Function at 0x413bb0
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x40], edi
jmp 0x413be8
rdtsc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
rdtsc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], edx
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
call ebx
mov esi, dword [ebp - 0x20]
and eax, 0x1f
mov ecx, 0x20
sub ecx, eax
shr esi, cl
call ebx
mov ecx, eax
mov eax, dword [ebp - 0x24]
and ecx, 0x1f
shl eax, cl
or esi, eax
call ebx
mov edx, dword [edi]
xor esi, eax
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
mov dword [ebp - 0x38], esi
call dword [edx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [0x7ffe0018]
mov eax, dword [0x7ffe001c]
mov dword [ebp - 0x30], ecx
cmp edx, eax
mov ecx, 0x7ffe0014
je 0x413c67
mov eax, dword [0x7ffe0018]
mov edx, dword [0x7ffe001c]
cmp eax, edx
jne 0x413c58
mov eax, dword [0x7ffe0018]
mov ecx, dword [ecx]
push 0
push 0x3e8
push eax
push ecx
call fcn.00415f00
push 0
push 0x3e8
push edx
push eax
call fcn.00415f00
push 0
push 0xa
push edx
push eax
call fcn.00415f00
mov esi, eax
mov dword [ebp - 0x28], esi
rdtsc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], edx
rdtsc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], edx
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
shl ebx, 0xc
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, 0xff54a32b
xor edx, 0xc7ffffff
shl ecx, 7
shr edx, 0x19
or ecx, edx
add ecx, 0x53a7321b
mov dword [edi + 0x10], ecx
rdtsc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], edx
rdtsc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x34]
mov edi, dword [edi + 4]
xor ecx, 0xffffc7ff
shl edx, 0x17
mov eax, dword [edi]
or edx, 0x280
shr ecx, 9
xor edx, 0xaa519580
and ecx, 0x7f
or edx, ecx
mov ecx, edi
add edx, 0x53a7321b
push edx
call dword [eax + 8]
mov eax, dword [ebp - 0x20]
xor edi, edi
xor edx, edx
mov dword [ebp - 0x24], edi
mov ecx, dword [eax + 0x18]
add eax, 0x1c
mov dword [ebp - 0x34], eax
mov eax, ecx
shr eax, 2
test eax, eax
jle 0x413d59
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], edi
mov edi, eax
mov eax, dword [ebp - 0x3c]
add edx, dword [eax]
add eax, 4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
jne 0x413d45
and ecx, 3
jle 0x413d78
mov eax, dword [ebp - 0x34]
lea esi, [eax + edi*4]
mov eax, ecx
lea edi, [ebp - 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], 4
lea edi, [ecx + edx]
jmp 0x413d8a
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, esi
mov edx, esi
neg eax
xor edx, ecx
and eax, 0x1f
mov ecx, 0x20
mov esi, edx
sub ecx, eax
shr esi, cl
mov ecx, eax
mov eax, ebx
shl edx, cl
mov ecx, dword [ebp - 0x28]
neg eax
and eax, 0x1f
or esi, edx
mov edx, ebx
xor edx, ecx
mov ecx, 0x20
mov dword [ebp - 0x30], esi
sub ecx, eax
mov esi, edx
shr esi, cl
mov ecx, eax
shl edx, cl
mov ecx, 0x20
or esi, edx
mov dword [ebp - 0x28], esi
mov esi, dword [ebp - 0x2c]
mov eax, esi
mov edx, esi
neg eax
and eax, 0x1f
xor edx, ebx
sub ecx, eax
mov ebx, edx
shr ebx, cl
mov ecx, eax
mov eax, edi
shl edx, cl
neg eax
and eax, 0x1f
mov ecx, 0x20
sub ecx, eax
or ebx, edx
mov edx, edi
xor edx, esi
mov esi, edx
shr esi, cl
mov ecx, eax
shl edx, cl
mov ecx, dword [ebp - 0x30]
mov eax, ecx
neg eax
or esi, edx
mov edx, edi
xor edx, ecx
and eax, 0x1f
mov ecx, 0x20
mov dword [ebp - 0x2c], esi
sub ecx, eax
mov esi, edx
shr esi, cl
mov ecx, eax
mov eax, dword [ebp - 0x24]
shl edx, cl
or esi, edx
dec eax
mov edi, esi
mov dword [ebp - 0x24], eax
jne 0x413d87
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi + 4], eax
xor eax, eax
mov dword [ebp - 0x5b], eax
mov dword [esi], edx
mov dword [ebp - 0x57], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edi
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x53], eax
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x4f], eax
lea ecx, [ebp - 0x5c]
push 0xa
mov dword [ebp - 0x4b], eax
push ecx
push edx
mov byte [ebp - 0x64], 0x24
mov byte [ebp - 0x63], 0x37
mov byte [ebp - 0x62], 0x4a
mov byte [ebp - 0x61], 0x64
mov byte [ebp - 0x60], 0x59
mov byte [ebp - 0x5f], 0x73
mov byte [ebp - 0x5e], 0x4b
mov byte [ebp - 0x5d], 0x40
mov byte [ebp - 0x5c], 0
mov byte [ebp - 0x47], al
call dword [sym.imp.MSVCRT.dll__itoa]
lea edi, [ebp - 0x64]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp + eax - 0x164], al
inc eax
cmp eax, 0x100
jb 0x413eb5
xor edi, edi
xor edx, edx
xor eax, eax
mov cl, byte [ebp + eax - 0x164]
xor ebx, ebx
mov bl, byte [ebp + edi - 0x64]
mov byte [ebp - 0x34], cl
and ecx, 0xff
add ecx, edx
inc edi
lea edx, [ecx + ebx]
mov ecx, dword [ebp - 0x24]
cmp edi, ecx
jb 0x413eef
xor edi, edi
mov ecx, edx
and ecx, 0xff
inc eax
cmp eax, 0x100
mov bl, byte [ebp + ecx - 0x164]
lea ecx, [ebp + ecx - 0x164]
mov byte [ebp + eax - 0x165], bl
mov bl, byte [ebp - 0x34]
mov byte [ecx], bl
jb 0x413eca
mov eax, dword [ebp - 0x20]
xor ecx, ecx
test eax, eax
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x30], 0
jbe 0x413f94
inc byte [ebp - 0x30]
mov edx, dword [ebp - 0x30]
and edx, 0xff
mov al, byte [ebp + edx - 0x164]
lea edi, [ebp + edx - 0x164]
mov dl, byte [ebp - 0x28]
mov byte [ebp - 0x24], al
add dl, al
mov byte [ebp - 0x28], dl
mov edx, dword [ebp - 0x28]
and edx, 0xff
mov bl, byte [ebp + edx - 0x164]
lea edx, [ebp + edx - 0x164]
mov byte [edi], bl
mov bl, byte [ecx + esi]
mov byte [edx], al
mov eax, dword [ebp - 0x24]
xor edx, edx
and eax, 0xff
mov dl, byte [edi]
add eax, edx
and eax, 0xff
mov al, byte [ebp + eax - 0x164]
xor bl, al
mov eax, dword [ebp - 0x20]
mov byte [ecx + esi], bl
inc ecx
cmp ecx, eax
jb 0x413f2a
mov ecx, dword [ebp - 0x18]
lea edi, [ecx + ecx]
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_3
push edi
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call sub.MFC42.DLL_CString::GetBuffer
mov edx, dword [ebp - 0x18]
push eax
push edx
push esi
call fcn.00412f90
add esp, 0x10
lea ecx, [ebp - 0x14]
push 0xffffffffffffffff
call sub.MFC42.DLL_CString::ReleaseBuffer
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
lea edx, [ebp - 0x1c]
push str.qms_skey_d
push edx
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::Format_1
add esp, 0x10
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x40]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
push ecx
mov ecx, edi
call fcn.00413a40
test al, al
jne 0x414025
mov esi, 0x65
jmp 0x41439e
mov edx, dword [ebp - 0x10]
mov esi, dword [edx - 8]
push esi
call sub.MFC42.DLL_operatornew
mov ebx, eax
mov eax, dword [ebp - 0x10]
push esi
push ebx
mov ecx, dword [eax - 8]
mov dword [ebp - 0x3c], ebx
push ecx
push eax
call fcn.004130b0
mov dword [ebp - 0x30], eax
xor eax, eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x5b], eax
mov dword [ebp - 0x57], eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x53], eax
push 0xa
mov dword [ebp - 0x4f], eax
push ecx
mov dword [ebp - 0x4b], eax
push edx
mov byte [ebp - 0x64], 0x24
mov byte [ebp - 0x63], 0x37
mov byte [ebp - 0x62], 0x4a
mov byte [ebp - 0x61], 0x64
mov byte [ebp - 0x60], 0x59
mov byte [ebp - 0x5f], 0x73
mov byte [ebp - 0x5e], 0x4b
mov byte [ebp - 0x5d], 0x40
mov byte [ebp - 0x5c], 0
mov byte [ebp - 0x47], al
call dword [sym.imp.MSVCRT.dll__itoa]
lea edi, [ebp - 0x64]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x20
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp + eax - 0x164], al
inc eax
cmp eax, 0x100
jb 0x4140a3
xor esi, esi
xor edi, edi
xor eax, eax
mov cl, byte [ebp + eax - 0x164]
xor edx, edx
mov dl, byte [ebp + esi - 0x64]
mov byte [ebp - 0x24], cl
and ecx, 0xff
add ecx, edi
inc esi
lea edi, [ecx + edx]
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
jb 0x4140dd
xor esi, esi
mov ecx, edi
and ecx, 0xff
inc eax
cmp eax, 0x100
mov dl, byte [ebp + ecx - 0x164]
lea ecx, [ebp + ecx - 0x164]
mov byte [ebp + eax - 0x165], dl
mov dl, byte [ebp - 0x24]
mov byte [ecx], dl
jb 0x4140b8
mov eax, dword [ebp - 0x30]
xor edi, edi
test eax, eax
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
jbe 0x414187
mov al, byte [ebp - 0x38]
mov cl, byte [ebp - 0x28]
inc al
mov byte [ebp - 0x38], al
mov eax, dword [ebp - 0x38]
and eax, 0xff
lea esi, [ebp + eax - 0x164]
mov al, byte [ebp + eax - 0x164]
add cl, al
mov byte [ebp - 0x20], al
mov byte [ebp - 0x28], cl
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
mov dl, byte [ebp + ecx - 0x164]
lea ecx, [ebp + ecx - 0x164]
mov byte [esi], dl
mov byte [ecx], al
mov ecx, dword [ebp - 0x20]
xor eax, eax
and ecx, 0xff
mov al, byte [esi]
add eax, ecx
and eax, 0xff
mov dl, byte [ebp + eax - 0x164]
mov al, byte [edi + ebx]
xor al, dl
mov byte [edi + ebx], al
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, eax
jb 0x414118
cmp dword [ebp - 0x30], 0x1c
jb 0x414378
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 4
mov ebx, dword [ebp - 0x2c]
mov eax, edx
neg eax
and eax, 0x1f
mov ecx, 0x20
sub ecx, eax
shl ebx, cl
mov ecx, eax
mov eax, ebx
mov ebx, dword [ebp - 0x2c]
shr ebx, cl
mov ecx, 0x20
or eax, ebx
mov ebx, edi
xor eax, edx
mov dword [ebp - 0x2c], eax
neg eax
and eax, 0x1f
sub ecx, eax
shl ebx, cl
mov ecx, eax
mov eax, dword [ebp - 0x2c]
shr edi, cl
mov ecx, 0x20
or ebx, edi
xor ebx, eax
mov edi, ebx
mov ebx, dword [ebp - 0x28]
mov eax, edi
neg eax
and eax, 0x1f
sub ecx, eax
shl ebx, cl
mov ecx, eax
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x28]
shr ebx, cl
mov ecx, dword [ebp - 0x24]
or ecx, ebx
mov ebx, esi
xor ecx, edi
mov eax, ecx
mov ecx, 0x20
mov dword [ebp - 0x28], eax
neg eax
and eax, 0x1f
sub ecx, eax
shl ebx, cl
mov ecx, eax
mov eax, dword [ebp - 0x28]
shr esi, cl
mov ecx, 0x20
or ebx, esi
xor ebx, eax
mov esi, ebx
mov ebx, edx
mov eax, esi
neg eax
and eax, 0x1f
sub ecx, eax
shl ebx, cl
mov ecx, eax
mov eax, dword [ebp - 0x20]
shr edx, cl
or ebx, edx
xor ebx, esi
dec eax
mov edx, ebx
mov dword [ebp - 0x20], eax
jne 0x4141ac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x20], eax
cmp edx, dword [ebp - 0x20]
jne 0x414341
mov edx, dword [0x7ffe0018]
mov eax, dword [0x7ffe001c]
cmp edx, eax
mov ecx, 0x7ffe0014
je 0x414293
mov eax, dword [0x7ffe0018]
mov edx, dword [0x7ffe001c]
cmp eax, edx
jne 0x414284
mov eax, dword [0x7ffe0018]
mov ecx, dword [ecx]
push 0
push 0x3e8
push eax
push ecx
call fcn.00415f00
push 0
push 0x3e8
push edx
push eax
call fcn.00415f00
push 0
push 0xa
push edx
push eax
call fcn.00415f00
cmp eax, esi
jae 0x41434b
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + 0x10]
lea edx, [eax - 0x53a7321b]
add eax, 0x65
shr edx, 7
shl eax, 0x19
or edx, eax
mov eax, dword [ebp - 0x28]
xor edx, 0xc754a32b
cmp eax, edx
jne 0x414341
mov ebx, dword [ebp - 0x3c]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x20], ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x1c]
mov eax, edi
shr eax, 2
test eax, eax
jle 0x414310
mov ecx, eax
add edx, dword [esi]
add esi, 4
dec eax
jne 0x414308
and edi, 3
jle 0x41432e
lea eax, [ebx + 0x1c]
lea esi, [eax + ecx*4]
mov ecx, edi
mov eax, ecx
lea edi, [ebp - 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
add ecx, edx
cmp eax, ecx
je 0x414355
mov esi, 0x66
jmp 0x41437d
mov ebx, dword [ebp - 0x3c]
mov esi, 0x66
jmp 0x41437d
mov ebx, dword [ebp - 0x3c]
mov esi, 0x68
jmp 0x41437d
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
push eax
push ebx
mov edx, dword [ecx]
call dword [edx + 0x10]
lea esi, [eax - 0x53a7321b]
shr esi, 7
shl eax, 0x19
or esi, eax
xor esi, 0xa32b
jmp 0x41437d
mov esi, 0x65
mov ecx, dword [ebp - 0x30]
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
rep stosb byte es:[edi], al
call sub.MFC42.DLL_operatordelete
mov edi, dword [ebp - 0x40]
add esp, 4
mov ecx, dword [edi + 0x24]
mov ax, word [edi + 0x24]
sub ecx, 0x53a7321b
shr ecx, 7
shl ax, 0x19
or ecx, eax
xor ecx, 0xa32b
test si, si
jne 0x4143c3
xor ecx, ecx
jmp 0x414418
cmp si, 0x65
je 0x4143d5
cmp si, 0x66
je 0x4143d5
cmp si, 0x68
jne 0x414418
inc ecx
cmp cx, 3
ja 0x414418
xor esi, esi
rdtsc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
rdtsc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
xor edx, 0xffffc7ff
shl eax, 0x17
shr edx, 9
or eax, 0x1c200
and edx, 0x7f
xor eax, 0xaa519580
or edx, eax
add edx, 0x53a7321b
mov dword [edi + 0xc], edx
rdtsc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
rdtsc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], edx
mov eax, ecx
mov ecx, dword [ebp - 0x20]
and eax, 0xffff
and ecx, 0xfe00
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, dword [ebp - 0x24]
shl edx, 0x10
or edx, eax
xor ecx, 0xc600
xor edx, 0xff54a32b
shr ecx, 9
shl edx, 7
or ecx, edx
add ecx, 0x53a7321b
mov dword [edi + 0x24], ecx
rdtsc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
rdtsc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x20]
mov eax, esi
and eax, 0xffff
and ecx, 0xfe00
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, dword [ebp - 0x24]
shl edx, 0x10
or edx, eax
xor ecx, 0xc600
xor edx, 0xff54a32b
shr ecx, 9
shl edx, 7
or ecx, edx
add ecx, 0x53a7321b
mov dword [edi + 8], ecx
jmp 0x4144c0
test si, si
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
sete bl
call fcn.00415612
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.00415612
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00415612
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret