Function at 0x402485
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x6c], 0x76660f24
mov dword [ebp - 0x68], 0x753f24
mov dword [ebp - 0x64], 0x643f05
mov dword [ebp - 0x60], 0x917f09
mov dword [ebp - 0x5c], 0x8685612a
mov dword [ebp - 0x58], 0x56a0f37
mov dword [ebp - 0x54], 0x7640d25
mov dword [ebp - 0x50], 0x67753024
mov dword [ebp - 0x4c], 0x76672d0a
push ebx
mov dword [ebp - 0x48], 0x87711004
mov dword [ebp - 0x44], 0x6551044
push esi
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x40], 0x8643f28
mov dword [ebp - 0x1c], eax
push edi
bsf ecx, ebx
test byte [0x409e58], 1
mov ecx, 0xff970
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xff971
jne 0x40251c
mov eax, dword [sym.imp.USER32.dll_SetActiveWindow]
or dword [0x409e58], 1
mov dword [0x409544], eax
mov dword [ebp - 8], 0xff974
mov dword [ebp - 0x20], 0xff950
mov eax, dword [0x408f44]
xor edx, edx
push 7
pop esi
div esi
mov esi, 0x53872
xor eax, 0x327b
mov dword [ebp - 0x24], eax
mov edx, dword [0x408f4c]
mov eax, dword [0x408f48]
sub eax, edx
mov edx, dword [ebp - 0x24]
or eax, 0x3f60
cmp edx, eax
je 0x402732
mov dword [ebp - 0x2c], ecx
cmp ah, 0x48
cmp cx, ax
mov edi, dword [ebp - 0x10]
xor edi, esi
mov ebx, 0xac102
sub edi, ebx
jmp 0x402724
cmp cl, 0xcf
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
xor eax, esi
sub eax, ebx
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, edi
div dword [ebp - 0x24]
xor cl, 0x72
sub cl, 2
xor edx, edx
mov ebx, eax
mov eax, dword [ebp - 8]
xor eax, esi
sub eax, 0xac102
mov dword [ebp - 0x24], eax
mov eax, edi
div dword [ebp - 0x24]
lea eax, [ebp + edx - 0x6c]
mov byte [eax + ebx*4], cl
cmp dx, 0x2e19
mov edi, dword [ebp - 0x10]
xor edi, esi
mov ebx, 0xac102
sub edi, ebx
jmp 0x4026f6
mov dword [ebp - 0x24], 0xfcf
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x408f50]
add eax, 0x537d
or eax, ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
mov eax, 0x5caf
xor ax, word [ecx + edi*4 + 2]
mov ecx, 0x436e
add ax, cx
cmp ax, word [ebp - 0xc]
jne 0x4026ea
mov eax, dword [0x408f54]
mov ecx, 0x42d1
xor edx, edx
div ecx
mov dword [ebp - 0x24], edx
mov cl, byte [0x408f58]
mov eax, dword [0x408f5c]
shl eax, cl
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
jbe 0x4026a6
leave
mul dword [esi - 0x65045539]
xchg esp, eax
insb byte es:[edi], dx
xor byte [ebx], ch
sal ah, 0x70
fistp dword [edx]
dec edx
add byte [eax], al
add byte [edx], ah
add byte [eax], al
test byte [ecx], cl
jecxz 0x40265e
ljmp 0x1b04:0xe401dbc7
add byte [esi], dl
xor al, 0xc3
dec esp
retf
mov eax, dword [ebp + 0xc]
mov al, byte [eax + edi*4]
mov ecx, dword [ebp - 8]
xor al, 0xaf
add al, 0x6e
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
xor ecx, esi
xor edx, edx
sub ecx, ebx
div ecx
xor edx, edx
mov ecx, eax
mov eax, dword [ebp - 8]
xor eax, esi
sub eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
div dword [ebp - 0x24]
lea eax, [ebp + edx - 0x6c]
mov dl, byte [ebp - 1]
mov byte [eax + ecx*4], dl
cmp edx, 0xebbd0b43
mov ebx, 0xac102
mov eax, dword [ebp - 0x14]
xor eax, esi
lea edi, [edi + eax - 0xac102]
mov ecx, dword [ebp + 0xc]
mov eax, 0x5caf
xor ax, word [ecx + 0x20]
mov ecx, 0x436e
add ax, cx
movzx eax, ax
cmp edi, eax
jb 0x4025ca
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
xor eax, esi
lea edi, [ecx + eax - 0xac102]
mov dword [ebp - 0xc], edi
cmp edi, 0x30
jb 0x40257a
jmp 0x402737
mov ebx, 0xac102
mov eax, dword [ebp - 0x10]
xor eax, esi
sub eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
xor eax, esi
sub eax, ebx
mov dword [ebp - 0x24], eax
mov ecx, dword [0x408f68]
mov eax, dword [0x408f64]
xor edx, edx
div ecx
mov ecx, dword [0x408f60]
xor eax, 0x135f
add eax, 0xffffa854
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, 0x4daf
mov word [ebp - 0x3c], ax
mov eax, 0x131c
mov word [ebp - 0x3a], ax
mov eax, 0x2304
mov word [ebp - 0x38], ax
mov eax, 0x75f1
mov word [ebp - 0x36], ax
mov eax, 0x4bb1
mov word [ebp - 0x34], ax
mov eax, 0xcc1
mov word [ebp - 0x32], ax
mov eax, 0x429e
mov word [ebp - 0x30], ax
mov eax, 0x2bae
mov word [ebp - 0x2e], ax
mov cl, byte [0x408f70]
mov eax, 0x6a79
sar eax, cl
movzx ecx, ax
mov ax, word [0x408f6c]
movzx eax, ax
xor eax, ecx
mov ecx, dword [ebp - 0x24]
mov cx, word [ebp + ecx*2 - 0x3c]
cdq
movzx ecx, cx
idiv ecx
mov word [ebp - 4], dx
mov ax, word [0x408f7c]
mov cx, word [0x408f78]
movzx eax, ax
or eax, 0x7a74
movzx ecx, cx
cdq
idiv ecx
mov ax, word [0x408f74]
mov cx, word [ebp - 4]
imul ax, dx
cmp cx, ax
jbe 0x40287d
ljmp 0x48c2:0x6241cb6b
sub ecx, 0x5be9f1b3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], 0xff970
movzx eax, word [0x408e6c]
mov ecx, 0xaee
sub ax, cx
and eax, 0x3ee7
mov word [ebp + 8], ax
mov ax, word [0x408e78]
mov cx, word [0x408e74]
sub cx, ax
movzx eax, cx
mov cx, word [0x408e70]
movzx ecx, cx
cdq
idiv ecx
mov cx, word [ebp + 8]
shr ax, 6
cmp cx, ax
ja 0x402958
invalid
mov dword [ebp - 0x18], 0xff971
movzx eax, word [0x408e7c]
imul eax, eax, 0x2973
mov word [ebp - 4], ax
mov eax, 0x4e45
mov word [ebp + 8], ax
mov ax, word [0x408e80]
mov ecx, 0x3651
xor ax, cx
mov cx, word [ebp + 8]
imul cx, ax
mov ax, word [ebp - 4]
cmp ax, cx
jbe 0x402aec
mov dword [ebp - 0x28], 0xff950
bts ebx, 0xa
jmp 0x402a0e
mov eax, dword [ebp - 0xc]
xor eax, esi
mov ebx, 0xac102
sub eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x408ec0]
mov ecx, dword [0x408ebc]
xor eax, ecx
shl eax, 0x1d
sub eax, 0x4ff6
xor eax, 0x7fffb00e
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov cl, byte [eax*4 + 0x408ec4]
mov eax, dword [0x408eb8]
shl eax, cl
mov ecx, dword [0x408eb4]
push 7
xor edx, edx
imul ecx, eax
mov dword [ebp + 8], ecx
mov eax, dword [0x408ee0]
add eax, 0x4b03
pop ecx
div ecx
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x402acf
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x3c]
mov ax, word [0x408e8c]
movzx edi, ax
mov ax, word [0x408e88]
movzx eax, ax
cdq
idiv edi
movzx eax, dx
mov dx, word [0x408e84]
movzx edi, dx
cdq
idiv edi
xor edx, edx
imul eax, eax, 0x25ae
mov word [ebp + 8], ax
mov edi, dword [ebp - 8]
add edi, dword [ecx + 0x78]
mov ecx, dword [0x408e90]
mov eax, 0xa74
div ecx
mov cl, 0x1e
and edx, 0x44
imul edx, edx, 0x1fc9
xor edx, 0x87167
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x408e94]
imul cl
movzx ecx, byte [0x408e8e]
movzx eax, al
or ecx, eax
mov byte [ebp + 0xb], cl
mov eax, dword [0x408ea4]
mov ecx, dword [0x408ea0]
and eax, ecx
mov ecx, dword [0x408e9c]
sub eax, ecx
sub eax, 0x4609
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov cl, byte [eax + 0x408ea8]
mov al, byte [0x408e9b]
or cl, al
mov al, byte [0x408e9a]
xor al, cl
mov cl, byte [ebp + 0xb]
add al, 0x50
cmp cl, al
jb 0x4029a9
jmp 0x40289a
mov eax, dword [ebp - 8]
add eax, dword [edi + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0xc]
xor ecx, esi
sub ecx, ebx
jmp 0x402ba6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
movsx edx, byte [eax + edx]
xor ebx, esi
sub ebx, 0xac102
cmp edx, ebx
je 0x402ced
mov edx, dword [ebp - 0x18]
xor edx, esi
lea eax, [eax + edx - 0xac102]
mov dword [ebp - 4], eax
shl ebx, 0x11
mov edx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x14]
xor dl, 0x72
sub dl, 2
cmp byte [ebx + eax], dl
je 0x402aef
test byte [0x409e50], 2
jne 0x402b4b
mov edx, dword [sym.imp.GDI32.dll_ExtTextOutA]
or dword [0x409e50], 2
mov dword [0x409534], edx
mov edx, dword [ebp - 0x14]
mov dl, byte [edx + eax]
mov ebx, dword [ebp - 0x1c]
cmp dl, byte [eax + ebx]
je 0x402aef
mov al, byte [0x408f1d]
movzx ebx, al
mov eax, 0xed
cdq
idiv ebx
movzx edx, byte [0x408f1c]
movzx eax, al
xor edx, eax
mov byte [ebp + 0xb], dl
mov edx, dword [ebp - 0xc]
xor edx, esi
sub edx, 0xac102
mov dword [ebp - 0x20], edx
aam 0xa
mov eax, dword [ebp - 0xc]
xor eax, esi
sub eax, 0xac102
cmp edx, eax
jne 0x402cfd
mov eax, dword [ebp - 0x18]
xor eax, esi
lea ecx, [ecx + eax - 0xac102]
mov dword [ebp - 0x10], ecx
cmp ecx, dword [edi + 0x18]
jae 0x402e2b
mov al, byte [0x408ee4]
or al, 0x5a
mov byte [ebp + 0xb], al
mov dl, byte [0x408ee7]
mov al, byte [0x408ee6]
add dl, al
mov al, byte [0x408ee5]
imul dl
mov dl, byte [ebp + 0xb]
shl al, 2
cmp dl, al
je 0x402aef
mov dword [ebp + 8], 0x6532
mov eax, dword [ebp + 8]
mov ecx, dword [0x408ee8]
shr eax, 8
sub eax, ecx
add eax, 0x688d
xor eax, 0x626f
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x408ef4]
mov ebx, dword [0x408ef0]
mov eax, dword [0x408eec]
xor edx, edx
div ebx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x20], 1
or ecx, eax
mov dword [ebp + 8], ecx
mov eax, dword [0x408f18]
mov ecx, dword [ebp + 8]
sub eax, 0x331
and eax, 0x4703
inc eax
add byte [ebx + 0x312d084d], cl
add eax, dword [eax]
add byte [0x4703], ah
cmp ecx, eax
jne 0x402cb5
mov ch, byte [esi - 0x69]
push ds
add eax, edi
jno 0x402c28
loop 0x402c18
jns 0x402cbd
and ebx, dword [ecx - 0x68]
test dword [ecx + 1], edx
add byte [eax], al
pop esi
add byte [eax], al
add byte [edi + 0x22], dl
cmpsb byte [esi], byte es:[edi]
test dword [edi - 0x75], esp
fdivr qword [edi - 0x294bba92]
sal cl, 0x7d
pminub mm2, mm1
call [ebx - 0x237cecf5]
cmp byte [ecx + esi + 0x5a], bh
adc bl, byte [ecx + 0x31360e36]
les ebx, [ebx + 0x10eef83a]
pop ebx
sub al, 0x85
inc edx
sti
mov edi, ebx
push 0x2a892585
add eax, dword ss:[eax]
sbb edi, dword [ebx + ebx*4 - 0x39278720]
int3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
add eax, dword [edx + ecx*4]
lock add eax, dword [edx + ecx*4]
test byte [0x409e50], 1
mov dword [ebp - 0x1c], eax
jne 0x402cde
mov eax, dword [sym.imp.COMCTL32.dll_ImageList_Draw]
or dword [0x409e50], 1
mov dword [0x409530], eax
mov eax, dword [ebp - 0xc]
xor eax, esi
sub eax, 0xac102
jmp 0x402b18
mov eax, dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov edx, dword [ebp - 0x20]
mov dword [ebp + 8], eax
jmp 0x402b88
mov eax, dword [sym.imp.USER32.dll_TrackPopupMenu]
mov dword [ebp + 8], eax
mov ebx, dword [ebp - 8]
add ebx, dword [edi + 0x24]
cmp al, 0xb8
mov edx, dword [ebp - 8]
add edx, dword [edi + 0x1c]
mov ax, word [0x408f28]
mov edi, 0x7567
imul ax, di
movzx eax, ax
shr eax, 7
add eax, 0xd97d
mov word [ebp - 4], ax
mov ax, word [0x408f2c]
sub ax, 0x3a
and ax, 0x41
shl ax, 8
mov edi, 0xdbfa
not ax
and ax, di
mov di, word [ebp - 4]
mov dword [ebp - 0x2c], edx
cmp di, ax
jbe 0x402e02
mov edi, dword [0x408f34]
mov eax, dword [0x408f30]
xor edx, edx
div edi
push 0x25
shl eax, 0x17
add eax, 0x78800002
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x408f3c]
movzx eax, al
mov dword [ebp + 8], eax
mov al, byte [0x408f38]
movzx edi, al
pop eax
cdq
idiv edi
mov edi, 0x3473
imul edx, dword [ebp + 8]
mov byte [ebp + 0xb], dl
mov ax, word [0x408f24]
movzx eax, ax
cdq
idiv edi
movzx eax, dx
mov dx, word [0x408f20]
xor eax, 0x5d7a
movzx edi, dx
cdq
idiv edi
sub edx, 0x1381
movzx eax, dx
movzx edx, word [ebp - 4]
sub edx, eax
mov word [ebp - 4], dx
mov ax, word [0x408f2c]
sub ax, 0x3a
and ax, 0x41
shl ax, 8
mov edx, 0xdbfa
not ax
and ax, dx
mov dx, word [ebp - 4]
cmp dx, ax
ja 0x402d5e
mov edx, dword [ebp - 0x2c]
movzx eax, word [ebx + ecx*2]
lea ecx, [edx + eax*4]
mov eax, dword [ebp - 8]
add eax, dword [ecx]
test byte [0x409e50], 4
mov dword [ebp - 0x24], eax
jne 0x402e2b
mov eax, dword [sym.imp.GDI32.dll_ResizePalette]
or dword [0x409e50], 4
mov dword [0x40952c], eax
test byte [0x409e58], 2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
jne 0x402e4b
mov eax, dword [sym.imp.USER32.dll_EndPaint]
or dword [0x409e58], 2
mov dword [0x409540], eax
rcl ebx, 6
mov dword [ebp + 8], 0xff974
mov eax, dword [ebp + 8]
push dword [ebp - 0x24]
mov edi, dword [ebp + 0x14]
xor eax, esi
lea eax, [ebp + eax - 0xac0ee]
push eax
call fcn.00402291
pop edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
pop esi
pop ebx
leave
ret