Function at 0x4df490
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x180
mov eax, dword [0x5b0008]
xor eax, esp
mov dword [esp + 0x17c], eax
push esi
push edi
mov eax, edx
mov dword [esp + 0x18], eax
mov esi, ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], 3
mov ecx, dword [ebp + 8]
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0xc]
mov dword [esp + 0x78], ecx
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x20], ecx
lea ecx, [esi + 0x2c]
mov dword [esp + 0xc], ecx
mov edi, eax
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 4]
sub edi, ecx
mov dword [esp + 0x58], edx
add edx, ecx
mov eax, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0xb8]
mov dword [esp + 0x7c], edx
mov edx, 1
shl edx, cl
mov ecx, dword [esi + 0x10]
sub eax, ecx
mov dword [esp + 0x14], edi
sub edi, edx
cmp eax, edx
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0x54]
cmovbe edi, ecx
cmp dword [esi + 0x18], 0
push 0xcf1bbcdc
cmovne edi, ecx
mov dword [esp + 0x48], edx
mov ecx, 4
mov dword [esp + 0x4c], edi
cmp eax, ecx
mov dword [esp + 0x70], edx
push 0xbb000000
cmovb ecx, eax
mov eax, dword [esi + 0x50]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x70], eax
mov eax, 1
shl eax, cl
mov dword [esp + 0x58], eax
mov eax, dword [esi + 0xb4]
mov dword [esp + 0x40], eax
mov edi, dword [eax + 0x5c]
mov esi, dword [eax + 0x28]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], edi
push dword [eax + 4]
push dword [eax]
call fcn.00546f20
mov edi, dword [esp + 0x38]
mov ecx, 0x38
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
sub ecx, dword [edi + 0x24]
call fcn.00519d00
mov edi, dword [esp + 8]
mov dword [esp + 0x60], eax
shr eax, 4
and eax, 0xffffff0
mov dword [esp + 0x4c], 0xf
lea ecx, [eax + esi]
lea eax, [edi + eax*4]
mov dword [esp + 0x5c], ecx
mov edi, dword [esp + 0x24]
mov dword [esp + 0x64], eax
cmp dword [edi + 0xdc], 0
jne 0x4df830
mov eax, dword [esp + 0x14]
mov esi, dword [edi + 0x1c]
sub eax, esi
mov edx, dword [esp + 0x28]
mov ecx, edx
cmp eax, 0x180
jbe 0x4df738
lea ecx, [esi + 0x60]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 8], edx
cmp esi, ecx
jae 0x4df6ab
mov eax, 0x38
sub eax, edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
add eax, 8
mov dword [esp + 0x40], eax
push 0xcf1bbcdc
push 0xbb000000
push dword [eax + esi + 4]
push dword [eax + esi]
call fcn.00546f20
xor eax, dword [edi + 0x50]
xor edx, dword [edi + 0x54]
mov ecx, dword [esp + 8]
call fcn.00519d00
mov edi, dword [esp + 0xc]
mov ecx, eax
mov eax, esi
and eax, 7
mov edx, dword [edi + eax*4]
mov dword [edi + eax*4], ecx
mov edi, edx
shr edi, 4
mov eax, 0
and edi, 0xffffff0
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
add edx, edi
movzx ecx, byte [edx]
dec ecx
and ecx, 0xf
cmove eax, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esp + 0x2c]
mov byte [edx], cl
mov byte [ecx + edx], al
lea eax, [ecx + edi]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
mov dword [ecx + eax*4], esi
inc esi
mov eax, dword [esp + 0x40]
cmp esi, dword [esp + 0x3c]
jb 0x4df620
mov eax, dword [edi + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0x2c], eax
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add esi, 0xffffffe0
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x70], esi
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x4df6ca
xor ecx, ecx
jmp 0x4df6cf
sub ecx, edx
sub ecx, esi
inc ecx
mov eax, 8
cmp ecx, eax
cmova ecx, eax
add ecx, esi
mov dword [esp + 0x68], ecx
cmp esi, ecx
jae 0x4df734
mov eax, 0x38
sub eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
push 0xcf1bbcdc
push 0xbb000000
push dword [esi + edx + 4]
push dword [esi + edx]
call fcn.00546f20
xor eax, dword [edi + 0x50]
xor edx, dword [edi + 0x54]
mov ecx, dword [esp + 0x3c]
call fcn.00519d00
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, esi
inc esi
and eax, 7
mov dword [edi + eax*4 + 0x2c], ecx
cmp esi, dword [esp + 0x68]
jb 0x4df6f0
mov ecx, dword [edi + 0x24]
mov esi, dword [esp + 0x70]
jmp 0x4df738
mov ecx, dword [esp + 8]
mov eax, dword [edi + 0x5c]
mov edx, dword [edi + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0x28]
mov dword [esp + 0x68], eax
mov dword [esp + 8], edx
cmp esi, dword [esp + 0x14]
jae 0x4df7e7
mov eax, 0x38
sub eax, ecx
mov dword [esp + 0x70], eax
push 0xcf1bbcdc
push 0xbb000000
push dword [edx + esi + 0xc]
push dword [edx + esi + 8]
call fcn.00546f20
xor eax, dword [edi + 0x50]
xor edx, dword [edi + 0x54]
mov ecx, dword [esp + 0x70]
call fcn.00519d00
mov edi, dword [esp + 0xc]
mov ecx, eax
mov eax, esi
and eax, 7
mov edx, dword [edi + eax*4]
mov dword [edi + eax*4], ecx
mov edi, edx
shr edi, 4
mov eax, 0
mov dword [esp + 0x40], edx
and edi, 0xffffff0
mov edx, dword [esp + 0x68]
add edx, edi
movzx ecx, byte [edx]
dec ecx
and ecx, 0xf
cmove eax, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esp + 0x40]
mov byte [edx], cl
mov byte [ecx + edx], al
lea eax, [ecx + edi]
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 8]
mov dword [ecx + eax*4], esi
inc esi
cmp esi, dword [esp + 0x14]
jb 0x4df762
mov esi, dword [esp + 0x14]
mov dword [edi + 0x1c], esi
mov edi, dword [esp + 0x18]
push 0xcf1bbcdc
push 0xbb000000
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.00546f20
xor eax, dword [esp + 0x54]
mov ecx, 0x38
xor edx, dword [esp + 0x44]
sub ecx, dword [esp + 0x28]
call fcn.00519d00
mov ecx, eax
mov eax, esi
mov esi, dword [esp + 0xc]
and eax, 7
mov edx, dword [esi + eax*4]
mov dword [esi + eax*4], ecx
jmp 0x4df860
movq xmm0, qword [esp + 0x68]
mov eax, 0x38
sub eax, dword [esp + 0x28]
movq xmm1, qword [esp + 0x70]
pxor xmm1, xmm0
movd xmm0, eax
mov eax, dword [esp + 0x14]
psrlq xmm1, xmm0
mov dword [edi + 0x1c], eax
mov edi, dword [esp + 0x18]
movd edx, xmm1
mov esi, dword [esp + 0x24]
mov eax, edx
mov ecx, dword [esp + 0x1c]
shr eax, 4
and eax, 0xffffff0
mov dword [esp + 0x28], edx
add dword [esi + 0x58], edx
mov edx, dword [esp + 0x20]
add edx, eax
mov dword [esp + 0xc], 0
lea ecx, [ecx + eax*4]
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x28]
movsx eax, al
mov dword [esp + 8], ecx
movzx ecx, byte [edx]
and ecx, 0xf
mov dword [esp + 0x2c], 0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
movups xmm0, xmmword [edx]
mov dword [esp + 0x20], ecx
neg ecx
and ecx, 0xf
pcmpeqb xmm0, xmm1
pmovmskb edx, xmm0
mov ax, dx
shl ax, cl
mov cx, word [esp + 0x20]
shr dx, cl
or ax, dx
movzx eax, ax
cdq
mov dword [esp + 0x44], eax
mov dword [esp + 0x1c], edx
test edx, edx
jne 0x4df8f1
test eax, eax
je 0x4df95f
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x50]
nop dword [eax]
test esi, esi
je 0x4df953
push edx
push edi
call fcn.004d6c70
add eax, dword [esp + 0x28]
add esp, 8
and eax, 0xf
je 0x4df935
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + eax*4]
cmp ecx, dword [esp + 0x48]
jb 0x4df953
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x80], ecx
inc eax
mov dword [esp + 0xc], eax
dec esi
mov edx, dword [esp + 0x1c]
mov ecx, edi
add ecx, 0xffffffff
mov eax, edx
adc eax, 0xffffffff
and edi, ecx
and edx, eax
mov dword [esp + 0x1c], edx
ja 0x4df900
jb 0x4df953
test edi, edi
jne 0x4df900
mov edi, dword [esp + 0x18]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x54]
mov eax, 0
movzx ecx, byte [edx]
dec ecx
and ecx, 0xf
cmove eax, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esp + 0x28]
mov byte [edx], cl
mov byte [ecx + edx], al
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x1c]
mov dword [edx + ecx*4], eax
inc dword [esi + 0x1c]
cmp dword [esp + 0xc], 0
jbe 0x4dfa00
mov ecx, dword [esp + 0xc]
mov esi, 3
xor eax, eax
nop
mov eax, dword [esp + eax*4 + 0x80]
mov edx, dword [esp + 0x10]
add edx, eax
mov dword [esp + 0x48], eax
mov eax, dword [edx + esi - 3]
cmp eax, dword [esi + edi - 3]
jne 0x4df9ef
push dword [esp + 0x34]
mov ecx, edi
call fcn.004d6d00
mov ecx, eax
add esp, 4
cmp ecx, esi
jbe 0x4df9eb
mov eax, dword [esp + 0x14]
mov esi, ecx
sub eax, dword [esp + 0x48]
mov edx, dword [esp + 0x78]
add eax, 3
mov dword [edx], eax
lea eax, [ecx + edi]
cmp eax, dword [esp + 0x34]
je 0x4df9fc
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0x2c], eax
cmp eax, ecx
jb 0x4df9a0
mov dword [esp + 0x30], esi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], 0
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 4]
mov dword [esp + 0x48], eax
mov eax, dword [edx]
mov dword [esp + 0x44], ecx
sub ecx, eax
add dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
movsx eax, al
movzx esi, byte [ecx]
and esi, 0xf
mov dword [esp + 0x5c], esi
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
movups xmm0, xmmword [ecx]
mov ecx, esi
neg ecx
pcmpeqb xmm0, xmm1
and ecx, 0xf
pmovmskb edx, xmm0
mov ax, dx
shl ax, cl
mov cx, si
shr dx, cl
or ax, dx
movzx eax, ax
cdq
mov dword [esp + 0x38], edx
mov esi, eax
test edx, edx
jne 0x4dfa8b
test esi, esi
je 0x4dfbce
mov edi, dword [esp + 0x50]
nop
test edi, edi
je 0x4dfae3
push edx
push esi
call fcn.004d6c70
add eax, dword [esp + 0x64]
add esp, 8
and eax, 0xf
je 0x4dfac5
mov ecx, dword [esp + 0x64]
mov ecx, dword [ecx + eax*4]
cmp ecx, dword [esp + 0x48]
jb 0x4dfae3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x80], ecx
inc eax
mov dword [esp + 0x10], eax
dec edi
mov edx, dword [esp + 0x38]
mov ecx, esi
add ecx, 0xffffffff
mov eax, edx
adc eax, 0xffffffff
and esi, ecx
and edx, eax
mov dword [esp + 0x38], edx
ja 0x4dfa90
jb 0x4dfae3
test esi, esi
jne 0x4dfa90
cmp dword [esp + 0x10], 0
mov edi, dword [esp + 0x18]
jbe 0x4dfbce
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [esp + eax*4 + 0x80]
mov esi, dword [esp + 0x44]
add esi, eax
mov dword [esp + 0x60], eax
mov eax, dword [esi]
cmp eax, dword [edi]
jne 0x4dfb9b
mov ecx, dword [esp + 0x34]
add edi, 4
add esi, 4
mov dword [esp + 0x64], edi
mov eax, edi
mov edx, esi
sub eax, esi
add eax, dword [esp + 0x20]
cmp eax, ecx
cmovb ecx, eax
push ecx
mov ecx, edi
call fcn.004d6d00
mov edi, eax
add esp, 4
lea ecx, [esi + edi]
mov esi, dword [esp + 0x34]
cmp ecx, dword [esp + 0x20]
jne 0x4dfb68
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x7c]
push esi
lea ecx, [ecx + edi]
call fcn.004d6d00
add esp, 4
add edi, eax
mov ecx, dword [esp + 0x30]
lea edx, [edi + 4]
cmp edx, ecx
jbe 0x4dfba1
mov eax, dword [esp + 0x14]
mov ecx, edx
sub eax, dword [esp + 0x60]
sub eax, dword [esp + 0x58]
mov edi, dword [esp + 0x78]
add eax, 3
mov dword [esp + 0x30], ecx
mov dword [edi], eax
mov edi, dword [esp + 0x18]
lea eax, [edx + edi]
cmp eax, esi
je 0x4dfbb8
jmp 0x4dfba5
mov ecx, dword [esp + 0x30]
jmp 0x4dfba5
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x10]
jb 0x4dfb00
mov eax, ecx
pop edi
pop esi
mov ecx, dword [esp + 0x17c]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x184]
mov eax, dword [esp + 0x30]
pop edi
pop esi
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret