Function at 0x4028f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x48706c]
xor eax, esp
mov dword [esp + 0x420], eax
cmp dword [ebp + 8], 2
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
jne 0x402c51
push 0x400
lea eax, [esp + 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40296d
sub esp, 0x18
lea ecx, [esp + 0x40]
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402950
sub ecx, esi
lea eax, [esp + 0x40]
push ecx
push eax
mov ecx, edx
call fcn.00405f60
mov ecx, edi
call fcn.00427340
lea eax, [esp + 0x10]
push eax
call fcn.004037f0
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x402984
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x4029a1
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x402990
mov edx, dword [esp + 0x24]
cmp edx, 0x10
jb 0x4029d7
mov ecx, dword [esp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4029cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402c68
push edx
push ecx
call fcn.0042bafb
add esp, 8
mov edi, dword [esp + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov dword [edi + 0x40], esi
mov edx, dword [eax + 4]
mov ecx, edx
mov byte [esp + 0x10], 0
mov eax, 0x47a354
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x402a20
test bl, bl
je 0x402a1c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x402a20
add eax, 2
add ecx, 2
test bl, bl
jne 0x402a00
xor eax, eax
jmp 0x402a25
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402a5d
call fcn.00402c70
mov edx, 0x47a358
mov ecx, 0x489650
call fcn.00407670
push eax
call fcn.00407920
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0042bab5
mov esp, ebp
pop ebp
ret 8
mov ecx, edx
mov eax, 0x47a394
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x402a84
test bl, bl
je 0x402a80
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x402a84
add eax, 2
add ecx, 2
test bl, bl
jne 0x402a64
xor eax, eax
jmp 0x402a89
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402b23
sub esp, 0x18
mov ecx, esp
push 9
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push str.conf.json
mov byte [ecx], al
call fcn.00405f60
mov ecx, edi
call fcn.00427620
lea eax, [esp + 0x10]
push eax
call fcn.0044a19f
mov edx, dword [edi + 0x1c]
add esp, 4
mov esi, dword [esp + 0x10]
xor eax, eax
xor ecx, ecx
test edx, edx
je 0x402ad5
mov ecx, edx
sub ecx, esi
mov edx, dword [edi + 0x20]
test edx, edx
je 0x402ae0
mov eax, edx
sub eax, esi
push eax
push ecx
mov ecx, 0x489650
call fcn.00404af0
push ecx
mov edx, 0x47a3a4
mov ecx, eax
call fcn.00407670
add esp, 4
mov ecx, eax
call fcn.00404af0
push eax
call fcn.00407920
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0042bab5
mov esp, ebp
pop ebp
ret 8
mov ecx, edx
mov eax, 0x47a3a8
nop word [eax + eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x402b50
test bl, bl
je 0x402b4c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x402b50
add eax, 2
add ecx, 2
test bl, bl
jne 0x402b30
xor eax, eax
jmp 0x402b55
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402b99
sub esp, 0x18
mov ecx, esp
push 9
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push str.conf.json
mov byte [ecx], al
call fcn.00405f60
mov ecx, edi
call fcn.00427620
call fcn.00403010
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0042bab5
mov esp, ebp
pop ebp
ret 8
mov ecx, edx
mov eax, 0x47a3ac
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x402bc0
test bl, bl
je 0x402bbc
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x402bc0
add eax, 2
add ecx, 2
test bl, bl
jne 0x402ba0
xor eax, eax
jmp 0x402bc5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402bea
call fcn.00418190
call fcn.00403010
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0042bab5
mov esp, ebp
pop ebp
ret 8
mov eax, 0x47a3b0
nop
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x402c10
test cl, cl
je 0x402c0c
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x402c10
add eax, 2
add edx, 2
test cl, cl
jne 0x402bf0
xor eax, eax
jmp 0x402c15
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402c51
cmp dword [edi + 0xe8], 0x10
lea eax, [edi + 0xd4]
jb 0x402c2a
mov eax, dword [eax]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 0x4035d0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042bab5
mov esp, ebp
pop ebp
ret 8
call fcn.0044acc1
int3