0x20]
movsd qword [esp + 0x40], xmm0
movsd xmm0, qword [edx + 0x18]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [esp + 0x30], xmm0
movsd xmm0, qword [edx]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [ecx + 0x28]
movsd qword [esp + 0x88], xmm0
movsd xmm0, qword [ecx + 0x20]
movsd qword [esp + 0x80], xmm0
movsd xmm0, qword [ecx + 0x18]
movsd qword [esp + 0x78], xmm0
movsd xmm0, qword [ecx + 0x10]
movsd qword [esp + 0x70], xmm0
movsd xmm0, qword [ecx]
movq xmm1, qword [ecx + 8]
movq qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm0
mov ecx, dword [esi + 0x90]
mov edx, dword [esi + 0x8c]
mov esi, dword [ecx + 8]
dec esi
and esi, 0xfffffff8
lea edx, [edx + esi + 8]
lea esi, [esp + 0x60]
push 0x30
push esi
push 0x20
push eax
push 0xd
push str.CLIENT_RANDOM
push edx
call dword [ecx + 0x18]
add esp, 0x1c
mov esi, dword [ebp + 8]
lea edx, [esp + 0x1c]
mov ecx, esi
call fcn.0047d6e0
mov eax, dword [esp + 0x128]
lea ebx, [esp + 0x90]
mov ecx, ebx
mov edx, dword [eax + 0xc]
push dword [eax + 0x10]
call fcn.00472f70
add esp, 4
lea ecx, [esp + 0x160]
mov edx, ebx
call fcn.004593d0
lea ecx, [esi + 0x228]
call fcn.00459480
mov eax, dword [esp + 0x168]
cmp dword [esp + 0x14], 0
lea ebx, [edi + 0xac]
mov dword [esi + 0x230], eax
movq xmm0, qword [esp + 0x160]
movq qword [esi + 0x228], xmm0
mov byte [esi + 0x258], 2
je 0x46ec2f
mov edx, edi
lea edi, [esp + 0x90]
mov ecx, 0x14
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x160]
lea esi, [esp + 0x1c]
mov ecx, 0x1d
movsd xmm1, qword [ebx + 8]
mov eax, dword [ebx + 0x10]
movq xmm0, qword [ebx]
movq xmm2, qword [edx + 0x90]
movsd qword [esp + 0x104], xmm1
movsd xmm1, qword [edx + 0x98]
mov dword [esp + 0x10c], eax
movq qword [esp + 0xfc], xmm0
mov eax, dword [edx + 0xa8]
movq qword [esp + 0xe0], xmm2
movsd qword [esp + 0xe8], xmm1
movq xmm1, qword [edx + 0xa0]
mov dword [esp + 0xf8], eax
mov edx, 0x120
movq qword [esp + 0xf0], xmm1
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [0x90320d]
xor ecx, ecx
call fcn.0049d570
test eax, eax
je 0x46ed42
lea esi, [esp + 0x90]
mov ecx, 0x20
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
lea esi, [esp + 0x160]
mov ecx, dword [esp + 8]
add edi, 0x84
mov dword [eax + 0x80], ecx
mov ecx, 0x1d
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x118], ecx
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [edx + 0x18]
movsd qword [eax + 0x110], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [eax + 0x108], xmm0
movq xmm0, qword [edx]
movq xmm1, qword [edx + 8]
movq qword [eax + 0x100], xmm1
movq qword [eax + 0xf8], xmm0
mov byte [eax + 0x11c], cl
mov byte [eax + 0x11d], 1
mov ecx, 0x8c3f54
jmp 0x46ed33
mov edx, dword [esp + 4]
mov edi, dword [esp]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x110]
mov byte [edx], 9
mov byte [edx + 1], al
call fcn.00464490
mov bl, 1
lock dec dword [esi]
je 0x46e331
jmp 0x46e33c
lea edi, [esp + 0x90]
lea esi, [esp + 0x1c]
mov ecx, 0x1d
mov edx, 0x128
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [0x90320d]
xor ecx, ecx
call fcn.0049d570
test eax, eax
je 0x46ed42
mov edx, dword [esp]
mov ecx, 0x14
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x50], 0
mov edi, eax
lea esi, [esp + 0x90]
movsd xmm0, qword [edx + 0x90]
movsd xmm1, qword [edx + 0x98]
add edi, 0x8c
movsd qword [eax + 0x58], xmm0
movsd qword [eax + 0x60], xmm1
movsd xmm0, qword [edx + 0xa0]
movsd qword [eax + 0x68], xmm0
mov ecx, dword [edx + 0xa8]
mov dword [eax + 0x70], ecx
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
movsd qword [eax + 0x74], xmm0
movsd qword [eax + 0x7c], xmm1
mov ecx, dword [ebx + 0x10]
mov dword [eax + 0x84], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 0x88], ecx
mov ecx, 0x1d
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x120], ecx
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [edx + 0x18]
movsd qword [eax + 0x118], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [eax + 0x110], xmm0
movq xmm0, qword [edx]
movq xmm1, qword [edx + 8]
movq qword [eax + 0x108], xmm1
movq qword [eax + 0x100], xmm0
mov byte [eax + 0x124], cl
mov ecx, 0x8c3f30
mov byte [eax + 0x125], 1
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
jmp 0x46e90a
ud2