Function at 0x41037c
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push ecx
mov eax, dword [esp + 0x20]
mov edx, 0x369a
mov ecx, dword [esp + 0xc]
push ebx
push ebp
lea ebp, [eax - 0x370]
push esi
lea ebx, [eax - 0xa51]
mov dword [esp + 0xc], ebp
push edi
mov edi, eax
mov esi, ecx
mov eax, dword [esp + 0x24]
xor esi, edx
add eax, 0x325
mov dword [esp + 0x30], esi
mov dword [esp + 0x1c], eax
xor edi, 0x23d
lea eax, [ecx - 0x369a]
xor eax, 0x3f6f
cmp ebp, eax
mov ebp, dword [esp + 0x20]
jg 0x410413
mov ecx, dword [ebp + 0xe8]
add ecx, dword [ebp + 0xe4]
xor ecx, 0x4f91f
mov dword [ebp + 0x38], ecx
mov eax, dword [ebp + 0xd4]
add eax, 0x10d1
add ecx, eax
mov dword [ebp + 0x38], ecx
mov eax, dword [ebp + 0x24]
cmp eax, dword [ebp + 0xb4]
je 0x410539
sub ecx, dword [ebp + 0xc]
sub ecx, 0x2b061d5e
mov dword [ebp + 0x38], ecx
jmp 0x410539
mov ecx, dword [ebp + 0xc0]
lea eax, [ecx + 0x5a78]
cmp ecx, eax
jne 0x410539
mov ecx, dword [esp + 0x1c]
mov eax, ebx
sub eax, ecx
cmp dword [ebp + 0x64], eax
je 0x410526
mov eax, ecx
or eax, dword [esp + 0x10]
add eax, edx
cmp dword [esp + 0x10], eax
jle 0x410518
mov eax, dword [ebp + 4]
and eax, esi
and eax, 0x3aeb
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0xdc]
or eax, edi
xor eax, dword [ebp + 0x68]
push eax
mov eax, dword [ebp + 0xd0]
and eax, dword [ebp + 4]
push eax
mov eax, dword [ebp + 0xe8]
add eax, dword [ebp + 0xe4]
and eax, 0x3900
push eax
mov eax, dword [ebp + 0x18]
imul eax, edi
xor eax, dword [ebp + 0xb8]
push eax
mov eax, dword [ebp + 0x88]
sub eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push eax
call edi
mov eax, dword [ebp + 0xc0]
mov ecx, dword [ebp + 0x9c]
imul eax, dword [esp + 0x30]
mov edx, dword [ebp + 0x54]
mov esi, dword [ebp + 0x64]
add edx, ebx
sub esi, dword [esp + 0x1c]
xor edx, 0x3aeb
add esi, dword [ebp + 0x24]
imul ecx, ebx
push ebp
push eax
push ecx
push edx
push esi
call fcn.0041e9a2
imul ecx, dword [ebp + 0xb8], 0x34ad
add esp, 0x14
mov dword [esp + 0x1c], eax
push 0
sub ecx, dword [ebp + 0xd0]
push ecx
mov ecx, dword [ebp + 0x6c]
and ecx, eax
xor eax, 0x1657
or ecx, dword [ebp + 0x24]
push ecx
push eax
mov eax, dword [ebp + 0xc8]
xor eax, dword [ebp + 0x4c]
or eax, 0x2a02
push eax
call edi
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x1c]
jmp 0x410539
sub edx, dword [ebp + 0x94]
add esi, edx
mov dword [esp + 0x30], esi
jmp 0x410539
mov eax, dword [ebp + 0x94]
imul eax, dword [ebp + 0x14]
or eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, 0x99a
cmp edi, ebx
jge 0x410688
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0xc8]
je 0x410559
mov dword [ebp + 0x48], 0x445f30
xor edi, edi
mov esi, edi
mov edx, dword [ebp + 0xac]
mov ecx, dword [ebp + 0xc]
xor ecx, edx
sub ecx, 0x179c20
imul ecx, dword [ebp + 0xc]
push 0x53
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 0xe4]
sub eax, 0x4fd35
xor eax, ecx
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x3c]
pop eax
sub eax, edx
sub eax, dword [ebp + 0x4c]
add dword [ebp + 0xe4], eax
mov eax, dword [ebp + 0x48]
mov ebx, dword [esi + eax]
add esi, 4
imul ebx, dword [ebp + 0x38]
mov eax, dword [ebp + 0xc]
sub eax, 0x179c73
xor dword [ebp + 0xa0], eax
mov eax, dword [ebp + 0x60]
mov edx, ebx
shr edx, 8
mov byte [ecx + eax], dl
inc dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x60]
mov byte [ecx + eax], bl
inc dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x24]
lea eax, [ecx - 0xf]
add ecx, 0xfffffff0
imul eax, dword [ebp + 0xac]
mov dword [ebp + 0xac], eax
xor ecx, dword [ebp + 0x4c]
mov eax, dword [ebp + 4]
sub ecx, dword [ebp + 0xe4]
add eax, 0x4fd35
add eax, ecx
mov dword [ebp + 0x4c], eax
cmp esi, 0x918
jl 0x41055d
mov esi, dword [esp + 0x30]
mov dword [ebp + 0xbc], 0x4666f0
mov eax, dword [ebp + 0xb4]
sub eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x70]
xor eax, 0xffcdd411
or dword [ebp + 0xe4], eax
mov eax, dword [ebp + 0x40]
xor dword [edi + ecx], eax
add edi, 4
mov eax, dword [ebp + 0x9c]
sub eax, dword [ebp + 0xc8]
sub eax, 0xa6744
add dword [ebp + 0x50], eax
mov eax, dword [ebp + 0xe4]
sub eax, dword [ebp + 0x7c]
sub eax, 0x4fd28
add dword [ebp + 0x94], eax
mov eax, dword [ebp + 0x98]
add dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x64]
add eax, dword [ebp + 4]
sub dword [ebp + 0xd4], eax
cmp edi, 0x12b60
jl 0x410611
cmp dword [ebp + 0xc8], 0x4ca7
jbe 0x410688
mov ecx, dword [ebp + 0x70]
mov dword [ebp + 0x44], ecx
xor esi, 0x2a02
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret