Function at 0x413950
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x350
mov eax, 0x79cc4519
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
push ebx
push ebp
push esi
push edi
mov eax, 0x7a879d8a
mov ecx, 0x30
lea edi, [esp + 0x1a0]
rep stosd dword es:[edi], eax
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 5]
mov dword [esp + 0x50], eax
movzx eax, byte [edx + 4]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 7]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 9]
mov dword [esp + 0x54], eax
movzx eax, byte [edx + 8]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0xa]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0xb]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0xd]
mov dword [esp + 0x58], eax
movzx eax, byte [edx + 0xc]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0xe]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0xf]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x11]
mov dword [esp + 0x5c], eax
movzx eax, byte [edx + 0x10]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x12]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x13]
shl eax, 8
or eax, ecx
mov dword [esp + 0x60], eax
movzx eax, byte [edx + 0x14]
shl eax, 8
movzx ecx, byte [edx + 0x15]
or eax, ecx
shl eax, 8
movzx ecx, byte [edx + 0x16]
or eax, ecx
shl eax, 8
movzx ecx, byte [edx + 0x17]
or eax, ecx
mov dword [esp + 0x64], eax
movzx eax, byte [edx + 0x18]
shl eax, 8
movzx ecx, byte [edx + 0x19]
or eax, ecx
shl eax, 8
movzx ecx, byte [edx + 0x1a]
or eax, ecx
shl eax, 8
movzx ecx, byte [edx + 0x1b]
or eax, ecx
mov dword [esp + 0x68], eax
movzx eax, byte [edx + 0x1c]
shl eax, 8
movzx ecx, byte [edx + 0x1d]
or eax, ecx
movzx ecx, byte [edx + 0x1e]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x1f]
shl eax, 8
or eax, ecx
mov dword [esp + 0x6c], eax
movzx eax, byte [edx + 0x20]
movzx ecx, byte [edx + 0x21]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x22]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x23]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x25]
mov dword [esp + 0x70], eax
movzx eax, byte [edx + 0x24]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x26]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x27]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x29]
mov dword [esp + 0x74], eax
movzx eax, byte [edx + 0x28]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x2a]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x2b]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x2d]
mov dword [esp + 0x78], eax
movzx eax, byte [edx + 0x2c]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x2e]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x2f]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x31]
mov dword [esp + 0x7c], eax
movzx eax, byte [edx + 0x30]
shl eax, 8
or eax, ecx
shl eax, 8
movzx ecx, byte [edx + 0x32]
or eax, ecx
movzx ecx, byte [edx + 0x33]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x35]
mov dword [esp + 0x80], eax
movzx eax, byte [edx + 0x34]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x36]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x37]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x39]
mov dword [esp + 0x84], eax
movzx eax, byte [edx + 0x38]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x3a]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x3b]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x3d]
mov dword [esp + 0x88], eax
movzx eax, byte [edx + 0x3c]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0x3e]
movzx edx, byte [edx + 0x3f]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x2c], 0xd
lea esp, [esp]
mov edx, dword [eax + 0x18]
mov esi, dword [eax - 0x10]
mov edi, dword [eax + 0xc]
mov ecx, edx
rol ecx, 0xf
xor ecx, dword [eax - 0x1c]
mov ebx, esi
xor ecx, dword [eax]
rol ebx, 7
mov ebp, ecx
rol ebp, 0xf
xor ebx, ebp
mov ebp, ecx
ror ebp, 9
xor ebx, ebp
xor ebx, edi
xor ebx, ecx
mov ecx, dword [eax + 0x1c]
rol ecx, 0xf
xor ecx, dword [eax - 0x18]
mov dword [eax + 0x24], ebx
xor ecx, dword [eax + 4]
mov ebx, dword [eax - 0xc]
rol ebx, 7
mov ebp, ecx
rol ebp, 0xf
xor ebx, ebp
mov ebp, ecx
ror ebp, 9
xor ebx, ebp
xor ebx, dword [eax + 0x10]
add eax, 0x10
xor ebx, ecx
mov ecx, dword [eax + 0x10]
rol ecx, 0xf
xor ecx, dword [eax - 0x24]
mov dword [eax + 0x18], ebx
xor ecx, dword [eax - 8]
mov ebx, dword [eax - 0x18]
rol ebx, 7
mov ebp, ecx
rol ebp, 0xf
xor ebx, ebp
mov ebp, ecx
ror ebp, 9
xor ebx, ebp
xor ebx, dword [eax + 4]
xor ebx, ecx
mov ecx, dword [eax + 0x14]
rol ecx, 0xf
xor ecx, edi
xor ecx, esi
mov esi, dword [eax - 0x14]
rol esi, 7
mov edi, ecx
rol edi, 0xf
xor esi, edi
mov edi, ecx
ror edi, 9
xor esi, edi
xor esi, edx
xor esi, ecx
sub dword [esp + 0x2c], 1
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], esi
jne 0x413c30
xor eax, eax
mov ecx, dword [esp + eax + 0x60]
xor ecx, dword [esp + eax + 0x50]
mov edx, dword [esp + eax + 0x64]
xor edx, dword [esp + eax + 0x54]
mov dword [esp + eax + 0x260], ecx
mov ecx, dword [esp + eax + 0x68]
xor ecx, dword [esp + eax + 0x58]
mov dword [esp + eax + 0x264], edx
mov edx, dword [esp + eax + 0x6c]
xor edx, dword [esp + eax + 0x5c]
mov dword [esp + eax + 0x268], ecx
mov dword [esp + eax + 0x26c], edx
add eax, 0x10
cmp eax, 0x100
jl 0x413ce2
mov eax, dword [esp + 0x364]
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 2
xor edx, edx
lea esp, [esp]
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + edx + 0x160]
mov eax, dword [esp + 0x18]
add ecx, 0xfffffffe
xor eax, ebx
xor eax, dword [esp + 0x20]
rol ebp, 0xc
rol edi, cl
mov ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x1c]
add edi, ebp
add edi, esi
rol edi, 7
xor ecx, esi
add ecx, dword [esp + edx + 0x50]
xor ebp, edi
add eax, ebp
add eax, dword [esp + edx + 0x260]
add ecx, edi
add eax, dword [esp + 0x24]
add ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x20]
mov ebp, ebx
mov ebx, dword [esp + edx + 0x164]
rol ebp, 9
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x1c]
ror edi, 0xd
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], esi
mov edi, ecx
ror edi, 0xf
mov esi, ecx
rol esi, 9
xor edi, esi
xor edi, ecx
mov ecx, dword [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x20], eax
xor eax, ebp
xor eax, dword [esp + 0x14]
rol esi, 0xc
add eax, dword [esp + edx + 0x264]
dec ecx
add eax, dword [esp + 0x24]
rol ebx, cl
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ebp
mov ebp, dword [esp + 0x20]
add ebx, esi
add ebx, edi
rol ebx, 7
xor esi, ebx
add esi, eax
mov eax, dword [esp + 0x10]
xor eax, ecx
xor eax, edi
add eax, dword [esp + edx + 0x54]
mov dword [esp + 0x20], esi
add eax, ebx
add eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
rol ebx, 9
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
ror ecx, 0xd
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ecx
mov ebx, eax
ror ebx, 0xf
mov ecx, eax
rol ecx, 9
xor ebx, ecx
xor ebx, eax
mov dword [esp + 0x1c], edi
mov eax, esi
xor esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + edx + 0x168]
rol eax, 0xc
rol edi, cl
mov ecx, dword [esp + 0x1c]
xor esi, ebp
add esi, dword [esp + edx + 0x268]
add edi, eax
add esi, dword [esp + 0x24]
add edi, ebx
rol edi, 7
xor eax, edi
add eax, esi
mov esi, eax
mov eax, dword [esp + 0x10]
xor eax, ecx
xor eax, ebx
add eax, dword [esp + edx + 0x58]
mov dword [esp + 0x1c], ebx
add eax, edi
add eax, dword [esp + 0x28]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + edx + 0x16c]
rol ebp, 9
ror ecx, 0xd
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, eax
mov dword [esp + 0x28], edi
mov edi, eax
ror edi, 0xf
rol ecx, 9
xor edi, ecx
mov ecx, dword [esp + 0x2c]
xor edi, eax
inc ecx
mov eax, esi
rol eax, 0xc
rol ebx, cl
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
xor esi, ebp
xor esi, dword [esp + 0x14]
add ebx, eax
add esi, dword [esp + edx + 0x26c]
add ebx, edi
add esi, dword [esp + 0x24]
rol ebx, 7
xor eax, ebx
add eax, esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], ebp
mov ebp, eax
mov eax, esi
xor eax, ecx
xor eax, edi
add eax, dword [esp + edx + 0x5c]
mov dword [esp + 0x1c], edi
add eax, ebx
add eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x14]
rol ebx, 9
ror ecx, 0xd
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], esi
mov ecx, eax
ror ecx, 0xf
mov esi, eax
rol esi, 9
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x20]
xor ecx, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ebp
xor ecx, eax
mov eax, dword [esp + 0x2c]
add eax, 4
mov dword [esp + 0x2c], eax
add eax, 0xfffffffe
add edx, 0x10
cmp eax, 0x10
mov esi, ecx
jl 0x413d90
mov dword [esp + 0x2c], 0x12
xor eax, eax
jmp 0x413fd0
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffffe
mov edi, dword [esp + eax + 0x1a0]
mov edx, ebp
rol edx, 0xc
rol edi, cl
mov ecx, ebp
and ebp, dword [esp + 0x14]
or ecx, ebx
mov ebx, dword [esp + 0x18]
and ecx, ebx
or ecx, ebp
add ecx, dword [esp + eax + 0x2a0]
add edi, edx
add ecx, dword [esp + 0x24]
add edi, esi
rol edi, 7
xor edx, edi
add edx, ecx
mov ebp, edx
mov edx, dword [esp + 0x1c]
and edx, esi
mov ecx, esi
not ecx
and ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ebx
or ecx, edx
add ecx, dword [esp + eax + 0x90]
mov edx, dword [esp + 0x14]
add ecx, edi
add ecx, dword [esp + 0x28]
rol edx, 9
mov ebx, dword [esp + eax + 0x1a4]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x1c]
ror edx, 0xd
mov dword [esp + 0x1c], esi
mov esi, ecx
mov dword [esp + 0x10], edx
mov edx, ecx
ror edx, 0xf
rol esi, 9
xor edx, esi
xor edx, ecx
mov ecx, dword [esp + 0x2c]
dec ecx
mov edi, ebp
rol edi, 0xc
rol ebx, cl
mov ecx, ebp
or ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
and ecx, dword [esp + 0x18]
and ebp, dword [esp + 0x14]
add ebx, edi
or ecx, ebp
add ecx, dword [esp + eax + 0x2a4]
add ebx, edx
add ecx, dword [esp + 0x24]
rol ebx, 7
xor edi, ebx
add edi, ecx
mov ebp, edi
mov edi, dword [esp + 0x1c]
mov ecx, edx
not ecx
and ecx, dword [esp + 0x10]
mov esi, edi
and esi, edx
or ecx, esi
add ecx, dword [esp + eax + 0x94]
mov esi, dword [esp + 0x18]
add ecx, ebx
add ecx, dword [esp + 0x28]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x14]
rol esi, 9
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x20]
ror edi, 0xd
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
mov edx, ecx
mov dword [esp + 0x28], esi
mov esi, ecx
ror esi, 0xf
rol edx, 9
xor esi, edx
xor esi, ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], edi
mov edi, dword [esp + eax + 0x1a8]
mov ebx, ebp
rol ebx, 0xc
rol edi, cl
mov ecx, ebp
or ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
and ecx, dword [esp + 0x18]
and ebp, dword [esp + 0x14]
add edi, ebx
or ecx, ebp
add ecx, dword [esp + eax + 0x2a8]
add edi, esi
add ecx, dword [esp + 0x24]
rol edi, 7
xor ebx, edi
add ebx, ecx
mov ebp, ebx
mov ebx, dword [esp + 0x1c]
mov edx, ebx
and edx, esi
mov ecx, esi
not ecx
and ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
or ecx, edx
add ecx, dword [esp + eax + 0x98]
mov edx, dword [esp + 0x18]
add ecx, edi
add ecx, dword [esp + 0x28]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
rol edx, 9
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
ror ebx, 0xd
mov esi, ecx
mov dword [esp + 0x28], edx
mov edx, ecx
ror edx, 0xf
rol esi, 9
xor edx, esi
xor edx, ecx
mov ecx, dword [esp + 0x2c]
inc ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + eax + 0x1ac]
mov edi, ebp
rol edi, 0xc
rol ebx, cl
mov ecx, ebp
or ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
and ecx, dword [esp + 0x18]
and ebp, dword [esp + 0x14]
add ebx, edi
or ecx, ebp
add ecx, dword [esp + eax + 0x2ac]
add ebx, edx
add ecx, dword [esp + 0x24]
rol ebx, 7
xor edi, ebx
add edi, ecx
mov ebp, edi
mov esi, dword [esp + 0x1c]
mov ecx, edx
not ecx
and ecx, dword [esp + 0x10]
mov edi, esi
and edi, edx
or ecx, edi
add ecx, dword [esp + eax + 0x9c]
mov edi, dword [esp + 0x18]
add ecx, ebx
add ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x14]
rol edi, 9
ror esi, 0xd
mov dword [esp + 0x1c], edx
mov edx, ecx
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], esi
mov esi, ecx
ror edx, 0xf
rol esi, 9
xor edx, esi
xor edx, ecx
mov ecx, dword [esp + 0x2c]
add ecx, 4
mov dword [esp + 0x2c], ecx
add ecx, 0xfffffffe
add eax, 0x10
cmp ecx, 0x40
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edi
mov esi, edx
jl 0x413fd0
mov eax, dword [esp + 0x364]
mov ecx, dword [esp + 0x48]
xor ecx, ebp
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x30]
xor ecx, ebx
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x3c]
xor ecx, dword [esp + 0x18]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x4c]
xor ecx, dword [esp + 0x24]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x44]
xor ecx, esi
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x34]
xor ecx, dword [esp + 0x1c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x38]
xor ecx, dword [esp + 0x10]
mov dword [eax + 0x20], ecx
mov ecx, dword [esp + 0x40]
xor ecx, edi
pop edi
pop esi
pop ebp
mov dword [eax + 0x24], ecx
pop ebx
add esp, 0x350
ret