Function at 0x420450
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov esi, esp
mov ebx, ecx
mov dword [esi + 0xcc], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 2
mov dword [esi + 0xb8], 1
push 0xc904973f
push dword [0x44cb08]
call fcn.00440d30
add esp, 8
lea ecx, [esi + 0x28]
lea edx, [esi + 0xb0]
push ecx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test eax, eax
mov dword [esi + 0x18], ebx
je 0x4204ee
cmp dword [ebx], 0xffffffff
jne 0x42059b
jmp 0x420a44
push 0x39be051d
push dword [0x44cb08]
call fcn.00440d30
add esp, 8
mov dword [esi], eax
push 0x847b02a2
push dword [0x44cb08]
call fcn.00440d30
add esp, 8
mov dword [esi + 8], eax
push 0x2e775759
push dword [0x44cb08]
call fcn.00440d30
add esp, 8
mov dword [esi + 4], eax
mov ebx, dword [esi + 0x28]
test ebx, ebx
je 0x420577
mov edi, dword [esi + 0x18]
jmp 0x420547
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x420577
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esi]
mov ecx, dword [esi + 0x18]
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x420540
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esi + 8]
test eax, eax
je 0x420577
push dword [edi]
call dword [esi + 4]
mov dword [edi], 0xffffffff
jmp 0x420540
push 0x18c354a9
push dword [0x44cb08]
call fcn.00440d30
add esp, 8
push dword [esi + 0x28]
call eax
mov ebx, dword [esi + 0x18]
cmp dword [ebx], 0xffffffff
je 0x420a44
mov ecx, dword [ebp + 0x10]
mov eax, 0x8d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ecx + eax - 0x8d], 0
lea eax, [eax + 1]
jne 0x4205b0
mov edx, dword [ebp + 8]
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x4205c0
mov edx, dword [ebp + 0xc]
nop
nop
nop
nop
inc eax
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x4205d0
add eax, 3
and eax, 0xfffffffc
call fcn.004086c0
mov edi, esp
and edi, 0xfffffff0
mov esp, edi
mov dword [esi + 0x30], 0x252a27fc
mov dword [esi + 0x34], 0xcbc1c220
mov dword [esi + 0x38], 0x31ece8c7
mov dword [esi + 0x3c], 0xc71e1e19
mov dword [esi + 0x40], 0x8fec
xor eax, eax
mov edx, eax
xor edx, 0xda
mov ebx, eax
or ebx, 0x25
and edx, ebx
add edx, ebx
xor dl, byte [esi + eax + 0x30]
add dl, 0x47
mov byte [esi + eax + 0x30], dl
inc eax
cmp eax, 0x14
jne 0x420610
mov dword [esi + 0xc], 0x493e202d
mov byte [esi + 0x10], 0x68
mov dword [esi + 0x11], 0
mov byte [esi + 0x15], 0
mov eax, 0x67
nop
nop
nop
movzx ebx, byte [esi + eax - 0x5b]
lea edx, [eax - 0x6e221d00]
or edx, ebx
and ebx, eax
sub edx, ebx
lea ebx, [edx + 0x60]
xor ebx, 0x64
and edx, 0x1b
add edx, edx
sub edx, ebx
inc dl
mov byte [esi + eax - 0x5b], dl
inc eax
cmp eax, 0x71
jne 0x420650
movzx eax, byte [esi + 0xc]
mov ebx, edi
test al, al
je 0x42069b
lea edx, [esi + 0xd]
mov ebx, edi
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x420690
mov byte [ebx], 0
movzx eax, byte [ecx]
test al, al
je 0x4206bd
inc ecx
mov edx, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4206b0
jmp 0x4206c0
mov edx, dword [ebp + 8]
mov byte [ebx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x4206db
lea ecx, [esi + 0x31]
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4206d0
mov byte [ebx], 0
movzx eax, byte [edx]
test al, al
mov dword [esi + 4], edi
je 0x4206fb
inc edx
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x4206f0
mov dword [esi + 0x1c], ebx
mov byte [ebx], 0x3a
mov dword [esi + 0x30], 0xa199c5c3
mov dword [esi + 0x34], 0xb1b1a1b9
mov dword [esi + 0x38], 0xa0f6edb3
mov dword [esi + 0x3c], 0xacafb9bf
mov dword [esi + 0x40], 0x95b9b2b9
mov dword [esi + 0x44], 0x94a7e9ef
mov dword [esi + 0x48], 0x8c81898a
mov dword [esi + 0x4c], 0x839b809c
mov dword [esi + 0x50], 0x81b9cfd6
mov dword [esi + 0x54], 0x91918199
mov dword [esi + 0x58], 0xacfcf893
mov dword [esi + 0x5c], 0xa4d59e9f
mov dword [esi + 0x60], 0x70ab9d9b
mov dword [esi + 0x64], 0x71656e65
mov dword [esi + 0x68], 0x72614a2b
mov dword [esi + 0x6c], 0x58422b32
mov dword [esi + 0x70], 0x216b7d63
mov dword [esi + 0x74], 0x4e7e5c65
mov dword [esi + 0x78], 0x50557a43
