Function at 0x401174
Capabilities:
Encode data using xor

Disassembly:
inc eax
add bh, bh
and eax, sym.imp.MSVBVM60.DLL_EVENT_SINK_QueryInterface
jmp dword [sym.imp.MSVBVM60.DLL_EVENT_SINK_AddRef]
push 0x401728
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dl, ah
adc al, 0xb7
jnp entry0
xlatb
scasb al, byte es:[edi]
dec esp
scasd eax, dword es:[edi]
dec ebp
stosb byte es:[edi], al
cmp bh, 0xda
loopne 0x401158
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push eax
jb 0x401222
push 0x65
arpl word [ecx + esi], si
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
int3
add byte [eax], al
add byte [eax], al
add eax, 0x726f4600
insd dword es:[edi], dx
xor dword [eax], eax
or eax, 0x46000501
outsd dx, dword [esi]
jb 0x4012a3
xor dword [eax], eax
sbb dword [ecx], eax
add byte [edx], al
and edi, edi
invalid
add dword [eax], ecx
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ebx]
add byte [eax + edi*2], al
add al, bh
pop es
lahf
push es
ja 0x4012bc
adc dword [esi], edx
push ss
add bh, bh
add ebp, dword [edx]
add byte [eax], al
add byte [edi], al
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
aaa
add byte [ecx + eax], al
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 0x78
add al, bl
or dword [edi + 0x11017706], ebx
adc eax, 0x2f03ff00
add byte [eax], al
add byte [ecx], 6
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [esi]
add byte [eax + eax*4], al
pop es
sbb byte [esi], al
lahf
push es
ja 0x401317
adc dword [eax + eax], edx
adc al, 0
inc dword [ebx]
das
add byte [eax], al
add byte [ebx + eax], 0
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor al, 0
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ebx]
add byte [eax + eax*4], al
pop es
clc
pop es
lahf
push es
ja 0x401347
adc dword [ebx], edx
add bh, bh
add ebp, dword [edi]
adc eax, dword [eax]
inc dword [ebx]
das
add byte [eax], al
add byte [0x80003], 0x43
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor eax, 0x8010400
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ebx]
add byte [eax + eax*4], al
pop es
fmul dword [ecx]
lahf
push es
ja 0x401377
adc dword [edx], edx
add bh, bh
add ebp, dword [edi]
adc al, byte [eax]
inc dword [ebx]
das
add byte [eax], al
add byte [ecx], 5
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [0xe880400]
sbb byte [esi], al
lahf
push es
ja 0x4013a7
adc dword [ecx], edx
add bh, bh
add ebp, dword [edi]
adc dword [eax], eax
inc dword [ebx]
das
add byte [eax], al
add byte [edx], 2
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor al, byte fs:[eax]
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [edx]
add byte [eax + ecx*4], al
push cs
clc
pop es
lahf
push es
ja 0x4013d7
adc dword [eax], edx
add bh, bh
add ebp, dword [edi]
adc byte [eax], al
inc dword [ebx]
das
add byte [eax], al
add byte [esi], 1
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
add byte ss:[ecx + eax], al
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ecx]
add byte [eax + ecx*4], al
push cs
fmul dword [ecx]
lahf
push es
ja 0x401407
adc dword [edi], ecx
add bh, bh
add ebp, dword [edi]
add byte [eax], al
add byte [ecx], 4
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [eax + eax]
add al, 0x90
adc eax, 0x69f0618
ja 0x401437
invalid
adc dword [esi], ecx
push cs
add bh, bh
add ebp, dword [edi]
add byte [eax], al
add byte [edx + eax], 0
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor al, 0
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [edx]
add byte [eax + edx*4], al
adc eax, 0x69f07f8
ja 0x401467
adc dword [0x2f03ff00], ecx
or eax, 0x2f03ff00
add byte [eax], al
add byte [0x80002], 0x43
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor eax, 0x8010400
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [edx]
add byte [eax + edx*4], al
adc eax, 0x69f09d8
ja 0x401497
adc dword [eax + eax], ecx
or al, 0
inc dword [ebx]
das
add byte [eax], al
add byte [0x80001], 0x43
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor eax, 0x8010400
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ecx]
add byte [eax + edx*4], al
adc eax, 0x69f0438
ja 0x4014c7
adc dword [ebx], ecx
add bh, bh
add ebp, dword [edi]
or eax, dword [eax]
inc dword [ebx]
das
add byte [eax], al
add byte [ecx + eax], 0
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor al, 0
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ecx]
add byte [eax + edx*4], al
adc eax, 0x69f0258
ja 0x4014f7
adc dword [edx], ecx
add bh, bh
add ebp, dword [edi]
or al, byte [eax]
inc dword [ebx]
das
add byte [eax], al
add byte [ecx], 3
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ebx]
add byte [eax + edx*4], al
adc eax, 0x69f0078
ja 0x401527
adc dword [ecx], ecx
add bh, bh
add ebp, dword [edi]
or dword [eax], eax
inc dword [ebx]
das
add byte [eax], al
add byte [esi], 0
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
add byte ss:[ecx + eax], al
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [eax]
add byte [eax + ecx*4], al
push cs
cmp byte [edi + ebx*4], al
push es
ja 0x401557
adc dword [eax], ecx
add bh, bh
add ebp, dword [edi]
or byte [eax], al
inc dword [ebx]
das
add byte [eax], al
add byte [edx], 1
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor al, byte fs:[eax]
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ecx]
add byte [eax + ecx*4], al
push cs
pop eax
add bl, byte [edi + 0x11017706]
pop es
add bh, bh
add ebp, dword [edi]
add byte [eax], al
add byte [ecx], 2
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [edx]
add byte [eax + ecx*4], al
push cs
js 0x4015b2
lahf
push es
ja 0x4015b7
adc dword [esi], eax
push es
add bh, bh
add ebp, dword [edi]
add byte [eax], al
add byte [0x80000], 0x43
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor eax, 0x8010400
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [eax]
add byte [eax + eax*4], al
pop es
cmp byte [edi + ebx*4], al
push es
ja 0x4015e7
adc dword [0x2f03ff00], eax
add eax, 0x2f03ff00
add byte [eax], al
add byte [eax + eax], 0
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor al, 0
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [eax]
add byte [eax + eax*4], al
pop es
pop eax
add bl, byte [edi + 0x11017706]
add al, 0
inc dword [ebx]
das
add byte [eax], al
add byte [ecx], 1
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [ecx]
add byte [eax + eax*4], al
pop es
js 0x401642
lahf
push es
ja 0x401647
adc dword [ebx], eax
add bh, bh
add ebp, dword [edx]
add byte [eax], al
add byte [ebx], al
or byte [eax], al
inc ebx
outsd dx, dword [esi]
add eax, dword [eax]
inc dword [ebx]
sub al, byte [eax]
add byte [eax], al
add ecx, dword [eax]
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor eax, dword fs:[eax]
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 0x78
add byte [eax], bh
add al, 0x9f
push es
ja 0x401672
adc dword [edx], eax
add bh, bh
add ebp, dword [edi]
add al, byte [eax]
inc dword [ebx]
das
add byte [eax], al
add byte [edx], 0
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor al, byte fs:[eax]
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [eax]
add byte [eax + edi*2], al
add byte [eax + 2], bl
lahf
push es
ja 0x4016a2
adc dword [ecx], eax
add bh, bh
add ebp, dword [edi]
add dword [eax], eax
inc dword [ebx]
das
add byte [eax], al
add byte [ecx], 0
add byte [eax], cl
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, 1
or byte [eax], al
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
xor dword fs:[eax], eax
add al, byte [eax]
add byte [eax + edi*2], al
add byte [eax], bh
lahf
push es
ja 0x4016d2
adc dword [eax], eax
add bh, bh
add al, byte [eax + eax]
add byte [eax], al
inc dword [edx]
add al, 0
push eax
add byte [eax], al
add byte [edi + 0x72], al
mov edx, 0x25a7237d
inc ebx
cmpsd dword [esi], dword es:[edi]
dec edi
lcall 0, 0xafbc4b80
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
nop
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx], dl
add eax, 0
add byte [eax], al
les edx, [ecx]
inc eax
add byte [eax + eax], cl
add byte [esi + 0x42], dl
xor eax, 0x2a263621
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, byte [eax]
or dword [eax + eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + edx - 0xfefffc0], bh
xor byte [eax], al
add bh, bh
invalid