Function at 0xcb70cf
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor edx, edx
mov ecx, dword [ebp + 8]
push edi
lea edi, [ebp - 0x14]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x60], edx
lea esi, [ecx + 0x1c]
mov eax, dword [ecx + 0x18]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x50], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x3c], dl
je 0xcb7147
cmp byte [ebx + 0xb0], dl
je 0xcb7121
cmp byte [ebx + 0xaf], dl
je 0xcb7131
mov edi, dword [ebx + 0x24]
mov eax, dword [ebx + 0x38]
jmp 0xcb7137
cmp byte [ebx + 0xaf], dl
jne 0xcb7131
mov edi, dword [ebx + 0x28]
mov eax, dword [ebx + 0x34]
jmp 0xcb7137
mov edi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x30]
mov esi, dword [ebp - 0x50]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x40], eax
jmp 0xcb7153
push edx
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov esi, dword [ebp - 0x50]
mov edi, eax
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 8]
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
test edi, edi
je 0xcb717c
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x40]
test eax, eax
je 0xcb718b
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp byte [ebx + 0xb0], 0
mov dword [ebp - 0x70], eax
je 0xcb71b0
cmp byte [ebx + 0xaf], 0
je 0xcb71be
mov ecx, 0x3fa
jmp 0xcb71c3
cmp byte [ebx + 0xaf], 0
mov ecx, 0x3f8
je 0xcb71c3
mov ecx, 0x3f9
call fcn.00b53222
and eax, 0xffffff
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x40], eax
mov edx, 0xd0aed4
mov eax, dword [ebx + 0x48]
neg eax
sbb eax, eax
and eax, 0x20000
add eax, 0x25
mov dword [ebp - 0x68], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x6c], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xcb71fb
mov eax, dword [0xd0a150]
test eax, eax
jne 0xcb774b
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0x4c], ebx
push ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x54], eax
test eax, eax
je 0xcb773f
or dword [ebp - 0x5c], 0xffffffff
mov edi, 0xb2bef2
add eax, 7
mov dword [ebp - 0x58], ebx
mov cl, bl
mov dword [ebp - 0x44], eax
mov edx, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x48], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x3c]
xor edx, ebx
mov dword [ebp - 0x28], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x3c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x3c]
shl edi, 8
add dword [ebp - 0x3c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x28]
xor eax, edx
mov dword [ebp - 0x28], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x28]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x28]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x28], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x28]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x28]
xor edx, eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x28]
xor eax, edx
mov dword [ebp - 0x28], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x28]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x28]
xor eax, edx
mov dword [ebp - 0x28], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x28]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x28]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x28], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x28]
xor eax, 0xab69605e
mov dword [ebp - 0x2c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x2c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x2c]
xor eax, edx
mov dword [ebp - 0x2c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x2c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edx, eax
mov dword [ebp - 0x2c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x2c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x2c]
xor eax, edx
mov dword [ebp - 0x2c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x2c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x2c]
xor eax, edx
mov dword [ebp - 0x2c], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x2c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x2c]
xor edx, dword [ebp - 0x58]
xor eax, dword [ebp - 0x5c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x28], esi
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x5c], edi
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x58], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
ror eax, 8
mov byte [esi - 5], dl
mov byte [esi - 1], al
ror edx, 8
ror eax, 8
mov byte [esi - 6], dl
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x48], 1
mov dword [ebp - 0x44], esi
mov esi, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x78], eax
jne 0xcb7263
mov esi, dword [ebp - 0x54]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xcb7557
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcb7586
cmp edx, dword [0xb2c22c]
jne 0xcb7586
mov edi, esi
xor eax, eax
mov dword [ebp - 0x38], edi
mov esi, eax
mov ebx, 0x337
jmp 0xcb7595
mov edi, dword [ebp - 0x38]
or ebx, 0xffffffff
mov dword [ebp - 0x34], 0xc004d501
xor eax, eax
test esi, esi
je 0xcb75a8
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x34], 0
jl 0xcb773c
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xcb76da
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x60]
jne 0xcb75dc
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xcb7735
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0x30], edx
cmp word [eax], cx
je 0xcb761d
mov edx, 0xc000007b
mov dword [ebp - 0x30], edx
jmp 0xcb7667
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcb7613
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xcb7613
cmp dword [ecx], 0x4550
jne 0xcb7613
movzx eax, word [ecx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xcb7655
mov ebx, 0x20b
cmp ax, bx
je 0xcb7655
mov edx, 0xc000000d
jmp 0xcb7618
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor ecx, ecx
add esi, 6
mov dword [ebp - 0x44], eax
mov ebx, ecx
test eax, eax
je 0xcb76ce
mov dword [ebp - 0x34], ecx
mov ecx, esi
mov dword [ebp - 0x48], esi
lea eax, [ecx + 1]
mov dword [ebp - 0x54], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcb7686
sub ecx, dword [ebp - 0x54]
inc esi
add esi, ecx
test edx, edx
js 0xcb76be
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x34]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0x30], edx
test edx, edx
js 0xcb76da
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x34]
mov dword [eax*4 + section..data], ecx
jmp 0xcb76c1
mov eax, dword [ebp - 0x4c]
inc eax
inc ebx
push 0
mov dword [ebp - 0x4c], eax
pop ecx
cmp ebx, dword [ebp - 0x44]
jb 0xcb7678
add edi, 0x10
cmp byte [esi], 0
jne 0xcb75d5
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
xor edi, edi
test esi, esi
je 0xcb76f5
push esi
push edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xcb7746
mov esi, edi
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcb770c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcb76fb
push 0x40
push edi
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xcb7751
mov ebx, 0xc000007a
jmp 0xcb76dd
mov esi, dword [ebp - 0x38]
mov ebx, 0xc000007a
jmp 0xcb76e0
mov eax, dword [0xd0a150]
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
push dword [ebp - 0x64]
mov ebx, dword [ebp - 0x50]
xor eax, eax
mov esi, dword [0xd0803c]
mov ecx, esi
push ebx
mov dword [ebp - 0x34], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov edi, eax
xor eax, eax
mov ecx, esi
push eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x6c]
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb77a3
mov dword [ebp - 0x34], 0x80004005
test edi, edi
je 0xcb77b9
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
push ebx
call dword [0xd0cffc]
call esi
mov edx, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xcb77be
mov eax, dword [0xd0a150]
test eax, eax
jle 0xcb781a
sub eax, 1
mov dword [0xd0a150], eax
jne 0xcb781a
xor esi, esi
mov edi, esi
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xcb77f3
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xcb77e2
push 0x40
push esi
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xffffffff
je 0xcb7833
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [ebp - 0x70]
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [ebp - 0x74]
test byte [eax + 0x10], 0x10
je 0xcb7869
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x24]
push 0xfffffffffffffffc
push 0xfffffffffffffffc
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_InflateRect]
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_DrawFocusRect]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x34]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8