Function at 0x42d6b0
Capabilities:
Encode data using xor
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dl, byte [0x77b0b8]
mov ecx, dword [0x77b0b4]
xor dl, al
xor byte [ecx + 0x77b0c0], dl
inc ecx
and ecx, 0xfff
xor dl, ah
xor byte [ecx + 0x77b0c0], dl
mov dword [ebp - 0x28], eax
xor dl, byte [ebp - 0x26]
inc ecx
and ecx, 0xfff
inc ecx
xor byte [ecx + 0x77b0bf], dl
xor dl, byte [ebp - 0x25]
and ecx, 0xfff
movzx eax, al
xor byte [ecx + 0x77b0c0], dl
inc ecx
and eax, 1
and ecx, 0xfff
add eax, ecx
and eax, 0xfff
mov dword [0x77b0b4], eax
lea eax, [ebp - 0x14]
push eax
mov byte [0x77b0b8], dl
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov ecx, dword [0x77b0b4]
mov al, byte [0x77b0b8]
xor edx, edx
xor al, byte [ebp + edx - 0x14]
inc ecx
xor byte [ecx + 0x77b0bf], al
xor al, byte [ebp + edx - 0x13]
and ecx, 0xfff
inc ecx
xor byte [ecx + 0x77b0bf], al
xor al, byte [ebp + edx - 0x12]
and ecx, 0xfff
inc ecx
xor byte [ecx + 0x77b0bf], al
xor al, byte [ebp + edx - 0x11]
and ecx, 0xfff
inc ecx
xor byte [ecx + 0x77b0bf], al
add edx, 4
and ecx, 0xfff
cmp edx, 0x10
jl 0x42d744
mov byte [0x77b0b8], al
movzx eax, byte [ebp - 0x14]
and eax, 1
add eax, ecx
and eax, 0xfff
mov dword [0x77b0b4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dl, byte [0x77b0b8]
mov ecx, dword [0x77b0b4]
xor dl, al
xor byte [ecx + 0x77b0c0], dl
inc ecx
and ecx, 0xfff
xor dl, ah
xor byte [ecx + 0x77b0c0], dl
mov dword [ebp - 0x28], eax
xor dl, byte [ebp - 0x26]
inc ecx
and ecx, 0xfff
inc ecx
xor byte [ecx + 0x77b0bf], dl
xor dl, byte [ebp - 0x25]
and ecx, 0xfff
movzx eax, al
xor byte [ecx + 0x77b0c0], dl
inc ecx
and eax, 1
and ecx, 0xfff
add eax, ecx
and eax, 0xfff
mov byte [0x77b0b8], dl
mov dword [0x77b0b4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dl, byte [0x77b0b8]
mov ecx, dword [0x77b0b4]
xor dl, al
xor byte [ecx + 0x77b0c0], dl
inc ecx
and ecx, 0xfff
xor dl, ah
xor byte [ecx + 0x77b0c0], dl
mov dword [ebp - 0x28], eax
xor dl, byte [ebp - 0x26]
inc ecx
and ecx, 0xfff
inc ecx
xor byte [ecx + 0x77b0bf], dl
xor dl, byte [ebp - 0x25]
and ecx, 0xfff
movzx eax, al
xor byte [ecx + 0x77b0c0], dl
inc ecx
and eax, 1
and ecx, 0xfff
add eax, ecx
and eax, 0xfff
mov dword [0x77b0b4], eax
lea eax, [ebp - 0x24]
push eax
mov byte [0x77b0b8], dl
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [0x77b0b4]
mov cl, byte [0x77b0b8]
xor esi, esi
jmp 0x42d8a0
xor cl, byte [ebp + esi - 0x24]
lea eax, [edx + 1]
xor byte [edx + 0x77b0c0], cl
xor cl, byte [ebp + esi - 0x23]
and eax, 0xfff
inc eax
xor byte [eax + 0x77b0bf], cl
xor cl, byte [ebp + esi - 0x22]
and eax, 0xfff
inc eax
xor byte [eax + 0x77b0bf], cl
xor cl, byte [ebp + esi - 0x21]
and eax, 0xfff
add esi, 4
xor byte [eax + 0x77b0c0], cl
lea edx, [eax + 1]
and edx, 0xfff
cmp esi, 0x10
jl 0x42d8a0
movzx eax, byte [ebp - 0x24]
and eax, 1
add eax, edx
and eax, 0xfff
mov dword [0x77b0b4], eax
lea eax, [ebp - 0x30]
push eax
mov byte [0x77b0b8], cl
call dword [sym.imp.USER32.dll_GetCursorPos]
mov dl, byte [0x77b0b8]
xor dl, byte [ebp - 0x30]
mov eax, dword [0x77b0b4]
inc eax
xor byte [eax + 0x77b0bf], dl
xor dl, byte [ebp - 0x2f]
and eax, 0xfff
inc eax
xor byte [eax + 0x77b0bf], dl
xor dl, byte [ebp - 0x2e]
and eax, 0xfff
inc eax
xor byte [eax + 0x77b0bf], dl
xor dl, byte [ebp - 0x2d]
and eax, 0xfff
inc eax
xor byte [eax + 0x77b0bf], dl
xor dl, byte [ebp - 0x2c]
and eax, 0xfff
inc eax
xor byte [eax + 0x77b0bf], dl
xor dl, byte [ebp - 0x2b]
and eax, 0xfff
inc eax
xor byte [eax + 0x77b0bf], dl
xor dl, byte [ebp - 0x2a]
and eax, 0xfff
push 0
xor byte [eax + 0x77b0c0], dl
xor dl, byte [ebp - 0x29]
lea ecx, [eax + 1]
movzx eax, byte [ebp - 0x30]
and ecx, 0xfff
inc ecx
xor byte [ecx + 0x77b0bf], dl
and eax, 1
and ecx, 0xfff
add eax, ecx
and eax, 0xfff
push 0x42d4e0
mov byte [0x77b0b8], dl
mov dword [0x77b0b4], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00633732
mov esp, ebp
pop ebp
ret