Function at 0xcd6c3f
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov bx, word [esp]
mov bh, 0x90
inc dx
jmp 0xcd6b0d
push ebp
push esi
mov ebp, ecx
jmp 0xcd6ba5
jmp 0xcffcab
xor edx, esi
lea edi, [ebx*4]
mov bh, 0x22
mov bl, 0x65
shr edi, 0xf
jmp 0xcd6b85
setno bh
shl edx, 8
xchg ebp, edi
movzx esi, byte [eax + 1]
jmp 0xcd6b44
mov bp, word [esp]
xor edx, esi
mov bp, 0x17b
bsf bx, cx
jmp 0xcd6c00
movzx esi, byte [eax + 2]
xchg bh, bl
shl edx, 8
setnp bl
jmp 0xcd6b6b
push edi
dec si
movzx edx, byte [eax]
mov bx, 0xba3a
pushal
jmp 0xcd6b5d
not dl
mov edx, dword [esp]
lea esi, [ebx*4]
not bh
jmp 0xcd6bde
xor edx, esi
pushfd
mov di, word [esp + 2]
lea ebp, reloc.mscoree.dll__CorExeMain
mov dword [ecx], edx
jmp 0xcd6bb2
movzx edx, byte [eax + 4]
movzx esi, byte [eax + 5]
call fcn.00cd6c21
jl 0xcd6c3c
salc
inc ecx
pop ecx
inc esp
cmp dword [edx + 0x54], eax
xor al, 0x6f
out 0xf3, eax
movsd dword es:[edi], dword [esi]
jmp 0xd96c38
movzx esi, byte [eax + 3]
shr bx, 0xc
shl edx, 8
jmp 0xcd6bc8
or al, 0
mov ch, 0x55
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0xcd6c56
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
xor esi, dword [ecx + 4]
movzx edi, byte [eax + 8]
movzx ebx, byte [eax + 0xd]
mov dword [ebp - 0x14], esi
movzx esi, byte [eax + 9]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xa]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xb]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xc]
xor edi, dword [ecx + 8]
xor edx, dword [ecx]
shl esi, 8
xor esi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl esi, 8
xor esi, ebx
shl esi, 8
xor esi, eax
xor esi, dword [ecx + 0xc]
mov dword [ebp - 0xc], edi
shr edi, 8
mov ebx, esi
shr ebx, 0x10
mov eax, 0xff
and edi, eax
and ebx, eax
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
xor ebx, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
mov edi, edx
shr edi, 0x18
xor ebx, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
mov edi, dword [ebp - 0x14]
and edi, eax
xor ebx, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
mov dword [ebp - 8], esi
xor ebx, dword [ecx + 0x10]
shr esi, 8
mov edi, edx
shr edi, 0x10
and edi, eax
and esi, eax
mov dword [ebp - 4], edi
mov edi, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 4]
xor edi, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 0x14]
mov dword [ebp + 8], edx
mov dword [ebp - 0x10], ebx
shr esi, 0x18
xor edi, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 0xc]
and esi, eax
xor edi, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 0x14]
shr esi, 0x10
shr edx, 8
and esi, eax
and edx, eax
mov dword [ebp - 4], edx
mov edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 4]
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 0xc]
shr esi, 0x18
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 8]
and esi, eax
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 0x14]
xor edx, dword [ecx + 0x18]
xor edi, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0xc]
shr edx, 0x10
shr esi, 8
and edx, eax
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
and esi, eax
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 8]
shr esi, 0x18
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp + 8]
and esi, eax
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 0x18]
xor edx, dword [ecx + 0x1c]
sar esi, 1
add ecx, 0x20
dec esi
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], esi
je 0xcd6fd0
mov esi, dword [ebp - 4]
shr esi, 8
and esi, eax
shr edx, 0x10
and edx, eax
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, ebx
shr esi, 0x18
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, edi
and esi, eax
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, ebx
xor edx, dword [ecx]
shr esi, 0x10
mov dword [ebp + 8], edx
mov edx, dword [ebp - 8]
and esi, eax
shr edx, 8
and edx, eax
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, edi
shr esi, 0x18
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, dword [ebp - 4]
shr ebx, 8
and ebx, eax
and esi, eax
xor edx, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, edi
shr esi, 0x10
and esi, eax
mov esi, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
xor esi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 4]
shr ebx, 0x18
xor esi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 8]
and ebx, eax
xor esi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 4]
shr edi, 8
shr ebx, 0x10
and edi, eax
xor esi, dword [ecx + 8]
and ebx, eax
mov dword [ebp - 0x18], edi
mov edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 0x18]
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 8]
shr ebx, 0x18
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 0x10]
xor edx, dword [ecx + 4]
and ebx, eax
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, esi
xor edi, dword [ecx + 0xc]
shr ebx, 8
mov dword [ebp - 8], edi
shr edi, 0x10
and edi, eax
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
and ebx, eax
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp + 8]
shr ebx, 0x18
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, edx
and ebx, eax
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp + 8]
xor edi, dword [ecx + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 8]
shr edi, 8
and edi, eax
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
shr ebx, 0x10
and ebx, eax
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
and esi, eax
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp + 8]
xor edi, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
mov esi, edx
shr esi, 0x10
and esi, eax
mov esi, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
shr ebx, 8
and ebx, eax
xor esi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 0xc]
shr ebx, 0x18
xor esi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 8]
xor edi, dword [ecx + 0x14]
and ebx, eax
xor esi, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 0x10]
xor esi, dword [ecx + 0x18]
shr edx, 8
mov dword [ebp - 4], esi
mov esi, dword [ebp - 0xc]
shr esi, 0x10
and esi, eax
mov esi, dword [esi*4 + reloc.mscoree.dll__CorExeMain]
and edx, eax
xor esi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
mov edx, dword [ebp - 8]
shr edx, 0x18
xor esi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
mov edx, dword [ebp + 8]
and edx, eax
xor esi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
add ecx, 0x20
xor esi, dword [ecx - 4]
dec dword [ebp - 0x14]
mov dword [ebp - 8], esi
mov edx, esi
jne 0xcd6df3
shr edx, 0x10
and edx, eax
mov esi, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
mov edx, dword [ebp - 4]
shr edx, 8
and edx, eax
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
and edx, 0xff00
and esi, 0xff0000
xor esi, edx
mov edx, ebx
shr edx, 0x18
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
and edx, 0xff000000
xor esi, edx
shr ebx, 0x10
mov edx, edi
and edx, eax
movzx edx, byte [edx*4 + 0xce6c18]
xor esi, edx
xor esi, dword [ecx]
and ebx, eax
mov dword [ebp + 8], esi
mov edx, esi
mov esi, dword [ebp + 0xc]
shr edx, 0x18
mov byte [esi], dl
mov edx, dword [ebp + 8]
shr edx, 0x10
mov byte [esi + 1], dl
mov edx, dword [ebp + 8]
shr edx, 8
mov byte [esi + 2], dl
mov dl, byte [ebp + 8]
mov byte [esi + 3], dl
mov edx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov ebx, dword [ebp - 8]
shr ebx, 8
and ebx, eax
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
and ebx, 0xff00
and edx, 0xff0000
xor edx, ebx
mov ebx, edi
shr ebx, 0x18
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
and ebx, 0xff000000
xor edx, ebx
mov ebx, dword [ebp - 4]
and ebx, eax
movzx ebx, byte [ebx*4 + 0xce6c18]
xor edx, ebx
xor edx, dword [ecx + 4]
mov ebx, edx
shr ebx, 0x18
mov byte [esi + 4], bl
mov ebx, edx
shr ebx, 0x10
mov byte [esi + 5], bl
mov ebx, edx
shr ebx, 8
mov byte [esi + 6], bl
mov ebx, dword [ebp - 0x10]
mov byte [esi + 7], dl
shr ebx, 8
and ebx, eax
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
mov edx, edi
shr edx, 0x10
and edx, eax
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
and ebx, 0xff00
and edx, 0xff0000
xor edx, ebx
mov ebx, dword [ebp - 4]
shr ebx, 0x18
mov ebx, dword [ebx*4 + reloc.mscoree.dll__CorExeMain]
and ebx, 0xff000000
xor edx, ebx
mov ebx, dword [ebp - 8]
and ebx, eax
movzx ebx, byte [ebx*4 + 0xce6c18]
xor edx, ebx
xor edx, dword [ecx + 8]
shr edi, 8
mov ebx, edx
shr ebx, 0x18
mov byte [esi + 8], bl
mov ebx, edx
mov byte [esi + 0xb], dl
and edi, eax
shr ebx, 0x10
mov byte [esi + 9], bl
mov ebx, edx
mov edx, dword [ebp - 4]
shr edx, 0x10
and edx, eax
shr ebx, 8
mov byte [esi + 0xa], bl
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
mov edx, dword [edx*4 + reloc.mscoree.dll__CorExeMain]
and edi, 0xff00
and edx, 0xff0000
xor edx, edi
mov edi, dword [ebp - 8]
shr edi, 0x18
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
and edi, 0xff000000
xor edx, edi
mov edi, dword [ebp - 0x10]
and edi, eax
movzx eax, byte [edi*4 + 0xce6c18]
xor edx, eax
xor edx, dword [ecx + 0xc]
mov eax, edx
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [esi + 0xe], al
mov byte [esi + 0xf], dl
jmp 0xcd718f
pop edi
pop esi
pop ebx
leave
ret 8
jmp 0xcd6b2e
jmp 0xcd7196
jmp 0xcd6ae1
mov ecx, esp
cdq
mov ah, 0x2e
mov cl, 0x4f
mov ebx, 0x36ad9045
mov byte [0x4f231e5a], al
push ecx
rcl byte [ebx - 0x22]
mov bl, 0xf0
inc eax
imul edx, dword [ebx - reloc.mscoree.dll__CorExeMain], 0xd3af258b
mov bl, 0x6d
cmp eax, 0x1aba41d2
aam 0x55
mov ch, 0xa7
sub al, 7
fnstcw word [esi + 0x2f]
bswap edx
xchg esp, eax
cmp ebp, ecx
invalid
push esp
xor bh, bl
inc eax
add edi, dword [edx + reloc.mscoree.dll__CorExeMain]
ljmp 0x66b6
or ch, byte [edx + 0x42]
sbb eax, 0x14830367
mov fs, ebp
jl 0xd96b93
loopne 0xd96c54
xchg dword [ebp + eax + 0x390ffffa], ebp
add eax, 0x390ffffa
or dword [edx + 0x58], reloc.mscoree.dll__CorExeMain
xlatb
cld
cmp eax, 0xc9989756
jle 0xd96bd0
sbb al, 0xd
and dh, byte [ebx + 0x38]
xchg dword [ebx - 0x59], edx
inc esi
inc ebp
sbb edi, dword [edx - 0x6283b895]
imul eax, dword [edi + 0x7c], reloc.mscoree.dll__CorExeMain
out dx, eax
sbb al, 0xfd
mov eax, dword [reloc.mscoree.dll__CorExeMain]
jbe 0xd96c40
pop edi
jne 0xd96bec
enter 0x44da, 0xffffffffffffffc6
push esp
xor ecx, esi
mov al, byte [0x81687bf6]
pop edi
mov al, byte [0x1b7be802]
idiv byte [ebx + 0x68]
sbb dword [edi - 0x60], 0x1b7be802
push 0x2a05f81
call fcn.00ce87bd
loop 0xd96c68
cmc
jmp edx
cmpsb byte [esi], byte es:[edi]
xor al, 0xaa
pop eax
out 0x82, eax
push ecx
invalid
xchg edx, eax
push edi
push ecx
invalid
sti
loope 0xd96c36
mov bh, 0x7a
loope 0xd96c1d
mov ch, 0xef
sbb edi, dword [edi - 0x58]
and bh, byte [edi]
jbe 0xd96bfc
dec eax
cmp esp, ebx
aas
or eax, 0x4ed94ec8
sahf
pop ecx
cmp eax, 0xb51880e6
xor al, 0x36
and dword [eax - 0x5d], esp
fidivr dword [esi]
int 0x8b
invalid