Function at 0x40da50
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa4
cmp dword [ecx + 0x20], 0
je 0x40df42
mov esi, ecx
movzx eax, byte [ecx]
lea ecx, [esp + 0xa0]
push 0xa
push 4
push ecx
push eax
call fcn.0040df60
add esp, 0x10
mov dword [esp], eax
lea eax, [esi + 0x10]
push eax
call fcn.0040a5a0
add esp, 4
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x48]
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
lea eax, [ecx + 0x400]
push eax
call fcn.0040c720
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0x75859684
mov byte [esp + 0x18], 0x10
mov word [esp + 0x19], 0
mov byte [esp + 0x1b], 0
xor eax, eax
mov ecx, eax
add cl, 5
xor cl, byte [esp + eax + 0x14]
add cl, 0xe7
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 8
jne 0x40dad0
lea eax, [esp + 0x14]
mov ecx, esi
push 0x44deb4
push eax
push edi
call fcn.0040d460
mov dword [esp + 0x14], 0x315a444c
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov eax, 0x628e9335
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x628e9321]
lea edx, [eax - 0x628e9300]
and edx, ecx
or ecx, eax
xor ecx, edx
mov ebp, ecx
xor ebp, 0xecc8e009
mov edx, ecx
or edx, 0x20613f6
and edx, ebp
mov ebp, edx
and ebp, 0xfd
mov ebx, ecx
and ebx, 2
or edx, 2
imul edx, ebx
xor ebx, 2
imul ebx, ebp
xor ecx, 0xf6
add ecx, ebx
add ecx, edx
inc cl
mov byte [esp + eax - 0x628e9321], cl
inc eax
cmp eax, 0x628e933c
jne 0x40db20
mov ecx, esi
push dword [esp]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 8], edi
push edi
call fcn.0040d460
mov ebp, dword [str.c2CoW0__PROVERKA]
mov dword [esp + 0x14], 0xf15a4440
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov ebx, 0xabbfc0d5
nop
nop
nop
movzx edi, byte [esp + ebx + 0x54403f3f]
mov edx, edi
and edx, ebx
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0xdd
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, ebx
add al, 0xd7
mov byte [esp + ebx + 0x54403f3f], al
inc ebx
cmp ebx, 0xabbfc0dc
jne 0x40dbb0
mov ecx, esi
push ebp
lea eax, [esp + 0x18]
push eax
mov edi, dword [esp + 8]
push edi
call fcn.0040d460
mov dword [esp + 0x14], 0xd5a0a899
mov dword [esp + 0x18], 0xe0d5dcd1
mov dword [esp + 0x1c], 0xdedfd4e1
mov byte [esp + 0x20], pe_nt_image_headers32
mov word [esp + 0x21], 0
mov byte [esp + 0x23], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3d
xor cl, byte [esp + eax + 0x14]
add cl, 0xcf
mov byte [esp + eax + 0x14], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x10
jb 0x40dc40
mov dword [esp + 4], 0xc15a6a67
mov word [esp + 8], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 4]
mov ebp, eax
and ebp, 2
mov edx, ecx
xor edx, 0xbf9008b1
add edx, ebp
mov ebp, edx
and ebp, ebx
add ebp, ebp
sub edx, ebp
add edx, ebx
mov ebx, edx
not ebx
mov ebp, edx
xor ebp, 0x75
or edx, 0x8a
and edx, ebp
and ebx, 0x75
sub edx, ebx
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 6
jne 0x40dc80
lea edx, [esp + 4]
mov ecx, esi
lea eax, [esp + 0x14]
push eax
push edx
push edi
call fcn.0040d460
mov dword [esp + 0x14], 0xb6a2a4aa
mov byte [esp + 0x18], 0x50
mov word [esp + 0x19], 0
mov byte [esp + 0x1b], 0
mov eax, 0xe1563b5f
mov ebx, 0xc2ac76be
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax + 0x1ea9c4b5]
mov ecx, ebx
and ecx, 0xc084245c
mov edx, eax
xor edx, 0x666bd6ae
add edx, ecx
mov ecx, edx
and ecx, ebp
add edx, ebp
add ecx, ecx
sub edx, ecx
add dl, 0xbf
mov byte [esp + eax + 0x1ea9c4b5], dl
inc eax
add ebx, 2
cmp eax, 0xe1563b67
jne 0x40dd00
mov ecx, esi
push dword [esp + 0x9c]
push dword [esp + 0x9c]
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.0040d6e0
mov eax, dword [esi + 0x60]
mov dword [esp + 0x14], 0x13a51153
mov dword [esp + 0x18], 0x6fe26dda
mov dword [esp + 0x1c], 0x6bdc69d5
mov dword [esp + 0x20], 0x671365e8
mov dword [esp + 0x24], 0x63eb61cc
mov dword [esp + 0x28], 0x7fc37dcc
mov dword [esp + 0x2c], 0x7b1a7932
mov dword [esp + 0x30], 0x77fb75c1
mov dword [esp + 0x34], 0x73fe71c4
mov dword [esp + 0x38], 0x4ffe4df5
mov dword [esp + 0x3c], 0x4bf849e9
mov dword [esp + 0x40], 0x473145c8
mov dword [esp + 0x44], 0x43f541fe
mov dword [esp + 0x48], 0x5feb5dee
mov dword [esp + 0x4c], 0x5be6592d
mov dword [esp + 0x50], 0x57da55f5
mov dword [esp + 0x54], 0x531951f1
mov dword [esp + 0x58], 0xaf0cadcc
mov dword [esp + 0x5c], 0xab27a91f
mov dword [esp + 0x60], 0xa71aa512
mov dword [esp + 0x64], 0xa310a101
mov dword [esp + 0x68], 0xbffbbd35
mov dword [esp + 0x6c], 0xbb07b91a
mov dword [esp + 0x70], 0xb7fbb5fc
mov dword [esp + 0x74], 0xb30fb10c
mov dword [esp + 0x78], 0x8f378dc1
mov dword [esp + 0x7c], 0x8b368938
mov dword [esp + 0x80], 0x87258533
mov dword [esp + 0x84], 0x833f8139
mov dword [esp + 0x88], 0x9f2c9d2e
mov dword [esp + 0x8c], 0x9beb9925
mov dword [esp + 0x90], 0x978c9581
mov dword [esp + 0x94], 0x9190
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
and edx, 0x3c
mov ebx, ecx
xor bl, 0x3c
mov bh, cl
and bh, 0xc3
sub bl, bh
movzx ebx, bl
add edx, ecx
add edx, ebx
xor dl, byte [esp + ecx + 0x14]
add dl, 0xd4
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 0x84
jne 0x40de80
mov dword [esp + 4], 0xc3a3c1ef
mov dword [esp + 8], 0xc7afc554
mov word [esp + 0xc], 0xc9c8
mov dword [esp + 0xe], 0
mov byte [esp + 0x12], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 4]
lea ebp, [ebx + ebx]
not ebp
add ebp, ebx
or ebp, ecx
or ebp, 0x50
mov edx, ecx
xor edx, 0xaf
or edx, ebx
and edx, ebp
mov bl, 0x6f
sub bl, dl
mov byte [esp + ecx + 4], bl
inc ecx
cmp ecx, 0xf
jne 0x40dee0
push 0x493e0
push eax
push edi
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00410080
add esp, 0x1c
mov ebx, eax
push edi
call fcn.0040c730
add esp, 4
mov eax, dword [esi + 0x60]
add dword [esi + 4], eax
mov dword [esi + 0x60], 0
jmp 0x40df44
mov bl, 1
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret