Function at 0x40dca0
Capabilities:
Encode data using xor
Enumerate process modules
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10d0
call fcn.00457050
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40eba0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
push eax
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edx, eax
inc eax
cmp eax, 1
ja 0x40dcf6
call fcn.004310b0
test eax, eax
jne 0x40e3ac
lea eax, [ebp - 0x47c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], 0
push eax
call fcn.004304e0
add esp, 4
movdqu xmm0, xmmword [ebp - 0x478]
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x8a4], 0x428
lea ecx, [ebp - 0x884]
movdqu xmmword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x888], eax
lea eax, [ebp - 0x45c]
push 0x200
push eax
push ecx
call fcn.00457b70
add esp, 0xc
lea eax, [ebp - 0x25c]
lea ecx, [ebp - 0x684]
push 0x208
push eax
push ecx
call fcn.00457b70
add esp, 0xc
lea eax, [ebp - 0x8a4]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x40e04b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
nop word cs:[eax + eax]
nop
lea eax, [ebp - 0x884]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.004308d0
add esp, 8
mov eax, dword [ebp - 0x47c]
cmp eax, 0x80000000
je 0x40dfe7
mov ebx, dword [ebp - 0x474]
mov edi, dword [ebp - 0x478]
mov dword [ebp - 0x20], eax
test ebx, ebx
mov dword [ebp - 0x24], edi
je 0x40dfa1
js 0x40e6dd
movzx eax, byte [0x472181]
push 1
mov edi, ebx
push ebx
call fcn.0040b8c0
add esp, 8
test eax, eax
je 0x40e6d6
mov esi, eax
mov ebx, eax
push edi
push dword [ebp - 0x24]
push esi
call fcn.00457b70
add esp, 0xc
cmp edi, 8
mov ecx, esi
mov ebx, edi
mov dword [ebp - 0x38], esi
jb 0x40df40
xor eax, eax
cmp ebx, 0x20
jb 0x40decf
movdqa xmm5, xmmword [0x4602b0]
movdqa xmm6, xmmword [0x4602c0]
movdqa xmm7, xmmword [0x4602d0]
mov eax, ebx
lea ecx, [esi + 0x10]
and eax, 0x7fffffe0
mov edx, eax
movdqu xmm1, xmmword [ecx - 0x10]
movdqu xmm0, xmmword [ecx]
movdqa xmm2, xmm1
movdqa xmm3, xmm0
paddb xmm2, xmm5
paddb xmm3, xmm5
movdqa xmm4, xmm2
pminub xmm4, xmm6
pcmpeqb xmm4, xmm2
movdqa xmm2, xmm3
pminub xmm2, xmm6
pand xmm4, xmm7
pcmpeqb xmm2, xmm3
pxor xmm4, xmm1
pand xmm2, xmm7
movdqu xmmword [ecx - 0x10], xmm4
pxor xmm2, xmm0
movdqu xmmword [ecx], xmm2
add ecx, 0x20
add edx, 0xffffffe0
jne 0x40de70
cmp ebx, eax
je 0x40df6a
test bl, 0x18
je 0x40df32
movdqa xmm3, xmmword [0x4602e0]
movdqa xmm4, xmmword [0x4602f0]
movdqa xmm5, xmmword [0x460300]
mov edx, ebx
lea edi, [esi + eax]
and edx, 0x7ffffff8
lea ecx, [esi + edx]
sub eax, edx
nop word [eax + eax]
movq xmm0, qword [edi]
movdqa xmm1, xmm0
paddb xmm1, xmm3
movdqa xmm2, xmm1
pmaxub xmm2, xmm4
pcmpeqb xmm2, xmm1
pandn xmm2, xmm5
pxor xmm2, xmm0
movq qword [edi], xmm2
add edi, 8
add eax, 8
jne 0x40df00
cmp ebx, edx
jne 0x40df40
jmp 0x40df6a
add eax, esi
mov ecx, eax
nop word cs:[eax + eax]
add esi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx eax, byte [ecx]
mov edx, eax
add dl, 0x9f
cmp dl, 0x1a
setb dl
shl dl, 5
xor dl, al
mov byte [ecx], dl
inc ecx
cmp ecx, esi
jne 0x40df50
test ebx, ebx
je 0x40dfa1
mov esi, dword [ebp - 0x38]
cmp ebx, 0xc
jne 0x40df8e
push 0xc
push str.KERNEL32.DLLImageDirectoryEntryToDataEx_failed
push esi
call fcn.004585fa
add esp, 0xc
test eax, eax
je 0x40e1d3
push 1
push ebx
push esi
call fcn.0040b8d0
add esp, 0xc
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x8a4]
mov dword [ebp - 0x10], 1
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x40dfc9
call fcn.004310b0
test eax, eax
jne 0x40e0c2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40ddb0
push 1
push eax
push dword [ebp - 0x24]
call fcn.0040b8d0
add esp, 0xc
jmp 0x40ddb0
call fcn.0045c610
mov edi, eax
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40e6ba
call fcn.004310b0
test eax, eax
je 0x40e6ba
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 3
push 0x45feb4
push 0x45fdc0
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x45fd93