mov dword [esi + 0x7c], 0x4c2d7477
mov dword [esi + 0x80], 0x13576f4c
mov dword [esi + 0x84], 0x7c6b4068
mov dword [esi + 0x88], 0x23291849
mov dword [esi + 0x8c], 0x24f4c7d
mov dword [esi + 0x90], 0x644c4875
mov dword [esi + 0x94], 0x525f5641
mov dword [esi + 0x98], 0x5e601840
mov dword [esi + 0x9c], 0x4c514e4a
mov dword [esi + 0xa0], 0x721e0552
mov dword [esi + 0xa4], 0x4a484c75
mov word [esi + 0xa8], 0x474e
mov dword [esi + 0xaa], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esi], eax
movzx edi, byte [esi + ecx + 0x30]
mov dword [esi + 8], edi
mov eax, dword [esi]
and eax, 0x9a
mov edx, ecx
xor edx, 0x7517f9cd
add edx, eax
mov eax, edx
and eax, edi
mov ebx, eax
and ebx, 0xfffffffd
mov edi, eax
or edi, 0xfffffffd
inc edi
imul edi, ebx
mov ebx, eax
and ebx, 2
or eax, 2
imul eax, ebx
sub edi, eax
add edx, dword [esi + 8]
add edx, edi
mov eax, edx
xor eax, 2
and edx, 0x7d
add edx, edx
sub edx, eax
mov eax, dword [esi]
inc dl
mov byte [esi + ecx + 0x30], dl
inc ecx
add eax, 2
cmp ecx, 0x7e
jne 0x420810
mov edx, dword [esi + 0x1c]
inc edx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x42088b
inc ecx
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x420880
mov byte [edx], 0
movzx eax, byte [esi + 0x30]
test al, al
je 0x4208ab
lea ecx, [esi + 0x31]
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4208a0
mov byte [edx], 0
mov edi, edx
mov ebx, dword [esi + 4]
sub edi, ebx
push 0xd0026952
push dword [0x44cb08]
call fcn.00440d30
add esp, 8
push 0
push edi
push ebx
mov edi, dword [esi + 0x18]
push dword [edi]
call eax
cmp eax, 0xffffffff
jne 0x42091a
cmp dword [edi], 0xffffffff
je 0x42091a
push 0x59ea2086
push dword [0x44cb08]
call fcn.00440d30
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44cb08]
call fcn.00440d30
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
xor eax, eax
jmp 0x420e06
cmp eax, 0xffffffff
je 0x420a44
push 0x400
call fcn.004087e0
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add eax, 0x400
mov dword [esi + 0x14], eax
lea eax, [esi + 0xc]
mov ecx, edi
push eax
call fcn.00420e10
mov cl, 1
mov dword [esi + 8], ecx
test al, al
je 0x420dee
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov ebx, ecx
sub ebx, eax
cmp ecx, dword [esi + 0x14]
jne 0x420aac
mov dword [esi + 8], ecx
mov dword [esi], eax
lea eax, [ebx + 1]
mov ecx, ebx
shr ecx, 1
mov dword [esi + 0x20], ecx
lea edi, [ecx + ebx]
cmp edi, eax
ja 0x420981
mov edi, eax
push edi
call fcn.004087e0
add esp, 4
mov ecx, dword [esi]
test ecx, ecx
je 0x420a9e
mov dword [esi + 0x24], edi
cmp eax, ecx
mov dword [esi + 4], ebx
mov edx, dword [esi + 8]
mov dword [esi + 0x1c], eax
jbe 0x420a4b
cmp edx, eax
jbe 0x420a4b
test ebx, ebx
je 0x420a8a
mov edx, dword [esi + 4]
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esi + 0x1c]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x4209e3
neg edi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x4209d0
add eax, edx
add ecx, edx
add edx, dword [esi + 4]
mov edi, dword [esi]
sub edi, dword [esi + 8]
cmp edi, 0xfffffff8
ja 0x420a8a
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x4209f5
jmp 0x420a8a
xor eax, eax
jmp 0x420e06
mov edx, ecx
mov ecx, ebx
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
lea edi, [eax + edx]
add edx, dword [esi]
mov ecx, dword [esi + 0x20]
and ecx, 1
mov eax, ebx
mov ebx, edx
mov dword [esi], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x420a8a
mov ecx, dword [esi + 4]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.004087f0
add esp, 4
mov ebx, dword [esi + 4]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0xc], eax
lea ecx, [eax + ebx]
mov dword [esi + 0x10], ecx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ebx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x30], 0xc1babb44
mov dword [esi + 0x34], 0x261c2021
mov dword [esi + 0x38], 0x2a262414
mov byte [esi + 0x3c], pe_nt_image_headers32
mov dword [esi + 0x3d], 0
mov word [esi + 0x41], 0
mov ecx, 0x3d
mov edx, 0xc2
nop
nop
nop
nop
mov edi, edx
and edi, 0x83
mov ebx, ecx
and ebx, 0x7c
or ebx, edi
xor bl, byte [esi + ecx - 0xd]
xor bl, 0x83
add bl, 0xcf
mov byte [esi + ecx - 0xd], bl
inc ecx
dec edx
cmp ecx, 0x50
jne 0x420af0
movzx edx, byte [esi + 0x30]
mov ecx, eax
mov dword [esi + 8], eax
test dl, dl
je 0x420b57
lea ebx, [esi + 0x30]
mov ecx, eax
mov edi, eax
mov dword [esi + 8], eax
jmp 0x420b37
movzx edx, byte [ebx]
test dl, dl
je 0x420b57
mov dh, byte [ecx]
test dh, dh
je 0x420dda
inc ecx
inc ebx
mov edi, dword [esi + 8]
inc edi
cmp dh, dl
je 0x420b50
mov ecx, edi
mov dword [esi + 8], edi
je 0x420b30
lea ebx, [esi + 0x30]
jmp 0x420b30
cmp dword [esi + 8], 0
je 0x420dda
mov ebx, dword [esi + 0x18]
jmp 0x420b78
cmp dl, dh
je 0x420dee
mov edx, dword [esi]
cmp eax, edx
je 0x420bcd
mov ebx, edx
sub ebx, eax
jbe 0x420b90
jae 0x420b90
cmp edx, edx
je 0x420bb6
dec eax
dec edx
jmp 0x420bb1
mov edx, dword [esi]
mov edi, eax
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, dword [esi]
mov edi, eax
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov edx, dword [esi]
mov cl, 1
test cl, cl
jne 0x420bb6
movzx ecx, byte [edx]
mov byte [eax], cl
lea eax, [ebx - 0x576ea627]
mov ecx, dword [esi + 0x10]
sub ecx, eax
add ecx, 0xa89159d9
mov dword [esi + 0x10], ecx
mov ebx, dword [esi + 0x18]
mov ecx, ebx
lea eax, [esi + 0xc]
push eax
call fcn.00420e10
test al, al
je 0x420de7
mov dword [esi + 8], eax
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov ecx, edx
sub ecx, eax
cmp edx, dword [esi + 0x14]
jne 0x420d51
mov dword [esi + 0x1c], edx
mov dword [esi + 4], eax
lea eax, [ecx + 1]
mov edx, ecx
shr edx, 1
mov dword [esi], ecx
mov dword [esi + 0x24], edx
lea edi, [edx + ecx]
cmp edi, eax
ja 0x420c11
mov edi, eax
push edi
call fcn.004087e0
add esp, 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x420d41
mov dword [esi + 0x2c], edi
cmp eax, ecx
mov ebx, eax
mov edx, dword [esi]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x20], ebx
jbe 0x420cef
cmp eax, ebx
jbe 0x420cef
test edx, edx
je 0x420d2d
mov edx, dword [esi]
mov eax, dword [esi + 4]
add eax, edx
dec eax
mov ecx, dword [esi + 0x20]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x420c82
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x420c70
add eax, edx
add ecx, edx
add edx, dword [esi]
mov edi, dword [esi + 4]
sub edi, dword [esi + 0x1c]
cmp edi, 0xfffffff8
ja 0x420d2d
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x420ca0
jmp 0x420d2d
mov ecx, edx
shr ecx, 2
mov eax, dword [esi + 4]
mov edi, ebx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, edx
and edx, 0xfffffffc
lea edi, [ebx + edx]
add edx, dword [esi + 4]
mov ecx, dword [esi + 0x24]
and ecx, 1
mov ebx, edx
mov dword [esi + 4], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x420d2d
mov ecx, dword [esi]
and ecx, 2
movzx edx, byte [edx + ecx]
mov eax, dword [esi + 4]
mov byte [eax + ecx], dl
push dword [esi + 0xc]
call fcn.004087f0
add esp, 4
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x20]
mov dword [esi + 0xc], eax
mov ecx, dword [esi]
lea edx, [eax + ecx]
mov dword [esi + 0x10], edx
add edi, eax
mov dword [esi + 0x14], edi
mov byte [eax + ecx], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov word [esi + 0x30], 0xefed
mov byte [esi + 0x32], 0xf6
lea ecx, [esi + 0x33]
mov byte [ecx + 2], 0
mov word [ecx], 0
mov ecx, 0xbbd6c756
nop
nop
nop
nop
movzx edx, byte [esi + ecx + 0x442938da]
xor edx, ecx
add edx, 0x54ce1b51
mov edi, edx
and edi, 0x77
xor edx, 0xf7
lea edx, [edx + edi*2]
add dl, 0xa
mov byte [esi + ecx + 0x442938da], dl
inc ecx
cmp ecx, 0xbbd6c75c
jne 0x420d80
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax + ecx]
mov dh, byte [esi + ecx + 0x30]
test dl, dl
je 0x420b70
inc ecx
cmp dl, dh
je 0x420dc0
jmp 0x420b70
mov ecx, dword [esi + 0x18]
push 0x3ea
call fcn.004201b0
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x420e03
cmp eax, dword [esi + 0x10]
je 0x420e03
push eax
call fcn.004087f0
add esp, 4
mov eax, dword [esi + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc