Function at 0x10048b3d
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
mov eax, dword [0x1026e004]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, ecx
lea ecx, [esp + 0x40]
or dword [edi + 0x10], 0xffffffff
or dword [edi + 0xc], 0xffffffff
mov dword [edi], 0x10206424
mov dword [edi + 0x24], ebx
mov dword [edi + 0x20], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov dword [edi + 8], esi
mov dword [edi + 4], esi
call fcn.10042bdb
push 0x3e
mov eax, 0x82
mov word [esp + 0x64], ax
pop eax
mov word [esp + 0x62], ax
push 0x40
pop eax
mov word [esp + 0x64], ax
push 0x3f
pop edx
push 0x2c
pop eax
push 0x37
mov word [esp + 0x6a], dx
mov word [esp + 0x6c], dx
mov word [esp + 0x6e], ax
pop eax
mov word [esp + 0x6c], ax
push 0x3b
pop eax
mov word [esp + 0x6e], ax
push 0x5f
pop eax
mov word [esp + 0x70], ax
push 0x34
pop ecx
push 0x3a
pop eax
push 0x40
mov word [esp + 0x76], cx
mov word [esp + 0x78], ax
pop eax
mov word [esp + 0x76], ax
push 0x39
pop eax
mov word [esp + 0x78], ax
push 0x40
pop eax
mov word [esp + 0x7a], ax
push 0x3b
pop eax
mov word [esp + 0x7c], cx
mov word [esp + 0x7e], ax
push 0x6c
pop eax
mov word [esp + 0x80], ax
mov word [esp + 0x82], ax
mov word [esp + 0x84], ax
push 0x3c
pop eax
mov word [esp + 0x86], cx
mov word [esp + 0x88], dx
mov word [esp + 0x8a], ax
push 0x39
pop eax
push 0x3d
mov word [esp + 0x90], ax
pop edx
mov word [esp + 0x8e], dx
mov word [esp + 0x90], cx
push 0x4d
mov word [esp + 0x96], ax
pop eax
mov word [esp + 0x94], ax
push 0x4a
pop eax
mov word [esp + 0x96], ax
mov word [esp + 0x98], dx
mov word [esp + 0x9a], dx
push 0x3a
pop edx
mov word [esp + 0x9c], dx
push 0x3d
pop ecx
mov word [esp + 0x9e], cx
mov word [esp + 0xa0], ax
push 0x38
pop eax
mov word [esp + 0xa2], ax
mov word [esp + 0xa4], cx
push 0x48
pop ecx
mov word [esp + 0xa6], cx
mov ecx, esi
mov word [esp + 0xa8], ax
add eax, 0x4c
mov word [esp + 0xaa], ax
xor eax, eax
mov word [esp + 0xac], ax
mov ax, word [esp + 0x60]
mov ax, word [esp + ecx*2 + 0x60]
movzx eax, ax
add eax, 0xfffffff9
mov word [esp + ecx*2 + 0x60], ax
inc ecx
cmp ecx, 0x26
jb 0x10048ceb
push ebx
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x260]
push 0x208
push eax
call fcn.10007b06
add esp, 0x10
lea eax, [esp + 0x258]
push eax
push esi
push esi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x18], eax
test eax, eax
je 0x100497c7
push 0x4b
pop edx
push 0x3a
mov eax, 0x81
mov word [esp + 0xb4], ax
mov word [esp + 0xb6], dx
pop edx
push 0x3b
pop ecx
push 0x3f
pop eax
push 0x3e
mov word [esp + 0xb8], dx
mov word [esp + 0xba], cx
mov word [esp + 0xbc], ax
mov word [esp + 0xbe], cx
pop ecx
push 0x3c
mov word [esp + 0xc0], cx
pop ecx
push 0x4c
mov word [esp + 0xc2], cx
pop ecx
push 0x33
mov word [esp + 0xc4], cx
pop ecx
push 0x4c
mov word [esp + 0xc6], cx
mov word [esp + 0xc8], ax
pop eax
push 0x48
mov word [esp + 0xca], ax
pop eax
push 0x39
mov word [esp + 0xcc], ax
pop eax
push 0x3b
mov word [esp + 0xce], ax
pop eax
push 0x6a
mov word [esp + 0xd0], cx
mov word [esp + 0xd2], dx
mov word [esp + 0xd4], ax
pop eax
push 0x67
mov word [esp + 0xd6], ax
pop eax
push 0x3f
mov word [esp + 0xd8], ax
pop eax
push 0x48
mov word [esp + 0xda], cx
mov word [esp + 0xdc], ax
pop eax
push 0x3b
mov word [esp + 0xde], ax
mov word [esp + 0xe0], dx
pop edx
push 0x3e
mov word [esp + 0xe2], dx
mov word [esp + 0xe4], cx
pop ecx
push 0x3d
mov word [esp + 0xe6], cx
pop ecx
push 0x4b
pop edx
push eax
mov word [esp + 0xe8], cx
pop ecx
push 0x3f
pop eax
mov word [esp + 0xe6], dx
mov word [esp + 0xe8], cx
push 0x2b
mov word [esp + 0xee], ax
pop eax
push 0x36
pop ecx
mov word [esp + 0xec], ax
mov word [esp + 0xee], cx
push 0x3a
pop edx
push 0x5e
mov word [esp + 0xf4], dx
pop eax
mov word [esp + 0xf2], ax
push 0x3f
pop eax
mov word [esp + 0xf4], ax
mov word [esp + 0xf6], cx
mov ecx, esi
push 0x49
pop eax
mov word [esp + 0xf8], ax
add eax, 0x3a
mov word [esp + 0xfa], ax
xor eax, eax
mov word [esp + 0xfc], ax
mov ax, word [esp + 0xb0]
mov ax, word [esp + ecx*2 + 0xb0]
movzx eax, ax
add eax, 0xfffffffa
mov word [esp + ecx*2 + 0xb0], ax
inc ecx
cmp ecx, 0x26
jb 0x10048edb
push ebx
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x260]
push 0x208
push eax
call fcn.10007b06
add esp, 0x10
lea eax, [esp + 0x258]
push eax
push esi
push esi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x14], eax
test eax, eax
jne 0x10048f59
mov ecx, edi
call fcn.10048aaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
lea ecx, [esp + 0x18]
push eax
call fcn.1000786e
push 0x1026b258
mov eax, ecx
jmp 0x100497e3
push 0x3b
pop edx
push 0x51
pop ecx
push 0x40
mov eax, 0x86
mov word [esp + 0x104], ax
pop eax
push 0x3e
mov word [esp + 0x106], dx
mov word [esp + 0x108], cx
mov word [esp + 0x10a], ax
pop eax
mov word [esp + 0x108], ax
push 0x30
pop eax
mov word [esp + 0x10a], ax
push 0x3f
mov word [esp + 0x110], dx
pop edx
push 0x63
pop eax
push 0x38
mov word [esp + 0x112], dx
mov word [esp + 0x114], ax
pop eax
mov word [esp + 0x112], ax
push 0x42
pop eax
push 0x41
mov word [esp + 0x118], dx
pop edx
mov word [esp + 0x116], ax
push 0x38
mov word [esp + 0x11c], cx
pop ecx
push 0x3f
pop eax
mov word [esp + 0x11a], dx
mov word [esp + 0x11c], cx
mov word [esp + 0x11e], ax
push 0x3e
pop eax
mov word [esp + 0x120], ax
push 0x71
pop eax
mov word [esp + 0x122], ax
mov word [esp + 0x124], dx
push 0x44
mov word [esp + 0x12a], cx
pop ecx
push 0x51
pop eax
mov word [esp + 0x128], cx
mov word [esp + 0x12a], ax
push 0x38
mov word [esp + 0x130], dx
pop eax
mov word [esp + 0x12e], cx
push 0x4e
mov word [esp + 0x134], ax
pop eax
push 0x3e
pop edx
mov word [esp + 0x132], ax
mov word [esp + 0x134], dx
push 0x3c
pop edx
mov word [esp + 0x136], dx
mov word [esp + 0x138], cx
push 0x42
pop ecx
push 0x3e
mov word [esp + 0x13e], cx
pop edx
mov word [esp + 0x13c], ax
mov word [esp + 0x13e], ax
push 0x40
pop eax
mov word [esp + 0x140], dx
mov word [esp + 0x142], ax
push 0x4c
pop eax
mov word [esp + 0x144], ax
mov ecx, esi
push 0x3d
pop eax
mov word [esp + 0x146], ax
push 0x3f
pop eax
mov word [esp + 0x148], ax
add eax, 0x49
mov word [esp + 0x14a], ax
xor eax, eax
mov word [esp + 0x14c], ax
mov ax, word [esp + 0x100]
mov ax, word [esp + ecx*2 + 0x100]
movzx eax, ax
add eax, 0xfffffff5
mov word [esp + ecx*2 + 0x100], ax
inc ecx
cmp ecx, 0x26
jb 0x100490f3
push ebx
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x260]
push 0x208
push eax
call fcn.10007b06
add esp, 0x10
lea eax, [esp + 0x258]
push eax
push esi
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x10049170
mov ecx, edi
call fcn.10048aaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
lea ecx, [esp + 0x20]
push eax
call fcn.1000786e
push 0x1026b258
mov eax, ecx
jmp 0x100497e3
mov dword [esp + 0x200], 0xe8e2
mov eax, 0xe899
mov word [esp + 0x204], ax
push ebx
lea edx, [eax + 0x38]
lea ecx, [eax + 0xb]
add eax, 0x41
mov word [esp + 0x20a], cx
mov word [esp + 0x20c], dx
mov word [esp + 0x20e], dx
mov word [esp + 0x210], dx
mov word [esp + 0x212], ax
lea eax, [ecx + 0x2f]
mov word [esp + 0x214], ax
add eax, 0xffffffcd
mov word [esp + 0x216], dx
add edx, 3
mov word [esp + 0x218], ax
lea eax, [ecx + 0x2b]
mov word [esp + 0x21a], ax
mov word [esp + 0x21c], dx
mov word [esp + 0x21e], cx
add ecx, 0x2f
mov word [esp + 0x220], cx
lea ecx, [eax + 3]
mov word [esp + 0x222], cx
mov word [esp + 0x224], ax
add eax, 7
mov word [esp + 0x226], ax
lea eax, [ecx - 0x4e]
mov word [esp + 0x228], ax
add ecx, 0xfffffffd
mov word [esp + 0x22a], ax
dec eax
mov word [esp + 0x22c], ax
mov eax, 0xe8db
mov word [esp + 0x22e], cx
mov word [esp + 0x230], ax
mov word [esp + 0x232], dx
lea edx, [eax - 0x3b]
add eax, 0xffffffc8
mov word [esp + 0x234], dx
mov word [esp + 0x236], ax
lea eax, [edx + 0x31]
mov word [esp + 0x238], cx
lea ecx, [edx + 0x36]
mov word [esp + 0x23a], ax
add eax, 0xffffffd0
mov word [esp + 0x23c], ax
lea eax, [edx + 0x37]
mov word [esp + 0x23e], ax
add eax, 0xfffffffc
mov word [esp + 0x240], cx
mov word [esp + 0x242], ax
lea eax, [edx + 0x27]
mov word [esp + 0x244], dx
mov word [esp + 0x246], ax
add eax, 0xb
mov word [esp + 0x248], ax
lea eax, [edx + 0x1a]
mov word [esp + 0x24a], cx
lea ecx, [esp + 0x204]
mov word [esp + 0x24c], ax
add eax, 0x19
mov word [esp + 0x24e], ax
mov word [esp + 0x250], ax
lea eax, [edx - 1]
mov word [esp + 0x252], ax
xor eax, eax
mov word [esp + 0x254], ax
mov ax, word [esp + 0x208]
call fcn.10049c05
push eax
lea eax, [esp + 0x260]
push 0x208
push eax
call fcn.10007b06
add esp, 0x10
lea eax, [esp + 0x258]
push eax
push esi
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x20], eax
test eax, eax
jne 0x10049376
mov ecx, edi
call fcn.10048aaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
lea ecx, [esp + 0x28]
push eax
call fcn.1000786e
push 0x1026b258
mov eax, ecx
jmp 0x100497e3
mov dword [esp + 0x150], 0xc9df
mov ecx, 0xc9ef
mov eax, 0xc9a4
mov word [esp + 0x154], ax
add eax, 0x45
mov word [esp + 0x156], ax
mov eax, 0xc9ed
mov word [esp + 0x158], ax
lea edx, [ecx + 3]
add eax, 0xd
mov word [esp + 0x15a], ax
lea eax, [ecx - 4]
mov word [esp + 0x15c], cx
mov word [esp + 0x15e], ax
add eax, 0xffffff9c
mov word [esp + 0x160], ax
lea eax, [ecx - 0x56]
mov word [esp + 0x162], ax
add eax, 0x4d
mov word [esp + 0x164], ax
lea eax, [ecx - 6]
mov word [esp + 0x166], dx
mov word [esp + 0x168], ax
inc eax
mov word [esp + 0x16a], ax
lea eax, [ecx - 0x52]
mov word [esp + 0x16c], ax
add eax, 0x49
mov word [esp + 0x16e], ax
lea eax, [ecx - 4]
mov word [esp + 0x170], dx
mov word [esp + 0x172], ax
add eax, 0xffffffd2
mov word [esp + 0x174], cx
mov word [esp + 0x176], ax
lea eax, [ecx - 0x35]
mov word [esp + 0x178], ax
add ecx, 0xffffffae
mov word [esp + 0x17a], dx
add eax, 0x2c
mov word [esp + 0x17c], ax
lea eax, [edx - 0x57]
mov word [esp + 0x17e], cx
mov word [esp + 0x180], ax
add eax, 0x4e
mov word [esp + 0x182], ax
mov word [esp + 0x184], dx
add edx, 0xfffffff9
mov word [esp + 0x186], ax
mov eax, 0xc99e
mov word [esp + 0x188], dx
mov word [esp + 0x18a], ax
add eax, 0x4f
mov word [esp + 0x18c], ax
mov eax, 0xc9e8
mov word [esp + 0x18e], cx
mov word [esp + 0x190], ax
lea ecx, [eax + 1]
mov word [esp + 0x192], cx
mov word [esp + 0x194], dx
mov word [esp + 0x196], dx
mov edx, esi
mov word [esp + 0x198], ax
add eax, 0xfffffffe
mov word [esp + 0x19a], ax
lea eax, [ecx - 0x4f]
mov word [esp + 0x19c], ax
add eax, 8
mov word [esp + 0x19e], ax
xor eax, eax
mov word [esp + 0x1a0], ax
mov ax, word [esp + 0x154]
mov ax, word [esp + edx*2 + 0x154]
movzx ecx, ax
movzx eax, word [esp + 0x150]
xor ecx, eax
mov word [esp + edx*2 + 0x154], cx
inc edx
cmp edx, 0x26
jb 0x10049524
xor eax, eax
mov word [esp + 0x1a0], ax
lea eax, [edi + 8]
push eax
lea eax, [edi + 0x10]
push eax
push ebx
lea eax, [esp + 0x160]
push eax
call fcn.10048a02
mov dword [esp + 0xc], eax
test eax, eax
jns 0x1004958f
mov ecx, edi
call fcn.10048aaf
push dword [esp + 0xc]
lea ecx, [esp + 0x34]
call fcn.1000786e
push 0x1026b258
mov eax, ecx
jmp 0x100497e3
mov dword [esp + 0x1a8], 0xba47
mov edx, 0xba05
mov eax, 0xba3c
mov word [esp + 0x1ac], ax
add eax, 0x34
mov word [esp + 0x1ae], ax
mov word [esp + 0x1b0], dx
lea eax, [edx + 1]
mov word [esp + 0x1b2], ax
lea ecx, [edx + 0x6e]
mov word [esp + 0x1b4], cx
add eax, 0xfffffffc
mov word [esp + 0x1b6], ax
mov eax, 0xba7f
mov word [esp + 0x1b8], cx
add ecx, 0xfffffff7
mov word [esp + 0x1ba], dx
add edx, 0x72
mov word [esp + 0x1bc], dx
mov word [esp + 0x1be], cx
mov word [esp + 0x1c0], dx
mov word [esp + 0x1c2], ax
add eax, 0xffffff84
mov word [esp + 0x1c4], ax
mov eax, 0xba76
mov word [esp + 0x1c6], ax
add eax, 0xfffffffd
mov word [esp + 0x1c8], cx
mov word [esp + 0x1ca], ax
mov word [esp + 0x1cc], ax
mov eax, 0xba26
mov word [esp + 0x1ce], ax
add eax, 0x4f
mov word [esp + 0x1d0], ax
mov eax, 0xba05
mov word [esp + 0x1d2], cx
mov word [esp + 0x1d4], ax
add eax, 0x6e
mov word [esp + 0x1d6], ax
mov eax, 0xba01
mov word [esp + 0x1d8], ax
add eax, 0x6f
mov word [esp + 0x1da], ax
mov eax, 0xba62
mov word [esp + 0x1dc], cx
mov word [esp + 0x1de], ax
add eax, 0x11
mov word [esp + 0x1e0], dx
mov word [esp + 0x1e2], ax
mov eax, 0xba1f
mov word [esp + 0x1e4], ax
add eax, 0x5f
mov word [esp + 0x1e6], ax
mov eax, 0xba04
mov word [esp + 0x1e8], ax
dec eax
mov word [esp + 0x1ea], ax
mov eax, 0xba76
mov word [esp + 0x1ec], ax
mov word [esp + 0x1ee], ax
add eax, 0xfffffffe
mov word [esp + 0x1f0], ax
mov eax, 0xba05
mov word [esp + 0x1f2], ax
add eax, 0x6b
mov word [esp + 0x1f4], ax
mov eax, 0xba3a
mov word [esp + 0x1f6], ax
xor eax, eax
mov word [esp + 0x1f8], ax
mov ax, word [esp + 0x1ac]
mov ax, word [esp + esi*2 + 0x1ac]
movzx ecx, ax
movzx eax, word [esp + 0x1a8]
xor ecx, eax
mov word [esp + esi*2 + 0x1ac], cx
inc esi
cmp esi, 0x26
jb 0x1004974b
xor eax, eax
mov word [esp + 0x1f8], ax
lea eax, [edi + 4]
push eax
lea eax, [edi + 0xc]
push eax
push ebx
lea eax, [esp + 0x1b8]
push eax
call fcn.10048a02
mov esi, eax
test esi, esi
jns 0x100497ae
mov ecx, edi
call fcn.10048aaf
push esi
lea ecx, [esp + 0x3c]
call fcn.1000786e
push 0x1026b258
mov eax, ecx
jmp 0x100497e3
mov ecx, dword [esp + 0x464]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
lea ecx, [esp + 0x10]
push eax
call fcn.1000786e
push 0x1026b258
mov eax, ecx
push eax
call fcn.100e172b
int3