Function at 0x1b4fb0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x294
mov ebx, dword [esp + 0x2b4]
mov dword [esp + 0x8f], 0xe48040
mov dword [esp + 0x8c], 0x4010ec83
mov dword [esp + 0x88], 0x48e78948
mov dword [esp + 0x84], 0xce8948fc
mov dword [esp + 0x17], 0xc3fc8948
mov dword [esp + 0x14], 0x48d2ff41
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xfffffff1
mov dword [esp + 8], 0xba49c031
lea ebp, [esp + 0x94]
lea eax, [esp + 0x84]
mov edi, ebp
mov ecx, 3
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xa0]
lea eax, [esp + 0x90]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x92]
mov byte [esp + 0xa2], al
mov esi, ebx
cmp ebx, 4
jb 0x1b5061
mov esi, 4
lea edx, [esp + 0xa3]
test ebx, ebx
je 0x1b5243
xor ebp, ebp
jmp 0x1b50aa
inc ebp
cmp esi, ebp
je 0x1b5129
cmp ebp, 3
ja 0x1b50a1
jmp dword [ebp*4 + 0x187b00]
cmp ebx, 3
lea ebp, [esp + 0x94]
jbe 0x1b5243
test bl, 1
je 0x1b5161
mov eax, 0x18804d
mov esi, 0x18804d
mov edi, edx
xor ecx, ecx
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
mov ecx, 1
mov edi, edx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
add edx, 2
mov word [esp + 4], 0x50
mov dword [esp], 0x20468b48
mov byte [esp + 0x2c], 0
mov dword [esp + 0x28], 0x50000000
mov dword [esp + 0x24], 0x80868b48
lea eax, [ebx*8]
cmp eax, 0x7ffffffe
ja 0x1b522d
lea ebp, [ebx - 1]
cmp ebp, 4
jb 0x1b523c
neg ebx
lea eax, [esp + 0x24]
jmp 0x1b51dc
mov dword [esp + 0x27], ecx
mov esi, eax
mov edi, edx
mov ecx, 2
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
add edx, 8
lea esi, [esp + 0x2c]
xor ecx, ecx
mov edi, edx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
dec ebp
inc ebx
cmp ebp, 3
jbe 0x1b523c
mov ecx, ebx
and ecx, 8
mov edi, ebp
and edi, 0xfffffff7
imul edi, ecx
mov esi, ebp
and esi, 8
mov ecx, ebp
or ecx, 8
imul ecx, esi
add ecx, edi
cmp ecx, 0x7e
ja 0x1b51b0
mov byte [esp + 3], cl
mov esi, esp
mov edi, edx
mov ecx, 1
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [edx + 4]
lea esi, [esp + 4]
xor ecx, ecx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
movzx ecx, byte [esp + 4]
mov byte [edx + 4], cl
add edx, 5
jmp 0x1b51d5
mov eax, 0xffffffff
mov edx, 0xffffffff
jmp 0x1b55d7
lea ebp, [esp + 0x94]
mov eax, dword [esp + 0x2ac]
mov esi, 0x188031
mov edi, edx
mov ecx, 1
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea esi, [edx + 4]
mov ebx, 0x188035
xor ecx, ecx
mov edi, esi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2a8]
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
mov edi, esi
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [edx + 0x14]
lea eax, [esp + 0x18]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x1a]
mov byte [edx + 0x16], al
mov eax, ebp
neg eax
lea ebx, [edx + eax]
add ebx, 0x17
sub edx, ebp
add edx, 0x71
mov dword [esp + 0x20], edx
xor eax, eax
mov dword [esp], 0
mov dword [esp + 0x24], 0x282b2a25
mov byte [esp + 0x28], 0
nop
mov edx, eax
shr edx, 1
and edx, 1
movzx ecx, byte [esp + eax + 0x24]
mov edi, eax
and edi, 5
mov ebp, eax
or ebp, 0xfffffffd
inc ebp
imul ebp, edi
mov edi, eax
or edi, 2
imul edi, edx
add edi, edi
sub ebp, edi
lea edx, [eax + ebp]
add edx, 0x3773c848
xor edx, ecx
mov ecx, edx
not ecx
and ecx, 1
xor edx, 0xfe
lea ecx, [edx + ecx*2]
add cl, 0x6c
mov byte [esp + eax + 0x24], cl
inc eax
cmp eax, 5
jne 0x1b52d0
mov eax, dword [esp + 0x24]
mov ecx, dword [0x190374]
test ecx, ecx
je 0x1b537c
xor edx, edx
mov edi, dword [0x190378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x3e416e49
je 0x1b5350
inc edx
cmp ecx, edx
jne 0x1b5340
jmp 0x1b537c
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x1b537c
lea eax, [esp + 0x20]
mov edx, esp
push 0x40
push 0x3000
push eax
push 0
push edx
push 0xffffffffffffffff
push 6
push dword [0x19037c]
push ecx
call fcn.001b2f10
add esp, 0x24
test eax, eax
js 0x1b55a0
mov dword [esp + 0x24], 0xe3719ce7
mov dword [esp + 0x28], 0x1d8d92e1
mov dword [esp + 0x2c], 0x7916d091
mov dword [esp + 0x30], 0x1d1e1f00
mov dword [esp + 0x34], 0x2f5a86f4
mov dword [esp + 0x38], 0x820e6385
mov dword [esp + 0x3c], 0xdcc4a6a
mov dword [esp + 0x40], 0x2d2e2fdd
mov dword [esp + 0x44], 0x3b5235bb
mov dword [esp + 0x48], 0xdf262728
mov dword [esp + 0x4c], 0x4eb044b0
mov dword [esp + 0x50], 0xdc1263bd
mov dword [esp + 0x54], 0x2164d8de
mov dword [esp + 0x58], 0x9f2a238
mov dword [esp + 0x5c], 0xfeea0535
mov dword [esp + 0x60], 0xa7cf2670
mov dword [esp + 0x64], 0x15931b2d
mov dword [esp + 0x68], 0xc5fbdbf4
mov dword [esp + 0x6c], 0x555c3c4
mov dword [esp + 0x70], 0x834907fc
mov dword [esp + 0x74], 0x86029be3
mov dword [esp + 0x78], 0xe1d7f7ae
lea edx, [esp + 0x7c]
mov word [esp + 0x7c], 0xd3e8
mov byte [esp + 0x82], 0
mov dword [esp + 0x7e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x43
xor cl, byte [esp + eax + 0x24]
add cl, 0xb1
mov byte [esp + eax + 0x24], cl
inc eax
cmp eax, 0x5f
jne 0x1b5460
mov eax, dword [esp]
lea ebp, [esp + 0x24]
mov edi, eax
mov ecx, 0x16
xchg esi, ebp
rep movsd dword es:[edi], dword [esi]
xchg esi, ebp
lea edi, [eax + 0x58]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x7c]
mov byte [eax + 0x58], cl
mov eax, dword [esp]
lea edi, [eax + 0x59]
mov ecx, ebx
shr ecx, 2
lea edx, [esp + 0x94]
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
and ecx, 0xfffffffc
add eax, ecx
add eax, 0x59
lea esi, [esp + ecx]
add esi, 0x94
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
test bl, 1
je 0x1b54ec
and ebx, 2
movzx ecx, byte [esi + ebx]
mov byte [eax + ebx], cl
mov eax, dword [esp]
lea ecx, [eax + 0x59]
push dword [esp + 0x2b0]
push ecx
call eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x282b2a25
mov byte [esp + 0x28], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ebp
shr esi, 1
and esi, 1
movzx ecx, byte [esp + ebp + 0x24]
mov edi, ebp
and edi, 5
mov ebx, ebp
or ebx, 0xfffffffd
inc ebx
imul ebx, edi
mov edi, ebp
or edi, 2
imul edi, esi
add edi, edi
sub ebx, edi
lea esi, [ebx + ebp]
add esi, 0x3773c848
xor esi, ecx
mov ecx, esi
not ecx
and ecx, 1
xor esi, 0xfe
lea ecx, [esi + ecx*2]
add cl, 0x6c
mov byte [esp + ebp + 0x24], cl
inc ebp
cmp ebp, 5
jne 0x1b5520
mov ecx, dword [0x190374]
test ecx, ecx
je 0x1b55d7
mov esi, dword [esp + 0x24]
xor edi, edi
mov ebx, dword [0x190378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x16194952
je 0x1b55a7
inc edi
cmp ecx, edi
jne 0x1b5590
jmp 0x1b55d7
mov edx, eax
sar edx, 0x1f
jmp 0x1b55d7
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, esi
je 0x1b55d7
lea esi, [esp + 0x1c]
mov edi, esp
push 0x8000
push esi
push edi
push 0xffffffffffffffff
push 4
push dword [0x19037c]
push ecx
mov esi, eax
mov edi, edx
call fcn.001b2f10
mov edx, edi
mov eax, esi
add esp, 0x1c
add esp, 0x294
pop esi
pop edi
pop ebx
pop ebp
ret 0x10