Function at 0xc0dd0d
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
push ecx
cmp dword [ebx + 0x4c], ecx
mov dword [ebp - 0xac], ebx
setne al
mov dword [ebp - 0xa0], ecx
dec al
and al, 0xc1
dec al
mov byte [ebp - 0x61], al
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xb0], eax
test eax, eax
jne 0xc0dd7c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc0dd6c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc0e5b1
mov esi, 0x80004005
jmp 0xc0e5b1
lea eax, [ebx + 0x9c]
mov edx, 0xc96238
mov dword [ebp - 0x6c], eax
mov eax, dword [ebx + 0x48]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebx + 0xa8]
sub eax, dword [ebx + 0x14]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebx + 0xa4]
sub eax, dword [ebx + 0x10]
mov dword [ebp - 0x98], eax
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0xa4], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc0ddba
mov eax, dword [0xc95890]
test eax, eax
jne 0xc0e302
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0x74], ebx
push ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x70], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x7c], eax
test eax, eax
je 0xc0e2f6
or dword [ebp - 0x84], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x58], ebx
mov edx, ebx
mov dword [ebp - 0x88], eax
mov esi, 0x9fbcf2
mov dword [ebp - 0x90], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x5c], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x78], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x58]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x5c]
xor eax, edx
mov dword [ebp - 0x5c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x5c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x5c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x5c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x5c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x5c]
xor edx, eax
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x5c]
xor eax, edx
mov dword [ebp - 0x5c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x5c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x5c]
xor eax, edx
mov dword [ebp - 0x5c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x5c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x5c]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x58], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x58]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x58]
xor eax, edx
mov dword [ebp - 0x58], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x58], edx
mov edx, dword [ebp - 0x58]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x58], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x58]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x58]
xor eax, edx
mov dword [ebp - 0x58], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x58]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x58]
xor eax, edx
mov dword [ebp - 0x58], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x58]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x58]
xor edx, dword [ebp - 0x80]
xor eax, dword [ebp - 0x84]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x5c], esi
mov esi, dword [ebp - 0x88]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x84], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
ror eax, 8
mov byte [esi - 5], dl
mov byte [esi - 1], al
ror edx, 8
ror eax, 8
mov byte [esi - 6], dl
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x90], 1
mov dword [ebp - 0x88], esi
mov esi, dword [ebp - 0x78]
mov dword [ebp - 0x58], eax
jne 0xc0de2b
mov esi, dword [ebp - 0x7c]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc0e11c
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc0e14b
cmp edx, dword [0x9fc02c]
jne 0xc0e14b
mov edi, esi
xor eax, eax
mov dword [ebp - 0x68], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc0e15a
mov edi, dword [ebp - 0x68]
or ebx, 0xffffffff
mov dword [ebp - 0x70], 0xc004d501
xor eax, eax
test esi, esi
je 0xc0e16d
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x70], 0
jl 0xc0e2f3
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc0e28f
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xa0]
jne 0xc0e1a1
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc0e2ec
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x60], ecx
cmp word [eax], dx
je 0xc0e1e7
mov ecx, 0xc000007b
mov dword [ebp - 0x60], ecx
jmp 0xc0e231
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc0e1dd
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc0e1dd
cmp dword [edx], 0x4550
jne 0xc0e1dd
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc0e21f
mov ebx, 0x20b
cmp ax, bx
je 0xc0e21f
mov ecx, 0xc000000d
jmp 0xc0e1e2
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x70], eax
mov ebx, edx
test eax, eax
je 0xc0e283
mov edx, esi
mov dword [ebp - 0x78], esi
lea eax, [edx + 1]
mov dword [ebp - 0x7c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc0e24d
sub edx, dword [ebp - 0x7c]
inc esi
add esi, edx
test ecx, ecx
js 0xc0e27a
push dword [ebp - 0x78]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc0e28f
mov ecx, dword [ebp - 0x74]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x60]
inc dword [ebp - 0x74]
inc ebx
cmp ebx, dword [ebp - 0x70]
jb 0xc0e242
add edi, 0x10
cmp byte [esi], 0
jne 0xc0e19a
mov ebx, dword [ebp - 0x60]
mov esi, dword [ebp - 0x68]
test esi, esi
je 0xc0e2aa
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc0e2fd
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc0e2c3
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc0e2b2
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc0e30a
mov ebx, 0xc000007a
jmp 0xc0e292
mov esi, dword [ebp - 0x68]
mov ebx, 0xc000007a
jmp 0xc0e295
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov esi, 0xc96238
xchg dword [esi], eax
mov eax, dword [ebp - 0xa4]
sub eax, 1
je 0xc0e483
sub eax, 1
je 0xc0e3cb
sub eax, 1
jne 0xc0e48f
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x54]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x54]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x54], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc0e494
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x40]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x38]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x98]
imul eax, eax, 0x32
push 0x64
pop ecx
mov ebx, dword [ebp - 0x6c]
cdq
idiv ecx
mov dword [ebx], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x9c]
imul eax, eax, 0x32
cdq
idiv ecx
mov dword [ebx + 4], eax
jmp 0xc0e497
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x2c]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x2c], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xc0e494
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x18]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x10]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa8], 0
lea esi, [ebp - 0x18]
lea edi, [ebp - 0xc0]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc0e45b
imul eax, dword [ebp - 0x10], 5
cdq
idiv ecx
add eax, dword [ebp - 0x18]
jmp 0xc0e46a
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x98]
imul eax, eax, 0x5f
cdq
idiv ecx
mov ebx, dword [ebp - 0x6c]
mov dword [ebx], eax
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0x9c]
imul eax, eax, 0x5f
jmp 0xc0e3c0
mov ebx, dword [ebp - 0x6c]
xor edx, edx
mov dword [ebx], edx
mov dword [ebx + 4], edx
jmp 0xc0e49e
mov ebx, dword [ebp - 0x6c]
jmp 0xc0e49c
mov ebx, dword [ebp - 0x6c]
mov esi, 0xc96238
xor edx, edx
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc0e49e
mov eax, dword [0xc95890]
test eax, eax
jle 0xc0e4ff
sub eax, 1
mov dword [0xc95890], eax
jne 0xc0e4ff
mov edi, edx
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xc0e4d1
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xc0e4c0
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0xc96238
xor eax, eax
xchg dword [esi], eax
mov edi, dword [ebp - 0xac]
xor ecx, ecx
push 2
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov eax, dword [edi + 0x10]
sub dword [ebx], eax
mov eax, dword [edi + 0x14]
sub dword [edi + 0xa0], eax
mov eax, dword [edi + 0xa4]
mov dword [ebp - 0x8c], eax
mov eax, dword [edi + 0xa8]
mov dword [ebp - 0x88], eax
mov al, byte [ebp - 0x61]
mov byte [ebp - 0x56], al
lea eax, [ebp - 0x58]
push eax
push ecx
lea eax, [ebp - 0x94]
mov word [ebp - 0x58], cx
push eax
push dword [edi + 4]
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x55], 1
push eax
push ebx
mov ebx, dword [ebp - 0xb0]
push ebx
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
test eax, eax
je 0xc0e57e
xor eax, eax
mov esi, eax
jmp 0xc0e59c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc0e595
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc0e59c
mov esi, 0x80004005
push 4
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push ebx
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret