Function at 0x421cc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov dword [esp + 0x60], 0x83ef81ed
mov dword [esp + 0x64], 0x87328531
mov dword [esp + 0x68], 0x8b268921
mov dword [esp + 0x6c], 0x8f3a8d25
mov dword [esp + 0x70], 0x93ff9129
mov dword [esp + 0x74], 0x97239527
mov dword [esp + 0x78], 0x9bf7993a
mov dword [esp + 0x7c], 0x9f279d28
mov dword [esp + 0x80], 0xe347e150
mov dword [esp + 0x84], 0xe748e599
mov dword [esp + 0x88], 0xeb5ee94d
mov dword [esp + 0x8c], 0xef41ed5b
mov dword [esp + 0x90], 0xf359f142
mov dword [esp + 0x94], 0xf75bf59a
mov dword [esp + 0x98], 0xfb50f957
mov dword [esp + 0x9c], 0xff53fd53
mov dword [esp + 0xa0], 0xc38cc1ae
mov dword [esp + 0xa4], 0xc772c561
mov dword [esp + 0xa8], 0xcb65c97f
mov dword [esp + 0xac], 0xcf65cd7e
mov dword [esp + 0xb0], 0xd377d183
mov dword [esp + 0xb4], 0xd760d566
mov dword [esp + 0xb8], 0xdb79d971
mov dword [esp + 0xbc], 0xdfdedd79
mov eax, 0xc72cf6a0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x38d309c0]
xor ecx, eax
add ecx, 0x1c1f2edf
mov edx, ecx
and edx, 0x67
xor ecx, 0xe7
lea ecx, [ecx + edx*2]
add cl, 0x1a
mov byte [esp + eax + 0x38d309c0], cl
inc eax
cmp eax, 0xc72cf700
jne 0x421dd0
lea edi, [esp + 0x4a0]
lea eax, [esp + 0x60]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x500]
lea edx, [esp + 0xc0]
xor eax, eax
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x60], 0x1c1d1a1b
nop
nop
nop
mov ecx, eax
add cl, 0x7a
xor cl, byte [esp + eax + 0x60]
add cl, 0x9e
mov byte [esp + eax + 0x60], cl
inc eax
cmp eax, 4
jne 0x421e40
mov eax, dword [esp + 0x60]
mov ecx, dword [0x44f228]
test ecx, ecx
je 0x421ea4
xor edx, edx
mov esi, dword [0x44f22c]
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x421e80
inc edx
cmp ecx, edx
jne 0x421e70
jmp 0x421ea4
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x421ea4
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 5
push 4
push dword [0x44f230]
push ecx
call fcn.004400f0
add esp, 0x1c
mov dword [esp + 0x60], 0xf13e3f38
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
mov ecx, 0x628e9335
nop
nop
nop
movzx edx, byte [esp + ecx - 0x628e92d5]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 0xf4
mov ebx, edx
and ebx, 2
mov edi, ebx
xor edi, 2
imul edi, esi
or esi, 2
imul esi, ebx
xor edx, 0xf6
add edx, edi
add edx, esi
inc dl
mov byte [esp + ecx - 0x628e92d5], dl
inc ecx
cmp ecx, 0x628e933c
jne 0x421ec0
cmp eax, dword [esp + 0x60]
jne 0x421f70
push dword [esp + 0x28]
call fcn.0043d5c0
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x60], 0x1c1d1a1b
xor eax, eax
mov ebx, dword [ebp + 0x14]
mov edx, eax
add dl, 0x7a
xor dl, byte [esp + eax + 0x60]
add dl, 0x9e
mov byte [esp + eax + 0x60], dl
inc eax
cmp eax, 4
jne 0x421f30
mov eax, dword [esp + 0x60]
mov edx, dword [0x44f228]
test edx, edx
je 0x421fa0
xor esi, esi
mov edi, dword [0x44f22c]
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x9abdb589
je 0x421f7e
inc esi
cmp edx, esi
jne 0x421f60
jmp 0x421fa0
xor ecx, ecx
xor edx, edx
xor esi, esi
mov ebx, dword [ebp + 0x14]
jmp 0x422519
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x421fa0
push 0
push ecx
push dword [esp + 0x24]
push 5
push 4
push dword [0x44f230]
push edx
call fcn.004400f0
add esp, 0x1c
test eax, eax
js 0x4224e9
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov dword [esp + 0x18], 0
mov edi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
jmp 0x421fde
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x422501
mov esi, edi
mov ecx, dword [edi + eax + 0x3c]
add eax, edi
mov dword [esp + 4], eax
xor eax, eax
mov esi, dword [ebp + 8]
nop
movzx edx, word [ecx + eax]
movzx edi, word [esi + eax]
test dx, dx
je 0x422005
add eax, 2
cmp dx, di
je 0x421ff0
cmp dx, di
jne 0x421fd0
mov edi, dword [esp + 4]
mov eax, dword [edi + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xdc]
mov dword [ebx + 0xc], eax
mov ecx, ebx
push 0x410
call fcn.0043d990
test eax, eax
js 0x421fd4
mov dword [esp + 0x24], 0
mov esi, dword [ebx]
mov dword [esp + 0x60], 0x1c1d1a1b
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x7a
xor cl, byte [esp + eax + 0x60]
add cl, 0x9e
mov byte [esp + eax + 0x60], cl
inc eax
cmp eax, 4
jne 0x422050
mov eax, dword [esp + 0x60]
mov edx, dword [0x44f228]
test edx, edx
je 0x4220c0
xor edi, edi
mov ecx, dword [0x44f22c]
nop
nop
nop
nop
cmp dword [ecx + edi*8], 0xae6e2b0b
je 0x422090
inc edi
cmp edx, edi
jne 0x422080
jmp 0x4220c0
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x4220c0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x2b
push esi
push 5
push dword [0x44f230]
push ecx
call fcn.004400f0
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x60], 0x31fefff8
lea ecx, [esp + 0x64]
mov byte [ecx + 2], 0
mov word [ecx], 0
xor ebx, ebx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x60]
mov edi, edx
xor edi, 0x54403f2b
mov ecx, ebx
and ecx, 8
sub ecx, edi
xor ecx, esi
mov esi, ecx
xor esi, 0x2a
and ecx, 0x55
add ecx, ecx
sub ecx, esi
inc cl
mov byte [esp + edx + 0x60], cl
inc edx
add ebx, 2
cmp edx, 7
jne 0x4220e0
cmp eax, dword [esp + 0x60]
mov edi, dword [esp + 4]
jne 0x4221a0
mov eax, dword [esp + 0x24]
add eax, 2
push eax
call fcn.0043d5c0
add esp, 4
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x24]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebx]
mov dword [esp + 0x60], 0x1c1d1a1b
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x7a
xor cl, byte [esp + eax + 0x60]
add cl, 0x9e
mov byte [esp + eax + 0x60], cl
inc eax
cmp eax, 4
jne 0x422150
mov eax, dword [esp + 0x60]
mov edi, dword [0x44f228]
test edi, edi
je 0x4221ce
mov dword [esp + 8], esi
add edx, 2
mov esi, edx
xor ecx, ecx
mov edx, dword [0x44f22c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xae6e2b0b
je 0x4221a8
inc ecx
cmp edi, ecx
jne 0x422190
jmp 0x4221ce
mov ebx, dword [ebp + 0x14]
jmp 0x4222fb
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, eax
je 0x4221ce
push 0
push esi
push dword [esp + 0x28]
push 0x2b
push dword [esp + 0x18]
push 5
push dword [0x44f230]
push ecx
call fcn.004400f0
add esp, 0x20
test eax, eax
js 0x4222eb
mov ecx, dword [esp + 0x20]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, edx
je 0x42220b
mov esi, dword [ebp + 0xc]
movzx edi, word [esi + edx*2]
cmp di, word [ecx + edx*2]
jne 0x4222eb
inc edx
test di, di
jne 0x4221f0
mov ecx, ebx
call fcn.0043dfe0
cmp eax, 2
mov edi, dword [esp + 4]
jne 0x4222ef
mov ecx, ebx
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.0043de10
test eax, eax
js 0x4222ef
mov ecx, ebx
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.0043e310
test eax, eax
js 0x4222ef
mov ecx, ebx
push 0
push 0
push 0x80
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.0043e310
test eax, eax
js 0x4222ef
movzx eax, word [esp + 0xd2]
push eax
call fcn.0043d5c0
add esp, 4
mov esi, eax
movzx eax, word [esp + 0xd2]
mov ecx, ebx
push 0
push 0
push eax
push esi
push dword [esp + 0xec]
push dword [esp + 0xec]
call fcn.0043e310
test eax, eax
js 0x4224db
movzx edi, word [esp + 0x4a0]
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
test di, di
je 0x422357
lea esi, [esp + 0x4a0]
mov eax, dword [esp + 0xc]
mov ecx, eax
mov dword [esp + 8], eax
jmp 0x422328
mov edi, dword [esp + 4]
push dword [esp + 0x20]
call fcn.0043d610
add esp, 4
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
je 0x422311
test eax, eax
jne 0x422501
mov ecx, ebx
call fcn.0043db20
jmp 0x421fd4
movzx edi, word [esi]
test di, di
je 0x422357
movzx eax, word [ecx]
test ax, ax
je 0x4224d3
add esi, 2
add ecx, 2
mov edx, dword [esp + 8]
add edx, 2
cmp ax, di
je 0x42234c
mov dword [esp + 8], edx
mov ecx, edx
je 0x422320
lea esi, [esp + 0x4a0]
jmp 0x422320
cmp dword [esp + 8], 0
mov edi, dword [esp + 4]
je 0x4224d7
mov ecx, ebx
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0043e310
test eax, eax
js 0x4224d7
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 8], eax
adc ecx, 0
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x422403
cmp cx, dx
je 0x4224a9
push edi
call fcn.0043d610
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 0x2c]
mov esi, eax
xor esi, dword [esp + 8]
or esi, ecx
mov edi, dword [esp + 4]
je 0x4224d7
mov ecx, ebx
push 0
push 0
push 0x68
lea esi, [esp + 0x50c]
push esi
push edx
push eax
call fcn.0043e310
test eax, eax
js 0x4224d7
movzx eax, word [esp + 0x55a]
push eax
call fcn.0043d5c0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x55a]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.0043e310
test eax, eax
js 0x4223d4
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x422483
or ecx, 0x20
movzx edx, word [edi + eax]
lea esi, [edx - 0x41]
cmp si, 0x1a
jae 0x422493
or edx, 0x20
test cx, cx
je 0x4223cb
add eax, 2
cmp cx, dx
je 0x422470
jmp 0x4223cb
mov eax, dword [esp + 0x530]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0x18], eax
push edi
call fcn.0043d610
add esp, 4
mov edi, dword [esp + 4]
mov esi, dword [esp + 0xc]
push esi
call fcn.0043d610
add esp, 4
jmp 0x4222ef
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
push dword [esp + 0x1c]
call fcn.0043d610
add esp, 4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, ebx
call fcn.0043db10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret