Function at 0xc0e80b
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor edx, edx
mov ecx, dword [ebp + 8]
push edi
lea edi, [ebp - 0x14]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x60], edx
lea esi, [ecx + 0x1c]
mov eax, dword [ecx + 0x18]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x4c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x3c], dl
je 0xc0e881
mov al, byte [ebx + 0xaf]
cmp byte [ebx + 0xb0], dl
je 0xc0e85f
test al, al
je 0xc0e86b
mov edi, dword [ebx + 0x24]
mov eax, dword [ebx + 0x38]
jmp 0xc0e871
test al, al
jne 0xc0e86b
mov edi, dword [ebx + 0x28]
mov eax, dword [ebx + 0x34]
jmp 0xc0e871
mov edi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x30]
mov esi, dword [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x40], eax
jmp 0xc0e88d
push edx
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov esi, dword [ebp - 0x4c]
mov edi, eax
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 8]
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
test edi, edi
je 0xc0e8b6
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x40]
test eax, eax
je 0xc0e8c5
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push esi
call dword [sym.imp.ext_ms_win_gdi_draw_l1_1_1.dll_SetBkMode]
cmp byte [ebx + 0xb0], 0
mov cl, byte [ebx + 0xaf]
mov dword [ebp - 0x70], eax
je 0xc0e8eb
test cl, cl
je 0xc0e8f4
mov ecx, 0x3ff
jmp 0xc0e8f9
test cl, cl
mov ecx, 0x3fd
je 0xc0e8f9
mov ecx, 0x3fe
call fcn.00a79f17
and eax, 0xffffff
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x40], eax
mov edx, 0xc96238
mov eax, dword [ebx + 0x48]
neg eax
sbb eax, eax
and eax, 0x20000
add eax, 0x25
mov dword [ebp - 0x68], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x6c], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc0e931
mov eax, dword [0xc95890]
test eax, eax
jne 0xc0ee6c
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0x48], ebx
push ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x50], eax
test eax, eax
je 0xc0ee1e
or dword [ebp - 0x58], 0xffffffff
mov edi, 0x9fbcf2
add eax, 7
mov dword [ebp - 0x54], ebx
mov cl, bl
mov dword [ebp - 0x5c], eax
mov edx, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0x3c]
xor edx, ebx
mov dword [ebp - 0x2c], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0x3c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0x3c]
shl edi, 8
add dword [ebp - 0x3c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0x28], esi
mov esi, edx
xor esi, dword [ebp - 0x28]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0x2c]
xor eax, edx
mov dword [ebp - 0x2c], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x2c]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0x2c]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0x2c], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x2c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0x2c]
xor edx, eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0x2c]
xor eax, edx
mov dword [ebp - 0x2c], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0x2c]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0x2c]
xor eax, edx
mov dword [ebp - 0x2c], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0x2c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0x2c]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0x28], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x28]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0x28]
xor eax, edx
mov dword [ebp - 0x28], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x28]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0x28], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x28]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0x28]
xor eax, edx
mov dword [ebp - 0x28], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0x28]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0x28]
xor eax, edx
mov dword [ebp - 0x28], eax
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0x28]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0x28]
xor edx, dword [ebp - 0x54]
xor eax, dword [ebp - 0x58]
xor esi, edx
mov edx, esi
mov dword [ebp - 0x2c], esi
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x58], edi
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x54], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
ror eax, 8
mov byte [esi - 5], dl
mov byte [esi - 1], al
ror edx, 8
ror eax, 8
mov byte [esi - 6], dl
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0x44], 1
mov dword [ebp - 0x5c], esi
mov esi, eax
mov dword [ebp - 0x28], eax
jne 0xc0e999
mov esi, dword [ebp - 0x50]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc0ec87
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xc0ecb6
cmp edx, dword [0x9fc02c]
jne 0xc0ecb6
mov edi, esi
xor eax, eax
mov dword [ebp - 0x34], edi
mov esi, eax
mov ebx, 0x337
jmp 0xc0ecc5
mov edi, dword [ebp - 0x34]
or ebx, 0xffffffff
mov dword [ebp - 0x38], 0xc004d501
xor eax, eax
test esi, esi
je 0xc0ecd8
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x38], 0
jl 0xc0ee1b
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xc0edf7
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x60]
jne 0xc0ed0c
sub ecx, ebx
xor eax, eax
push edi
sar ecx, 1
push edx
push eax
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc0ee14
xor eax, eax
mov edx, 0x5a4d
mov ecx, eax
mov eax, dword [edi]
mov dword [ebp - 0x30], ecx
cmp word [eax], dx
je 0xc0ed4f
mov ecx, 0xc000007b
mov dword [ebp - 0x30], ecx
jmp 0xc0ed99
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xc0ed45
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xc0ed45
cmp dword [edx], 0x4550
jne 0xc0ed45
movzx eax, word [edx + 0x18]
mov ebx, 0x10b
cmp ax, bx
je 0xc0ed87
mov ebx, 0x20b
cmp ax, bx
je 0xc0ed87
mov ecx, 0xc000000d
jmp 0xc0ed4a
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
xor edx, edx
add esi, 6
mov dword [ebp - 0x44], eax
mov ebx, edx
test eax, eax
je 0xc0edeb
mov edx, esi
mov dword [ebp - 0x38], esi
lea eax, [edx + 1]
mov dword [ebp - 0x50], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xc0edb5
sub edx, dword [ebp - 0x50]
inc esi
add esi, edx
test ecx, ecx
js 0xc0ede2
push dword [ebp - 0x38]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xc0edf7
mov ecx, dword [ebp - 0x48]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0x30]
inc dword [ebp - 0x48]
inc ebx
cmp ebx, dword [ebp - 0x44]
jb 0xc0edaa
add edi, 0x10
cmp byte [esi], 0
jne 0xc0ed05
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
test esi, esi
je 0xc0ee25
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor edi, edi
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc0ee27
mov ebx, 0xc000007a
jmp 0xc0edfa
mov esi, dword [ebp - 0x34]
mov ebx, 0xc000007a
jmp 0xc0edfd
xor edi, edi
test ebx, ebx
jns 0xc0ee67
mov esi, edi
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xc0ee3e
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc0ee2d
push 0x40
push edi
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc0ee72
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push dword [ebp - 0x64]
mov esi, dword [0xc9303c]
xor eax, eax
mov ebx, dword [ebp - 0x4c]
mov ecx, esi
push ebx
mov dword [ebp - 0x38], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov edi, eax
xor eax, eax
mov ecx, esi
push eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x6c]
push ebx
call dword [0xc99200]
call esi
test eax, eax
jne 0xc0eec4
mov dword [ebp - 0x38], 0x80004005
test edi, edi
je 0xc0eeda
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
push ebx
call dword [0xc99200]
call esi
mov edx, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc0eedf
mov eax, dword [0xc95890]
test eax, eax
jle 0xc0ef3b
sub eax, 1
mov dword [0xc95890], eax
jne 0xc0ef3b
xor esi, esi
mov edi, esi
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xc0ef14
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xc0ef03
push 0x40
push esi
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xffffffff
je 0xc0ef54
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [ebp - 0x70]
push ebx
call dword [sym.imp.ext_ms_win_gdi_draw_l1_1_1.dll_SetBkMode]
mov eax, dword [ebp - 0x74]
test byte [eax + 0x10], 0x10
je 0xc0ef8a
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x24]
push 0xfffffffffffffffc
push 0xfffffffffffffffc
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_InflateRect]
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_DrawFocusRect]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00ab3c50
leave
ret 8