Function at 0x41a6d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov esi, esp
mov ebx, ecx
mov dword [esi + 0xdc], 0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd0], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 2
mov dword [esi + 0xc8], 1
push 0x565577c1
push dword [0x447dd0]
call fcn.0043b9b0
add esp, 8
lea ecx, [esi + 0x38]
lea edx, [esi + 0xc0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
mov dword [esi + 0x28], ebx
je 0x41a76e
cmp dword [ebx], 0xffffffff
jne 0x41a81c
jmp 0x41aca2
push 0xb646c33f
push dword [0x447dd0]
call fcn.0043b9b0
add esp, 8
mov dword [esi + 0xc], eax
push 0xe7db718c
push dword [0x447dd0]
call fcn.0043b9b0
add esp, 8
mov dword [esi + 0x10], eax
push 0xa3d60213
push dword [0x447dd0]
call fcn.0043b9b0
add esp, 8
mov dword [esi + 0x24], eax
mov ebx, dword [esi + 0x38]
test ebx, ebx
je 0x41a7f8
mov edi, dword [esi + 0x28]
jmp 0x41a7c7
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x41a7f8
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi + 0xc]
mov ecx, dword [esi + 0x28]
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x41a7c0
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 0x10]
test eax, eax
je 0x41a7f8
push dword [edi]
call dword [esi + 0x24]
mov dword [edi], 0xffffffff
jmp 0x41a7c0
push 0xeb17dc3b
push dword [0x447dd0]
call fcn.0043b9b0
add esp, 8
push dword [esi + 0x38]
call eax
mov ebx, dword [esi + 0x28]
cmp dword [ebx], 0xffffffff
je 0x41aca2
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x41a830
mov edx, dword [ebp + 8]
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41a840
mov edx, dword [ebp + 0xc]
nop
nop
nop
nop
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x41a850
add eax, 3
and eax, 0xfffffffc
call fcn.00408180
mov edi, esp
and edi, 0xfffffff0
mov esp, edi
mov dword [esi + 0x40], 0xc5ba476c
mov dword [esi + 0x44], 0x1b2122c0
mov dword [esi + 0x48], 0x317c7827
mov dword [esi + 0x4c], 0x27eeeee9
mov word [esi + 0x50], 0x7f1c
mov dword [esi + 0x52], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
xor edx, 0x42
mov ebx, eax
or ebx, 0x1d
and ebx, edx
mov edx, eax
xor edx, 0xbd
lea edx, [edx + ebx*2]
xor dl, byte [esi + eax + 0x40]
add dl, 0x4f
mov byte [esi + eax + 0x40], dl
inc eax
cmp eax, 0x16
jne 0x41a8a0
mov dword [esi + 0x14], 0xc10a383d
mov byte [esi + 0x18], 0xe0
mov dword [esi + 0x19], 0
mov word [esi + 0x1d], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x29
xor dl, byte [esi + eax + 0x14]
add dl, 0x33
mov byte [esi + eax + 0x14], dl
inc eax
cmp eax, 0xb
jne 0x41a8f0
movzx eax, byte [esi + 0x14]
mov ebx, edi
test al, al
je 0x41a92b
lea edx, [esi + 0x15]
mov ebx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41a920
mov byte [ebx], 0
movzx eax, byte [ecx]
test al, al
je 0x41a94d
inc ecx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41a940
jmp 0x41a950
mov edx, dword [ebp + 8]
mov byte [ebx], 0
movzx eax, byte [esi + 0x40]
test al, al
je 0x41a96b
lea ecx, [esi + 0x41]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41a960
mov byte [ebx], 0
movzx eax, byte [edx]
test al, al
je 0x41a98b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41a980
mov byte [ebx], 0x3a
mov dword [esi + 0x40], 0x21798583
mov dword [esi + 0x44], 0x51512159
mov dword [esi + 0x48], 0x20966d53
mov dword [esi + 0x4c], 0x2c2f595f
mov dword [esi + 0x50], 0x35595259
mov dword [esi + 0x54], 0x3467a9af
mov dword [esi + 0x58], 0x4c41494a
mov dword [esi + 0x5c], 0x433b403c
mov dword [esi + 0x60], 0xc1598f76
mov dword [esi + 0x64], 0xb1b1c1b9
mov dword [esi + 0x68], 0xac5c58b3
mov dword [esi + 0x6c], 0xa475bebf
mov dword [esi + 0x70], 0xd0abbdbb
mov dword [esi + 0x74], 0xd1a5aea5
mov dword [esi + 0x78], 0xd2a18a6b
mov dword [esi + 0x7c], 0xb8826b92
mov dword [esi + 0x80], 0xa1abdda3
mov dword [esi + 0x84], 0x8e9ebce5
mov dword [esi + 0x88], 0xb0b59a83
mov dword [esi + 0x8c], 0x8cad9497
mov dword [esi + 0x90], 0xb3b7ef8c
mov dword [esi + 0x94], 0x9cab80a8
mov dword [esi + 0x98], 0x6369b889
mov dword [esi + 0x9c], 0x428f8c9d
mov dword [esi + 0xa0], 0xe48c8895
mov dword [esi + 0xa4], 0xf2fff681
mov dword [esi + 0xa8], 0xfee03880
mov dword [esi + 0xac], 0x8cf18e8a
mov dword [esi + 0xb0], 0xd23ec5f2
mov dword [esi + 0xb4], 0xa080cd5
mov word [esi + 0xb8], 0x70e
mov word [esi + 0xbe], 0
mov dword [esi + 0xba], 0
mov eax, 0x5d
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax - 0x1d]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x2f
mov byte [esi + eax - 0x1d], cl
inc eax
cmp eax, 0xdd
jne 0x41aab0
inc ebx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x41aaeb
inc ecx
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41aae0
mov byte [ebx], 0
movzx eax, byte [esi + 0x40]
test al, al
je 0x41ab0b
lea ecx, [esi + 0x41]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ab00
mov byte [ebx], 0
sub ebx, edi
push 0xefae2064
push dword [0x447dd0]
call fcn.0043b9b0
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x28]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x41ab75
cmp dword [edi], 0xffffffff
je 0x41ab75
push 0xea8d1240
push dword [0x447dd0]
call fcn.0043b9b0
add esp, 8
push 2
push dword [edi]
call eax
push 0xa3d60213
push dword [0x447dd0]
call fcn.0043b9b0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x41b126
cmp eax, 0xffffffff
je 0x41aca2
push 0x400
call fcn.004081b0
add esp, 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
add eax, 0x400
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x14]
mov ecx, edi
push eax
call fcn.0041b130
mov cl, 1
mov dword [esi + 0x24], ecx
test al, al
je 0x41b10e
mov ebx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov edi, edx
sub edi, ebx
mov eax, ebx
cmp edx, dword [esi + 0x1c]
jne 0x41ad44
mov dword [esi + 0xc], edx
lea eax, [edi + 1]
mov ecx, edi
shr ecx, 1
add ecx, edi
cmp ecx, eax
ja 0x41abd8
mov ecx, eax
mov dword [esi + 0x24], ecx
push ecx
call fcn.004081b0
add esp, 4
test ebx, ebx
je 0x41ad30
cmp eax, ebx
mov dword [esi + 0x20], ebx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], edi
jbe 0x41aca9
cmp ecx, eax
jbe 0x41aca9
test edi, edi
je 0x41ad1c
mov ebx, dword [esi + 0x20]
mov edx, dword [esi + 0x10]
lea eax, [ebx + edx]
dec eax
mov ecx, dword [esi + 0x34]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x41ac41
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x41ac2b
add eax, edx
add ecx, edx
add edx, dword [esi + 0x10]
mov ebx, dword [esi + 0x20]
mov edi, ebx
sub edi, dword [esi + 0xc]
cmp edi, 0xfffffff8
ja 0x41ad1c
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x41ac53
jmp 0x41ad1c
xor eax, eax
jmp 0x41b126
mov ecx, edi
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, dword [esi + 0x10]
mov edx, ecx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, ebx
mov eax, ecx
and eax, 3
mov ecx, eax
shr ecx, 1
mov dword [esi + 0x30], edx
mov dword [esi + 0x2c], edi
mov ebx, dword [esi + 0x30]
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ecx, eax
xor ecx, 0xfffffffe
or eax, 1
and eax, ecx
je 0x41ad1c
mov edi, dword [esi + 0x10]
and edi, 2
movzx ecx, byte [edx + edi]
mov ebx, dword [esi + 0x2c]
mov byte [ebx + edi], cl
cmp eax, 1
je 0x41ad1c
movzx ecx, byte [edx + edi + 1]
mov ebx, dword [esi + 0x2c]
mov byte [ebx + edi + 1], cl
cmp eax, 2
je 0x41ad1c
movzx eax, byte [edx + edi + 2]
mov ecx, dword [esi + 0x2c]
mov byte [ecx + edi + 2], al
push dword [esi + 0x14]
call fcn.004081c0
add esp, 4
mov ebx, dword [esi + 0x20]
mov eax, dword [esi + 0x34]
mov edi, dword [esi + 0x10]
mov dword [esi + 0x14], eax
lea ecx, [eax + edi]
mov dword [esi + 0x18], ecx
mov ecx, dword [esi + 0x24]
add ecx, eax
mov dword [esi + 0x1c], ecx
mov edx, dword [esi + 0xc]
mov ecx, edx
not ecx
and ecx, ebx
not ebx
and ebx, edx
sub ebx, ecx
cmp ebx, edi
jae 0x41ad74
lea edi, [eax + ebx]
inc edi
mov dword [esi + 0xc], edi
add eax, ebx
mov edx, eax
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, dword [esi + 0xc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esi + 0x14]
mov byte [eax + ebx], 0
mov eax, dword [esi + 0x14]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x18]
inc eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x40], 0x5f5a5d50
mov dword [esi + 0x44], 0x72707c7f
mov dword [esi + 0x48], 0x76767060
mov byte [esi + 0x4c], 0x84
mov word [esi + 0x4d], 0
mov byte [esi + 0x4f], 0
mov ecx, 0xe11567e2
movzx edx, byte [esi + ecx + 0x1eea985e]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x96
mov byte [esi + ecx + 0x1eea985e], dl
inc ecx
cmp ecx, 0xe11567f2
jne 0x41adb0
movzx edx, byte [esi + 0x40]
mov eax, dword [esi + 0xc]
test dl, dl
je 0x41ae15
lea ebx, [esi + 0x40]
mov eax, dword [esi + 0xc]
mov ecx, eax
jmp 0x41adf7
movzx edx, byte [ebx]
test dl, dl
je 0x41ae15
mov dh, byte [ecx]
test dh, dh
je 0x41b0fa
inc ecx
inc ebx
lea edi, [eax + 1]
cmp dh, dl
je 0x41ae0e
mov eax, edi
mov ecx, edi
je 0x41adf0
lea ebx, [esi + 0x40]
jmp 0x41adf0
test eax, eax
je 0x41b0fa
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0xc]
jmp 0x41ae3b
cmp dl, dh
mov eax, dword [esi + 0x28]
je 0x41b10e
mov edx, edi
mov ecx, dword [esi + 0x10]
sub edx, ecx
je 0x41ae69
mov dword [esi + 0xc], edi
mov ebx, ecx
mov dword [esi + 0x10], ecx
xor ecx, ecx
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0xc]
xor ecx, ecx
mov ebx, dword [esi + 0x10]
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
add dword [esi + 0x18], edx
mov ecx, eax
lea eax, [esi + 0x14]
push eax
call fcn.0041b130
test al, al
je 0x41b107
mov dword [esi + 0x24], eax
mov ebx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov edi, edx
sub edi, ebx
mov eax, ebx
cmp edx, dword [esi + 0x1c]
jne 0x41b01a
mov dword [esi + 0x10], edx
lea eax, [edi + 1]
mov ecx, edi
shr ecx, 1
add ecx, edi
cmp ecx, eax
ja 0x41aea6
mov ecx, eax
mov dword [esi + 0x34], ecx
push ecx
call fcn.004081b0
add esp, 4
test ebx, ebx
je 0x41b006
cmp eax, ebx
mov dword [esi + 0x2c], ebx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], edi
jbe 0x41af7f
cmp ecx, eax
jbe 0x41af7f
test edi, edi
je 0x41aff2
mov ebx, dword [esi + 0x2c]
mov edx, dword [esi + 0x20]
lea eax, [ebx + edx]
dec eax
mov ecx, dword [esi + 0xc]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x41af16
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x41af00
add eax, edx
add ecx, edx
add edx, dword [esi + 0x20]
mov ebx, dword [esi + 0x2c]
mov edi, ebx
sub edi, dword [esi + 0x10]
cmp edi, 0xfffffff8
ja 0x41aff2
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x41af30
jmp 0x41aff2
mov ecx, edi
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, dword [esi + 0x20]
mov edx, ecx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, ebx
mov eax, ecx
and eax, 3
mov ecx, eax
shr ecx, 1
mov dword [esi + 0x3c], edx
mov dword [esi + 0x30], edi
mov ebx, dword [esi + 0x3c]
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ecx, eax
xor ecx, 0xfffffffe
or eax, 1
and eax, ecx
je 0x41aff2
mov edi, dword [esi + 0x20]
and edi, 2
movzx ecx, byte [edx + edi]
mov ebx, dword [esi + 0x30]
mov byte [ebx + edi], cl
cmp eax, 1
je 0x41aff2
movzx ecx, byte [edx + edi + 1]
mov ebx, dword [esi + 0x30]
mov byte [ebx + edi + 1], cl
cmp eax, 2
je 0x41aff2
movzx eax, byte [edx + edi + 2]
mov ecx, dword [esi + 0x30]
mov byte [ecx + edi + 2], al
push dword [esi + 0x14]
call fcn.004081c0
add esp, 4
mov ebx, dword [esi + 0x2c]
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 0x20]
mov dword [esi + 0x14], eax
lea ecx, [eax + edi]
mov dword [esi + 0x18], ecx
mov ecx, dword [esi + 0x34]
add ecx, eax
mov dword [esi + 0x1c], ecx
mov edx, dword [esi + 0x10]
mov ecx, edx
not ecx
and ecx, ebx
not ebx
and ebx, edx
sub ebx, ecx
cmp ebx, edi
jae 0x41b054
lea edx, [eax + ebx]
inc edx
add eax, ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
xor ecx, ecx
mov eax, edx
mov edi, edx
mov edx, dword [esi + 0x10]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, eax
xor ecx, ecx
mov eax, dword [esi + 0xc]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esi + 0x14]
mov byte [eax + ebx], 0
mov eax, dword [esi + 0x14]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x18]
inc eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov word [esi + 0x40], 0x85b7
mov byte [esi + 0x42], 0xba
mov dword [esi + 0x43], 0
mov ecx, 0x5cc565b9
nop
nop
movzx ebx, byte [esi + ecx - 0x5cc56579]
lea edi, [ecx - 0x5cc5659a]
and edi, ebx
mov eax, edi
and eax, 0x3d
mov edx, edi
or edx, 0xfffffffd
inc edx
imul edx, eax
mov eax, edi
and eax, 2
or edi, 2
imul edi, eax
add edx, ebx
sub edx, edi
add edx, ecx
mov eax, edx
xor eax, 0x36
and edx, 0x49
add edx, edx
sub edx, eax
inc dl
mov byte [esi + ecx - 0x5cc56579], dl
inc ecx
cmp ecx, 0x5cc565c0
jne 0x41b080
xor ecx, ecx
mov edi, dword [esi + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ecx]
mov dh, byte [esi + ecx + 0x40]
test dl, dl
je 0x41ae30
inc ecx
cmp dl, dh
je 0x41b0e0
jmp 0x41ae30
mov ecx, dword [esi + 0x28]
push 0x3ea
call fcn.0041a0c0
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41b123
cmp eax, dword [esi + 0x18]
je 0x41b123
push eax
call fcn.004081c0
add esp, 4
mov eax, dword [esi + 0x24]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc