Function at 0x4f2020
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x7b0
mov esi, esp
mov dword [esi + 0x798], ebp
mov dword [esi + 0x79c], esp
mov dword [esi + 0x7a8], 0xffffffff
mov dword [esi + 0x7a4], 0x579160
mov ebx, ecx
mov eax, dword fs:[0]
mov dword [esi + 0x7a0], eax
lea eax, [esi + 0x7a0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4f2090
shl eax, 4
mov edi, edx
lea ecx, [edx + eax]
mov dword [esi], ecx
mov ecx, edx
nop
test eax, eax
je 0x4f20aa
add eax, 0xfffffff0
cmp dword [ecx + 8], 0
lea ecx, [ecx + 0x10]
jne 0x4f2080
mov dword [ebx], 0x80000007
mov eax, dword [esi + 0x7a0]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esi + 4], ebx
cmp eax, 1
jne 0x4f20ce
mov eax, dword [edi + 8]
mov edx, dword [edi + 4]
cmp eax, 1
jne 0x4f210c
movzx eax, byte [edx]
mov dword [ebx], 0x80000000
mov byte [ebx + 4], al
jmp 0x4f2096
cmp eax, 2
jne 0x4f2173
xor eax, eax
cmp dword [edi + 8], 1
jne 0x4f21b9
cmp dword [edi + 0x18], 1
mov ecx, 0
jne 0x4f21bb
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0x14]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
mov dword [ebx], 0x80000001
mov byte [ebx + 4], al
mov byte [ebx + 5], cl
jmp 0x4f2096
mov dword [esi + 0x7a8], 0xffffffff
lea ecx, [esi + 0x50]
push eax
call fcn.004f8ce0
add esp, 4
mov edx, dword [esi + 0x8c]
mov edi, dword [esi + 0x90]
cmp dword [esi + 0x88], 0
jne 0x4f28dc
test edi, edi
je 0x4f28c7
mov dword [esi], edx
js 0x4f2a1c
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, edi
call fcn.0056a9f0
mov edx, dword [esi]
mov ebx, eax
test eax, eax
jne 0x4f28cc
mov ecx, 1
mov edx, edi
call fcn.0057f230
mov ecx, eax
xor eax, eax
cmp ecx, 3
jne 0x4f21b9
cmp dword [edi + 8], 1
jne 0x4f21b9
cmp dword [edi + 0x18], 1
jne 0x4f21b9
cmp dword [edi + 0x28], 1
mov ecx, 0
jne 0x4f21bb
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0x24]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
movzx edx, byte [edx]
shl ecx, 0x10
shl eax, 8
shl edx, 0x18
or eax, ecx
mov ecx, 1
or eax, edx
jmp 0x4f21bb
xor ecx, ecx
mov edx, eax
and edx, 1
or edx, ecx
je 0x4f21de
mov ecx, eax
shr eax, 0x18
mov dword [ebx], 0x80000002
shr ecx, 8
mov byte [ebx + 6], al
mov word [ebx + 4], cx
jmp 0x4f2096
mov eax, dword [ebp + 8]
mov ebx, dword [edi + 8]
xor ecx, ecx
mov dword [esi + 8], edi
lea edx, [eax + 0xfffffff]
mov eax, edx
and eax, 0xfffffff
cmp eax, 8
jb 0x4f2334
movd xmm0, ebx
and edx, 7
mov ecx, eax
add edi, 0x88
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x589850]
sub ecx, edx
mov ebx, ecx
movdqa xmm2, xmm1
nop word cs:[eax + eax]
nop dword [eax]
movd xmm3, dword [edi - 0x40]
movd xmm5, dword [edi - 0x50]
movd xmm4, dword [edi - 0x70]
movd xmm6, dword [edi - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [edi - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [edi]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edi - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [edi - 0x30]
sub edi, 0xffffff80
add ebx, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x4f2230
movdqa xmm4, xmm1
movdqa xmm3, xmm2
mov edi, dword [esi + 8]
test edx, edx
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ebx, xmm0
je 0x4f234d
sub eax, ecx
shl ecx, 4
lea ecx, [ecx + edi + 0x18]
nop dword [eax]
mov edx, dword [ecx]
cmp ebx, edx
cmovae ebx, edx
add ecx, 0x10
dec eax
jne 0x4f2340
mov ecx, dword [esi]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x238], 0x2020100
mov word [esi + 0x23c], 2
mov dword [esi + 0x214], 0
mov dword [esi + 0x218], 4
mov dword [esi + 0x21c], 0
mov dword [esi + 0x220], 0
mov dword [esi + 0x224], 4
mov dword [esi + 0x228], 0
mov dword [esi + 0x22c], 0xffffffff
mov dword [esi + 0x230], 0
mov byte [esi + 0x234], 0
xor eax, eax
mov ebx, edi
test al, al
jne 0x4f24e9
jmp 0x4f23df
movzx eax, byte [esi + 0x23d]
test al, al
jne 0x4f24e9
mov edi, dword [esi + 0x21c]
mov dword [esi + 0xc], ebx
cmp edi, 0x80
jb 0x4f2450
mov byte [esi + 0x23d], 1
mov byte [esi + 0x234], 0
mov ebx, dword [esi + 0x218]
mov dword [esi + 0x21c], 0
add ebx, 4
jmp 0x4f242a
add ebx, 0xc
dec edi
je 0x4f24d0
cmp dword [ebx - 4], 0
je 0x4f2420
push dword [ebx]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4f2420
mov eax, dword [ebx + 8]
test eax, eax
je 0x4f247a
mov edx, dword [ebx + 4]
lea ecx, [esi + 0x214]
mov dword [esi + 0x7a8], 0
push eax
call fcn.0045f200
mov ebx, dword [esi + 0xc]
add esp, 4
mov ecx, dword [esi]
jmp 0x4f24e9
mov byte [esi + 0x23d], 1
mov byte [esi + 0x234], 0
test edi, edi
mov ebx, dword [esi + 0x218]
mov dword [esi + 0x21c], 0
je 0x4f24d0
add ebx, 4
jmp 0x4f24b6
add ebx, 0xc
dec edi
je 0x4f24d0
cmp dword [ebx - 4], 0
je 0x4f24b0
push dword [ebx]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4f24b0
mov ecx, dword [esi]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x228], 0
mov dword [esi + 0x22c], 0xffffffff
add ebx, 0x10
cmp ebx, ecx
jne 0x4f23d0
lea ecx, [esi + 0x378]
lea edx, [esi + 0x214]
mov dword [esi + 0x7a8], 0
call fcn.0045cc10
mov eax, dword [esi + 0x378]
cmp eax, 0x80000000
jne 0x4f2575
mov eax, dword [esi + 0x218]
mov ebx, dword [esi + 0x21c]
mov dword [esi + 0x50], 0x80000000
mov dword [esi], eax
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x4f2601
mov ecx, dword [esi]
lea edi, [ecx + 4]
jmp 0x4f255a
add edi, 0xc
dec ebx
je 0x4f2601
cmp dword [edi - 4], 0
je 0x4f2550
push dword [edi]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x4f2550
movsd xmm2, qword [esi + 0x394]
movsd xmm1, qword [esi + 0x38c]
mov ecx, dword [esi + 0x3a4]
movq xmm0, qword [esi + 0x39c]
mov ebx, dword [esi + 0x21c]
movsd qword [esi + 0x3c], xmm2
movsd qword [esi + 0x34], xmm1
movq xmm2, qword [esi + 0x37c]
movq xmm1, qword [esi + 0x384]
mov dword [esi + 0x4c], ecx
movq qword [esi + 0x44], xmm0
test ebx, ebx
movq qword [esi + 0x2c], xmm1
movq qword [esi + 0x24], xmm2
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x218]
mov dword [esi], eax
mov eax, dword [ebp + 8]
je 0x4f2646
mov ecx, dword [esi]
lea edi, [ecx + 4]
jmp 0x4f25e6
add edi, 0xc
dec ebx
je 0x4f2646
cmp dword [edi - 4], 0
je 0x4f25e0
push dword [edi]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x4f25e0
cmp dword [esi + 0x214], 0
je 0x4f261d
push dword [esi]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
cmp dword [esi + 0x220], 0
mov edi, dword [esi + 4]
je 0x4f277e
push dword [esi + 0x224]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4f277b
cmp dword [esi + 0x214], 0
je 0x4f2662
push dword [esi]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
cmp dword [esi + 0x220], 0
mov edi, dword [esi + 8]
je 0x4f268f
push dword [esi + 0x224]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov dword [esi + 0x7a8], 1
mov dword [esi + 0x10], 3
mov byte [esi + 0x16], 0
mov word [esi + 0x14], 1
mov word [esi + 0x18], 0x102
mov dword [esi + 0x7a8], 1
lea ecx, [esi + 0x378]
lea edx, [esi + 0x10]
push eax
push edi
call fcn.005242b0
add esp, 8
cmp dword [esi + 0x378], 0
lea edi, [esi + 0x214]
jne 0x4f275b
lea eax, [esi + 0x37c]
push 0x164
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esi + 0x18]
movzx eax, byte [esi + 0x19]
mov dword [esi + 0x7a8], 2
lea ecx, [esi + 0x4e0]
push edi
push eax
call fcn.0044e7f0
add esp, 8
lea eax, [esi + 0x214]
mov dword [esi + 0x7a8], 1
push eax
call fcn.004f3710
add esp, 4
cmp dword [esi + 0x4e0], 0
jne 0x4f275b
mov edi, dword [esi + 0x4e4]
lea ebx, [esi + 0x640]
lea eax, [esi + 0x4e8]
push 0x158
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 0x80000000
jne 0x4f29b7
lea eax, [esi + 0x20]
mov dword [esi + 0x50], 0x80000000
mov dword [esi + 0x7a8], 0xffffffff
push eax
call fcn.0051bc10
add esp, 4
mov edi, dword [esi + 4]
mov eax, dword [ebp + 8]
cmp dword [esi + 0x50], 0x80000000
jne 0x4f2874
mov edi, dword [esi + 8]
pxor xmm0, xmm0
shl eax, 4
xor ecx, ecx
movdqa xmmword [esi + 0x140], xmm0
movdqa xmmword [esi + 0x130], xmm0
movdqa xmmword [esi + 0x120], xmm0
movdqa xmmword [esi + 0x110], xmm0
movdqa xmmword [esi + 0x100], xmm0
movdqa xmmword [esi + 0xf0], xmm0
movdqa xmmword [esi + 0xe0], xmm0
movdqa xmmword [esi + 0xd0], xmm0
movdqa xmmword [esi + 0xc0], xmm0
movdqa xmmword [esi + 0xb0], xmm0
movdqa xmmword [esi + 0xa0], xmm0
movdqa xmmword [esi + 0x90], xmm0
movdqa xmmword [esi + 0x80], xmm0
movdqa xmmword [esi + 0x70], xmm0
movdqa xmmword [esi + 0x60], xmm0
movdqa xmmword [esi + 0x50], xmm0
nop
cmp dword [edi + ecx + 8], 1
jne 0x4f288b
mov edx, dword [edi + ecx + 4]
add ecx, 0x10
cmp eax, ecx
movzx edx, byte [edx]
mov byte [esi + edx + 0x50], 1
lea edx, [esi + 0x378]
jne 0x4f2810
movzx ebx, byte [esi + 0x50]
lea eax, [esi + 0x51]
push 0xff
push eax
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp bl, 2
je 0x4f2895
mov edi, dword [esi + 4]
lea eax, [edi + 5]
push 0xff
lea ecx, [esi + 0x378]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi], 0x80000005
mov byte [edi + 4], bl
jmp 0x4f2096
lea eax, [esi + 0x50]
push 0x190
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x4f2096
mov dword [esi + 0x7a8], 0xffffffff
mov dword [esi + 0x7a8], 0xffffffff
lea ecx, [esi + 0x50]
mov edx, edi
push dword [ebp + 8]
call fcn.00523be0
add esp, 4
cmp byte [esi + 0x59], 3
jne 0x4f2999
mov eax, dword [esi + 4]
mov dword [eax], 0x80000007
jmp 0x4f2096
mov ebx, 1
push edi
push edx
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, ebx
mov ebx, dword [esi + 4]
movq xmm0, qword [esi + 0x50]
movq xmm1, qword [esi + 0x58]
movq xmm2, qword [esi + 0x60]
movq xmm3, qword [esi + 0x68]
movq xmm4, qword [esi + 0x70]
mov eax, dword [esi + 0x80]
movq xmm5, qword [esi + 0x78]
mov dword [ebx], 0x80000003
movq qword [esi + 0x74], xmm4
movq qword [esi + 0x6c], xmm3
movq qword [esi + 0x64], xmm2
movq qword [esi + 0x5c], xmm1
movq qword [esi + 0x54], xmm0
movq qword [esi + 0x1e8], xmm0
movq qword [esi + 0x1f0], xmm1
movq qword [esi + 0x1f8], xmm2
movq qword [esi + 0x200], xmm3
movq qword [esi + 0x208], xmm4
movsd xmm6, qword [esi + 0x50]
mov ecx, dword [esi + 0x78]
movq xmm7, qword [esi + 0x70]
movsd qword [ebx + 4], xmm6
movsd xmm6, qword [esi + 0x58]
mov dword [ebx + 0x2c], ecx
movq qword [ebx + 0x24], xmm7
movsd qword [ebx + 0xc], xmm6
movsd xmm6, qword [esi + 0x60]
movsd qword [ebx + 0x14], xmm6
movq xmm6, qword [esi + 0x68]
movq qword [ebx + 0x1c], xmm6
movq qword [ebx + 0x30], xmm5
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x40], 1
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edi
jmp 0x4f2096
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 4]
movq xmm0, qword [esi + 0x50]
mov dword [ecx + 0xc], eax
movq qword [ecx + 4], xmm0
mov dword [ecx], 0x80000006
jmp 0x4f2096
lea eax, [esi + 0x84]
push 0x158
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esi + 0x28]
movsd xmm2, qword [esi + 0x30]
movq xmm0, qword [esi + 0x20]
mov eax, dword [esi + 0x1c]
movsd qword [esi + 0x58], xmm1
movsd xmm1, qword [esi + 0x38]
movsd qword [esi + 0x60], xmm2
movq xmm2, qword [esi + 0x40]
movq qword [esi + 0x50], xmm0
movsd qword [esi + 0x68], xmm1
movq xmm1, qword [esi + 0x48]
movq qword [esi + 0x70], xmm2
movq qword [esi + 0x78], xmm1
mov dword [esi + 0x80], edi
mov dword [esi + 0x1dc], eax
jmp 0x4f2778
call fcn.004634e0
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
sub esp, 0xc
lea esi, [ebp - 0x7ac]
mov ebp, dword [esi + 0x798]
lea eax, [esi + 0x214]
push eax
call fcn.004f3710
add esp, 0x10
pop ebp
ret