Function at 0x41cfd0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1e2c
call fcn.0040a270
mov ax, word [0x429b0c]
movq xmm0, qword [str.Password_Protected]
mov word [esp + 0x2c], ax
mov al, byte [0x429b0e]
push ebx
movq qword [esp + 0x20], xmm0
movq xmm0, qword [0x429b04]
mov byte [esp + 0x32], al
xor eax, eax
push esi
xor ebx, ebx
push edi
movq qword [esp + 0x30], xmm0
mov dword [esp + 0x3b], eax
mov word [esp + 0x3f], ax
mov dword [esp + 0x14], ebx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov esi, eax
mov edx, 0xb616c5d9
mov ecx, esi
call fcn.0041d340
mov edx, 0xe0baa99
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.0041d340
mov edx, 0x9347c911
mov ecx, esi
mov edi, eax
call fcn.0041d340
push 0xa
push str.IEUCIZEO
push ebx
call eax
push eax
push ebx
lea esi, [esp + 0x438]
call edi
mov ecx, eax
test ecx, ecx
je 0x41d092
mov eax, esi
sub ecx, eax
mov ebx, 0x1a05
mov al, byte [ecx + esi]
mov byte [esi], al
lea esi, [esi + 1]
dec ebx
jne 0x41d087
xor eax, eax
mov cl, byte [esp + eax + 0x430]
not cl
xor cl, al
sub cl, al
xor cl, al
dec cl
xor cl, 0x73
sub cl, al
xor cl, 0x6c
sub cl, 0x56
xor cl, 0x9d
not cl
mov byte [esp + eax + 0x430], cl
inc eax
cmp eax, 0x1a05
jb 0x41d094
lea eax, [esp + 0x44]
push eax
push 0x40
push 0x1a05
lea eax, [esp + 0x43c]
push eax
call dword [esp + 0x28]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x448]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GrayStringW]
push 0x428e50
call fcn.004017e4
add esp, 4
mov dword [0x42e0cc], 0x4000a
push dword [0x42e0cc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov edi, 0x14
call fcn.00401e37
lea esi, [eax + 0x32]
lea ecx, [ecx]
call fcn.00401e37
cmp esi, eax
jg 0x41d140
push 0x429b24
call fcn.004019a4
add esp, 4
dec edi
jne 0x41d135
lea esp, [esp]
call fcn.00401e37
lea esi, [eax + 0x32]
call fcn.00401e37
cmp esi, eax
jg 0x41d168
movsx eax, byte [esp + edi + 0x28]
push eax
push 0x429b28
call fcn.004019a4
inc edi
add esp, 8
cmp edi, 0x14
jl 0x41d160
mov edi, 0x14
nop
call fcn.00401e37
lea esi, [eax + 0x32]
call fcn.00401e37
cmp esi, eax
jg 0x41d198
push 0x429b24
call fcn.004019a4
add esp, 4
dec edi
jne 0x41d190
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x42e0cc], 0xa000a
push dword [0x42e0cc]
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push eax
call edi
mov dword [0x42e0cc], 0x7000f
push dword [0x42e0cc]
push 0xfffffffffffffff5
call esi
push eax
call edi
push str.Enter_Password:
call fcn.004019a4
add esp, 4
cmp byte [esp + 0x13], 0xd
je 0x41d22e
nop
call fcn.0041c920
mov bl, al
cmp bl, 0xd
je 0x41d22a
cmp bl, 8
je 0x41d200
push 0x2a
call fcn.0041cd48
mov eax, dword [esp + 0x18]
add esp, 4
mov byte [esp + eax + 0x1c], bl
inc eax
mov dword [esp + 0x14], eax
jmp 0x41d200
mov ebx, dword [esp + 0x14]
mov byte [esp + ebx + 0x1c], 0
mov ecx, str.pokhara
lea eax, [esp + 0x1c]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41d260
test dl, dl
je 0x41d25c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41d260
add eax, 2
add ecx, 2
test dl, dl
jne 0x41d240
xor eax, eax
jmp 0x41d265
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41d2c2
mov dword [0x42e0cc], 0x9000f
push dword [0x42e0cc]
push 0xfffffffffffffff5
call esi
push eax
call edi
push str.Password_match
call fcn.004019a4
add esp, 4
mov dword [0x42e0cc], 0xa0011
push dword [0x42e0cc]
push 0xfffffffffffffff5
call esi
push eax
call edi
push str.Press_any_key_to_countinue.....
call fcn.004019a4
add esp, 4
call fcn.0041c920
call fcn.0041f8b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x42e0cc], 0x10000f
push dword [0x42e0cc]
push 0xfffffffffffffff5
call esi
push eax
call edi
push str._aWarning___Incorrect_Password
call fcn.004019a4
add esp, 4
call fcn.0041c920
call fcn.0041cfd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret