Function at 0x422b50
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov dword [esp + 0xc0], 0x23df21dd
mov dword [esp + 0xc4], 0x27922591
mov dword [esp + 0xc8], 0x3b863981
mov dword [esp + 0xcc], 0x3f8a3d85
mov dword [esp + 0xd0], 0x33cf31b9
mov dword [esp + 0xd4], 0x37833587
mov dword [esp + 0xd8], 0xbf709aa
mov dword [esp + 0xdc], 0xf870db8
mov dword [esp + 0xe0], 0x3a701b0
mov dword [esp + 0xe4], 0x7b805c9
mov dword [esp + 0xe8], 0x1bae19bd
mov dword [esp + 0xec], 0x1fa11dab
mov dword [esp + 0xf0], 0x13a911a2
mov dword [esp + 0xf4], 0x17ab15ea
mov dword [esp + 0xf8], 0xeb50e957
mov dword [esp + 0xfc], 0xef53ed53
mov dword [esp + 0x100], 0xe33ce11e
mov dword [esp + 0x104], 0xe752e541
mov dword [esp + 0x108], 0xfb45f94f
mov dword [esp + 0x10c], 0xff45fd4e
mov dword [esp + 0x110], 0xf357f123
mov dword [esp + 0x114], 0xf740f546
mov dword [esp + 0x118], 0xcb69c971
mov dword [esp + 0x11c], 0xcfcecd69
mov eax, 0x48
mov ecx, 0x4079b3b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x78]
mov esi, ecx
or esi, edx
lea ebx, [ecx - 0x4079b300]
and ebx, edx
xor ebx, esi
and ebx, eax
add bl, bl
sub dl, bl
movzx edx, dl
add edx, eax
add dl, 0x98
mov byte [esp + eax + 0x78], dl
inc eax
dec ecx
cmp eax, 0xa8
jne 0x422c80
lea edi, [esp + 0x60]
lea eax, [esp + 0xc0]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xc0]
lea eax, [esp + 0x120]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0xc0], 0x34353637
mov word [esp + 0xc4], 0
mov byte [esp + 0xc6], 0
mov eax, 0x3039a8f4
mov ecx, 0xcfc6570b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x3039a834]
lea edx, [eax - 0x3039a800]
and edx, esi
mov ebx, edx
and ebx, 2
mov edi, edx
or edx, 2
imul edx, ebx
xor ebx, 2
and edi, 0xfffffffd
imul edi, ebx
add edx, edi
mov edi, ecx
sub edi, esi
add esi, eax
and edi, edx
not edx
and edx, esi
sub edx, edi
add dl, 0x3c
mov byte [esp + eax - 0x3039a834], dl
inc eax
dec ecx
cmp eax, 0x3039a8fb
jne 0x422d10
mov eax, dword [esp + 0xc0]
mov ecx, dword [0x451f60]
test ecx, ecx
je 0x422d90
xor edx, edx
mov esi, dword [0x451f64]
mov ebx, dword [ebp + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xc85f7986
je 0x422d95
inc edx
cmp ecx, edx
jne 0x422d80
jmp 0x422db9
mov ebx, dword [ebp + 0x14]
jmp 0x422db9
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x422db9
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 5
push 4
push dword [0x451f68]
push ecx
call fcn.004426c0
add esp, 0x1c
cmp eax, 0xc0000004
jne 0x422e90
push dword [esp + 0x28]
call fcn.0043f600
add esp, 4
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 0xc0], 0x34353637
mov word [esp + 0xc4], 0
mov byte [esp + 0xc6], 0
mov eax, 0x3039a8f4
mov edx, 0xcfc6570b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x3039a834]
lea ecx, [eax - 0x3039a800]
and ecx, edi
mov ebx, ecx
and ebx, 2
mov esi, ecx
or ecx, 2
imul ecx, ebx
xor ebx, 2
and esi, 0xfffffffd
imul esi, ebx
add ecx, esi
mov esi, edx
sub esi, edi
add edi, eax
and esi, ecx
not ecx
and ecx, edi
sub ecx, esi
add cl, 0x3c
mov byte [esp + eax - 0x3039a834], cl
inc eax
dec edx
cmp eax, 0x3039a8fb
jne 0x422e10
mov eax, dword [esp + 0xc0]
mov ecx, dword [0x451f60]
test ecx, ecx
je 0x422e9b
xor edx, edx
mov edi, dword [0x451f64]
mov esi, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xc85f7986
je 0x422ea0
inc edx
cmp ecx, edx
jne 0x422e80
jmp 0x422ec5
xor ecx, ecx
xor edx, edx
xor esi, esi
jmp 0x4234b1
mov esi, dword [ebp + 8]
jmp 0x422ec5
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x422ec5
push 0
push dword [esp + 8]
push dword [esp + 0x28]
push 5
push 4
push dword [0x451f68]
push ecx
call fcn.004426c0
add esp, 0x1c
test eax, eax
mov ebx, dword [ebp + 0x14]
js 0x423481
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov dword [esp + 0x10], 0
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
jmp 0x422f0e
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x423499
mov edx, edi
mov ecx, dword [edi + eax + 0x3c]
add eax, edi
mov dword [esp + 4], eax
xor edx, edx
nop
nop
nop
nop
movzx eax, word [ecx + edx]
movzx edi, word [esi + edx]
test eax, eax
je 0x422f34
add edx, 2
cmp ax, di
je 0x422f20
movzx ecx, di
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
cmp edx, eax
jne 0x422f00
mov edi, dword [esp + 4]
mov eax, dword [edi + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xdc]
mov dword [ebx + 0xc], eax
mov ecx, ebx
push 0x410
call fcn.0043f910
test eax, eax
js 0x422f04
mov dword [esp + 0x24], 0
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 0xc0], 0x34353637
lea eax, [esp + 0xc4]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0x3039a8f4
mov edx, 0xcfc6570b
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x3039a834]
lea ecx, [eax - 0x3039a800]
and ecx, edi
mov ebx, ecx
and ebx, 2
mov esi, ecx
or ecx, 2
imul ecx, ebx
xor ebx, 2
and esi, 0xfffffffd
imul esi, ebx
add ecx, esi
mov esi, edx
sub esi, edi
add edi, eax
and esi, ecx
not ecx
and ecx, edi
sub ecx, esi
add cl, 0x3c
mov byte [esp + eax - 0x3039a834], cl
inc eax
dec edx
cmp eax, 0x3039a8fb
jne 0x422fa0
mov eax, dword [esp + 0xc0]
mov ecx, dword [0x451f60]
test ecx, ecx
je 0x423050
xor edx, edx
mov edi, dword [0x451f64]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x62429966
je 0x423020
inc edx
cmp ecx, edx
jne 0x423010
jmp 0x423050
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x423050
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x2b
push dword [esp + 0x1c]
push 5
push dword [0x451f68]
push ecx
call fcn.004426c0
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0xc0000004
mov ebx, dword [ebp + 0x14]
jne 0x423130
mov eax, dword [esp + 0x24]
add eax, 2
push eax
call fcn.0043f600
add esp, 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc0], 0x34353637
lea eax, [esp + 0xc4]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0x3039a8f4
mov edi, 0xcfc6570b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3039a834]
lea ecx, [eax - 0x3039a800]
and ecx, edx
mov ebx, ecx
and ebx, 2
mov esi, ecx
or ecx, 2
imul ecx, ebx
xor ebx, 2
and esi, 0xfffffffd
imul esi, ebx
add ecx, esi
mov esi, edi
sub esi, edx
add edx, eax
and esi, ecx
not ecx
and ecx, edx
sub ecx, esi
add cl, 0x3c
mov byte [esp + eax - 0x3039a834], cl
inc eax
dec edi
cmp eax, 0x3039a8fb
jne 0x4230b0
mov eax, dword [esp + 0xc0]
mov ecx, dword [0x451f60]
test ecx, ecx
je 0x42313c
mov ebx, dword [esp + 8]
add ebx, 2
xor edx, edx
mov edi, dword [0x451f64]
mov esi, dword [ebp + 8]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x62429966
je 0x423141
inc edx
cmp ecx, edx
jne 0x423120
jmp 0x423167
mov esi, dword [ebp + 8]
mov edi, dword [esp + 4]
jmp 0x4232d4
mov esi, dword [ebp + 8]
jmp 0x423167
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x423167
push 0
push ebx
push dword [esp + 0x14]
push 0x2b
push dword [esp + 0x2c]
push 5
push dword [0x451f68]
push ecx
call fcn.004426c0
add esp, 0x20
test eax, eax
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
js 0x4232c4
mov ecx, dword [esp + 0xc]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, edx
je 0x4231a8
movzx esi, word [edi + edx*2]
cmp si, word [ecx + edx*2]
jne 0x4232c1
inc edx
test si, si
jne 0x423190
mov ecx, ebx
call fcn.00440000
cmp eax, 2
mov esi, dword [ebp + 8]
mov edi, dword [esp + 4]
jne 0x4232c8
mov ecx, ebx
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.0043fe10
test eax, eax
js 0x4232c8
mov ecx, ebx
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.00440340
test eax, eax
js 0x4232c8
mov ecx, ebx
push 0
push 0
push 0x80
lea eax, [esp + 0xcc]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.00440340
test eax, eax
js 0x4232c8
movzx eax, word [esp + 0x132]
push eax
call fcn.0043f600
add esp, 4
movzx edx, word [esp + 0x132]
mov ecx, ebx
push 0
push 0
push edx
mov dword [esp + 0x14], eax
push eax
push dword [esp + 0x14c]
push dword [esp + 0x14c]
call fcn.00440340
test eax, eax
js 0x423443
movzx edi, word [esp + 0x60]
mov eax, dword [esp + 8]
test di, di
je 0x4232f5
lea ecx, [esp + 0x60]
mov eax, dword [esp + 8]
mov edx, eax
jmp 0x423298
movzx edi, word [ecx]
test di, di
je 0x4232f5
movzx esi, word [edx]
test si, si
je 0x42343c
add edx, 2
add ecx, 2
lea ebx, [eax + 2]
cmp si, di
je 0x4232b6
mov eax, ebx
mov edx, ebx
mov ebx, dword [ebp + 0x14]
je 0x423290
lea ecx, [esp + 0x60]
jmp 0x423290
mov esi, dword [ebp + 8]
mov edi, dword [esp + 4]
push dword [esp + 0xc]
call fcn.0043f660
add esp, 4
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x14]
je 0x4232e9
cmp dword [esp + 0x10], 0
jne 0x423499
mov ecx, ebx
call fcn.0043fa60
jmp 0x422f04
test eax, eax
mov esi, dword [ebp + 8]
mov edi, dword [esp + 4]
je 0x423443
mov ecx, ebx
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.00440340
test eax, eax
js 0x423443
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 0x1c], eax
adc ecx, 0
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x4233a0
cmp cx, dx
je 0x423455
push edi
call fcn.0043f660
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 0x2c]
mov esi, eax
xor esi, dword [esp + 0x1c]
or esi, ecx
mov esi, dword [ebp + 8]
je 0x42343f
mov ecx, ebx
push 0
push 0
push 0x68
lea edi, [esp + 0x50c]
push edi
push edx
push eax
call fcn.00440340
test eax, eax
js 0x42343f
movzx eax, word [esp + 0x55a]
push eax
call fcn.0043f600
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x55a]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.00440340
test eax, eax
js 0x423372
xor eax, eax
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x423413
or ecx, 0x20
movzx edx, word [edi + eax]
lea esi, [edx - 0x41]
cmp si, 0x1a
jae 0x423423
or edx, 0x20
mov esi, dword [ebp + 8]
test cx, cx
je 0x423369
add eax, 2
cmp cx, dx
je 0x423400
jmp 0x423369
mov esi, dword [ebp + 8]
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
push eax
call fcn.0043f660
add esp, 4
jmp 0x4232c8
mov eax, dword [esp + 0x530]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0x10], eax
push edi
call fcn.0043f660
add esp, 4
jmp 0x42343f
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push dword [esp + 0x20]
call fcn.0043f660
add esp, 4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, ebx
call fcn.0043fa50
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret