Function at 0xcb65b1
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
push ecx
cmp dword [ebx + 0x4c], ecx
mov dword [ebp - 0xac], ebx
setne al
mov dword [ebp - 0xa0], ecx
dec al
and al, 0xc1
dec al
mov byte [ebp - 0x61], al
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xb0], eax
test eax, eax
jne 0xcb6620
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xcb6610
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xcb6e66
mov esi, 0x80004005
jmp 0xcb6e66
lea eax, [ebx + 0x9c]
mov edx, 0xd0aed4
mov dword [ebp - 0x6c], eax
mov eax, dword [ebx + 0x48]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebx + 0xa8]
sub eax, dword [ebx + 0x14]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebx + 0xa4]
sub eax, dword [ebx + 0x10]
mov dword [ebp - 0x98], eax
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0xa4], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xcb665e
mov eax, dword [0xd0a150]
test eax, eax
jne 0xcb6bcb
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0x78], ebx
push ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x70], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x80], eax
test eax, eax
je 0xcb6bbf
or dword [ebp - 0x88], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x58], ebx
mov edx, ebx
mov dword [ebp - 0x90], eax
mov esi, 0xb2bef2
mov dword [ebp - 0x74], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0x5c], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0x7c], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0x58]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x5c]
xor eax, edx
mov dword [ebp - 0x5c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x5c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x5c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x5c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x5c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x5c]
xor edx, eax
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x5c]
xor eax, edx
mov dword [ebp - 0x5c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x5c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x5c]
xor eax, edx
mov dword [ebp - 0x5c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x5c]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0x5c]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0x5c], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0x5c]
xor eax, 0xab69605e
mov dword [ebp - 0x58], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x58]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x58]
xor eax, edx
mov dword [ebp - 0x58], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x58], edx
mov edx, dword [ebp - 0x58]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edx, eax
mov dword [ebp - 0x58], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x58]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x58]
xor eax, edx
mov dword [ebp - 0x58], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x58]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x58]
xor eax, edx
mov dword [ebp - 0x58], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x58]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x58]
xor edx, dword [ebp - 0x84]
xor eax, dword [ebp - 0x88]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x5c], esi
mov esi, dword [ebp - 0x90]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
ror eax, 8
mov byte [esi - 5], dl
mov byte [esi - 1], al
ror edx, 8
ror eax, 8
mov byte [esi - 6], dl
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x74], 1
mov dword [ebp - 0x90], esi
mov esi, dword [ebp - 0x7c]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xb4], eax
jne 0xcb66cf
mov esi, dword [ebp - 0x80]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xcb69d2
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcb6a01
cmp edx, dword [0xb2c22c]
jne 0xcb6a01
mov edi, esi
xor eax, eax
mov dword [ebp - 0x68], edi
mov esi, eax
mov ebx, 0x337
jmp 0xcb6a10
mov edi, dword [ebp - 0x68]
or ebx, 0xffffffff
mov dword [ebp - 0x70], 0xc004d501
xor eax, eax
test esi, esi
je 0xcb6a23
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x70], 0
jl 0xcb6bbc
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xcb6b58
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xa0]
jne 0xcb6a57
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xcb6bb5
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0x60], edx
cmp word [eax], cx
je 0xcb6a9b
mov edx, 0xc000007b
mov dword [ebp - 0x60], edx
jmp 0xcb6ae5
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcb6a91
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xcb6a91
cmp dword [ecx], 0x4550
jne 0xcb6a91
movzx eax, word [ecx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xcb6ad3
mov ebx, 0x20b
cmp ax, bx
je 0xcb6ad3
mov edx, 0xc000000d
jmp 0xcb6a96
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor ecx, ecx
add esi, 6
mov dword [ebp - 0x74], eax
mov ebx, ecx
test eax, eax
je 0xcb6b4c
mov dword [ebp - 0x70], ecx
mov ecx, esi
mov dword [ebp - 0x7c], esi
lea eax, [ecx + 1]
mov dword [ebp - 0x80], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcb6b04
sub ecx, dword [ebp - 0x80]
inc esi
add esi, ecx
test edx, edx
js 0xcb6b3c
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x70]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0x60], edx
test edx, edx
js 0xcb6b58
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x70]
mov dword [eax*4 + section..data], ecx
jmp 0xcb6b3f
mov eax, dword [ebp - 0x78]
inc eax
inc ebx
push 0
mov dword [ebp - 0x78], eax
pop ecx
cmp ebx, dword [ebp - 0x74]
jb 0xcb6af6
add edi, 0x10
cmp byte [esi], 0
jne 0xcb6a50
mov ebx, dword [ebp - 0x60]
mov esi, dword [ebp - 0x68]
test esi, esi
je 0xcb6b73
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xcb6bc6
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcb6b8c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcb6b7b
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xcb6bd3
mov ebx, 0xc000007a
jmp 0xcb6b5b
mov esi, dword [ebp - 0x68]
mov ebx, 0xc000007a
jmp 0xcb6b5e
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov esi, 0xd0aed4
xchg dword [esi], eax
mov eax, dword [ebp - 0xa4]
sub eax, 1
je 0xcb6d38
sub eax, 1
je 0xcb6c94
sub eax, 1
jne 0xcb6d44
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x54]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x54]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x54], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb6d49
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x40]
push eax
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x38]
push eax
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x98]
imul eax, eax, 0x32
push 0x64
pop ecx
mov ebx, dword [ebp - 0x6c]
cdq
idiv ecx
mov dword [ebx], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x9c]
imul eax, eax, 0x32
cdq
idiv ecx
mov dword [ebx + 4], eax
jmp 0xcb6d4c
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x2c]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x2c], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb6d49
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x18]
push eax
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x10]
push eax
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xa8], 0
mov ebx, dword [ebp - 0x6c]
push 0x64
pop ecx
je 0xcb6d16
imul eax, dword [ebp - 0x10], 5
cdq
idiv ecx
add eax, dword [ebp - 0x18]
jmp 0xcb6d25
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x98]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x9c]
imul eax, eax, 0x5f
jmp 0xcb6c89
mov ebx, dword [ebp - 0x6c]
xor edx, edx
mov dword [ebx], edx
mov dword [ebx + 4], edx
jmp 0xcb6d53
mov ebx, dword [ebp - 0x6c]
jmp 0xcb6d51
mov ebx, dword [ebp - 0x6c]
mov esi, 0xd0aed4
xor edx, edx
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xcb6d53
mov eax, dword [0xd0a150]
test eax, eax
jle 0xcb6db4
sub eax, 1
mov dword [0xd0a150], eax
jne 0xcb6db4
mov edi, edx
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xcb6d86
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xcb6d75
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0xd0aed4
xor eax, eax
xchg dword [esi], eax
mov edi, dword [ebp - 0xac]
xor ecx, ecx
push 2
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov eax, dword [edi + 0x10]
sub dword [ebx], eax
mov eax, dword [edi + 0x14]
sub dword [edi + 0xa0], eax
mov eax, dword [edi + 0xa4]
mov dword [ebp - 0x8c], eax
mov eax, dword [edi + 0xa8]
mov dword [ebp - 0x88], eax
mov al, byte [ebp - 0x61]
mov byte [ebp - 0x56], al
lea eax, [ebp - 0x58]
push eax
push ecx
lea eax, [ebp - 0x94]
mov word [ebp - 0x58], cx
push eax
push dword [edi + 4]
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x55], 1
push eax
push ebx
mov ebx, dword [ebp - 0xb0]
push ebx
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
test eax, eax
je 0xcb6e33
xor eax, eax
mov esi, eax
jmp 0xcb6e51
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xcb6e4a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xcb6e51
mov esi, 0x80004005
push 4
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push ebx
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret