Function at 0x401dc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [esp + 0x96], 0x7f0d
mov byte [esp + 0x95], 0x4a
mov dword [esp + 0x90], 0x7e370174
mov word [esp + 0x62], 0x6d4f
mov cx, word [esp + 0xaa]
mov edx, dword [esp + 0x90]
mov esi, edx
xor esi, 0x7e370175
mov bl, byte [eax]
mov dword [esp + 0x84], esi
cmp bl, 0xb8
mov byte [esp + 0x5b], bl
mov word [esp + 0x58], cx
mov dword [esp + 0x54], edx
je 0x401e64
jmp 0x401fb1
mov eax, dword [esp + 0x64]
mov dword [esp + 0x84], eax
jmp 0x401e64
mov word [esp + 0xaa], 0x663a
mov eax, esp
mov dword [eax], str.tttt32
call fcn.00401720
mov dword [esp + 0x8c], 0
mov dword [esp + 0x50], eax
jmp 0x401eda
mov eax, dword [esp + 0x84]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [0x427af4]
xor ecx, ecx
mov edx, 1
mov esi, esp
mov dword [esi + 8], 1
mov dword [esi + 4], 0
mov dword [esi], 0x427af4
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], edx
call esi
sub esp, 0xc
mov bl, byte [esp + 0x5b]
add bl, 0xc3
mov byte [esp + 0xa9], bl
mov ecx, dword [esp + 0x90]
xor ecx, 0x7e370174
mov dword [esp + 0x64], ecx
cmp eax, 0
je 0x401e3c
jmp 0x401e2f
xor eax, eax
mov ecx, 0x7e370174
mov edx, 0x7e370175
sub edx, dword [esp + 0x90]
sub ecx, dword [esp + 0x90]
mov esi, dword [esp + 0x8c]
mov edi, esp
mov dword [edi], 0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], esi
call edi
sub esp, 4
xor ecx, ecx
mov edx, esp
mov esi, dword [esp + 0x38]
mov dword [edx + 0x10], esi
mov dword [edx + 0xc], esi
mov dword [edx + 8], esi
mov dword [edx + 4], 0
mov dword [edx], 0
mov edx, dword [sym.imp.ADVAPI32.dll_RegLoadAppKeyW]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
call edx
sub esp, 0x14
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
add ecx, edx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x64], 0
cmp ecx, 0x3ff
mov dword [esp + 0x28], eax
je 0x401e2f
jmp 0x401eda
mov eax, dword [esp + 0x80]
mov word [eax], 0x65
mov eax, dword [esp + 0x5c]
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call eax
sub esp, 4
mov dword [esp + 0x64], 1
cmp eax, 0
je 0x40209b
jmp 0x401e2f
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x90]
xor edx, 0x7e370175
xor ecx, 0x3e554176
mov dword [esp + 0x98], ecx
mov bl, byte [esp + 0x95]
mov bh, byte [eax]
xor bl, 0x20
mov dword [esp + 0x84], edx
cmp bh, bl
je 0x401e64
lea eax, [esp + 0x68]
lea ecx, str._es_app
mov edx, 0x18
mov esi, eax
mov dword [esp + 0x88], esi
mov di, word [esp + 0x62]
mov esi, dword [esp + 0x88]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x18
mov dword [esp + 0x24], eax
mov word [esp + 0x22], di
mov dword [esp + 0x1c], edx
call fcn.00404790
mov di, word [esp + 0x96]
xor di, 0x7f68
mov eax, dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x54]
and edx, edx
mov dword [esp + 0xa4], edx
mov word [ecx], 0x74
mov word [esp + 0x6e], 0x74
mov word [esp + 0x76], 0x2e
mov word [esp + 0x78], di
mov word [esp + 0x7a], 0x78
add eax, 0x14
mov dword [esp + 0x80], eax
mov di, word [esp + 0x22]
cmp di, 0x53ba
jb 0x401ff2
jmp 0x401f7d
lea eax, [0x427af4]
mov byte [0x427afb], 0x45
mov ecx, dword [esp + 0x90]
add ecx, 0x81c8fe8c
mov edx, esp
mov dword [edx], 0x427af4
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call edx
sub esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x64], ecx
cmp eax, 0
je 0x401e73
jmp 0x401e2f