Function at 0x1004ed00
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov ebx, ecx
xor esi, esi
nop dword [eax + eax]
mov ecx, esi
call fcn.1005b900
mov byte [ebx + esi + 0x19c], al
inc esi
cmp esi, 0xf
jl 0x1004ed10
mov al, byte [0x100c5b68]
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
test al, al
je 0x1004eebc
sahf
dec edi
cmpsd dword [esi], dword es:[edi]
pop esp
mov ch, 0xcd
lock or al, byte [0xe9c9602c]
into
insb byte es:[edi], dx
pop ss
in eax, dx
add dl, cl
jecxz 0x1004ed6f
pop ss
fcomp qword [edx + 0x46]
lodsd eax, dword [esi]
pop eax
jnp 0x1004edd3
sub al, 0xa3
mov al, 0xde
rcl byte [esp - 0x4fad1ce2], cl
mov ebp, 0x6a38eb21
xchg ecx, eax
movsb byte es:[edi], byte [esi]
jo 0x1004edb5
ret
popal
and dh, dl
invalid
sti
pop ecx
retf
or eax, 0x3d855b23
sub eax, 0x80483351
inc ebx
in eax, 0x56
stc
movsd dword es:[edi], dword [esi]
popal
invalid
mov dword [ebx + 4], 0x22ba4
mov ecx, 0x22ba4
mov dword [ebx + 8], 0xfa4
test al, al
je 0x1004effa
test byte [ebx], ah
add dword [eax], eax
add byte [ebx - 0x7ec49f3f], al
enter 0xffffffffffffc44d, 0xffffffffffffff99
add ecx, 0x60
cmp eax, dword [ecx - 0x663bb238]
loop 0x1004eed2
pop ds
fucomi st(6)
mov fs, word [esi - 0x5038cd28]
mov cl, 0xbd
mov bh, 0x36
imul ecx, edx, 0xf361a963
aam 0x51
xchg edi, eax
or eax, dword [0x1c1c8cb1]
test al, 0x6a
push 0xc23101d0
pop ds
cmp byte [ecx], dl
sub al, 0x45
cmpsd dword [esi], dword es:[edi]
retf
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ecx + 1]
push eax
push 0
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [ebx + 0xc], eax
mov dword [esp + 0x3c], 0x2780a3da
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x40], 0
cmp byte [esp + 0x40], 0
jne 0x1004f039
mov eax, dword [esp + 0x3c]
xor eax, 0x27ccef9e
mov dword [esp + 0x3c], eax
push 0x10
push 0
call ebp
push eax
call edi
push 0x1f
push 0
mov dword [esp + 0x38], eax
call ebp
push eax
call edi
push 0x29
push 0
mov dword [esp + 0x3c], eax
call ebp
push eax
call edi
push 1
push 0
mov dword [esp + 0x40], eax
call ebp
push eax
call edi
mov edi, eax
push 1
push 0
mov byte [edi], 0
call ebp
push eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
push edi
push 0
mov byte [eax], 0
adc bh, bh
rcl byte [edi + 0x6a]
add dh, al
add byte [eax], al
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], ecx
inc ecx
cmp byte [eax], 0
je 0x1004f09e
inc eax
jmp 0x1004f091
push ecx
push 0
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [0x100c5b68], 0
je 0x1004f3c9
je 0x1004f148
aas
adc al, 0xcb
test eax, 0x7c0a00a9
jp 0x1004f130
push es
inc ebp
dec eax
insb byte es:[edi], dx
pop ebx
cdq
stosd dword es:[edi], eax
mov dl, byte [ebp + 0xa252e91]
pop ebp
mov ebx, edx
das
jmp 0x1004f079
invalid
leave
mov es, edi
and eax, 0x20822fc3
wait
and al, 0x3b
cmpsb byte [esi], byte es:[edi]
or byte [ebx + 0x3a], cl
loope 0x1004f13e
dec ebx
cmp ah, cl
cld
imul esi, dword [ebx + 0x74f44818], 0xfffffff8
clc
cdq
test eax, edx
daa
stc
cld
adc byte [edx], ch
push esp
pop edx
adc byte [esi - 0x2d37c134], al
mov ecx, 0xb4d81d06
jnp 0x1004f14e
test dword [eax - 0x13], ebp
mov dword [ebx + esi*4], ecx
cmp dword [esp + edi*4 - 0x10], ebp
mov al, bh
pop eax
add dl, bl
jge 0x1004f131
pop esp
scasb al, byte es:[edi]
cmp al, 0x24
out dx, eax
lds ebx, [edx]
add dword [0x15b57f3c], eax
pop edi
imul esp, dword [ecx], 0xcdf0390d
cli
insd dword es:[edi], dx
pop es
salc
add edx, ecx
adc eax, 0x4ff3c6fc
dec esi
xor esp, esi
invalid
mov dword [esp + 0x44], 0x7fcb2257
mov eax, dword [esp + 0x44]
mov byte [esp + 0x48], 0
cmp byte [esp + 0x48], 0
jne 0x1004f3ee
mov eax, dword [esp + 0x44]
xor eax, 0x7f876e13
mov dword [esp + 0x44], eax
push 0x10
push 0
call ebp
push eax
call edi
push 0x1f
push 0
mov dword [esp + 0x2c], eax
call ebp
push eax
call edi
push 0x29
push 0
mov dword [esp + 0x30], eax
call ebp
push eax
call edi
push 1
push 0
mov dword [esp + 0x34], eax
call ebp
push eax
call edi
mov edi, eax
push 1
push 0
mov byte [edi], 0
call ebp
push eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
push edi
push 0
mov byte [eax], 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x20], ecx
inc ecx
cmp byte [eax], 0
je 0x1004f453
inc eax
jmp 0x1004f446
push ecx
push 0
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x1c]
mov eax, ecx
cmp ecx, dword [esp + 0x20]
cmovbe eax, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x20], eax
test eax, eax
je 0x1004f4ab
mov edx, eax
nop dword [eax]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov al, byte [eax + ecx]
cmp al, byte [ecx + esi]
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
jne 0x1004f4ff
inc ecx
cmp ecx, edx
jb 0x1004f490
mov byte [esp + 0x13], 1
push dword [esp + 0x24]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x28]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x2c]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x18]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [esp + 0x13], 0
je 0x1004f506
mov dword [ebx + 0x38], 2
jmp 0x1004f62d
mov byte [esp + 0x13], 0
jmp 0x1004f4b0
mov dword [esp + 0x4c], 0x140ef923
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x50], 0
cmp byte [esp + 0x50], 0
jne 0x1004f52b
mov eax, dword [esp + 0x4c]
xor eax, 0x144ba166
mov dword [esp + 0x4c], eax
push 0x10
push 0
call ebp
push eax
call edi
push 0x1f
push 0
mov dword [esp + 0x30], eax
call ebp
push eax
call edi
push 0x29
push 0
mov dword [esp + 0x2c], eax
call ebp
push eax
call edi
push 1
push 0
mov dword [esp + 0x28], eax
call ebp
push eax
call edi
mov edi, eax
push 1
push 0
mov byte [edi], 0
call ebp
push eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
push edi
push 0
mov byte [eax], 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c], ecx
inc ecx
cmp byte [eax], 0
je 0x1004f590
inc eax
jmp 0x1004f583
push ecx
push 0
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x18], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x2c]
cmovbe edx, dword [esp + 0x2c]
xor ecx, ecx
test edx, edx
je 0x1004f5e0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov al, byte [ecx + eax]
cmp al, byte [esi + ecx]
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
jne 0x1004f8be
inc ecx
cmp ecx, edx
jb 0x1004f5c1
mov byte [esp + 0x13], 1
push dword [esp + 0x28]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x24]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
adc eax, sym.imp.KERNEL32.dll_HeapFree
push dword [esp + 0x20]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x18]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
cmp byte [esp + 0x13], al
setne al
mov dword [ebx + 0x38], eax
push dword [ebx + 0x1b0]
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xa0
push 0
call ebp
push eax
call edi
mov dword [ebx + 0x1b0], eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp byte [0x100c5b68], 0
je 0x1004f8a8
jns 0x1004f6b3
adc dword [ecx - 0x37], edi
cld
stosb byte es:[edi], al
adc eax, 0x3636590d
jg 0x1004f5fe
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
mov byte [edx + 0x50], dl
mov byte [eax + 0x5b9a4630], bl
cwde
xor byte [esi - 0x66], al
pop ebx
add eax, 0x246dffed
wait
mov ah, 0xdd
push ebx
sbb ah, ch
sub ecx, dword [edi - 0x15fbba76]
and al, byte [ecx - 0x3b]
sbb al, byte [edi - 0x58651d11]
mov ebx, 0xf9d845a2
stosb byte es:[edi], al
pop esi
xor dword [edi + esi], edi
dec edi
lea edi, [esi]
sub eax, 0xeb78e8a9
mov eax, dword [0x8c1c7220]
sal byte [ebx - 0x41b162a3], cl
inc ebp
ficom dword [edx - 0x6fe005bf]
mov bl, 0x5d
popfd
dec esi
mov esi, 0x4192da45
cli
pop ds
nop
std
mov cl, 0x22
shr byte [eax + 0x47], cl
stosd dword es:[edi], eax
pop ds
dec eax
daa
or eax, 0x58811c11
or dword [ebx + 0x7ce3911b], 0x1388ba21
jle 0x1004f6bd
push dword [esi + eax]
add al, 0xf7
push edx
cmc
jl 0x1004f759
div al
add al, 0x7b
mov bl, 0x1b
jp 0x1004f69b
dec ebx
jg 0x1004f67c
mov ah, 0xdb
fld st(6)
out 0x4b, al
loope 0x1004f76a
stosb byte es:[edi], al
leave
mov edx, 0x926f448e
invalid
inc esi
fstp qword [edx - 0x5f]
sbb eax, ebp
jns 0x1004f77c
retf 0x3a80
jne 0x1004f796
pop ds
and esi, eax
invalid
push ebx
push ebp
ljmp 0x3a4f
mov bh, 0x15
add edx, 0x6c
pop esp
sub edx, esi
lahf
xchg edx, eax
pop ds
stosb byte es:[di], al
mov ch, 5
daa
xchg edi, eax
sub edi, dword [ebp + 0x6aeb5cf1]
aaa
push ebx
test dword [ecx + ecx*4 + 0x4f], eax
mov dl, 0x6b
push esp
in al, dx
mov dl, 0x8e
sar byte [esi + 0x555833a6], 0xdb
pop es
cmp esp, dword [esp + ebp*2 - 0x5d1f9d0d]
pop eax
cmp al, 0x6e
xchg ecx, eax
sub eax, 0x3aa54776
inc esp
or al, byte [eax + 0x48d75ba]
adc eax, 0xe1425302
and eax, 0x2c1604cf
wait
xor bl, cl
mov al, byte [0x81dff96c]
aam 0x7b
sti
xor ebx, dword [esi - 0x35d7a883]
loop 0x1004f85e
mov dl, byte [esi + 4]
inc edx
mov al, byte [0x34808117]
dec esp
pop esi
pushal
xchg edi, eax
xor al, 0x14
xchg edi, eax
inc edi
jle 0x1004f829
sbb byte [eax - 0x451f896], ch
jmp 0x1004f855
fild qword [ecx + 0x57]
push edi
or al, byte [ebp + 4]
pop es
dec ebx
pop eax
jle 0x1004f869
push edi
fldcw word [esi + 0xde96b1a]
int1
jmp 0xc85083c8
pushfd
mov ebp, 0x9afad0d9
push esi
push 0x77
inc esi
ja 0x1004f84e
sahf
in eax, dx
sbb al, al
test byte [edi + 0x6fc07b2b], bl
and eax, 0xb6654433
and byte [ebx - 0x2d], dl
sbb ch, byte [ebp - 0x13]
mov dh, 0x20
push ebx
rcr dword [edx], cl
insd dword es:[edi], dx
in eax, dx
bound ebx, qword [ecx - 0x4c3971c5]
adc esp, dword [edi - 0x7b588900]
aas
mov dword [0x7a9a60f4], eax
wait
invalid
movzx eax, word [esp + 0x54]
add eax, 0xfffff81f
cmp eax, 0xd
ja case.default.0x1004f8b7
jmp dword [eax*4 + 0x10050a70]
mov byte [esp + 0x13], 0
jmp 0x1004f5e5
mov eax, 0x100bf090
jmp 0x1004f92c
mov eax, str.fgfdlkmg_lfdgjlkfdgm_lkl_kfjlsdjk_lksadfgafsdg
jmp 0x1004f92c
mov eax, 0x100bf0e4
jmp 0x1004f92c
mov eax, 0x100bf0f8
jmp 0x1004f92c
mov eax, 0x100bf118
jmp 0x1004f92c
mov eax, str.JJyuhjgghJHHYJNKOIREEDKIUKKFFe
jmp 0x1004f92c
mov eax, 0x100bf1a4
jmp 0x1004f92c
mov eax, str._N2
jmp 0x1004f92c
mov eax, 0x100bf1f4
jmp 0x1004f92c
mov eax, str.6iuonBFRFHj8967rvjhYRDHJJIJG676yujhiuytiu
jmp 0x1004f92c
mov eax, 0x100bf244
jmp 0x1004f92c
mov eax, 0x100bf268
jmp 0x1004f92c
mov eax, str.LKJHUYFGV5r654vJHKJYHKLPOI__LKJHGDRDGHJKRFSZUI
jmp 0x1004f92c
mov eax, 0x100bf2b4
jmp 0x1004f92c
xor eax, eax
push eax
push dword [ebx + 0x1b0]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dl, byte [0x100c5b68]
test dl, dl
je 0x1004fbed
pop edi
scasd eax, dword es:[edi]
push edi
popfd
xchg cx, ax
cmp dl, al
pushal
xchg dword [ecx], ebx
jne 0x1004f8f7
invalid
bound eax, qword [esi + 0x23]
add dword [esi + 0x4f], edi
push ebx
in al, 0x99
inc esi
mov dword [ecx + ebp*4 + 0x37bc8f81], edi
push 0xffffffffffffff8b
rcr byte [ecx - 0x26], cl
push ebx
dec esi
adc al, cl
iretd
or dword [esi - 0x10682f6c], esi
outsd dx, dword [esi]
cwde
pop ebx
cmpsd dword [esi], dword es:[edi]
out dx, eax
xchg ebp, eax
scasb al, byte es:[edi]
add eax, 0x1c033487
mov bh, 0x1c
or dword [edi - 0x6e5dab], ebp
cmp byte [esi], al
bound ebx, qword [ecx + eax - 0x19]
pop eax
aad 0xfb
jge 0x1004fb5a
out 0x3a, al
and al, 0xc5
invalid
mov dword [ebx + 0x18c], 0x9a
mov dword [ebx + 0x190], 0x4f
test dl, dl
je 0x1004fdef
pop ss
jns 0x1004fbaf
cmp bl, 0xf7
dec edi
sub al, 0xf7
mov dword [0xb1a54ced], eax
and eax, 0x933276c1
jge 0x1004fc03
xchg edi, eax
nop
std
dec esp
retf
mov dword [ebx + 0x194], 0x2f
movups xmm1, xmmword [0x100bf2d8]
movups xmm0, xmmword [0x100bf2e8]
movd eax, xmm1
movd ecx, xmm1
movups xmmword [esp + 0x74], xmm0
movsx eax, al
movaps xmm0, xmm1
psrldq xmm0, 4
movups xmmword [esp + 0x64], xmm1
mov dword [ebx + eax*4 + 0x38], 0x100a7198
mov eax, ecx
shr eax, 8
movsx eax, al
psrldq xmm1, 4
mov dword [ebx + eax*4 + 0x38], 0x100ab6f8
mov eax, ecx
shr eax, 0x10
movsx eax, al
shr ecx, 0x18
mov dword [ebx + eax*4 + 0x38], 0x10092810
movsx eax, cl
movd ecx, xmm1
mov dword [ebx + eax*4 + 0x38], 0x1008f408
movd eax, xmm0
movsx eax, al
mov dword [ebx + eax*4 + 0x38], 0x100a82f0
mov eax, ecx
shr eax, 8
movsx eax, al
mov dword [ebx + eax*4 + 0x38], 0x1008e2b0
mov eax, ecx
shr eax, 0x10
movsx eax, al
shr ecx, 0x18
mov dword [ebx + eax*4 + 0x38], 0x100ad9a8
movsx eax, cl
mov dword [ebx + eax*4 + 0x38], 0x100a2c38
test dl, dl
je 0x1005002e
xlatb
packuswb mm4, qword [ebx + 0xb]
mov edx, 0xd2c1d2bd
daa
or esi, ebp
test al, 0x26
cmp ch, dh
and dh, byte [esi + 0x28ae286b]
xchg edi, eax
pop ebp
add eax, 0x8ed16d91
cmovs eax, dword ss:[edx + 0x7a]
sar edi, cl
adc byte [esi], ah
sbb dword [edx], edi
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
stosb byte es:[edi], al
stc
jnp 0x1004ff00
shr bh, 0xa9
push ss
pop esi
neg byte [ebx + 0x39882e14]
int 0x75
push 0xf04e
invalid
movsb byte es:[edi], byte [esi]
mov edx, dword [bp - 0x41]
invalid
movsx eax, byte [esp + 0x6c]
mov dword [ebx + eax*4 + 0x38], 0x1009b2d0
movsx eax, byte [esp + 0x6d]
mov dword [ebx + eax*4 + 0x38], 0x100ac850
movsx eax, byte [esp + 0x6e]
mov dword [ebx + eax*4 + 0x38], 0x1008d158
movsx eax, byte [esp + 0x6f]
mov dword [ebx + eax*4 + 0x38], 0x100a1ae0
movsx eax, byte [esp + 0x70]
mov dword [ebx + eax*4 + 0x38], 0x100a3d90
movsx eax, byte [esp + 0x71]
mov dword [ebx + eax*4 + 0x38], 0x1009a178
movsx eax, byte [esp + 0x72]
mov dword [ebx + eax*4 + 0x38], 0x10094ac0
test dl, dl
je 0x100503f7
dec edi
dec ebp
lds edi, [ebx + eax]
push edx
push 0x61
invalid
movsx eax, byte [esp + 0x73]
mov dword [ebx + eax*4 + 0x38], 0x1008c000
movsx eax, byte [esp + 0x74]
mov dword [ebx + eax*4 + 0x38], 0x100aa5a0
movsx eax, byte [esp + 0x75]
mov dword [ebx + eax*4 + 0x38], 0x100a0988
movsx eax, byte [esp + 0x76]
mov dword [ebx + eax*4 + 0x38], 0x10097ec8
movsx eax, byte [esp + 0x77]
mov dword [ebx + eax*4 + 0x38], 0x100a9448
movsx eax, byte [esp + 0x78]
mov dword [ebx + eax*4 + 0x38], 0x1009f830
movsx eax, byte [esp + 0x79]
mov dword [ebx + eax*4 + 0x38], 0x1009c428
movsx eax, byte [esp + 0x7a]
mov dword [ebx + eax*4 + 0x38], 0x10090560
test dl, dl
je 0x1005070d
mov ah, 0x5a
lodsd eax, dword [esi]
push esp
push ss
sub dword [edx - 0x46], 0xf0554e0b
cld
ljmp 0xb1b6
movsx eax, byte [esp + 0x7b]
mov dword [ebx + eax*4 + 0x38], 0x100a4ee8
movsx eax, byte [esp + 0x7c]
mov dword [ebx + eax*4 + 0x38], 0x10093968
movsx eax, byte [esp + 0x7d]
mov dword [ebx + eax*4 + 0x38], 0x1009d580
movsx eax, byte [esp + 0x7e]
mov dword [ebx + eax*4 + 0x38], 0x10096d70
test dl, dl
je 0x100509e9
invalid
movsx eax, byte [esp + 0x7f]
push dword [esp + 0x30]
push 0
mov dword [ebx + eax*4 + 0x38], 0x10095c18
movsx eax, byte [esp + 0x88]
mov dword [ebx + eax*4 + 0x38], 0x10099020
movsx eax, byte [esp + 0x89]
mov dword [ebx + eax*4 + 0x38], 0x100916b8
movsx eax, byte [esp + 0x8a]
mov dword [ebx + eax*4 + 0x38], 0x100a6040
movsx eax, byte [esp + 0x8b]
mov dword [ebx + eax*4 + 0x38], 0x1009e6d8
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
push dword [esp + 0x34]
push 0
call ebp
push eax
call ebx
push dword [esp + 0x38]
push 0
call ebp
push eax
call ebx
push dword [esp + 0x14]
push 0
call ebp
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret