Function at 0x40d820
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x328
mov esi, esp
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x7c], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x78], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x74], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x70], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x6c], eax
mov esp, eax
push eax
sub esp, 0x20
mov dword [esi + 0x68], esp
sub esp, 0x100
mov dword [esi + 0x30], esp
sub esp, 0x10
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x64], eax
mov esp, eax
push eax
sub esp, 0xc
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x40], eax
mov esp, eax
push eax
sub esp, 0x24
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x4c], eax
mov esp, eax
push eax
mov dword [esi + 0x44], esp
push eax
mov dword [esi + 0x60], esp
push eax
mov dword [esi + 0x90], esp
sub esp, 0x70
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x38], eax
mov esp, eax
push eax
sub esp, 0x14
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x48], eax
mov esp, eax
push eax
sub esp, 0xc
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x50], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x5c], eax
mov esp, eax
push eax
sub esp, 0x14
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x80], eax
mov esp, eax
push eax
sub esp, 0x7fc
mov dword [esi + 0x58], esp
sub esp, 0x88
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x34], eax
mov esp, eax
push eax
sub esp, 0x40
mov dword [esi + 0x88], esp
sub esp, 0x10
mov dword [esi + 0x8c], esp
mov eax, dword [0x446ac4]
mov dword [esi], eax
mov dword [esi + 8], 0xc38773ac
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov eax, 0x39258061
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esi + eax - 0x39258059]
mov edx, eax
and edx, edi
mov ebx, edx
and ebx, 2
mov ecx, edx
or edx, 2
imul edx, ebx
xor ebx, 2
and ecx, 0x7d
imul ecx, ebx
add edx, ecx
lea ecx, [eax - 0x39258000]
and ecx, edi
xor edi, eax
lea ecx, [edi + ecx*2]
lea edi, [edx + edx]
not edi
add edi, edx
and edi, ecx
not ecx
and ecx, edx
sub edi, ecx
mov dword [esi + 0x98], edi
mov ecx, dword [esi + 0x98]
add ecx, 0xcb1ae63f
mov edx, ecx
xor edx, 0xe6
and ecx, 0x19
add ecx, ecx
sub ecx, edx
mov byte [esi + eax - 0x39258059], cl
inc eax
cmp eax, 0x3925806a
jne 0x40d960
mov eax, dword [str.K8DY38__ner]
mov dword [esi + 4], eax
mov dword [esi + 0x98], 0x70b8a8a9
mov dword [esi + 0x9c], 0xb8adaabc
mov dword [esi + 0xa0], 0xb84db6a4
mov dword [esi + 0xa4], 0xb8a5a4b1
mov dword [esi + 0xa8], 0xa97ebebf
mov dword [esi + 0xac], 0x1363afb9
mov dword [esi + 0xb0], 0xcf060d0c
mov dword [esi + 0xb4], 0x571bc5cd
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbb], 0
mov eax, 0x29
mov edx, 0xd6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax + 0x6f]
mov edi, edx
and edi, 0xb6
mov ebx, eax
and ebx, 0x49
or ebx, edi
xor ebx, ecx
xor ebx, 0xb6
and ebx, ecx
lea edi, [edx - 0xc57900]
or edi, ecx
not edi
or edi, ebx
mov dword [esi + 0x2a0], edi
mov edi, dword [esi + 0x2a0]
mov ecx, edi
xor ecx, 0x1e
or edi, 0xfa99b6e1
and ecx, edi
add ecx, edi
mov byte [esi + eax + 0x6f], cl
inc eax
dec edx
cmp eax, 0x50
jne 0x40da50
movzx eax, byte [esi + 0x98]
lea ecx, [esi + 0x2a0]
test al, al
je 0x40dacd
lea edi, [esi + 0x99]
mov edx, dword [esi + 4]
nop
nop
nop
nop
nop
nop
mov byte [ecx], al
inc ecx
movzx eax, byte [edi]
inc edi
test al, al
jne 0x40dac0
jmp 0x40dad0
mov edx, dword [esi + 4]
mov byte [ecx], 0
movzx eax, byte [edx]
test al, al
je 0x40daeb
inc edx
nop
nop
nop
nop
nop
mov byte [ecx], al
inc ecx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x40dae0
mov byte [ecx], 0
movzx eax, byte [esi + 8]
test al, al
je 0x40db0b
lea edx, [esi + 9]
nop
nop
nop
nop
nop
nop
nop
mov byte [ecx], al
inc ecx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x40db00
mov byte [ecx], 0
mov edx, dword [esi]
movzx eax, byte [edx]
test al, al
je 0x40db2b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ecx], al
inc ecx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x40db20
mov byte [ecx], 0
mov dword [esi + 0x98], 0x23912d6b
mov dword [esi + 0x9c], 0x27922192
mov dword [esi + 0xa0], 0x3b882581
mov dword [esi + 0xa4], 0x3f43398c
mov dword [esi + 0xa8], 0x33bb3d68
mov dword [esi + 0xac], 0x37933180
mov dword [esi + 0xb0], 0xb6a357a
mov dword [esi + 0xb4], 0xfbe09a9
mov dword [esi + 0xb8], 0x3be0dbc
mov dword [esi + 0xbc], 0x7a101b9
mov dword [esi + 0xc0], 0x1bae05a5
mov dword [esi + 0xc4], 0x1fad19a1
mov dword [esi + 0xc8], 0x13611dae
mov dword [esi + 0xcc], 0x176b1198
mov dword [esi + 0xd0], 0x6be1159f
mov dword [esi + 0xd4], 0x6f1369e3
mov dword [esi + 0xd8], 0x63d16dd6
mov dword [esi + 0xdc], 0x67db61d6
mov dword [esi + 0xe0], 0x7bcf6519
mov dword [esi + 0xe4], 0x7fc279ce
mov dword [esi + 0xe8], 0x73c07dd9
mov dword [esi + 0xec], 0x77c571d7
mov dword [esi + 0xf0], 0x4bef75d0
mov dword [esi + 0xf4], 0x4f5349ec
mov dword [esi + 0xf8], 0x43424d52
mov dword [esi + 0xfc], 0
lea eax, [esi + 0x2a0]
mov edx, eax
not edx
and edx, ecx
mov dword [esi + 4], edx
xor ecx, eax
mov dword [esi + 0x24], ecx
mov ecx, 0x46
mov edi, 0xcf270bb9
mov edx, ecx
and edx, 0x186
xor edx, 0x46220186
mov ebx, edi
or ebx, 0x76fa0186
lea eax, [edx + ebx]
mov dword [esi], eax
mov eax, 0xcf270bb8
sub eax, dword [esi]
add ebx, edx
add ebx, 0x47
movzx edx, byte [esi + edi + 0x30d8f4df]
or eax, edx
not edx
or edx, ebx
and edx, eax
not edx
mov dword [esi + 8], edx
mov eax, dword [esi + 8]
add al, 0x56
mov byte [esi + edi + 0x30d8f4df], al
dec ecx
inc edi
cmp ecx, 0xffffffde
jne 0x40dc50
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0xfb5bf9d7
mov dword [esi + 0xc], 0xff67fd6a
mov word [esi + 0x10], 0xf1fe
mov dword [esi + 0x12], 0
mov dword [esi + 0x16], 0
mov word [esi + 0x1a], 0
mov ebx, 0xfb57cfbf
mov edx, 0x4a83040
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + ebx + 0x4a83049]
mov dword [esi], ecx
mov eax, edx
and eax, ecx
add eax, eax
mov edi, ecx
sub edi, eax
add edi, edx
and edi, ecx
mov ecx, edi
or ecx, 0xfffffffd
inc ecx
mov eax, edi
and eax, 0xfffffffd
imul eax, ecx
mov ecx, edi
and ecx, 2
or edi, 2
imul edi, ecx
sub eax, edi
mov ecx, edx
and ecx, 0x408000c
mov edi, ebx
and edi, 0xe3514373
or edi, ecx
xor edi, 0x1c0e8c8c
add edi, dword [esi]
add edi, eax
mov dword [esi + 0x2c], edi
mov eax, dword [esi + 0x2c]
mov ecx, eax
not ecx
and eax, 0xc6
and ecx, 0x39
sub eax, ecx
mov byte [esi + ebx + 0x4a83049], al
inc ebx
dec edx
cmp ebx, 0xfb57cfd3
jne 0x40dce0
mov ebx, dword [esi + 4]
sub ebx, dword [esi + 0x24]
lea eax, [esi + 0x94]
lea ecx, [esi + 0x84]
lea edi, [esi + 0x98]
lea edx, [esi + 8]
push eax
push ecx
push ebx
lea eax, [esi + 0x2a0]
push eax
push edi
push edx
push 0x44c314
call fcn.0040c5e0
add esp, 0x1c
movzx eax, al
jmp dword [eax*4 + 0x447770]