Function at 0x409c70
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x80
mov dword [esp], ecx
mov edx, dword [ecx + 0x80]
mov dword [esp + 0x14], 0xebecea3f
mov dword [esp + 0x18], 0x4ef6ef19
mov dword [esp + 0x1c], 0x2f6f814
mov dword [esp + 0x20], 0xff0b453a
mov dword [esp + 0x24], 0x70908fc
mov dword [esp + 0x28], 0x7000801
mov dword [esp + 0x2c], 0x4bb09c3
mov dword [esp + 0x30], 0xfcfffbf2
mov dword [esp + 0x34], 0x9290940c
mov dword [esp + 0x38], 0x9d92
xor esi, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, esi
and ebp, 0x54
mov ebx, edi
xor ebx, 0xea
add ebx, ebp
xor bl, byte [esp + edi + 0x14]
add bl, 0x6e
mov byte [esp + edi + 0x14], bl
inc edi
add esi, 2
cmp edi, 0x28
jne 0x409ce0
mov dword [esp + 0xc], 0x190c0872
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
add al, 0x3b
xor al, byte [esp + ebx + 0xc]
add al, 0xd9
mov byte [esp + ebx + 0xc], al
inc ebx
cmp ebx, 7
jne 0x409d20
mov dword [esp + 0x40], 0xa08bc5c3
mov dword [esp + 0x44], 0xbbb5a7be
mov dword [esp + 0x48], 0xb292f8a0
mov dword [esp + 0x4c], 0xa8ababad
mov dword [esp + 0x50], 0x90b5abb7
mov dword [esp + 0x54], 0x83c2d98e
mov dword [esp + 0x58], 0xc6899595
mov dword [esp + 0x5c], 0x8e9e888c
mov dword [esp + 0x60], 0x9280cfd1
mov dword [esp + 0x64], 0xd7cd949f
mov dword [esp + 0x68], 0x9e9a9c92
mov dword [esp + 0x6c], 0x9bdac6da
mov dword [esp + 0x70], 0x6f999397
mov dword [esp + 0x74], 0x3a656c63
mov word [esp + 0x78], 0x726
mov dword [esp + 0x7a], 0
mov word [esp + 0x7e], 0
mov esi, 0x3ec8a9b2
mov edi, 0xc137564d
mov ebp, 0x4137564e
mov ecx, dword [esp + 0x94]
movzx ebx, byte [esp + edi + 0x3ec8a9f3]
mov eax, esi
or eax, ebx
add eax, ebp
add eax, eax
sub ebx, eax
add ebx, edi
mov eax, ebx
and eax, 1
or ebx, 1
add ebx, eax
add bl, 0x7e
mov byte [esp + edi + 0x3ec8a9f3], bl
dec esi
inc edi
inc ebp
cmp esi, 0x3ec8a972
jne 0x409dd0
add ecx, edx
mov word [esp + 4], 0xa4a5
mov byte [esp + 6], 0x92
mov word [esp + 7], 0
mov edx, 0x24
mov esi, 0x5b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, esi
and eax, 0x48
mov ebx, edx
and ebx, 0x27
sub ebx, eax
xor bl, byte [esp + edx - 0x20]
add bl, 0xb4
mov byte [esp + edx - 0x20], bl
inc edx
dec esi
cmp edx, 0x29
jne 0x409e30
movzx ebx, byte [esp + 4]
mov edx, ecx
test bl, bl
je 0x409e6b
lea esi, [esp + 5]
mov edx, ecx
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x409e60
mov byte [edx], 0
mov eax, dword [esp]
movzx ebx, byte [eax + 0x60]
test bl, bl
je 0x409e9d
lea esi, [eax + 0x61]
mov eax, dword [esp + 0x98]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x409e90
jmp 0x409ea4
mov eax, dword [esp + 0x98]
mov byte [edx], 0
movzx ebx, byte [esp + 0x40]
test bl, bl
je 0x409ecb
lea esi, [esp + 0x41]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x409ec0
mov byte [edx], 0
movzx ebx, byte [eax]
test bl, bl
mov dword [esp + 0x3c], ecx
je 0x409eeb
inc eax
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [eax]
inc eax
test bl, bl
jne 0x409ee0
mov byte [edx], 0
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x409f0b
lea esi, [esp + 0xd]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409f00
mov byte [edx], 0
movzx ecx, byte [esp + 0x14]
test cl, cl
je 0x409f2b
lea esi, [esp + 0x15]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409f20
mov byte [edx], 0
mov esi, dword [esp + 0xa0]
mov ecx, esi
shr ecx, 2
mov ebp, dword [esp + 0x9c]
mov eax, ebp
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, esi
mov ebx, esi
and ebx, 0xfffffffc
lea esi, [edx + ebx]
add ebx, ebp
mov ecx, eax
mov ebp, eax
shr ecx, 1
and ecx, 1
mov eax, ebx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, ebp
test al, 1
je 0x409f7e
mov eax, dword [esp + 0xa0]
and eax, 2
movzx ecx, byte [ebx + eax]
mov byte [esi + eax], cl
mov dword [esp + 0x40], 0x4f494d4f
mov byte [esp + 0x44], pe_nt_image_headers32
mov dword [esp + 0x45], 0
mov dword [esp + 0x48], 0
xor ecx, ecx
nop
nop
nop
movzx esi, byte [esp + ecx + 0x40]
mov eax, ecx
xor eax, 0x96e77614
mov edi, ecx
or edi, 0xb
and edi, eax
mov eax, edi
and eax, 0xd
mov ebx, ecx
and ebx, 2
or edi, 2
imul edi, ebx
mov ebp, ebx
xor ebp, 2
imul ebp, eax
mov ebx, ecx
xor ebx, 0x691889eb
add ebx, ebp
add ebx, edi
xor ebx, esi
mov eax, ebx
and eax, 1
or ebx, 1
add ebx, eax
add bl, 0x68
mov byte [esp + ecx + 0x40], bl
lea eax, [ecx + ecx]
and eax, 2
mov esi, eax
and esi, ecx
xor eax, ecx
xor eax, 1
lea ecx, [eax + esi*2]
cmp ecx, 0xc
jb 0x409fa0
mov dword [esp + 0x14], 0x2e2fcbcd
mov byte [esp + 0x18], 0xc4
mov word [esp + 0x19], 0
mov byte [esp + 0x1b], 0
xor ecx, ecx
nop
nop
nop
nop
mov eax, ecx
add al, 0x30
xor al, byte [esp + ecx + 0x14]
add al, 0x10
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 8
jne 0x40a020
add edx, dword [esp + 0xa0]
movzx ecx, byte [esp + 0x14]
test cl, cl
je 0x40a05d
lea esi, [esp + 0x15]
mov eax, dword [esp]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x40a050
jmp 0x40a060
mov eax, dword [esp]
mov byte [edx], 0
movzx ecx, byte [eax + 0x60]
test cl, cl
je 0x40a07b
lea esi, [eax + 0x61]
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x40a070
mov byte [edx], 0
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x40a09b
lea esi, [esp + 0x41]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x40a090
mov byte [edx], 0
sub edx, dword [esp + 0x3c]
add dword [eax + 0x80], edx
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret 0x10