Function at 0x403485
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x6c], 0x76620f24
mov dword [ebp - 0x68], 0x773f24
mov dword [ebp - 0x64], 0x643f05
mov dword [ebp - 0x60], 0x937f09
mov dword [ebp - 0x5c], 0x8687612a
mov dword [ebp - 0x58], 0x5760f37
mov dword [ebp - 0x54], 0x7640d25
mov dword [ebp - 0x50], 0x67773024
mov dword [ebp - 0x4c], 0x76652d0a
push ebx
mov dword [ebp - 0x48], 0x87731004
mov dword [ebp - 0x44], 0x6571044
push esi
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x40], 0x8643f28
mov dword [ebp - 0x1c], eax
push edi
bsf ecx, ebx
test byte [0x40aeec], 1
mov ecx, 0xdf970
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xdf971
jne 0x40351c
mov eax, dword [sym.imp.USER32.dll_SetActiveWindow]
or dword [0x40aeec], 1
mov dword [0x40a5e0], eax
mov dword [ebp - 8], 0xdf974
mov dword [ebp - 0x20], 0xdf950
mov eax, dword [0x409fe0]
xor edx, edx
push 7
pop esi
div esi
mov esi, 0x63872
xor eax, 0x327b
mov dword [ebp - 0x24], eax
mov edx, dword [0x409fe8]
mov eax, dword [0x409fe4]
sub eax, edx
mov edx, dword [ebp - 0x24]
or eax, 0x3f60
cmp edx, eax
je 0x403732
mov dword [ebp - 0x2c], ecx
cmp ah, 0x48
cmp cx, ax
mov edi, dword [ebp - 0x10]
xor edi, esi
mov ebx, 0xbc102
sub edi, ebx
jmp 0x403724
cmp cl, 0xcf
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
xor eax, esi
sub eax, ebx
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, edi
div dword [ebp - 0x24]
xor cl, 0x72
sub cl, 2
xor edx, edx
mov ebx, eax
mov eax, dword [ebp - 8]
xor eax, esi
sub eax, 0xbc102
mov dword [ebp - 0x24], eax
mov eax, edi
div dword [ebp - 0x24]
lea eax, [ebp + edx - 0x6c]
mov byte [eax + ebx*4], cl
cmp dx, 0x2e19
mov edi, dword [ebp - 0x10]
xor edi, esi
mov ebx, 0xbc102
sub edi, ebx
jmp 0x4036f6
mov dword [ebp - 0x24], 0xfcf
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x409fec]
add eax, 0x537d
or eax, ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
mov eax, 0x6caf
xor ax, word [ecx + edi*4 + 2]
mov ecx, 0x336e
add ax, cx
cmp ax, word [ebp - 0xc]
jne 0x4036ea
mov eax, dword [0x409ff0]
mov ecx, 0x42d1
xor edx, edx
div ecx
mov dword [ebp - 0x24], edx
mov cl, byte [0x409ff4]
mov eax, dword [0x409ff8]
shl eax, cl
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
jbe 0x4036a6
cmp edx, dword [eax - 0x34ca9d92]
invalid
mov eax, dword [ebp + 0xc]
mov al, byte [eax + edi*4]
mov ecx, dword [ebp - 8]
xor al, 0xaf
add al, 0x6e
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
xor ecx, esi
xor edx, edx
sub ecx, ebx
div ecx
xor edx, edx
mov ecx, eax
mov eax, dword [ebp - 8]
xor eax, esi
sub eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
div dword [ebp - 0x24]
lea eax, [ebp + edx - 0x6c]
mov dl, byte [ebp - 1]
mov byte [eax + ecx*4], dl
cmp edx, 0xebbd0b43
mov ebx, 0xbc102
mov eax, dword [ebp - 0x14]
xor eax, esi
lea edi, [edi + eax - 0xbc102]
mov ecx, dword [ebp + 0xc]
mov eax, 0x6caf
xor ax, word [ecx + 0x20]
mov ecx, 0x336e
add ax, cx
movzx eax, ax
cmp edi, eax
jb 0x4035ca
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
xor eax, esi
lea edi, [ecx + eax - 0xbc102]
mov dword [ebp - 0xc], edi
cmp edi, 0x30
jb 0x40357a
jmp 0x403737
mov ebx, 0xbc102
mov eax, dword [ebp - 0x10]
xor eax, esi
sub eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
xor eax, esi
sub eax, ebx
mov dword [ebp - 0x24], eax
mov ecx, dword [0x40a004]
mov eax, dword [0x40a000]
xor edx, edx
div ecx
mov ecx, dword [0x409ffc]
xor eax, 0x135f
add eax, 0xffffa854
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, 0x4daf
mov word [ebp - 0x3c], ax
mov eax, 0x131c
mov word [ebp - 0x3a], ax
mov eax, 0x2304
mov word [ebp - 0x38], ax
mov eax, 0x75f1
mov word [ebp - 0x36], ax
mov eax, 0x4bb1
mov word [ebp - 0x34], ax
mov eax, 0xcc1
mov word [ebp - 0x32], ax
mov eax, 0x429e
mov word [ebp - 0x30], ax
mov eax, 0x2bae
mov word [ebp - 0x2e], ax
mov cl, byte [0x40a00c]
mov eax, 0x6a79
sar eax, cl
movzx ecx, ax
mov ax, word [0x40a008]
movzx eax, ax
xor eax, ecx
mov ecx, dword [ebp - 0x24]
mov cx, word [ebp + ecx*2 - 0x3c]
cdq
movzx ecx, cx
idiv ecx
mov word [ebp - 4], dx
mov ax, word [0x40a018]
mov cx, word [0x40a014]
movzx eax, ax
or eax, 0x7a74
movzx ecx, cx
cdq
idiv ecx
mov ax, word [0x40a010]
mov cx, word [ebp - 4]
imul ax, dx
cmp cx, ax
jbe 0x40387d
mov edi, 0xafecfe8c
invalid
sub ecx, 0x5be9f1b3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], 0xdf970
movzx eax, word [0x409f08]
mov ecx, 0xaee
sub ax, cx
and eax, 0x3ee7
mov word [ebp + 8], ax
mov ax, word [0x409f14]
mov cx, word [0x409f10]
sub cx, ax
movzx eax, cx
mov cx, word [0x409f0c]
movzx ecx, cx
cdq
idiv ecx
mov cx, word [ebp + 8]
shr ax, 6
cmp cx, ax
ja 0x403958
and al, byte [ebp - 0x5579f057]
or al, 0x21
rcr dh, 1
pop eax
pop ecx
loop 0x403965
aas
sti
add byte [eax], al
add byte [esi], dl
add byte [eax], al
inc edx
wait
jp 0x403941
mov ah, 0x55
sar byte [edx + 0xf], 0x6a
int 0xe
push es
jbe 0x403984
lodsd eax, dword [esi]
stc
xlatb
add dl, dl
adc esi, dword [edi - 0x7e]
invalid
xchg ebx, eax
sub byte [ebx + 0x46], al
push ds
sub bh, byte ds:[eax - 0x5df37fd0]
or al, 0x48
sbb al, 0x4b
js 0x4039aa
sub ch, byte [esi]
imul edx, dword [bp + si - 0x3f], 0x52
xchg edx, eax
xor ch, byte [eax + 0x24]
dec esp
ficomp word [edi]
or cl, byte [ebp - 0x45]
xlatb
push ds
leave
dec ebp
dec ebp
mov ebx, 0x4dc91ed7
not dword [ebx - 0x1b]
std
add al, 0x76
lea esp, [eax]
loop 0x4039bc
cwde
mov edi, 0x10e0d112
loop 0x403920
mov dword [ebp - 0x18], 0xdf971
inc ebp
call 0x4e32d0
movzx eax, word [0x409f18]
imul eax, eax, 0x2973
add byte [ecx - 0x40], ch
jae 0x403993
add byte [eax], al
mov word [ebp - 4], ax
mov eax, 0x4e45
mov word [ebp + 8], ax
mov ax, word [0x409f1c]
mov ecx, 0x3651
xor ax, cx
mov cx, word [ebp + 8]
imul cx, ax
mov ax, word [ebp - 4]
cmp ax, cx
jbe 0x403aec
mov dword [ebp - 0x28], 0xdf950
bts ebx, 0xa
jmp 0x403a0e
mov eax, dword [ebp - 0xc]
xor eax, esi
mov ebx, 0xbc102
sub eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x409f5c]
mov ecx, dword [0x409f58]
xor eax, ecx
shl eax, 0x1d
sub eax, 0x4ff6
xor eax, 0x7fffb00e
inc ebp
hlt
add byte [ebx + 0x409f580d], cl
add byte [ebx], dh
rol ecx, 0xe0
sbb eax, 0x4ff62d
add byte [0x7fffb00e], dh
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov cl, byte [eax*4 + 0x409f60]
mov eax, dword [0x409f54]
shl eax, cl
mov ecx, dword [0x409f50]
push 7
xor edx, edx
imul ecx, eax
mov dword [ebp + 8], ecx
mov eax, dword [0x409f7c]
add eax, 0x4b03
pop ecx
div ecx
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x403acf
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x3c]
mov ax, word [0x409f28]
movzx edi, ax
mov ax, word [0x409f24]
movzx eax, ax
cdq
idiv edi
movzx eax, dx
mov dx, word [0x409f20]
movzx edi, dx
cdq
idiv edi
xor edx, edx
imul eax, eax, 0x25ae
mov word [ebp + 8], ax
mov edi, dword [ebp - 8]
add edi, dword [ecx + 0x78]
mov ecx, dword [0x409f2c]
mov eax, 0xa74
div ecx
mov cl, 0x1e
and edx, 0x44
imul edx, edx, 0x1fc9
xor edx, 0x87167
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x409f30]
imul cl
movzx ecx, byte [0x409f2a]
movzx eax, al
or ecx, eax
mov byte [ebp + 0xb], cl
mov eax, dword [0x409f40]
mov ecx, dword [0x409f3c]
and eax, ecx
mov ecx, dword [0x409f38]
sub eax, ecx
sub eax, 0x4609
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, byte [eax + 0x409f44]
mov al, byte [0x409f37]
or cl, al
mov al, byte [0x409f36]
xor al, cl
mov cl, byte [ebp + 0xb]
add al, 0x50
cmp cl, al
jb 0x4039a9
jmp 0x40389a
mov eax, dword [ebp - 8]
add eax, dword [edi + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0xc]
xor ecx, esi
sub ecx, ebx
jmp 0x403ba6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
movsx edx, byte [eax + edx]
xor ebx, esi
sub ebx, 0xbc102
cmp edx, ebx
je 0x403ced
mov edx, dword [ebp - 0x18]
xor edx, esi
lea eax, [eax + edx - 0xbc102]
mov dword [ebp - 4], eax
shl ebx, 0x11
mov edx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x14]
xor dl, 0x72
sub dl, 2
cmp byte [ebx + eax], dl
je 0x403aef
test byte [0x40aee4], 2
jne 0x403b4b
mov edx, dword [sym.imp.GDI32.dll_ExtTextOutA]
or dword [0x40aee4], 2
mov dword [0x40a5d0], edx
mov edx, dword [ebp - 0x14]
mov dl, byte [edx + eax]
mov ebx, dword [ebp - 0x1c]
cmp dl, byte [eax + ebx]
je 0x403aef
mov al, byte [0x409fb9]
movzx ebx, al
mov eax, 0xed
cdq
idiv ebx
movzx edx, byte [0x409fb8]
movzx eax, al
xor edx, eax
mov byte [ebp + 0xb], dl
mov edx, dword [ebp - 0xc]
xor edx, esi
sub edx, 0xbc102
mov dword [ebp - 0x20], edx
aam 0xa
mov eax, dword [ebp - 0xc]
xor eax, esi
sub eax, 0xbc102
cmp edx, eax
jne 0x403cfd
mov eax, dword [ebp - 0x18]
xor eax, esi
lea ecx, [ecx + eax - 0xbc102]
mov dword [ebp - 0x10], ecx
cmp ecx, dword [edi + 0x18]
jae 0x403e2b
mov al, byte [0x409f80]
or al, 0x5a
mov byte [ebp + 0xb], al
mov dl, byte [0x409f83]
mov al, byte [0x409f82]
add dl, al
mov al, byte [0x409f81]
imul dl
mov dl, byte [ebp + 0xb]
shl al, 2
cmp dl, al
je 0x403aef
mov dword [ebp + 8], ImageList_ReplaceIcon
mov eax, dword [ebp + 8]
mov ecx, dword [0x409f84]
shr eax, 8
sub eax, ecx
add eax, 0x688d
xor eax, 0x626f
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x409f90]
mov ebx, dword [0x409f8c]
mov eax, dword [0x409f88]
inc ebp
or byte [ebx - 0x606f7af4], cl
inc eax
add byte [ebx + 0x409f8c1d], cl
add byte [ecx + 0x409f88], ah
xor edx, edx
div ebx
mov dword [ebp - 0x20], 1
or ecx, eax
mov dword [ebp + 8], ecx
mov eax, dword [0x409fb4]
mov ecx, dword [ebp + 8]
sub eax, 0x331
and eax, 0x4703
cmp ecx, eax
jne 0x403cb5
out 0x8c, eax
lodsb al, byte [esi]
sub eax, 0xfc54464
add al, 0xe4
sub al, 0x2f
xor dword [esp + eax], eax
je 0x403c9d
add dword [eax], eax
add byte [esi], bl
add byte [eax], al
inc ecx
std
or dword [esp + esi*8 + 0x4d], esi
fisub word [esi + 0x7b]
into
xchg ebp, eax
jle 0x403c01
les ebp, [ecx - 0x42]
mov ah, 0x85
mov es, word ds:[edi + 0x3df37643]
lodsd eax, dword [esi]
sbb al, byte [edx - 0x70]
imul eax, dword [esi - 0x419601b1], 0x12b8e7bf
in al, dx
add dword [esi + edi], ecx
out 0xfa, eax
test byte [edi + 0x4f], 0xb
cli
pop ebp
mov eax, dword [0xd0f91161]
mov dword [ebx + 0x6db9bd6c], ebx
adc edx, dword [eax + 0x2f]
lcall 0x2e70, 0x687c911e
dec esp
stosd dword es:[edi], eax
imul esi, ebp, 0x2d
push esp
lea ecx, [edx + 0x47]
sar byte [edi + 0x6b], 0xf2
sar dword [ecx - 0x73], 1
dec ecx
pop ebp
frstor dword [eax + 0x6d]
mov dword [ecx], ebp
and byte [eax], bl
invalid
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
add eax, dword [edx + ecx*4]
test byte [0x40aee4], 1
mov dword [ebp - 0x1c], eax
jne 0x403cde
mov eax, dword [sym.imp.COMCTL32.dll_ImageList_Draw]
or dword [0x40aee4], 1
mov dword [0x40a5cc], eax
mov eax, dword [ebp - 0xc]
xor eax, esi
sub eax, 0xbc102
jmp 0x403b18
mov eax, dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov edx, dword [ebp - 0x20]
mov dword [ebp + 8], eax
jmp 0x403b88
mov eax, dword [sym.imp.USER32.dll_TrackPopupMenu]
mov dword [ebp + 8], eax
mov ebx, dword [ebp - 8]
add ebx, dword [edi + 0x24]
cmp al, 0xb8
mov edx, dword [ebp - 8]
add edx, dword [edi + 0x1c]
mov ax, word [0x409fc4]
mov edi, 0x7567
imul ax, di
movzx eax, ax
shr eax, 7
add eax, 0xd97d
mov word [ebp - 4], ax
mov ax, word [0x409fc8]
sub ax, 0x3a
and ax, 0x41
shl ax, 8
mov edi, 0xdbfa
not ax
and ax, di
mov di, word [ebp - 4]
mov dword [ebp - 0x2c], edx
cmp di, ax
jbe 0x403e02
mov edi, dword [0x409fd0]
mov eax, dword [0x409fcc]
xor edx, edx
div edi
push 0x25
shl eax, 0x17
add eax, 0x78800002
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x409fd8]
movzx eax, al
mov dword [ebp + 8], eax
mov al, byte [0x409fd4]
movzx edi, al
pop eax
cdq
idiv edi
mov edi, 0x3473
imul edx, dword [ebp + 8]
mov byte [ebp + 0xb], dl
mov ax, word [0x409fc0]
movzx eax, ax
cdq
idiv edi
movzx eax, dx
mov dx, word [0x409fbc]
xor eax, 0x5d7a
movzx edi, dx
cdq
idiv edi
sub edx, 0x1381
movzx eax, dx
movzx edx, word [ebp - 4]
sub edx, eax
mov word [ebp - 4], dx
mov ax, word [0x409fc8]
sub ax, 0x3a
and ax, 0x41
shl ax, 8
mov edx, 0xdbfa
not ax
and ax, dx
mov dx, word [ebp - 4]
cmp dx, ax
ja 0x403d5e
mov edx, dword [ebp - 0x2c]
movzx eax, word [ebx + ecx*2]
lea ecx, [edx + eax*4]
mov eax, dword [ebp - 8]
add eax, dword [ecx]
test byte [0x40aee4], 4
mov dword [ebp - 0x24], eax
jne 0x403e2b
mov eax, dword [sym.imp.GDI32.dll_ResizePalette]
or dword [0x40aee4], 4
mov dword [0x40a5c8], eax
test byte [0x40aeec], 2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
jne 0x403e4b
mov eax, dword [sym.imp.USER32.dll_EndPaint]
or dword [0x40aeec], 2
mov dword [0x40a5dc], eax
rcl ebx, 6
mov dword [ebp + 8], 0xdf974
mov eax, dword [ebp + 8]
push dword [ebp - 0x24]
mov edi, dword [ebp + 0x14]
xor eax, esi
lea eax, [ebp + eax - 0xbc0ee]
push eax
call fcn.00403291
pop edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
pop esi
pop ebx
leave
ret