Function at 0x420670
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0xc904973f
push dword [0x44ba88]
call fcn.004402e0
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
je 0x42070b
cmp dword [edi], 0xffffffff
jne 0x4207b5
jmp 0x420c91
push 0x39be051d
push dword [0x44ba88]
call fcn.004402e0
add esp, 8
mov dword [esi], eax
push 0x847b02a2
push dword [0x44ba88]
call fcn.004402e0
add esp, 8
mov dword [esi + 4], eax
push 0x2e775759
push dword [0x44ba88]
call fcn.004402e0
add esp, 8
mov dword [esi + 8], eax
mov ebx, dword [esi + 0x28]
jmp 0x420763
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x420794
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x420760
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 4]
test eax, eax
je 0x420794
push dword [edi]
call dword [esi + 8]
mov dword [edi], 0xffffffff
jmp 0x420760
push 0x18c354a9
push dword [0x44ba88]
call fcn.004402e0
add esp, 8
push dword [esi + 0x28]
call eax
cmp dword [edi], 0xffffffff
je 0x420c91
mov ecx, dword [ebp + 0x10]
mov eax, 0x8e
nop
nop
nop
cmp byte [ecx + eax - 0x8e], 0
lea eax, [eax + 1]
jne 0x4207c0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x4207e0
mov dword [esi + 0x1c], edi
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edx + ecx + 1], 0
lea ecx, [ecx + 1]
jne 0x420800
mov edx, ecx
and edx, eax
xor ecx, eax
lea eax, [ecx + edx*2]
add eax, 3
and eax, 0xfffffffc
call fcn.004082c0
mov eax, esp
and eax, 0xfffffff0
mov dword [esi], eax
mov esp, eax
mov dword [esi + 0x30], 0x77760920
mov dword [esi + 0x34], 0x29172a74
mov dword [esi + 0x38], 0x3c0c419
mov dword [esi + 0x3c], 0x155a5e63
mov dword [esi + 0x40], 0xb150
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [esi + eax + 0x30]
lea ecx, [eax + 0x35ed30b0]
mov edi, ecx
and edi, edx
lea ebx, [eax + edx]
add ebx, 0x35ed30b0
not ebx
lea edi, [ebx + edi*2]
and edi, ecx
mov ecx, edi
and ecx, 0xfd
mov ebx, edi
or ebx, 0xfd
inc ebx
imul ebx, ecx
mov ecx, edi
and ecx, 2
or edi, 2
imul edi, ecx
sub ebx, edi
add ebx, eax
add bl, dl
add bl, 0x40
mov byte [esi + eax + 0x30], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x14
jb 0x420850
mov dword [esi + 0xc], 0x798e809d
mov byte [esi + 0x10], 0x58
mov dword [esi + 0x11], 0
mov byte [esi + 0x15], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esi + eax + 0xc]
lea ecx, [eax + 0x13f0a78f]
mov ebx, 0x6c0f5870
sub ebx, eax
and ebx, 0x400a4825
mov edx, ecx
and edx, 0x39a
or edx, ebx
xor edx, edi
xor edx, 0x25
lea ebx, [eax + 0x8f]
and ebx, edi
or ebx, edx
and ecx, edi
sub ebx, ecx
add bl, 0x35
mov byte [esi + eax + 0xc], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xa
jb 0x4208d0
movzx eax, byte [esi + 0xc]
mov ebx, dword [esi]
test al, al
je 0x42093b
lea edx, [esi + 0xd]
mov ebx, dword [esi]
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420930
mov byte [ebx], 0
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ecx]
test al, al
je 0x42095d
inc ecx
mov edx, dword [ebp + 0xc]
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420950
jmp 0x420960
mov edx, dword [ebp + 0xc]
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x42097b
lea ecx, [esi + 0x31]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420970
mov byte [ebx], 0
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
test al, al
je 0x42099b
inc ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420990
mov byte [ebx], 0x3a
mov dword [esi + 0x30], 0x674bfffd
mov dword [esi + 0x34], 0x5f536b5f
mov dword [esi + 0x38], 0x641e375d
mov dword [esi + 0x3c], 0x68655351
mov dword [esi + 0x40], 0x7b4b6e57
mov dword [esi + 0x44], 0x702d1311
mov dword [esi + 0x48], 0x40437372
mov dword [esi + 0x4c], 0x79794470
mov dword [esi + 0x50], 0x476b092e
mov dword [esi + 0x54], 0x7f734b7f
mov dword [esi + 0x58], 0x6028247d
mov dword [esi + 0x5c], 0x600f7271
mov dword [esi + 0x60], 0x54797775
mov dword [esi + 0x64], 0x5f6f526b
mov dword [esi + 0x68], 0x56637615
mov dword [esi + 0x6c], 0x74022d0a
mov dword [esi + 0x70], 0x6719575d
mov dword [esi + 0x74], 0xa26002b
mov dword [esi + 0x78], 0x747f260d
mov dword [esi + 0x7c], 0x8672829
mov dword [esi + 0x80], 0x796d2908
mov dword [esi + 0x84], 0x1869046c
mov dword [esi + 0x88], 0x595b6437
mov dword [esi + 0x8c], 0x7e050013
mov dword [esi + 0x90], 0x28380413
mov dword [esi + 0x94], 0x3e053a07
mov dword [esi + 0x98], 0x3224440c
mov dword [esi + 0x9c], 0x8330202
mov dword [esi + 0xa0], 0x56665f0a
mov dword [esi + 0xa4], 0x7674705b
mov word [esi + 0xa8], 0x8176
mov byte [esi + 0xac], 0
mov word [esi + 0xaa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x7e
xor cl, byte [esi + eax + 0x30]
add cl, 0x8a
mov byte [esi + eax + 0x30], cl
inc eax
cmp eax, 0x7d
jne 0x420ab0
inc ebx
movzx eax, byte [edx]
test al, al
je 0x420adb
inc edx
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420ad0
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x420afb
lea ecx, [esi + 0x31]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420af0
mov byte [ebx], 0
mov edi, dword [esi]
sub ebx, edi
push 0xd0026952
push dword [0x44ba88]
call fcn.004402e0
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x1c]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x420b67
cmp dword [edi], 0xffffffff
je 0x420b67
push 0x59ea2086
push dword [0x44ba88]
call fcn.004402e0
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44ba88]
call fcn.004402e0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x420def
cmp eax, 0xffffffff
je 0x420c91
push 0x400
call fcn.004083e0
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add eax, 0x400
mov dword [esi + 0x14], eax
lea eax, [esi + 0xc]
mov ecx, edi
push eax
call fcn.00421020
mov cl, 1
mov dword [esi + 4], ecx
test al, al
je 0x420dd7
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x420cf9
mov dword [esi + 4], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x20], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x420bce
mov edi, eax
push edi
call fcn.004083e0
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x420ceb
mov dword [esi + 0x24], edi
cmp eax, ecx
mov dword [esi + 8], ebx
mov edx, dword [esi + 4]
mov dword [esi + 0x18], eax
jbe 0x420c98
cmp edx, eax
jbe 0x420c98
test ebx, ebx
je 0x420cd7
mov edx, dword [esi + 8]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x18]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x420c30
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x420c1d
add eax, edx
add ecx, edx
add edx, dword [esi + 8]
mov edi, dword [esi]
sub edi, dword [esi + 4]
cmp edi, 0xfffffff8
ja 0x420cd7
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420c42
jmp 0x420cd7
xor eax, eax
jmp 0x420def
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x20]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x420cd7
mov ecx, dword [esi + 8]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.004083f0
add esp, 4
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x18]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x30], 0x514a4b5c
mov dword [esi + 0x34], 0x8eb4b0b1
mov dword [esi + 0x38], 0x8a8e8cbc
mov byte [esi + 0x3c], 0xd8
mov dword [esi + 0x3d], 0
mov byte [esi + 0x41], 0
mov ecx, 0xd9
mov edi, 6
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edi
and edx, 0x10
mov ebx, ecx
and ebx, 0xef
or ebx, edx
xor bl, byte [esi + ecx - 0xa9]
xor bl, 0x10
add bl, 0xc3
mov byte [esi + ecx - 0xa9], bl
inc ecx
dec edi
cmp ecx, 0xeb
jne 0x420d40
movzx ebx, byte [esi + 0x30]
mov ecx, eax
mov dword [esi + 8], eax
test bl, bl
mov ecx, dword [esi + 0x1c]
je 0x420dc0
lea edx, [esi + 0x30]
mov dword [esi + 4], edx
mov edx, eax
mov edi, eax
mov dword [esi + 8], eax
mov edi, dword [esi + 4]
jmp 0x420d9a
movzx ebx, byte [edi]
test bl, bl
mov ecx, dword [esi + 0x1c]
je 0x420dc0
mov bh, byte [edx]
test bh, bh
je 0x420dc6
inc edx
inc edi
mov dword [esi + 4], edi
mov ecx, dword [esi + 8]
lea edi, [ecx + 1]
cmp bh, bl
je 0x420db6
mov ecx, edi
mov dword [esi + 8], edi
mov edx, edi
mov edi, dword [esi + 4]
je 0x420d90
lea edi, [esi + 0x30]
jmp 0x420d90
cmp dword [esi + 8], 0
jne 0x420e14
push 0x3ea
call fcn.00420390
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x420dec
cmp eax, dword [esi + 0x10]
je 0x420dec
push eax
call fcn.004083f0
add esp, 4
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
movsx edx, bl
mov edi, edx
xor edi, ecx
not edx
and edx, ecx
add edx, edx
cmp edx, edi
mov ecx, dword [esi + 0x1c]
je 0x420dd7
mov ebx, eax
mov edx, dword [esi]
sub ebx, edx
je 0x420e3f
mov dword [esi], edx
mov dword [esi + 4], edx
mov edi, eax
xor ecx, ecx
mov edx, dword [esi + 4]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, eax
xor ecx, ecx
mov eax, dword [esi]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 0x1c]
add dword [esi + 0x10], ebx
lea eax, [esi + 0xc]
push eax
call fcn.00421020
test al, al
je 0x420dd0
mov dword [esi + 4], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x420fb0
mov dword [esi + 8], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x24], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x420e7a
mov edi, eax
push edi
call fcn.004083e0
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x420fa2
mov dword [esi + 0x2c], edi
cmp eax, ecx
mov dword [esi + 0x18], ebx
mov edx, dword [esi + 8]
mov dword [esi + 0x20], eax
jbe 0x420f4f
cmp edx, eax
jbe 0x420f4f
test ebx, ebx
je 0x420f8e
mov edx, dword [esi + 0x18]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x20]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x420ee3
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x420ed0
add eax, edx
add ecx, edx
add edx, dword [esi + 0x18]
mov edi, dword [esi]
sub edi, dword [esi + 8]
cmp edi, 0xfffffff8
ja 0x420f8e
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420f00
jmp 0x420f8e
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x24]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x420f8e
mov ecx, dword [esi + 0x18]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.004083f0
add esp, 4
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov word [esi + 0x30], 0xe5f7
mov byte [esi + 0x32], 0xea
mov dword [esi + 0x33], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x27
xor dl, byte [esi + ecx + 0x30]
add dl, 0x3d
mov byte [esi + ecx + 0x30], dl
inc ecx
cmp ecx, 7
jne 0x420fe0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [eax + edi]
movzx ebx, byte [esi + edi + 0x30]
test ecx, ecx
je 0x420e00
inc edi
cmp cl, bl
je 0x421000
jmp 0x420e00