Function at 0x41b320
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov edi, ecx
mov ebx, dword [ebp + 8]
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0x565577c1
push dword [0x449080]
call fcn.0043c760
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push dword [ebp + 0xc]
push ebx
call eax
test eax, eax
je 0x41b3bc
cmp dword [edi], 0xffffffff
jne 0x41b468
jmp 0x41b865
push 0xb646c33f
push dword [0x449080]
call fcn.0043c760
add esp, 8
mov dword [esi], eax
push 0xe7db718c
push dword [0x449080]
call fcn.0043c760
add esp, 8
mov dword [esi + 4], eax
push 0xa3d60213
push dword [0x449080]
call fcn.0043c760
add esp, 8
mov dword [esi + 8], eax
mov ebx, dword [esi + 0x28]
jmp 0x41b413
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x41b444
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x41b410
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 4]
test eax, eax
je 0x41b444
push dword [edi]
call dword [esi + 8]
mov dword [edi], 0xffffffff
jmp 0x41b410
push 0xeb17dc3b
push dword [0x449080]
call fcn.0043c760
add esp, 8
push dword [esi + 0x28]
call eax
mov ebx, dword [ebp + 8]
cmp dword [edi], 0xffffffff
je 0x41b865
mov dword [esi + 0x24], edi
mov ecx, dword [ebp + 0x10]
mov eax, 0xffffffff
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
add edx, 2
cmp byte [ecx + eax + 1], 0
lea eax, [eax + 1]
jne 0x41b480
and edx, 0x120
xor edi, edi
mov ecx, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ebx + edi], 0
lea edi, [edi + 1]
jne 0x41b4a0
add edx, edi
add edx, 0xfffffffe
mov edi, ecx
inc edx
cmp byte [edi], 0
lea edi, [edi + 1]
jne 0x41b4b0
xor eax, 0x90
add eax, edx
add eax, 3
and eax, 0xfffffffc
call fcn.004083f0
mov eax, esp
and eax, 0xfffffff0
mov dword [esi], eax
mov esp, eax
mov dword [esi + 0x30], 0xafaeb990
mov dword [esi + 0x34], 0x898f8aac
mov dword [esi + 0x38], 0xb3706c89
mov dword [esi + 0x3c], 0xbdfaf6f3
mov dword [esi + 0x40], 0x41a0
mov byte [esi + 0x44], 0
xor edi, edi
mov eax, 1
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
or edx, 0xe2077d14
mov ebx, edi
xor ebx, 0xe2077d14
add ebx, edx
mov edx, edi
and edx, 0xb
sub ebx, edx
add ebx, eax
mov edx, ebx
or edx, 0x4b
and ebx, 0x4b
xor ebx, edx
movzx edx, byte [esi + edi + 0x30]
xor ebx, edx
xor ebx, 0x4b
add bl, 0x9c
mov byte [esi + edi + 0x30], bl
inc edi
add eax, 2
dec ecx
cmp edi, 0x15
jne 0x41b510
mov dword [esi + 0xc], 0x719a8885
mov byte [esi + 0x10], 0x50
mov dword [esi + 0x11], 0
mov eax, 0x8d
mov edx, 0x72
nop
nop
nop
nop
movzx ecx, byte [esi + eax - 0x81]
mov ebx, eax
xor ebx, edx
and ebx, ecx
xor ebx, edx
mov cl, 0x3e
sub cl, bl
mov byte [esi + eax - 0x81], cl
inc eax
dec edx
cmp eax, 0x96
jne 0x41b570
movzx eax, byte [esi + 0xc]
mov ebx, dword [esi]
test al, al
je 0x41b5bb
lea edx, [esi + 0xd]
mov ebx, dword [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41b5b0
mov byte [ebx], 0
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ecx]
test al, al
je 0x41b5db
inc ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b5d0
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x41b5fb
lea ecx, [esi + 0x31]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b5f0
mov byte [ebx], 0
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
test al, al
je 0x41b61b
inc ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b610
mov byte [ebx], 0x3a
mov dword [esi + 0x30], 0x53b7cbcd
mov dword [esi + 0x34], 0xa3a757a3
mov dword [esi + 0x38], 0x5cea93ad
mov dword [esi + 0x3c], 0xa05dafa9
mov dword [esi + 0x40], 0x67979a93
mov dword [esi + 0x44], 0x98b5fff9
mov dword [esi + 0x48], 0x989f9796
mov dword [esi + 0x4c], 0x91919468
mov dword [esi + 0x50], 0x7397c1ba
mov dword [esi + 0x54], 0x83877783
mov dword [esi + 0x58], 0x98e0e48d
mov dword [esi + 0x5c], 0x98c38e89
mov dword [esi + 0x60], 0x7c617375
mov dword [esi + 0x64], 0x83737e77
mov dword [esi + 0x68], 0x827f5235
mov dword [esi + 0x6c], 0x6c563d46
mov dword [esi + 0x70], 0x5361936d
mov dword [esi + 0x74], 0x7e6a4897
mov dword [esi + 0x78], 0x4c4b627d
mov dword [esi + 0x7c], 0x405b6061
mov dword [esi + 0x80], 0x6175a140
mov dword [esi + 0x84], 0x4071547c
mov dword [esi + 0x88], 0x31376453
mov dword [esi + 0x8c], 0x125d584f
mov dword [esi + 0x90], 0x50404457
mov dword [esi + 0x94], 0x424d464b
mov dword [esi + 0x98], 0x4e5c04bc
mov dword [esi + 0x9c], 0x4047bebe
mov dword [esi + 0xa0], 0x2720b3e
mov dword [esi + 0xa4], 0x5a5c5807
mov word [esi + 0xa8], 0x5952
mov dword [esi + 0xaa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0x51
xor edx, 0x44b558d1
mov ecx, eax
and ecx, 0x2e
sub ecx, edx
mov edx, 0x5e
sub edx, ecx
add ecx, 0xa1
and edx, 0x60
and ecx, 0x9f
or ecx, edx
xor cl, byte [esi + eax + 0x30]
xor cl, 0x60
add cl, 0xf0
mov byte [esi + eax + 0x30], cl
inc eax
cmp eax, 0x7e
jne 0x41b730
inc ebx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x41b78b
inc ecx
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b780
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x41b7ab
lea ecx, [esi + 0x31]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41b7a0
mov byte [ebx], 0
mov edi, dword [esi]
sub ebx, edi
push 0xefae2064
push dword [0x449080]
call fcn.0043c760
add esp, 8
push 0
push ebx
push edi
mov edi, dword [esi + 0x24]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x41b817
cmp dword [edi], 0xffffffff
je 0x41b817
push 0xea8d1240
push dword [0x449080]
call fcn.0043c760
add esp, 8
push 2
push dword [edi]
call eax
push 0xa3d60213
push dword [0x449080]
call fcn.0043c760
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x41bce3
cmp eax, 0xffffffff
je 0x41b865
push 0x400
call fcn.00408420
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add eax, 0x400
mov dword [esi + 0x14], eax
lea eax, [esi + 0xc]
mov ecx, edi
push eax
call fcn.0041bcf0
mov cl, 1
mov dword [esi + 4], ecx
test al, al
je 0x41bccb
mov ebx, dword [esi + 0xc]
mov edi, dword [esi + 0x10]
mov ecx, edi
sub ecx, ebx
cmp edi, dword [esi + 0x14]
je 0x41b86c
mov eax, ebx
jmp 0x41b9bb
xor eax, eax
jmp 0x41bce3
lea eax, [ecx + 1]
mov edx, ecx
shr edx, 1
mov dword [esi], ecx
add edx, ecx
cmp edx, eax
ja 0x41b87d
mov edx, eax
mov dword [esi + 4], edx
push edx
call fcn.00408420
add esp, 4
test ebx, ebx
je 0x41b9a8
mov ecx, ebx
xor ecx, edi
mov edx, ebx
not edx
and edx, edi
add edx, edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x18], ecx
sub edx, ecx
cmp eax, ebx
mov dword [esi + 8], eax
jbe 0x41b954
lea ecx, [ebx + edx]
cmp ecx, eax
jbe 0x41b954
test edx, edx
je 0x41b99a
mov eax, dword [esi + 8]
add eax, edx
dec eax
lea ecx, [ebx + edx]
dec ecx
mov ebx, edx
and ebx, 7
je 0x41b8f0
mov dword [esi + 0x1c], edx
neg ebx
xor edi, edi
movzx edx, byte [ecx + edi]
mov byte [eax + edi], dl
dec edi
cmp ebx, edi
jne 0x41b8db
add ecx, edi
add eax, edi
mov edx, dword [esi + 0x1c]
add edx, edi
mov edi, edx
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x20]
cmp edx, 0xfffffff8
ja 0x41b99a
neg edi
xor edx, edx
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
movzx ebx, byte [ecx + edx - 1]
mov byte [eax + edx - 1], bl
movzx ebx, byte [ecx + edx - 2]
mov byte [eax + edx - 2], bl
movzx ebx, byte [ecx + edx - 3]
mov byte [eax + edx - 3], bl
movzx ebx, byte [ecx + edx - 4]
mov byte [eax + edx - 4], bl
movzx ebx, byte [ecx + edx - 5]
mov byte [eax + edx - 5], bl
movzx ebx, byte [ecx + edx - 6]
mov byte [eax + edx - 6], bl
movzx ebx, byte [ecx + edx - 7]
mov byte [eax + edx - 7], bl
add edx, 0xfffffff8
cmp edi, edx
jne 0x41b905
jmp 0x41b99a
mov ecx, edx
shr ecx, 2
mov dword [esi + 0x1c], edx
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, dword [esi + 0x1c]
mov edx, ecx
and edx, 0xfffffffc
add eax, edx
add edx, ebx
shr ecx, 1
and ecx, 1
mov ebx, edx
mov dword [esi + 0x18], eax
mov edi, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ebx, dword [esi + 0x1c]
test bl, 1
je 0x41b99a
and ebx, 2
movzx ecx, byte [edx + ebx]
mov eax, dword [esi + 0x18]
mov byte [eax + ebx], cl
push dword [esi + 0xc]
call fcn.00408430
add esp, 4
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov ecx, dword [esi]
lea edx, [eax + ecx]
mov dword [esi + 0x10], edx
mov edx, dword [esi + 4]
add edx, eax
mov dword [esi + 0x14], edx
mov byte [eax + ecx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x30], 0xa75a55a0
mov dword [esi + 0x34], 0x82808487
mov dword [esi + 0x38], 0xbebe8090
mov byte [esi + 0x3c], 0xcc
mov dword [esi + 0x3d], 0
xor ebx, ebx
mov ecx, dword [esi + 0x24]
mov edx, ebx
add dl, 0xd6
xor dl, byte [esi + ebx + 0x30]
add dl, 0xd2
mov byte [esi + ebx + 0x30], dl
inc ebx
cmp ebx, 0x11
jne 0x41b9f0
movzx ebx, byte [esi + 0x30]
mov edx, eax
mov dword [esi + 8], eax
test bl, bl
je 0x41ba64
lea edx, [esi + 0x30]
mov dword [esi + 4], edx
mov edx, eax
mov edi, eax
mov dword [esi + 8], eax
mov edi, dword [esi + 4]
jmp 0x41ba3a
movzx ebx, byte [edi]
test bl, bl
mov ecx, dword [esi + 0x24]
je 0x41ba64
mov bh, byte [edx]
test bh, bh
je 0x41bcba
inc edx
inc edi
mov dword [esi + 4], edi
mov ecx, dword [esi + 8]
lea edi, [ecx + 1]
cmp bh, bl
je 0x41ba5a
mov ecx, edi
mov dword [esi + 8], edi
mov edx, edi
mov edi, dword [esi + 4]
je 0x41ba30
lea edi, [esi + 0x30]
jmp 0x41ba30
cmp dword [esi + 8], 0
je 0x41bcba
mov edx, dword [esi]
jmp 0x41ba8d
cmp bl, bh
mov ecx, dword [esi + 0x24]
mov edx, dword [esi]
je 0x41bccb
mov ebx, eax
sub ebx, edx
je 0x41bab6
mov dword [esi], edx
mov dword [esi + 4], edx
mov edi, eax
xor ecx, ecx
mov edx, dword [esi + 4]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
xor ecx, ecx
mov edi, eax
mov eax, dword [esi]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 0x24]
add dword [esi + 0x10], ebx
lea eax, [esi + 0xc]
push eax
call fcn.0041bcf0
test al, al
je 0x41bcc4
mov dword [esi + 4], eax
mov ebx, dword [esi + 0xc]
mov edi, dword [esi + 0x10]
mov ecx, edi
sub ecx, ebx
cmp edi, dword [esi + 0x14]
je 0x41bae0
mov eax, ebx
jmp 0x41bc36
lea eax, [ecx + 1]
mov edx, ecx
shr edx, 1
mov dword [esi], ecx
add edx, ecx
cmp edx, eax
ja 0x41baf1
mov edx, eax
mov dword [esi + 8], edx
push edx
call fcn.00408420
add esp, 4
test ebx, ebx
je 0x41bc23
mov ecx, ebx
xor ecx, edi
mov edx, ebx
not edx
and edx, edi
add edx, edx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x20], ecx
sub edx, ecx
cmp eax, ebx
mov dword [esi + 0x1c], eax
jbe 0x41bbcf
lea ecx, [ebx + edx]
cmp ecx, eax
jbe 0x41bbcf
test edx, edx
je 0x41bc15
mov eax, dword [esi + 0x1c]
add eax, edx
dec eax
lea ecx, [ebx + edx]
dec ecx
mov ebx, edx
and ebx, 7
je 0x41bb65
mov dword [esi + 0x18], edx
neg ebx
xor edi, edi
nop
movzx edx, byte [ecx + edi]
mov byte [eax + edi], dl
dec edi
cmp ebx, edi
jne 0x41bb50
add ecx, edi
add eax, edi
mov edx, dword [esi + 0x18]
add edx, edi
mov edi, edx
mov edx, dword [esi + 0x20]
sub edx, dword [esi + 0x2c]
cmp edx, 0xfffffff8
ja 0x41bc15
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
movzx ebx, byte [ecx + edx - 1]
mov byte [eax + edx - 1], bl
movzx ebx, byte [ecx + edx - 2]
mov byte [eax + edx - 2], bl
movzx ebx, byte [ecx + edx - 3]
mov byte [eax + edx - 3], bl
movzx ebx, byte [ecx + edx - 4]
mov byte [eax + edx - 4], bl
movzx ebx, byte [ecx + edx - 5]
mov byte [eax + edx - 5], bl
movzx ebx, byte [ecx + edx - 6]
mov byte [eax + edx - 6], bl
movzx ebx, byte [ecx + edx - 7]
mov byte [eax + edx - 7], bl
add edx, 0xfffffff8
cmp edi, edx
jne 0x41bb80
jmp 0x41bc15
mov ecx, edx
shr ecx, 2
mov dword [esi + 0x18], edx
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, dword [esi + 0x18]
mov edx, ecx
and edx, 0xfffffffc
add eax, edx
add edx, ebx
shr ecx, 1
and ecx, 1
mov ebx, edx
mov dword [esi + 0x20], eax
mov edi, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ebx, dword [esi + 0x18]
test bl, 1
je 0x41bc15
and ebx, 2
movzx ecx, byte [edx + ebx]
mov eax, dword [esi + 0x20]
mov byte [eax + ebx], cl
push dword [esi + 0xc]
call fcn.00408430
add esp, 4
mov eax, dword [esi + 0x1c]
mov dword [esi + 0xc], eax
mov ecx, dword [esi]
lea edx, [eax + ecx]
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
add edx, eax
mov dword [esi + 0x14], edx
mov byte [eax + ecx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov word [esi + 0x30], 0x1715
mov byte [esi + 0x32], 0xe
lea ecx, [esi + 0x33]
mov byte [ecx + 4], 0
mov dword [ecx], 0
mov ecx, 0xc701fa42
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + ecx + 0x38fe05ee]
xor edx, ecx
add edx, 0x1cf61cb5
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov byte [esi + ecx + 0x38fe05ee], dl
inc ecx
cmp ecx, 0xc701fa4a
jne 0x41bc70
xor ecx, ecx
nop
nop
nop
movzx ebx, byte [eax + ecx]
mov bh, byte [esi + ecx + 0x30]
test bl, bl
je 0x41ba80
inc ecx
cmp bl, bh
je 0x41bca0
jmp 0x41ba80
push 0x3ea
call fcn.0041adc0
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41bce0
cmp eax, dword [esi + 0x10]
je 0x41bce0
push eax
call fcn.00408430
add esp, 4
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc