Function at 0x469af0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1f8
mov edi, edx
mov edx, dword [ebp + 0x10]
mov esi, ecx
mov eax, 0x1445247
mov ecx, 0x4e574f44
mov ebx, dword [ebp + 8]
mov dword [esp], edi
movsd xmm1, qword [edx + 0x24]
movq xmm0, qword [edx + 0x2c]
movq xmm2, qword [edx + 0x14]
movsd qword [edi + 0x90], xmm1
movq xmm1, qword [edx + 0x1c]
movq qword [edi + 0x98], xmm0
movq qword [edi + 0x80], xmm2
movq qword [edi + 0x88], xmm1
xor eax, dword [edi + 0x9c]
xor ecx, dword [edi + 0x98]
or ecx, eax
mov ah, byte [ebp + 0x14]
sete cl
test cl, ah
je 0x469bbf
mov word [esp + 0x10c], 4
mov dword [esp + 0x90], 0x80000001
mov dword [esp + 0x94], 0xd0001
xor eax, eax
lea edx, [esp + 0x90]
mov ecx, ebx
cmp byte [ebx + 0x31], 2
sete al
push eax
call fcn.00456630
add esp, 4
mov byte [ebx + 0x249], 1
mov word [esi], 9
mov esi, dword [edi + 0xd0]
xor ebx, ebx
lock dec dword [esi]
je 0x469cbd
jmp 0x469cc8
mov ecx, dword [edx + 8]
mov eax, dword [edx + 4]
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x469c46
lea esi, [ecx*4]
lea edx, [eax + 0x10]
mov edi, 0x3f7f
lea esi, [esi + esi*4]
jmp 0x469bf8
add edx, 0x14
add esi, 0xffffffec
je 0x469c46
movzx ebx, word [edx - 0x10]
bt edi, ebx
jb 0x469bf0
cmp ebx, 0xe
jne 0x469c0c
cmp word [edx], 0x13
jne 0x469bf0
mov edi, dword [esp]
mov dl, 1
mov dword [esp + 0xc], edx
mov byte [edi + 0xd4], 1
mov esi, dword [edi + 0xd0]
test ecx, ecx
mov dword [esp + 4], esi
jne 0x469d7a
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
jmp 0x469e03
mov edi, dword [esp]
mov byte [edi + 0xd4], 0
mov esi, dword [edi + 0xd0]
cmp byte [esi + 0xb7], 0
je 0x469d66
mov ebx, dword [ebp + 8]
mov word [esp + 0x10c], 4
mov dword [esp + 0x90], 0x80000001
mov dword [esp + 0x94], 0x60001
xor eax, eax
lea edx, [esp + 0x90]
cmp byte [ebx + 0x31], 2
mov ecx, ebx
sete al
push eax
call fcn.00456630
add esp, 4
mov eax, dword [esp + 0x10]
mov byte [ebx + 0x249], 1
mov byte [eax], 8
mov dword [eax + 4], 0x80000002
xor ebx, ebx
lock dec dword [esi]
jne 0x469cc8
lea ecx, [edi + 0xd0]
call fcn.00464a30
xor eax, eax
cmp eax, dword [edi + 8]
seto al
or bl, al
jne 0x469cdb
mov ecx, edi
call fcn.00460570
cmp byte [edi + 0xbc], 0
jne 0x469d04
test dword [edi + 0xc0], 0x7fffffff
je 0x469d04
push dword [edi + 0xc4]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [edi + 0xb4]
mov edi, dword [edi + 0xb8]
mov eax, dword [edi]
test eax, eax
je 0x469d1c
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x469d3a
cmp dword [edi + 8], 9
jb 0x469d2b
mov esi, dword [esi - 4]
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp]
test dword [eax + 0xa0], 0x7fffffff
je 0x46a0d7
push dword [eax + 0xa4]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x46a0d7
mov dword [esp + 0xc], 0
test ecx, ecx
mov dword [esp + 4], esi
je 0x469c2e
shl ecx, 2
lea esi, [eax + 0x10]
lea edi, [ecx + ecx*4]
jmp 0x469d98
add esi, 0x14
add edi, 0xffffffec
je 0x469db8
movzx ebx, word [esi - 0x10]
lea edx, [ebx - 3]
cmp edx, 0xb
jb 0x469d90
cmp ebx, 2
jb 0x469d90
mov dl, 1
cmp ebx, 0xe
jne 0x469dba
cmp word [esi], 0x15
jne 0x469d90
jmp 0x469dba
xor edx, edx
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x10]
add eax, 0x10
lea ecx, [ecx + ecx*4]
mov esi, 0x3eff
jmp 0x469dd8
add eax, 0x14
add ecx, 0xffffffec
je 0x469df4
movzx edi, word [eax - 0x10]
mov bl, 1
mov dword [esp + 8], ebx
bt esi, edi
jb 0x469dd0
cmp edi, 0xe
jne 0x469dfc
cmp word [eax], 5
jne 0x469dd0
jmp 0x469dfc
mov dword [esp + 8], 0
mov edi, dword [esp]
mov esi, dword [esp + 4]
lea eax, [edi + 0x60]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
xor eax, eax
cmp eax, dword [edi + 8]
jo 0x469f69
mov esi, edi
lea edi, [esp + 0x120]
mov ecx, 0x18
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x174]
cmp eax, dword [edx + 0x54]
jne 0x469f56
lea edi, [edx + 0x34]
test eax, eax
je 0x46a0df
lea ecx, [eax - 0x21]
cmp ecx, 0xffffffe0
jb 0x46a52b
xor edx, edx
cmp eax, 8
mov ecx, 0
jb 0x469f39
xor edx, edx
cmp eax, 0x10
jae 0x469ec9
mov esi, ecx
mov ecx, eax
movzx edx, dl
and ecx, 0x38
movd xmm0, edx
nop word cs:[eax + eax]
nop
movq xmm1, qword [esp + esi + 0x154]
movq xmm2, qword [edi + esi]
add esi, 8
cmp ecx, esi
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x469e80
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd edx, xmm1
jmp 0x469f47
mov ecx, eax
pxor xmm0, xmm0
xor edx, edx
and ecx, 0x30
nop word cs:[eax + eax]
nop
movdqu xmm1, xmmword [esp + edx + 0x154]
movdqu xmm2, xmmword [edi + edx]
add edx, 0x10
cmp ecx, edx
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x469ee0
pshufd xmm1, xmm0, 0xee
cmp eax, ecx
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd edx, xmm0
je 0x469f4b
test al, 8
jne 0x469e66
movzx ebx, byte [edi + ecx]
xor bl, byte [esp + ecx + 0x154]
inc ecx
or dl, bl
cmp eax, ecx
jne 0x469f39
mov ebx, dword [ebp + 0xc]
test dl, dl
je 0x46a0df
lea ecx, [esp + 0x120]
call fcn.00460570
mov edi, dword [esp]
mov esi, dword [esp + 4]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, 0x100
mov byte [eax + 0x24f], 0
movzx eax, byte [0x6019e5]
call fcn.00499510
test eax, eax
je 0x46a52b
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], 0x80000000
mov edx, dword [ebp + 0x10]
movsd xmm0, qword [ecx + 0x38]
movsd qword [eax + 0x98], xmm0
movsd xmm0, qword [ecx + 0x30]
movsd qword [eax + 0x90], xmm0
movsd xmm0, qword [ecx + 0x28]
movsd qword [eax + 0x88], xmm0
movsd xmm0, qword [ecx + 0x20]
movsd qword [eax + 0x80], xmm0
movsd xmm0, qword [ecx + 0x18]
movsd qword [eax + 0x78], xmm0
movsd xmm0, qword [ecx + 0x10]
movsd qword [eax + 0x70], xmm0
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [eax + 0x68], xmm1
movsd qword [eax + 0x60], xmm0
movsd xmm0, qword [edi + 0xa0]
movsd xmm1, qword [edi + 0xa8]
movsd qword [eax + 0xa0], xmm0
movsd qword [eax + 0xa8], xmm1
movsd xmm0, qword [edi + 0xb0]
movsd qword [eax + 0xb0], xmm0
mov ecx, dword [edi + 0xb8]
mov dword [eax + 0xb8], ecx
movsd xmm1, qword [edi + 0xc4]
movsd xmm0, qword [edi + 0xbc]
movsd qword [eax + 0xc4], xmm1
mov ecx, dword [edi + 0xcc]
movsd qword [eax + 0xbc], xmm0
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], esi
mov dword [eax + 0xd4], ebx
mov ecx, dword [edx + 0x54]
mov dword [eax + 0xf8], ecx
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [edx + 0x4c]
movsd qword [eax + 0xf0], xmm0
movsd xmm0, qword [edx + 0x44]
movsd qword [eax + 0xe8], xmm0
movq xmm0, qword [edx + 0x34]
movq xmm1, qword [edx + 0x3c]
movq qword [eax + 0xe0], xmm1
movq qword [eax + 0xd8], xmm0
mov byte [eax + 0xfc], cl
mov ecx, dword [esp + 8]
mov byte [eax + 0xfd], cl
mov ecx, dword [esp + 0x14]
mov byte [eax + 0xfe], cl
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0x5bb2f0
mov byte [ecx], 0x16
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x150]
mov al, 0x2c
movzx edx, word [ecx + 0x28]
cmp dx, word [ebx + 0x28]
jne 0x46a3d3
mov dword [esp + 8], edi
mov edi, dword [esp]
mov esi, dword [esp + 4]
movzx edx, dx
cmp edx, 0x178
jne 0x46a11a
movzx ecx, word [ecx + 0x2a]
cmp cx, word [ebx + 0x2a]
jne 0x46a3da
mov ecx, dword [esp + 0xc]
mov al, 0x2d
cmp byte [esp + 0x178], cl
jne 0x46a3da
cmp dword [esp + 0x13c], 0x30
jne 0x46a52b
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x20]
movsd xmm0, qword [edx + 0x38]
movsd xmm1, qword [edx + 8]
movsd qword [esp + 0x58], xmm0
movsd xmm0, qword [edx + 0x30]
movsd qword [esp + 0x28], xmm1
movsd qword [esp + 0x50], xmm0
movsd xmm0, qword [edx + 0x28]
movsd qword [esp + 0x48], xmm0
movsd xmm0, qword [edx + 0x20]
movsd qword [esp + 0x40], xmm0
movsd xmm0, qword [edx + 0x18]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [edx + 0x10]
movsd qword [esp + 0x30], xmm0
movsd xmm0, qword [edx]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [ecx + 0x28]
movsd qword [esp + 0x88], xmm0
movsd xmm0, qword [ecx + 0x20]
movsd qword [esp + 0x80], xmm0
movsd xmm0, qword [ecx + 0x18]
movsd qword [esp + 0x78], xmm0
movsd xmm0, qword [ecx + 0x10]
movsd qword [esp + 0x70], xmm0
movsd xmm0, qword [ecx]
movq xmm1, qword [ecx + 8]
movq qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm0
mov ecx, dword [esi + 0x90]
mov edx, dword [esi + 0x8c]
mov esi, dword [ecx + 8]
dec esi
and esi, 0xfffffff8
lea edx, [edx + esi + 8]
lea esi, [esp + 0x60]
push 0x30
push esi
push 0x20
push eax
push 0xd
push str.CLIENT_RANDOM
push edx
call dword [ecx + 0x18]
add esp, 0x1c
mov edi, dword [ebp + 8]
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.00479120
mov edx, dword [esp + 0x144]
lea esi, [esp + 0x90]
mov ecx, esi
push dword [esp + 0x148]
call fcn.00460b60
add esp, 4
lea ecx, [esp + 0x180]
mov edx, esi
call fcn.0044d610
lea ecx, [edi + 0x220]
call fcn.0044d6c0
mov eax, dword [esp + 0x188]
cmp byte [esp + 0x14], 0
mov dword [edi + 0x228], eax
movq xmm0, qword [esp + 0x180]
movq qword [edi + 0x220], xmm0
mov byte [edi + 0x24f], 2
je 0x46a400
mov edx, dword [esp]
lea edi, [esp + 0x90]
mov ecx, 0x18
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x180]
lea esi, [esp + 0x1c]
mov ecx, 0x1d
movsd xmm1, qword [edx + 0xc4]
mov eax, dword [edx + 0xcc]
movq xmm0, qword [edx + 0xbc]
movq xmm2, qword [edx + 0xa0]
movsd qword [esp + 0x114], xmm1
movsd xmm1, qword [edx + 0xa8]
mov dword [esp + 0x11c], eax
movq qword [esp + 0x10c], xmm0
mov eax, dword [edx + 0xb8]
movq qword [esp + 0xf0], xmm2
movsd qword [esp + 0xf8], xmm1
movq xmm1, qword [edx + 0xb0]
mov dword [esp + 0x108], eax
mov edx, 0x130
movq qword [esp + 0x100], xmm1
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [0x6019e5]
xor ecx, ecx
call fcn.00499510
test eax, eax
je 0x46a52b
mov ebx, eax
push 0x90
lea eax, [esp + 0x94]
push eax
push ebx
call fcn.004ef180
add esp, 0xc
mov eax, dword [esp + 4]
mov edi, ebx
lea esi, [esp + 0x180]
mov ecx, 0x1d
add edi, 0x94
mov dword [ebx + 0x90], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 8]
mov eax, dword [ecx + 0x20]
mov dword [ebx + 0x128], eax
mov eax, dword [esp + 0xc]
movsd xmm0, qword [ecx + 0x18]
movsd qword [ebx + 0x120], xmm0
movsd xmm0, qword [ecx + 0x10]
movsd qword [ebx + 0x118], xmm0
movq xmm0, qword [ecx]
movq xmm1, qword [ecx + 8]
movq qword [ebx + 0x110], xmm1
movq qword [ebx + 0x108], xmm0
mov byte [ebx + 0x12c], al
mov byte [ebx + 0x12d], 1
mov eax, 0x5bb2cc
jmp 0x46a51c
mov edi, dword [esp]
mov esi, dword [esp + 4]
mov ecx, dword [esp + 0x10]
mov byte [ecx], 9
mov byte [ecx + 1], al
lea ecx, [esp + 0x120]
call fcn.00460570
mov bl, 1
lock dec dword [esi]
je 0x469cbd
jmp 0x469cc8
lea edi, [esp + 0x90]
lea esi, [esp + 0x1c]
mov ecx, 0x1d
mov edx, 0x140
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [0x6019e5]
xor ecx, ecx
call fcn.00499510
test eax, eax
je 0x46a52b
mov edx, dword [esp]
mov dword [eax], 0x80000000
lea edi, [eax + 0x10]
mov ecx, 0x18
mov ebx, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
lea esi, [esp + 0x90]
mov ecx, 0x1d
mov eax, dword [edx + 0xb8]
add edi, 0xa4
mov dword [ebx + 0x88], eax
movsd xmm0, qword [edx + 0xb0]
movsd qword [ebx + 0x80], xmm0
movsd xmm0, qword [edx + 0xa0]
movsd xmm1, qword [edx + 0xa8]
movsd qword [ebx + 0x78], xmm1
movsd qword [ebx + 0x70], xmm0
movsd xmm0, qword [edx + 0xbc]
movsd xmm1, qword [edx + 0xc4]
movsd qword [ebx + 0x8c], xmm0
movsd qword [ebx + 0x94], xmm1
mov eax, dword [edx + 0xcc]
mov dword [ebx + 0x9c], eax
mov eax, dword [esp + 4]
mov dword [ebx + 0xa0], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 8]
mov eax, dword [ecx + 0x20]
mov dword [ebx + 0x138], eax
mov eax, dword [esp + 0xc]
movsd xmm0, qword [ecx + 0x18]
movsd qword [ebx + 0x130], xmm0
movsd xmm0, qword [ecx + 0x10]
movsd qword [ebx + 0x128], xmm0
movq xmm0, qword [ecx]
movq xmm1, qword [ecx + 8]
movq qword [ebx + 0x120], xmm1
movq qword [ebx + 0x118], xmm0
mov byte [ebx + 0x13c], al
mov eax, 0x5bb2a8
mov byte [ebx + 0x13d], 1
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
jmp 0x46a0d4
ud2