Function at 0x403c1d
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x401130]
xor eax, ebp
mov dword [ebp - 4], eax
or al, 0xff
push ebx
sub ebx, ebx
push esi
mov byte [ebp - 0x5f], al
mov byte [ebp - 0x32], al
mov byte [ebp - 0x7e], al
mov byte [ebp - 0x6e], al
push edi
mov dword [ebp - 0x14], 0xf0ecfbf5
mov dword [ebp - 0x10], 0xacadf2fb
mov dword [ebp - 0xc], 0xf2f2fab0
mov byte [ebp - 8], bl
mov dword [ebp - 0x64], 0xeaecf7c8
mov byte [ebp - 0x60], 0xeb
mov dword [ebp - 0x5e], 0xf1eccef2
mov dword [ebp - 0x5a], 0xeafdfbea
mov byte [ebp - 0x56], bl
mov dword [ebp - 0x44], 0xfaf0f7d8
mov dword [ebp - 0x40], 0xf1edfbcc
mov dword [ebp - 0x3c], 0xfbfdeceb
mov word [ebp - 0x38], 0xdf
mov word [ebp - 0x34], 0xf1d2
mov dword [ebp - 0x31], 0xedfbccfa
mov dword [ebp - 0x2d], 0xfdecebf1
mov word [ebp - 0x29], 0xfb
mov dword [ebp - 0x54], 0xfbe4f7cd
mov dword [ebp - 0x50], 0xfbccf8f1
mov dword [ebp - 0x4c], 0xecebf1ed
mov word [ebp - 0x48], 0xfbfd
mov byte [ebp - 0x46], bl
mov dword [ebp - 0x24], 0xf5fdf1d2
mov dword [ebp - 0x20], 0xf1edfbcc
mov dword [ebp - 0x1c], 0xfbfdeceb
mov byte [ebp - 0x18], bl
mov dword [ebp - 0x8c], 0xd3eafbd9
mov dword [ebp - 0x88], 0xf2ebfaf1
mov dword [ebp - 0x84], 0xf2f7d8fb
mov word [ebp - 0x80], 0xd0fb
mov dword [ebp - 0x7d], 0xdffbf3
mov dword [ebp - 0x78], 0xd3eafbd9
mov dword [ebp - 0x74], 0xf2ebfaf1
mov word [ebp - 0x70], 0xd6fb
mov dword [ebp - 0x6d], 0xfbf2faf0
mov word [ebp - 0x69], 0xdf
sub eax, eax
xor byte [ebp + eax - 0x14], 0x9e
inc eax
cmp eax, 0xc
jb 0x403d30
sub eax, eax
xor byte [ebp + eax - 0x78], 0x9e
inc eax
cmp eax, 0x10
jb 0x403d3d
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [0x409528]
push eax
call dword [0x409524]
mov dword [0x4094ac], eax
sub eax, eax
xor byte [ebp + eax - 0x64], 0x9e
inc eax
cmp eax, 0xe
jb 0x403d66
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [0x409528]
push eax
call dword [0x409524]
mov dword [0x4094c4], eax
sub eax, eax
xor byte [ebp + eax - 0x44], 0x9e
inc eax
cmp eax, 0xd
jb 0x403d8f
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [0x409528]
push eax
call dword [0x409524]
mov dword [0x4094c0], eax
sub eax, eax
xor byte [ebp + eax - 0x34], 0x9e
inc eax
cmp eax, 0xc
jb 0x403db8
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [0x409528]
push eax
call dword [0x409524]
mov dword [0x4094bc], eax
sub eax, eax
xor byte [ebp + eax - 0x24], 0x9e
inc eax
cmp eax, 0xc
jb 0x403de1
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [0x409528]
push eax
call dword [0x409524]
mov dword [0x4094b4], eax
sub eax, eax
xor byte [ebp + eax - 0x54], 0x9e
inc eax
cmp eax, 0xe
jb 0x403e0a
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [0x409528]
push eax
call dword [0x409524]
push ebx
mov dword [0x4094b8], eax
call dword [0x4094ac]
push 4
push eax
pop esi
push 0xa
push esi
call dword [0x4094c0]
push eax
pop edi
push edi
push esi
call dword [0x4094bc]
push eax
call dword [0x4094b4]
push edi
push esi
mov dword [ebp - 0x194], eax
call dword [0x4094b8]
push edi
push ebx
call dword [0x4094b8]
push eax
pop esi
cmp esi, ebx
jne 0x403e79
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub eax, eax
xor byte [ebp + eax - 0x8c], 0x9e
inc eax
cmp eax, 0x12
jb 0x403e7b
lea eax, [ebp - 0x8c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [0x409528]
push eax
call dword [0x409524]
push 0x104
lea ecx, [ebp - 0x190]
push ecx
push ebx
mov dword [0x4094b0], eax
call eax
push 4
push esi
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x194]
mov dword [ebp - 0x198], 0x333231
call fcn.0040358b
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.004036a5
add esp, 0x18
jmp 0x403e72