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
call fcn.004310b0
test eax, eax
je 0x40dd9e
push edx
push eax
call fcn.0045c170
add esp, 8
mov edi, eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40e6ba
call fcn.004310b0
test eax, eax
je 0x40e6ba
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 2
push 0x45feb4
push 0x45fdc0
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x45fd93
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
push edx
push eax
call fcn.0045c170
add esp, 8
mov edi, eax
xor ebx, ebx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40e0ec
push 1
push eax
push dword [ebp - 0x24]
call fcn.0040b8d0
add esp, 0xc
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40e10e
call fcn.004310b0
test eax, eax
jne 0x40e74d
test bl, bl
je 0x40e6ba
movq xmm0, qword [ebp - 0x54]
movq xmm1, qword [ebp - 0x4c]
lea eax, [ebp - 0xcb4]
lea ecx, [ebp - 0x10dc]
movq qword [ebp - 0xcc0], xmm1
movq qword [ebp - 0xcc8], xmm0
push 0x410
push ecx
push eax
call fcn.00457b70
add esp, 0xc
lea eax, [ebp - 0xaac]
mov dword [ebp - 0xccc], edi
mov dword [ebp - 0xcb8], esi
push 0
push 0x80
push 3
push 0
push 0
push 0x120089
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [eax + 1]
mov dword [ebp - 0x3c], esi
cmp ecx, 1
ja 0x40e192
call fcn.004310b0
mov ecx, eax
mov eax, edx
test ecx, ecx
jne 0x40e549
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 5
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea ecx, [eax + 1]
cmp ecx, 1
ja 0x40e232
call fcn.004310b0
mov ecx, eax
mov eax, edx
test ecx, ecx
je 0x40e232
push eax
push ecx
call fcn.0045c170
add esp, 8
mov edi, eax
jmp 0x40e425
push 1
push 0xc
push esi
call fcn.0040b8d0
add esp, 0xc
lea eax, [ebp - 0x8a0]
mov edi, dword [ebp - 0x8a4]
mov esi, dword [ebp - 0x890]
movq xmm0, qword [eax]
movq xmm1, qword [eax + 8]
lea eax, [ebp - 0x10dc]
movq qword [ebp - 0x54], xmm0
movq qword [ebp - 0x4c], xmm1
push 0x410
lea ecx, [ebp - 0x88c]
push ecx
push eax
call fcn.00457b70
add esp, 0xc
mov bl, 1
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x40e0d7
jmp 0x40e0ec
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 7
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x40e3bd
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.dbghelp.dll_ImageNtHeader]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0
push 0
push eax
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.dbghelp.dll_ImageDirectoryEntryToDataEx]
test eax, eax
je 0x40e483
mov ecx, dword [eax + 0x18]
test ecx, ecx
mov dword [ebp - 0x44], ecx
je 0x40e4c5
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x24]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], edx
push 0
push dword [eax + 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x40e507
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x40e5c9
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x40e608
xor eax, eax
jmp 0x40e32c
xor ebx, ebx
test esi, esi
je 0x40e313
push 1
push esi
push edi
call fcn.0040b8d0
add esp, 0xc
mov esi, dword [ebp - 0x20]
mov edx, ebx
lea eax, [esi + 1]
cmp eax, dword [ebp - 0x44]
setne cl
xor dl, 1
test cl, dl
je 0x40e550
mov ecx, eax
push 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], ecx
push dword [eax + ecx*4]
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov dword [ebp - 0x10dc], eax
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x8a4]
push eax
call fcn.004307b0
add esp, 8
cmp dword [ebp - 0x8a4], 0x80000000
jne 0x40e6f5
mov esi, dword [ebp - 0x8a0]
mov edi, dword [ebp - 0x89c]
cmp dword [ebp - 0x898], 0xc
jne 0x40e301
push 0xc
push 0x460508
push edi
call fcn.004585fa
add esp, 0xc
test eax, eax
sete bl
test esi, esi
jne 0x40e307
jmp 0x40e313
push edx
push eax
call fcn.0045c170
add esp, 8
mov edi, eax
jmp 0x40e6ba
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x47c], 0x460528
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x474], 4
mov dword [ebp - 0x470], 0
call fcn.0045c030
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x40e425
call fcn.004310b0
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x40e82a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40e6ba
call fcn.004310b0
test eax, eax
je 0x40e6ba
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 0x10
push 0x45feb4
push 0x45fdc0
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x45fd93
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x47c], 0x460474
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x474], 4
mov dword [ebp - 0x470], 0
call fcn.0045c030
jmp 0x40e645
lea ecx, [ebp - 0x47c]
mov dword [ebp - str.NumberOfNames_is_0], 0x460490
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x474], 4
mov dword [ebp - 0x470], 0
call fcn.0045c030
jmp 0x40e645
lea ecx, [ebp - 0x47c]
mov dword [ebp - str.ImageRvaToVa_failed], 0x4604ac
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x474], 4
mov dword [ebp - 0x470], 0
call fcn.0045c030
jmp 0x40e645
push eax
push ecx
jmp 0x40e3ae
mov ecx, dword [ebp - 0x3c]
test bl, bl
je 0x40e85f
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x34]
movzx eax, word [eax + esi*2]
add ecx, dword [edx + eax*4]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x40e599
call fcn.004310b0
test eax, eax
jne 0x40e86e
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0xa
push eax
call fcn.0040c620
add esp, 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x10], 0xffffffff
push eax
call fcn.0040c620
add esp, 4
mov edi, dword [ebp - 0x3c]
xor eax, eax
jmp 0x40e6bf
lea ecx, [ebp - 0x47c]
mov dword [ebp - str.ImageRvaToVa_failed], 0x4604ac
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x474], 4
mov dword [ebp - 0x470], 0
call fcn.0045c030
jmp 0x40e645
lea ecx, [ebp - 0x47c]
mov dword [ebp - str.ImageRvaToVa_failed], 0x4604ac
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x474], 4
mov dword [ebp - 0x470], 0
call fcn.0045c030
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0x47c], eax
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x40e670
call fcn.004310b0
test eax, eax
jne 0x40e785
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 0xa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x40e698
call fcn.004310b0
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x40e7bd
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40e6ba
call fcn.004310b0
test eax, eax
jne 0x40e7f5
mov eax, 1
mov ecx, dword [ebp - 0x18]
mov edx, edi
mov dword fs:[0], ecx
add esp, 0x10d0
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 1
jmp 0x40e6df
xor eax, eax
mov dword [ebp - 0x10], 1
push ebx
push eax
call fcn.0045d9b0
add esp, 8
jmp 0x40e8a1
mov eax, dword [ebp - 0x894]
movq xmm0, qword [ebp - 0x8a4]
movq xmm1, qword [ebp - 0x89c]
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x46c], eax
movq qword [ebp - 0x474], xmm1
movq qword [ebp - 0x47c], xmm0
push 0x4604f8
push 0x4603bc
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x4603cc
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 4
push 0x45feb4
push 0x45fdc0
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x45fd93
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 0xd
push 0x460530
push 0x4603f8
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x4603cc
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 0xb
push 0x45feb4
push 0x45fdc0
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x45fd93
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 0xf
push 0x45feb4
push 0x45fdc0
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x45fd93
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 6
push 0x45feb4
push 0x45fdc0
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x45fd93
call fcn.0045de40
add esp, 0x14
jmp 0x40e8a1
push 0x4604e8
call fcn.0045da90
add esp, 4
jmp 0x40e8a1
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x10], 0xe
push 0x460530
push 0x4603f8
lea eax, [ebp - 0x47c]
push eax
push 0x2b
push 0x4603cc
call fcn.0045de40
add esp, 0x14
ud2