Function at 0x483a00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x35c
mov esi, dword [esp + 0x388]
mov al, byte [esp + 0x394]
mov byte [esp + 0x9f], al
cmp esi, 0xfffff
ja 0x4841de
mov edx, dword [esp + 0x370]
mov eax, dword [edx]
mov eax, dword [eax]
cmp eax, 0x2a0
je 0x4843bc
jg 0x483a94
cmp eax, 4
je 0x484474
cmp eax, 0x40
je 0x484418
mov dword [esp + 8], 0x5e0990
mov dword [esp + 4], 0x1de
mov dword [esp], str.s3_cbc.c
call fcn.004d2d10
mov eax, dword [esp + 0x378]
test eax, eax
je 0x483a89
mov eax, dword [esp + 0x378]
mov dword [eax], 0xffffffff
add esp, 0x35c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x2a2
je 0x48452c
jl 0x4844d0
cmp eax, 0x2a3
jne 0x483a55
lea eax, [esp + 0x278]
mov dword [esp + 0x64], eax
mov dword [esp], eax
call fcn.004f2850
mov eax, 0x2b
mov ebp, 0x33
mov ecx, 0x200
mov byte [esp + 0x1c], 1
mov ebx, 8
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x6c], 0x1c
mov dword [esp + 0x68], 0x4f29f0
mov dword [esp + 0x70], 0x483110
cmp byte [esp + 0x9f], 0
je 0x48413f
mov edi, dword [esp + 0x98]
mov edx, dword [esp + 0x390]
lea edx, [edi + edx + 0xb]
mov dword [esp + 0x30], edx
add esi, edx
mov dword [esp + 0x4c], esi
add eax, esi
xor edx, edx
div dword [esp + 0x28]
mov esi, eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x384]
add edi, eax
mov eax, edi
xor edx, edx
div dword [esp + 0x28]
mov dword [esp + 0x34], edx
mov dword [esp + 0x84], eax
lea eax, [edi + ebx]
xor edx, edx
div dword [esp + 0x28]
mov dword [esp + 0x88], eax
mov eax, 3
mov dword [esp + 0x74], 2
cmp esi, eax
jbe 0x48412a
mov eax, esi
sub eax, dword [esp + 0x74]
mov dword [esp + 0x58], eax
imul eax, dword [esp + 0x28]
mov dword [esp + 0x54], eax
mov dword [esp + 0x74], esi
lea edx, [edi*8]
cmp byte [esp + 0x9f], 0
je 0x48423b
lea edi, [esp + 0xf8]
mov dword [esp + 0x7c], edi
cmp byte [esp + 0x1c], 0
je 0x4840e1
lea esi, [ebx - 4]
lea edi, [esp + 0xa8]
mov dword [esp + 0x1c], edi
cmp esi, 4
jb 0x483bde
mov ecx, esi
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, edx
shr eax, 0x18
mov byte [esp + esi + 0xa8], al
mov eax, edx
shr eax, 0x10
mov byte [esp + ebx + 0xa5], al
mov eax, edx
shr eax, 8
mov byte [esp + ebx + 0xa6], al
mov byte [esp + ebx + 0xa7], dl
mov eax, dword [esp + 0x54]
test eax, eax
je 0x483cfd
cmp byte [esp + 0x9f], 0
je 0x48431b
mov ebp, dword [esp + 0x30]
sub ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x37c]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x64]
mov dword [esp], edi
mov eax, dword [esp + 0x68]
call eax
lea eax, [esp + 0x1f8]
mov edi, eax
mov ecx, dword [esp + 0x37c]
mov edx, dword [esp + 0x28]
lea esi, [ecx + edx]
cmp ebp, 4
jae 0x4846f7
xor edx, edx
test ebp, 2
jne 0x4846de
test ebp, 1
jne 0x4846d3
mov esi, dword [esp + 0x28]
sub esi, ebp
mov dword [esp + 0x20], esi
mov edx, esi
lea edi, [eax + ebp]
mov esi, dword [esp + 0x380]
cmp edx, 4
jae 0x4846ab
xor ecx, ecx
test dl, 2
jne 0x484695
and edx, 1
jne 0x48468a
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov esi, dword [esp + 0x68]
call esi
mov eax, dword [esp + 0x54]
xor edx, edx
div dword [esp + 0x28]
lea edi, [eax - 1]
cmp edi, 1
jbe 0x483cfd
mov ebp, dword [esp + 0x380]
add ebp, dword [esp + 0x20]
mov esi, 1
mov dword [esp + 4], ebp
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov edx, dword [esp + 0x68]
call edx
inc esi
add ebp, dword [esp + 0x28]
cmp esi, edi
jne 0x483ce3
lea ebp, [esp + 0xb8]
mov ecx, 0x10
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x74]
lea esi, [esp + 0x178]
cmp dword [esp + 0x58], eax
ja 0x483feb
mov edx, dword [esp + 0x34]
inc edx
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x28]
sub ecx, ebx
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x34]
not edx
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x38]
not ecx
mov dword [esp + 0x40], ecx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4841b8
mov esi, dword [esp + 0x28]
mov dword [esp + 0x8c], esi
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4841a7
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x78], edi
shr edi, 2
mov eax, edi
shl eax, 2
mov dword [esp + 0x80], eax
sete byte [esp + 0x9e]
jne 0x4841c8
mov dword [esp + 0x90], 0
lea esi, [esp + 0x178]
sub ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x1c]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x94], edi
nop
lea esi, [esi]
mov edx, dword [esp + 0x58]
xor edx, dword [esp + 0x84]
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov byte [esp + 0x20], dl
mov edx, dword [esp + 0x58]
xor edx, dword [esp + 0x88]
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x60], edx
mov edi, edx
mov cl, dl
not ecx
mov byte [esp + 0x9c], cl
mov al, byte [esp + 0x20]
or byte [esp + 0x9c], al
mov edx, dword [esp + 0x34]
neg edx
mov dword [esp + 0x1c], edx
mov ebx, dword [esp + 0x54]
xor eax, eax
mov edx, ebx
sub edx, dword [esp + 0x30]
add edx, dword [esp + 0x380]
mov dword [esp + 0x5c], edx
mov ecx, dword [esp + 0x37c]
add ecx, ebx
mov dword [esp + 0x48], ecx
movzx edx, byte [esp + 0x60]
not edx
mov dword [esp + 0x44], edx
mov ecx, edi
mov byte [esp + 0x9d], cl
mov dword [esp + 0x2c], esi
jmp 0x483eca
mov dl, byte [esp + 0x20]
and esi, edx
mov ecx, esi
and ecx, 0xff
not ecx
mov edi, dword [esp + 0x48]
xor edx, edx
mov dl, byte [edi + eax]
and ecx, edx
inc ebx
mov edx, dword [esp + 0x38]
xor edx, eax
mov edi, dword [esp + 0x24]
add edi, eax
or edx, edi
not edx
and esi, 0x80
or ecx, esi
mov esi, dword [esp + 0x40]
and esi, eax
or edx, esi
sar edx, 0x1f
and edx, dword [esp + 0x20]
not edx
and edx, dword [esp + 0x9c]
and edx, ecx
cmp eax, dword [esp + 0x3c]
jb 0x483eb8
and edx, dword [esp + 0x44]
mov cl, byte [esp + 0x9d]
mov esi, dword [esp + 0x50]
and cl, byte [esi + eax]
or edx, ecx
mov edi, dword [esp + 0x2c]
mov byte [edi + eax], dl
inc eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x28], eax
jbe 0x483f20
mov esi, dword [esp + 0x34]
xor esi, eax
or esi, dword [esp + 0x1c]
not esi
mov edx, dword [esp + 0x24]
and edx, eax
or esi, edx
sar esi, 0x1f
cmp ebx, dword [esp + 0x30]
jb 0x483e50
cmp ebx, dword [esp + 0x4c]
jb 0x483f00
mov dl, byte [esp + 0x20]
and esi, edx
xor ecx, ecx
jmp 0x483e6b
mov cl, byte [esp + 0x20]
and esi, ecx
mov ecx, esi
and ecx, 0xff
not ecx
mov edi, dword [esp + 0x5c]
xor edx, edx
mov dl, byte [edi + eax]
and ecx, edx
jmp 0x483e6b
mov esi, edi
movzx edi, byte [esp + 0x9d]
mov dword [esp + 4], esi
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov edx, dword [esp + 0x68]
call edx
mov dword [esp + 4], esi
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov eax, dword [esp + 0x70]
call eax
cmp byte [esp + 0x9e], 0
jne 0x483fab
xor ecx, ecx
mov edx, edi
mov cl, dl
mov ch, byte [esp + 0x60]
mov eax, edi
and eax, 0xff
mov edx, eax
shl edx, 0x10
and ecx, 0xffff
shl eax, 0x18
or ecx, edx
or ecx, eax
xor eax, eax
mov ebx, dword [esp + 0x94]
lea esi, [esi]
lea edi, [edi]
mov edx, dword [esi + eax*4]
and edx, ecx
or dword [ebp + eax*4], edx
inc eax
cmp ebx, eax
ja 0x483f90
mov ecx, dword [esp + 0x80]
cmp dword [esp + 0x78], ecx
je 0x483fce
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x6c]
lea esi, [esi]
lea edi, [edi]
mov edx, edi
and dl, byte [esi + eax]
or byte [ebp + eax], dl
inc eax
cmp ecx, eax
ja 0x483fc0
inc dword [esp + 0x58]
mov edi, dword [esp + 0x8c]
add dword [esp + 0x54], edi
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x58], eax
jbe 0x483dc0
mov dword [esp], esi
call fcn.004d1950
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x370]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004d1a50
cmp byte [esp + 0x9f], 0
jne 0x4841ff
mov edi, dword [esp + 0x28]
test edi, edi
je 0x4841d4
mov ebx, dword [esp + 0x28]
mov ecx, ebx
shr ecx, 2
mov eax, ecx
shl eax, 2
je 0x484050
xor edx, edx
mov edi, dword [esp + 0x7c]
xor dword [edi + edx*4], 0x6a6a6a6a
inc edx
cmp edx, ecx
jb 0x484040
cmp eax, ebx
je 0x484069
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x7c]
nop
lea esi, [esi]
xor byte [edx + eax], 0x6a
inc eax
cmp ecx, eax
ja 0x484060
mov edx, dword [esp + 0x28]
mov dword [esp + 8], edx
mov edi, dword [esp + 0x7c]
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004d1d50
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.004d1d50
lea eax, [esp + 0xa4]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x374]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004d24c0
mov ebx, dword [esp + 0x378]
test ebx, ebx
je 0x4840ce
mov eax, dword [esp + 0xa4]
mov edx, dword [esp + 0x378]
mov dword [edx], eax
mov dword [esp], esi
call fcn.004d1e50
add esp, 0x35c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esp + 0xa8]
mov dword [esp + 0x1c], edi
cmp ebx, 4
jb 0x4840fa
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, edx
shr eax, 0x18
mov byte [esp + ebx + 0xa3], al
mov eax, edx
shr eax, 0x10
mov byte [esp + ebx + 0xa2], al
mov eax, edx
shr eax, 8
mov byte [esp + ebx + 0xa1], al
mov byte [esp + ebx + 0xa0], dl
jmp 0x483c09
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
jmp 0x483b97
lea edi, [esi + 0xd]
mov dword [esp + 0x4c], edi
mov edx, dword [esp + 0x28]
lea eax, [edx + esi + 0xc]
add eax, ebx
sub eax, dword [esp + 0x6c]
xor edx, edx
div dword [esp + 0x28]
mov esi, eax
mov edi, dword [esp + 0x384]
add edi, 0xd
sub edi, dword [esp + 0x6c]
mov eax, edi
xor edx, edx
div dword [esp + 0x28]
mov dword [esp + 0x34], edx
mov dword [esp + 0x84], eax
lea eax, [edi + ebx]
xor edx, edx
div dword [esp + 0x28]
mov dword [esp + 0x88], eax
mov eax, 6
mov dword [esp + 0x74], 6
mov dword [esp + 0x30], 0xd
jmp 0x483b78
mov dword [esp + 0x78], 1
mov edi, dword [esp + 0x78]
jmp 0x483d76
mov dword [esp + 0x8c], 1
jmp 0x483d62
mov dword [esp + 0x90], eax
jmp 0x483d9e
mov ebx, 1
jmp 0x48402e
mov dword [esp + 8], str.data_plus_mac_plus_padding_size___10241024
mov dword [esp + 4], 0x1a8
mov dword [esp], str.s3_cbc.c
call fcn.004d2d10
jmp 0x483a2b
cmp dword [esp + 0x98], 4
jae 0x484670
mov edx, dword [esp + 0x390]
mov dword [esp + 8], edx
mov ecx, dword [esp + 0x38c]
mov dword [esp + 4], ecx
mov dword [esp], esi
call fcn.004d1d50
mov edi, dword [esp + 0x98]
mov dword [esp + 8], edi
jmp 0x484071
add edx, ecx
lea edi, [esp + 0xf8]
mov dword [esp + 0x7c], edi
cmp dword [esp + 0x28], 4
jae 0x48462b
cmp dword [esp + 0x390], 0x80
ja 0x484647
mov edi, dword [esp + 0x7c]
mov esi, dword [esp + 0x38c]
cmp dword [esp + 0x390], 4
jae 0x48460d
xor eax, eax
test byte [esp + 0x390], 2
jne 0x4845f2
test byte [esp + 0x390], 1
jne 0x4845df
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4845d5
mov edi, dword [esp + 0x28]
mov esi, edi
shr esi, 2
mov eax, esi
shl eax, 2
je 0x4842e4
xor ecx, ecx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x7c]
jmp 0x4842d0
xor dword [edx + ecx*4], 0x36363636
inc ecx
cmp esi, ecx
ja 0x4842d0
mov edx, dword [esp + 0x20]
cmp edi, eax
je 0x4842f9
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x7c]
lea esi, [esi]
xor byte [ecx + eax], 0x36
inc eax
cmp esi, eax
ja 0x4842f0
mov edi, dword [esp + 0x7c]
mov dword [esp + 4], edi
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x68]
call ecx
mov edx, dword [esp + 0x14]
jmp 0x483bb7
lea eax, [esp + 0x1f8]
mov ecx, 3
mov edi, eax
mov esi, dword [esp + 0x37c]
rep movsd dword es:[edi], dword [esi]
mov cl, byte [esi]
mov byte [edi], cl
mov edx, ebp
lea edi, [esp + 0x205]
mov esi, dword [esp + 0x380]
cmp ebp, 4
jae 0x4845a9
xor ecx, ecx
test dl, 2
jne 0x484593
and edx, 1
jne 0x484588
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x64]
mov dword [esp], ecx
mov esi, dword [esp + 0x68]
call esi
mov eax, dword [esp + 0x54]
xor edx, edx
div dword [esp + 0x28]
mov edi, eax
cmp eax, 1
jbe 0x483cfd
mov ecx, dword [esp + 0x380]
mov edx, dword [esp + 0x28]
lea ebp, [ecx + edx - 0xd]
mov esi, 1
mov dword [esp + 4], ebp
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov edx, dword [esp + 0x68]
call edx
inc esi
add ebp, dword [esp + 0x28]
cmp esi, edi
jne 0x48439d
jmp 0x483cfd
lea edx, [esp + 0x278]
mov dword [esp + 0x64], edx
mov dword [esp], edx
call fcn.004f28f0
mov eax, 0x27
mov ebp, 0x33
mov ecx, 0x200
mov byte [esp + 0x1c], 1
mov ebx, 8
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x6c], 0x20
mov dword [esp + 0x68], 0x4f29f0
mov dword [esp + 0x70], 0x483110
jmp 0x483b03
lea edi, [esp + 0x278]
mov dword [esp + 0x64], edi
mov dword [esp], edi
call fcn.004f2490
mov eax, 0x33
mov ebp, 0x33
mov ecx, 0x200
mov byte [esp + 0x1c], 1
mov ebx, 8
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x6c], 0x14
mov dword [esp + 0x68], 0x4f2250
mov dword [esp + 0x70], 0x483060
jmp 0x483b03
lea ecx, [esp + 0x278]
mov dword [esp + 0x64], ecx
mov dword [esp], ecx
call fcn.004c7cc0
mov eax, 0x37
mov ebp, 0x33
mov ecx, 0x200
mov byte [esp + 0x1c], 0
mov ebx, 8
mov dword [esp + 0x98], 0x30
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x6c], 0x10
mov dword [esp + 0x68], 0x4c7a90
mov dword [esp + 0x70], 0x482fd0
jmp 0x483b03
lea ecx, [esp + 0x278]
mov dword [esp + 0x64], ecx
mov dword [esp], ecx
call fcn.004f2e70
mov eax, 0x5f
mov ebp, 0x73
mov ecx, 0x400
mov byte [esp + 0x1c], 1
mov ebx, 0x10
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], pe_nt_image_headers32
mov dword [esp + 0x6c], 0x30
mov dword [esp + 0x68], 0x4f3910
mov dword [esp + 0x70], 0x483220
jmp 0x483b03
lea edi, [esp + 0x278]
mov dword [esp + 0x64], edi
mov dword [esp], edi
call fcn.004f2f20
mov eax, 0x4f
mov ebp, 0x73
mov ecx, 0x400
mov byte [esp + 0x1c], 1
mov ebx, 0x10
mov dword [esp + 0x98], 0x28
mov dword [esp + 0x28], pe_nt_image_headers32
mov dword [esp + 0x6c], 0x40
mov dword [esp + 0x68], 0x4f3910
mov dword [esp + 0x70], 0x483220
jmp 0x483b03
mov dl, byte [esi + ecx]
mov byte [edi + ecx], dl
jmp 0x484363
mov cx, word [esi]
mov word [edi], cx
mov ecx, 2
and edx, 1
je 0x484363
jmp 0x484588
test edi, 1
jne 0x484722
test edi, 2
jne 0x48470e
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
test dl, 2
je 0x48435a
jmp 0x484593
mov edi, 1
jmp 0x4842ab
mov cl, byte [esi + eax]
mov byte [edi + eax], cl
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4845d5
jmp 0x4842a7
mov ax, word [esi]
mov word [edi], ax
mov eax, 2
test byte [esp + 0x390], 1
je 0x48429b
jmp 0x4845df
mov ecx, dword [esp + 0x390]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor eax, eax
test byte [esp + 0x390], 2
je 0x48428d
jmp 0x4845f2
mov ecx, dword [esp + 0x28]
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
cmp dword [esp + 0x390], 0x80
jbe 0x484264
mov dword [esp + 8], str.mac_secret_length___sizeof_hmac_pad_
mov dword [esp + 4], 0x237
mov dword [esp], str.s3_cbc.c
mov dword [esp + 0x14], edx
call fcn.004d2d10
mov edx, dword [esp + 0x14]
jmp 0x484264
mov ecx, dword [esp + 0x98]
shr ecx, 2
mov eax, 0x5c5c5c5c
mov edi, dword [esp + 0x7c]
rep stosd dword es:[edi], eax
jmp 0x48420d
mov dl, byte [esi + ecx]
mov byte [edi + ecx], dl
jmp 0x483cb0
mov cx, word [esi]
mov word [edi], cx
mov ecx, 2
and edx, 1
je 0x483cb0
jmp 0x48468a
test edi, 1
jne 0x48474f
test edi, 2
jne 0x48473b
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
test dl, 2
je 0x483ca7
jmp 0x484695
mov cl, byte [esi + edx]
mov byte [edi + edx], cl
jmp 0x483c7d
mov dx, word [esi]
mov word [edi], dx
mov edx, 2
test ebp, 1
je 0x483c7d
jmp 0x4846d3
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor edx, edx
test ebp, 2
je 0x483c71
jmp 0x4846de
mov cx, word [esi]
mov word [edi], cx
add edi, 2
add esi, 2
sub edx, 2
jmp 0x4845c1
mov cl, byte [esi]
mov byte [edi], cl
lea edi, [esp + 0x206]
mov esi, dword [esp + 0x380]
inc esi
dec edx
jmp 0x4845b5
mov cx, word [esi]
mov word [edi], cx
add edi, 2
add esi, 2
sub edx, 2
jmp 0x4846bf
mov dl, byte [esi]
mov byte [edi], dl
inc edi
mov esi, dword [esp + 0x380]
inc esi
mov edx, dword [esp + 0x20]
dec edx
jmp 0x4846b7