Function at 0x40d6fc
Capabilities:
Access peb ldr_data
Encode data using xor
Identify system language via api
Resolve function by parsing pe exports

Disassembly:
push ebp
mov edx, str._TableEntry
mov ecx, 0xbbe
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40d755
add ecx, eax
cmp ecx, 0x1ebd
jbe 0x40d70f
or dword [0x4290fc], 0x3fe2d4c4
mov dword [esp], 0xcc0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push eax
mov eax, dword [0x4290fc]
mov dword [esp], eax
call fcn.0040e6e4
mov eax, dword [0x4290fc]
and eax, 0x5ba9ce4f
jmp 0x40d75f
mov eax, dword [0x4290fc]
xor eax, 0xaca9b3c5
and eax, 0x181bf758
mov ecx, str.An_operation_is_not_supported_on_a_resident_file.
or eax, 0xb1599118
mov dword [0x4290fc], eax
mov dl, byte [ecx]
test dl, dl
je 0x40d790
sub edx, 0x30
cmp dl, 9
jbe 0x40d78d
xor eax, 0x7bf8ba60
mov dword [0x4290fc], eax
jmp 0x40d790
inc ecx
jmp 0x40d773
xor dword [0x4290fc], 0x3fe24323
lea edi, [ebp - 0x40]
mov esi, 0x41615c
xor ebx, ebx
mov dword [esp], 0x42a040
call fcn.00414b08
xor dword [0x4290fc], 0xc0f4ce52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, 0xc5b6b98e
mov dword [0x4290fc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.SdbpGetPathCustomSdb
mov dword [esp], str._TableEntry
call fcn.00412234
mov eax, dword [0x4290fc]
mov ecx, 5
mov dword [ebp - 0x60], 0xb
rep movsd dword es:[edi], dword [esi]
or eax, 0x2d401598
xor eax, 0xfe0d60f7
add eax, 0x349b4256
mov dword [0x4290fc], eax
mov dword [esp], str.double_initialized_or_corrupted_critical_section
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, 0xc2657db1
push edi
mov dword [0x4290fc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp + ebx*4 - 0x40]
inc ebx
sub dword [ebp - 0x60], edi
lea edx, [eax - 0x52a40dd3]
mov dword [0x4290fc], edx
cmp ebx, 5
jne 0x40d80d
cmp dword [0x427dc0], 0
mov ecx, 0x42a040
je 0x40d8af
mov dl, byte [ecx]
test dl, dl
je 0x40d86f
sub edx, 0x30
cmp dl, 9
jbe 0x40d86c
sub eax, 0x116443cd
mov dword [0x4290fc], eax
jmp 0x40d86f
inc ecx
jmp 0x40d852
mov eax, dword [0x4290fc]
add eax, 0x23141a9
and eax, 0xfb047e69
xor eax, 0x3e1e1d93
add eax, 0x10f4bfff
mov dword [0x4290fc], eax
mov dword [esp], str.SdbpGetPathCustomSdb
call fcn.004133c4
mov dword [ebp - 0x60], 1
or dword [0x4290fc], 0xb2abf810
jmp 0x40df9f
sub eax, 0x16e418fb
mov edx, dword fs:[0x30]
mov dword [0x4290fc], eax
mov ebx, dword [edx + 0xc]
mov dword [esp], 0x134b
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
xor esi, esi
mov edi, dword [ebx + 0xc]
xor ebx, ebx
add dword [0x4290fc], 0x25050d4c
cmp dword [edi + 0x18], 0
je 0x40da16
xor eax, eax
cmp byte [eax + 0x42a040], 0
je 0x40d928
inc eax
cmp eax, 0x241e
jne 0x40d8ee
mov eax, dword [0x4290fc]
mov dword [esp + 4], str._TableEntry
mov dword [esp], str.An_operation_is_not_supported_on_a_resident_file.
mov dword [esp + 8], eax
call fcn.0040f614
sub dword [0x4290fc], 0x727713c4
jmp 0x40d92f
cmp eax, 0xd1e
jle 0x40d940
call fcn.0040fbd0
mov eax, dword [0x4290fc]
and eax, 0xdd682dd9
jmp 0x40d94a
mov eax, dword [0x4290fc]
and eax, 0xcd87404
and eax, 0x30604f76
mov dword [0x4290fc], eax
call dword [sym.imp.USER32.dll_AnyPopup]
xor eax, 0x236842a2
mov dword [0x4290fc], eax
mov dword [esp], eax
call fcn.0040e6e4
mov edx, 0x42a040
mov al, byte [edx]
test al, al
je 0x40d98d
sub eax, 0x30
cmp al, 9
jbe 0x40d98a
and dword [0x4290fc], 0x33764d80
jmp 0x40d98d
inc edx
jmp 0x40d971
mov eax, dword [0x4290fc]
xor edx, edx
xor eax, 0xdb3a879a
mov dword [0x4290fc], eax
cmp word [edx + str.SdbpGetPathCustomSdb], 0
je 0x40d9bd
add edx, 2
cmp edx, 0x3246
jne 0x40d99e
and eax, 0xe4a795d8
mov dword [0x4290fc], eax
mov eax, dword [0x4290fc]
mov esi, dword [edi + 0x18]
or eax, 0xfec0588a
sub eax, 0x62dec318
or eax, 0x193a8a40
imul eax, eax, 0xfb2cd6d
mov dword [0x4290fc], eax
mov eax, dword [esi + 0x3c]
mov eax, dword [esi + eax + 0x78]
test eax, eax
je 0x40da0f
lea ebx, [esi + eax]
mov edx, dword [ebx + 0xc]
add edx, esi
mov eax, dword [edx]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x40da0f
mov eax, dword [edx + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x40da1e
mov edi, dword [edi]
jmp 0x40d8e2
test ebx, ebx
je 0x40df9a
mov eax, dword [0x4290fc]
mov edi, dword [ebx + 0x18]
mov ecx, str.An_operation_is_not_supported_on_a_resident_file.
mov dword [0x42aca0], esi
and eax, 0xeafe5428
mov dword [ebp - 0x5c], edi
mov dword [0x4290fc], eax
mov dl, byte [ecx]
test dl, dl
je 0x40da5b
sub edx, 0x30
cmp dl, 9
jbe 0x40da58
xor eax, 0x57cd44ee
mov dword [0x4290fc], eax
jmp 0x40da5b
inc ecx
jmp 0x40da3e
or dword [0x4290fc], 0x8c2afe76
xor edi, edi
mov dword [esp], str.SdbpGetPathCustomSdb
call fcn.004133c4
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 0x70], eax
mov eax, dword [ebx + 0x20]
add eax, esi
mov dword [ebp - 0x68], eax
mov eax, dword [ebx + 0x24]
add eax, esi
mov dword [ebp - 0x6c], eax
imul eax, dword [0x4290fc], 0xf58be6d3
and eax, 0x72875a28
sub eax, 0x7b9cb67d
and eax, 0x80ba57a3
mov dword [0x4290fc], eax
mov dword [esp], 0x42a040
call fcn.00414b08
imul eax, dword [0x4290fc], 0x804f1042
xor eax, 0x8d6617f7
sub eax, 0x62275c5b
imul eax, eax, 0xf2f6e78c
or eax, 0xa977c42c
mov dword [0x4290fc], eax
cmp byte [str.An_operation_is_not_supported_on_a_resident_file.], 0
je 0x40dafd
sub dword [0x4290fc], 0x6551186b
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
imul eax, eax, 0xde42bf54
mov dword [0x4290fc], eax
mov eax, dword [0x4290fc]
dec dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x68]
mov ebx, dword [ebp - 0x5c]
add eax, 0x7f992416
imul eax, eax, 0x3c40f698
xor eax, 0x586b883
mov dword [0x4290fc], eax
mov eax, dword [ecx + ebx*4]
add eax, esi
cmp word [eax], 0x775a
mov dword [ebp - 0x64], eax
jne 0x40dcc0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, 0x694
mov ecx, 0x42a040
sub eax, 0x18d2e966
xor eax, 0xbba96806
mov dword [0x4290fc], eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x40db9b
add ebx, edx
cmp ebx, 0x1dce
jbe 0x40db52
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.0040e55c
mov eax, dword [0x4290fc]
or eax, 0xcbcd8aca
mov dword [0x4290fc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str._TableEntry
mov dword [esp], 0x42e160
call fcn.0040f614
mov ebx, dword [0x4290fc]
xor ebx, 0x6f4f9c7d
and ebx, 0x8cc20a99
mov dword [0x4290fc], ebx
mov dword [esp + 4], ebx
mov dword [esp + 8], str.SdbpGetPathCustomSdb
mov dword [esp], 0x42a040
call fcn.0040f55c
mov dword [esp], ebx
mov dword [esp + 4], 0x42a040
call fcn.0041137c
mov eax, dword [0x4290fc]
or eax, 0xddd33da8
xor eax, 0x37045b99
mov dword [0x4290fc], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, str.An_operation_is_not_supported_on_a_resident_file.
mov ecx, 0xe5e
mov ebx, dword [0x4290fc]
xor ebx, 0xda09559b
mov dword [0x4290fc], ebx
movzx eax, byte [edx]
inc edx
test al, al
je 0x40dc61
add ecx, eax
cmp ecx, 0x2184
jbe 0x40dc11
mov dword [esp + 4], ebx
and ebx, 0xd5fa94aa
mov dword [esp + 8], str._TableEntry
mov dword [esp], 0x42e160
call fcn.0040f55c
mov dword [esp + 4], ebx
or ebx, 0xa4aeab60
mov dword [esp + 8], str.SdbpGetPathCustomSdb
mov dword [esp], 0x42a040
call fcn.0040f55c
jmp 0x40dc67
and ebx, 0xc8aed747
add ebx, 0x15f23fb7
mov dword [0x4290fc], ebx
mov dword [esp + 8], ebx
lea ebx, [edi*8 + 0x427dc4]
mov dword [esp + 4], str._TableEntry
mov dword [esp], str.An_operation_is_not_supported_on_a_resident_file.
call fcn.0040f614
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.0040d4cc
mov ecx, dword [ebp - 0x5c]
mov dword [edi*8 + 0x427dc4], eax
mov eax, dword [ebp - 0x6c]
inc edi
movzx eax, word [eax + ecx*2]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ecx + eax*4]
mov dword [ebx + 4], eax
cmp edi, 0x226
je 0x40dcca
cmp dword [ebp - 0x5c], 0
jne 0x40dad9
xor ecx, ecx
mov dword [0x427dc0], edi
mov dword [ebp - 0x5c], ecx
mov eax, dword [0x427dc0]
dec eax
cmp dword [ebp - 0x5c], eax
jae 0x40df9f
imul eax, dword [0x4290fc], 0xd1583ce6
cmp byte [str.An_operation_is_not_supported_on_a_resident_file.], 0
mov dword [0x4290fc], eax
je 0x40dd0b
call fcn.00412674
and dword [0x4290fc], 0x2d082395
mov eax, dword [0x4290fc]
mov ecx, str.An_operation_is_not_supported_on_a_resident_file.
mov ebx, 0x1266
and eax, 0xb838cd5e
sub eax, 0x2ef30ed
mov edx, eax
or edx, 0xb59b0f0b
mov dword [0x4290fc], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x40dd4e
add ebx, edx
cmp ebx, 0x26b5
jbe 0x40dd32
or eax, 0xbdbf3f5b
mov dword [0x4290fc], eax
mov eax, dword [0x4290fc]
and eax, 0x3136b494
xor eax, 0xb021d5fd
mov dword [0x4290fc], eax
mov dword [esp], 0x42a040
call fcn.00414b08
xor edx, edx
mov eax, dword [ebp - 0x5c]
not eax
add eax, dword [0x427dc0]
cmp edx, eax
jae 0x40df92
mov eax, dword [0x4290fc]
mov esi, dword [edx*8 + 0x427dc8]
lea ebx, [edx + 1]
or eax, 0xaa15b12d
mov dword [0x4290fc], eax
cmp dword [edx*8 + 0x427dd0], esi
jae 0x40df8b
lea edi, [ebp - 0x2c]
mov esi, str._vC_a_
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov esi, 0xf
sub esi, dword [ebp + ecx*4 - 0x2c]
add eax, 0x22273dfc
inc ecx
mov dword [ebp - 0x64], esi
and eax, 0x56c6dc33
cmp ecx, 5
jne 0x40ddbd
cmp byte [0x42a040], 0
mov dword [0x4290fc], eax
je 0x40ddec
or eax, 0xed16fabd
mov dword [0x4290fc], eax
xor eax, eax
cmp byte [eax + 0x42e160], 0
je 0x40de09
inc eax
cmp eax, 0x9d
jne 0x40ddee
sub dword [0x4290fc], 0x6681d9ab
mov eax, dword [0x4290fc]
mov dword [ebp - 0x68], edx
xor edi, edi
and eax, 0xa47c1cc4
imul eax, eax, 0x9a90ae17
sub eax, 0x13c6158e
xor eax, 0xd9e307a0
mov dword [0x4290fc], eax
call fcn.00413b98
mov eax, dword [0x4290fc]
and eax, 0xc1c85195
sub eax, 0x50dfd1cb
mov dword [0x4290fc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.SdbpGetPathCustomSdb
mov dword [esp], str.SdbpGetPathCustomSdb
call fcn.00412234
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x4c], 0x52
mov edx, dword [ebp - 0x68]
mov ecx, 7
mov dword [ebp - 0x48], 0x1b
mov dword [ebp - 0x44], 0xffffff99
imul eax, dword [0x4290fc], 0x156f08b4
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], edx
add eax, 0x358d64a5
mov dword [0x4290fc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub eax, 0x1585434b
or eax, 0x9cccb14a
mov dword [0x4290fc], eax
mov dword [esp], eax
call fcn.0040e6e4
mov esi, dword [ebp - 0x6c]
sub esi, dword [ebp + edi*4 - 0x4c]
inc edi
cmp edi, 3
mov edx, dword [ebp - 0x68]
mov ecx, esi
jne 0x40de85
mov ecx, str.An_operation_is_not_supported_on_a_resident_file.
mov edi, 0x984
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x40def4
add edi, eax
cmp edi, 0x8a5
jbe 0x40ded8
add dword [0x4290fc], 0x4cf8727e
mov edi, dword [0x4290fc]
mov dword [ebp - 0x68], edx
mov dword [esp + 8], 0x42e160
and edi, 0x938b27c1
mov dword [esp + 4], str._TableEntry
or edi, 0x13810741
mov dword [esp + 0xc], edi
mov dword [esp], edi
imul edi, edi, 0x82de370
call fcn.00413ed0
mov dword [0x4290fc], edi
mov dword [esp], 0x42e160
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0x7e25744c
push edx
mov edx, dword [ebp - 0x68]
mov dword [0x4290fc], eax
mov eax, dword [ebp - 0x64]
add esi, edx
mov edi, dword [ebx*8 + 0x427dbc]
mov ecx, dword [ebx*8 + 0x427dc0]
add eax, edx
mov eax, dword [eax*8 + 0x427dc4]
mov dword [ebx*8 + 0x427dbc], eax
mov eax, dword [esi*8 + 0x427dc8]
mov dword [ebx*8 + 0x427dc4], edi
mov dword [ebx*8 + 0x427dc0], eax
mov dword [ebx*8 + 0x427dc8], ecx
mov edx, ebx
jmp 0x40dd70
inc dword [ebp - 0x5c]
jmp 0x40dcd5
xor eax, eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret