Function at 0x4044b0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data using crc32b

Disassembly:
mov eax, dword [0x6621f4]
sub esp, 0x424
push ebx
push esi
push edi
push 0xffffffffffffffff
xor ebx, ebx
mov esi, ecx
mov ecx, dword [eax + 0x44]
push 3
push ebx
call fcn.0040bc10
mov ecx, dword [0x6621f4]
mov ecx, dword [ecx + 0x94]
call fcn.00411340
mov edi, eax
cmp edi, ebx
je 0x404516
mov edx, dword [0x6621f4]
mov ecx, dword [edx + 0x28]
call fcn.00409050
mov eax, dword [0x6621f4]
push 0xffffffffffffffff
push 3
push edi
mov ecx, dword [eax + 0x44]
call fcn.0040bc10
mov ecx, dword [0x6621f4]
mov edx, dword [ecx + 0x94]
mov word [edx + 0x24], di
mov ecx, esi
call fcn.00404b20
mov ecx, esi
call fcn.00407100
mov edi, 0x400
mov dword [0x662b44], edi
call fcn.00403540
mov ecx, dword [0x662100]
push edi
call fcn.00401130
mov esi, eax
call fcn.00403560
mov dword [0x662b40], esi
mov dword [0x662b64], edi
call fcn.00403540
mov ecx, dword [0x662100]
push edi
call fcn.00401130
mov esi, eax
call fcn.00403560
mov dword [0x662b60], esi
mov dword [0x662b54], edi
call fcn.00403540
mov ecx, dword [0x662100]
push edi
call fcn.00401130
mov esi, eax
call fcn.00403560
mov dword [0x662b50], esi
mov dword [0x662b6c], ebx
call fcn.00411aa0
mov eax, dword [0x6621f4]
mov ecx, dword [eax + 0x30]
cmp byte [ecx + 0x2a], 1
je 0x404a8b
push ebp
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, ebx
je 0x404a69
push 0x645764
push str.IDR_RCP
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x404a69
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x30], edi
je 0x4048b9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
cmp ebp, ebx
je 0x4048b9
mov eax, dword [ebp + 4]
mov edx, dword [ebp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x10], 0x6c7000
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov ebx, section..idr_dt
push eax
push section..idr
push section..idr_dt
call fcn.0060a650
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jne 0x404a4e
mov dword [esp + 0x1c], ebx
xor edi, edi
lea eax, [esp + 0x34]
mov edx, edi
xor esi, esi
mov ecx, 7
test dl, 1
je 0x40477a
mov ebp, 1
shl ebp, cl
or esi, ebp
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x40476c
shl esi, 0x18
mov dword [eax], esi
mov ecx, 8
mov edx, dword [eax]
mov esi, dword [eax]
and edx, 0x80000000
neg edx
sbb edx, edx
add esi, esi
and edx, 0x4c11db7
xor edx, esi
dec ecx
mov dword [eax], edx
jne 0x40478c
mov edx, dword [eax]
xor esi, esi
mov ecx, 0x1f
test dl, 1
je 0x4047c0
mov ebp, 1
shl ebp, cl
or esi, ebp
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x4047b2
mov dword [eax], esi
inc edi
add eax, 4
cmp edi, 0xff
jbe 0x404763
xor edx, edx
xor eax, eax
mov ecx, 0x1f
test dl, 1
je 0x4047ed
mov esi, 1
shl esi, cl
or eax, esi
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x4047df
not eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
not eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x404836
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [esi]
and ecx, 0xff
xor ecx, edx
mov ecx, dword [esp + ecx*4 + 0x34]
mov edx, dword [esp + 0x10]
shr edx, 8
xor ecx, edx
inc esi
dec eax
mov dword [esp + 0x10], ecx
jne 0x404811
mov ecx, dword [0x649bd8]
mov esi, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
not esi
jle 0x404868
mov ecx, dword [eax*4 + 0x6478b0]
xor ecx, 0x6920
add ecx, ebx
mov edi, dword [ecx]
add edi, ebx
inc eax
mov dword [ecx], edi
mov ecx, dword [0x649bd8]
cmp eax, ecx
jl 0x404848
mov ecx, dword [0x649bd4]
xor eax, eax
test ecx, ecx
jle 0x404896
mov edx, dword [eax*8 + 0x647618]
mov ecx, dword [eax*8 + 0x64761c]
xor edx, 0x6920
inc eax
mov dword [edx + ebx], ecx
mov ecx, dword [0x649bd4]
cmp eax, ecx
jl 0x404874
mov edx, dword [0x647604]
push 0
xor edx, 0x6920
push 1
push 0
add edx, ebx
call edx
lea esi, [ebx]
nop
nop
nop
nop
nop
mov edi, dword [esp + 0x30]
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp esi, ebx
je 0x404a69
mov eax, dword [0x647614]
xor eax, 0x38cc
add eax, esi
call eax
cmp eax, 1
jne 0x404a65
mov ecx, dword [0x6475c4]
lea eax, [esp + 0x34]
xor ecx, 0x38cc
add ecx, esi
xor edi, edi
mov edx, edi
shl edx, 8
mov dword [eax], edx
mov edx, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edx
mov dword [eax], ebx
jne 0x4048ff
inc edi
add eax, 4
cmp edi, 0xff
jbe 0x4048f3
mov eax, ecx
xor ebp, ebp
sub eax, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x40498e
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x404989
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add edi, 0xf8
cmp ebx, edi
jae 0x40498e
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x404941
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x34]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x18], edx
cmp ebp, 0xf8
jb 0x404990
xor edx, edx
test eax, eax
jbe 0x404a09
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x404a04
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
add eax, 0xf8
cmp edi, eax
jae 0x404a09
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x4049bd
mov eax, dword [0x6475c4]
mov ecx, dword [esp + 0x18]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
push 0x9eb13c2e
push 0x4ca11b
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
cmp eax, 1
je 0x404a46
push esi
call fcn.00412660
add esp, 4
test al, al
je 0x404a39
xor ebx, ebx
jmp 0x404a69
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x4048b3
mov esi, dword [esp + 0x1c]
mov eax, dword [0x647604]
push ebx
xor eax, 0x6920
push ebx
push ebx
add eax, esi
call eax
push esi
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
mov esi, dword [0x662b40]
cmp esi, ebx
je 0x404aab
call fcn.00403540
mov ecx, dword [0x662100]
push esi
call fcn.00401250
call fcn.00403560
mov esi, dword [0x662b60]
mov dword [0x662b40], ebx
cmp esi, ebx
mov dword [0x662b48], ebx
je 0x404ad7
call fcn.00403540
mov ecx, dword [0x662100]
push esi
call fcn.00401250
call fcn.00403560
mov esi, dword [0x662b50]
mov dword [0x662b60], ebx
cmp esi, ebx
mov dword [0x662b68], ebx
je 0x404b03
call fcn.00403540
mov ecx, dword [0x662100]
push esi
call fcn.00401250
call fcn.00403560
pop edi
mov dword [0x662b50], ebx
mov dword [0x662b58], ebx
mov dword [0x662b6c], ebx
pop esi
pop ebx
add esp, 0x424
ret