Function at 0x10004b69
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
jmp 0x10004b84
jmp 0x10004b96
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ebx, ebx
mov dword [0x1004db34], eax
cmp byte [0x1004bb74], bl
je 0x10004bc3
mov ecx, ebx
mov al, 0x68
sub al, cl
xor byte [ecx + 0x1004bb58], al
inc ecx
cmp ecx, 8
jb 0x10004bad
mov byte [0x1004bb74], bl
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x1004bb58
call esi
mov dword [0x1004dc54], eax
test eax, eax
je 0x10004e57
cmp byte [0x1004bad2], bl
je 0x10004bfd
mov ecx, ebx
mov al, 0xb2
sub al, cl
xor byte [ecx + 0x1004bc00], al
inc ecx
cmp ecx, 0xa
jb 0x10004be7
mov byte [0x1004bad2], bl
push 0x1004bc00
call esi
mov dword [0x1004db10], eax
test eax, eax
je 0x10004e57
push 0xc
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov ecx, dword [ebp - 8]
mov edx, dword [0x1004db10]
mov dword [0x1004db2c], edx
lea eax, [ecx - 1]
add eax, edx
push eax
push ecx
push edx
push str.Engine:_Start:__d__Size:__d__End:__d_n
mov dword [0x1004db3c], eax
call fcn.10001a63
add esp, 0x10
cmp byte [0x1004ba0a], bl
je 0x10004c6e
mov ecx, ebx
mov al, 0x8c
sub al, cl
xor byte [ecx + 0x1004bb10], al
inc ecx
cmp ecx, 7
jb 0x10004c58
mov byte [0x1004ba0a], bl
cmp byte [0x1004bb18], bl
je 0x10004c8e
mov ecx, ebx
mov al, 0xa3
sub al, cl
xor byte [ecx + 0x1004bbf4], al
inc ecx
cmp ecx, 0xa
jb 0x10004c78
mov byte [0x1004bb18], bl
push 0x1004bb10
push 0x1004bbf4
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x10004e57
mov edx, 0x10003670
mov ecx, eax
call fcn.10001964
mov dword [0x1004dd80], eax
cmp byte [0x1004b9bc], bl
je 0x10004cdc
mov ecx, ebx
mov al, 0xcc
sub al, cl
xor byte [ecx + 0x1004bc20], al
inc ecx
cmp ecx, 0x41
jb 0x10004cc6
mov byte [0x1004b9bc], bl
push 0x1004bc20
push dword [0x1004db10]
call esi
test eax, eax
je 0x10004e57
mov edx, 0x10003fc7
mov ecx, eax
call fcn.10001964
mov dword [0x1004dc44], eax
cmp byte [0x1004bc0b], bl
je 0x10004d22
mov ecx, ebx
mov al, 0xce
sub al, cl
xor byte [ecx + 0x1004bbb8], al
inc ecx
cmp ecx, 0x2e
jb 0x10004d0c
mov byte [0x1004bc0b], bl
push 0x1004bbb8
push dword [0x1004db10]
call esi
test eax, eax
je 0x10004e57
mov edx, 0x100042f5
mov ecx, eax
call fcn.10001964
mov dword [0x1004db30], eax
cmp byte [0x1004bc7e], bl
je 0x10004d68
mov ecx, ebx
mov al, 0x7f
sub al, cl
xor byte [ecx + 0x1004bb1c], al
inc ecx
cmp ecx, 0x39
jb 0x10004d52
mov byte [0x1004bc7e], bl
push 0x1004bb1c
push dword [0x1004db10]
call esi
test eax, eax
je 0x10004e57
mov edx, 0x10004946
mov ecx, eax
call fcn.10001964
cmp byte [0x1004b9fb], bl
je 0x10004da9
mov ecx, ebx
mov al, 0xe5
sub al, cl
xor byte [ecx + 0x1004bb78], al
inc ecx
cmp ecx, 0x3c
jb 0x10004d93
mov byte [0x1004b9fb], bl
push 0x1004bb78
push dword [0x1004db10]
call esi
test eax, eax
je 0x10004e57
mov edx, 0x100043f2
mov ecx, eax
call fcn.10001964
mov dword [0x1004dc60], eax
cmp byte [0x1004bb56], bl
je 0x10004def
mov ecx, ebx
mov al, 0x38
sub al, cl
xor byte [ecx + str._avRQzVFF__EYN_Lhrh_PTMSKW], al
inc ecx
cmp ecx, 0x3a
jb 0x10004dd9
mov byte [0x1004bb56], bl
push str._avRQzVFF__EYN_Lhrh_PTMSKW
push dword [0x1004db10]
call esi
test eax, eax
je 0x10004e57
mov edx, 0x10003fe0
mov ecx, eax
call fcn.10001964
mov dword [0x1004dc5c], eax
cmp byte [0x1004bb19], bl
je 0x10004e31
mov ecx, ebx
mov al, 0xe7
sub al, cl
xor byte [ecx + 0x1004b9b0], al
inc ecx
cmp ecx, 0xb
jb 0x10004e1b
mov byte [0x1004bb19], bl
push 0x1004b9b0
push dword [0x1004db10]
call esi
test eax, eax
je 0x10004e57
mov edx, 0x10004adb
mov ecx, eax
call fcn.10001964
mov dword [0x1004dd6c], eax
mov al, 1
jmp 0x10004e59
xor al, al
pop edi
pop esi
pop ebx
leave
ret