Function at 0x40d950
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa4
cmp dword [ecx + 0x20], 0
je 0x40de04
mov esi, ecx
movzx eax, byte [ecx]
lea ecx, [esp + 0xa0]
push 0xa
push 4
push ecx
push eax
call fcn.0040de20
add esp, 0x10
mov edi, eax
lea eax, [esi + 0x10]
push eax
call fcn.0040a570
add esp, 4
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x48]
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
lea eax, [ecx + 0x400]
push eax
call fcn.0040c730
add esp, 4
mov dword [esp], eax
mov dword [esp + 0x14], 0x6d6d5e6c
mov byte [esp + 0x18], 0xc0
mov dword [esp + 0x19], 0
mov word [esp + 0x1d], 0
mov ebx, 0x15e4f131
mov ebp, 0xca1b0ece
nop
nop
nop
nop
nop
movzx edx, byte [esp + ebx - 0x15e4f11d]
mov ecx, ebp
and ecx, 0xc80000b2
mov eax, ebx
and eax, 0x1064214d
or eax, ecx
xor eax, edx
xor eax, 0xed80d0b2
add eax, 0x73cf649c
mov ecx, eax
and ecx, 0x6f
xor eax, 0x6f
lea eax, [eax + ecx*2]
mov byte [esp + ebx - 0x15e4f11d], al
inc ebx
dec ebp
cmp ebx, 0x15e4f13c
jne 0x40d9e0
lea eax, [esp + 0x14]
mov ecx, esi
push 0x451df8
push eax
push dword [esp + 8]
call fcn.0040d3d0
mov dword [esp + 0x14], 0x219a9c94
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov eax, 0xc9
mov ecx, 0x36
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xb5]
mov ebx, eax
or ebx, edx
not edx
or edx, ecx
and edx, ebx
add dl, 0x13
mov byte [esp + eax - 0xb5], dl
inc eax
dec ecx
cmp eax, 0xd0
jne 0x40da60
mov ecx, esi
push edi
lea eax, [esp + 0x18]
push eax
push dword [esp + 8]
call fcn.0040d3d0
mov eax, dword [str.eJYIHk__]
mov dword [esp + 0x14], 0x51aaa4a0
mov word [esp + 0x18], 0
mov ebp, 0x8d
mov edx, 0x72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ebp - 0x79]
mov edi, ebp
and edi, ebx
mov ecx, ebp
xor ecx, ebx
sub ecx, ebx
add ecx, edi
and ebx, edx
or ebx, ecx
add bl, 0x3f
mov byte [esp + ebp - 0x79], bl
inc ebp
dec edx
cmp ebp, 0x93
jne 0x40dac0
mov ecx, esi
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 8]
call fcn.0040d3d0
mov dword [esp + 0x14], 0xd5a0a899
mov dword [esp + 0x18], 0xe0d5dcd1
mov dword [esp + 0x1c], 0xdedfd4e1
mov byte [esp + 0x20], pe_nt_image_headers32
mov dword [esp + 0x21], 0
mov dword [esp + 0x24], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x14]
mov ebx, eax
and ebx, 0x3a
mov edx, ecx
xor edx, 0x6341ba3d
add edx, ebx
mov ebp, edx
and ebp, edi
add edx, edi
add ebp, ebp
mov ebx, edx
sub ebx, ebp
add ebx, 2
and edx, 1
or ebx, 1
add ebx, edx
add bl, 0xcc
mov byte [esp + ecx + 0x14], bl
inc ecx
add eax, 2
cmp ecx, 0x14
jne 0x40db30
mov dword [esp + 4], 0x99e6f6f3
mov byte [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x9b
xor cl, byte [esp + eax + 4]
add cl, 0xf9
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 5
jne 0x40db80
lea edx, [esp + 4]
mov ecx, esi
lea eax, [esp + 0x14]
push eax
push edx
push dword [esp + 8]
call fcn.0040d3d0
mov dword [esp + 0x14], 0x467e7846
mov byte [esp + 0x18], 0xe4
mov dword [esp + 0x19], 0
mov word [esp + 0x1d], 0
mov eax, 0x58
mov ecx, 0xa7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x44]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
add dl, 0x48
mov byte [esp + eax - 0x44], dl
inc eax
dec ecx
cmp eax, 0x63
jne 0x40dbe0
mov ecx, esi
push dword [esp + 0x9c]
push dword [esp + 0x9c]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0xc]
call fcn.0040d620
mov eax, dword [esi + 0x60]
mov dword [esp + 0x14], 0xd96bdb01
mov dword [esp + 0x18], 0xdd6adf6a
mov dword [esp + 0x1c], 0xd160d367
mov dword [esp + 0x20], 0xd525d764
mov dword [esp + 0x24], 0xa925ab00
mov dword [esp + 0x28], 0xad15af18
mov dword [esp + 0x2c], 0xa142a362
mov dword [esp + 0x30], 0xa52da713
mov dword [esp + 0x34], 0xb90ebb18
mov dword [esp + 0x38], 0xbd0ebf07
mov dword [esp + 0x3c], 0xb104b31b
mov dword [esp + 0x40], 0xb547b704
mov dword [esp + 0x44], 0x893b8b0e
mov dword [esp + 0x48], 0x8d3d8f3e
mov dword [esp + 0x4c], 0x8126837f
mov dword [esp + 0x50], 0x85328727
mov dword [esp + 0x54], 0x99579b23
mov dword [esp + 0x58], 0x9d389f78
mov dword [esp + 0x5c], 0x9119932d
mov dword [esp + 0x60], 0x95329722
mov dword [esp + 0x64], 0x69dc6b33
mov dword [esp + 0x68], 0x6dad6fe7
mov dword [esp + 0x6c], 0x61d963ca
mov dword [esp + 0x70], 0x65ad67a8
mov dword [esp + 0x74], 0x79c17bc0
mov dword [esp + 0x78], 0x7dc17fb3
mov dword [esp + 0x7c], 0x71d673cc
mov dword [esp + 0x80], 0x75d377c1
mov dword [esp + 0x84], 0x49f14bcb
mov dword [esp + 0x88], 0x4df84ffe
mov dword [esp + 0x8c], 0x41b543f7
mov dword [esp + 0x90], 0x45584753
mov dword [esp + 0x94], 0x5b44
mov ecx, 0x29f5f7af
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x29f5f79b]
lea ebp, [ecx - 0x29f5f700]
and ebp, edi
or edi, ecx
lea edx, [edi + edi]
not edx
add edx, edi
or edx, ebp
mov bl, 0x94
sub bl, dl
mov byte [esp + ecx - 0x29f5f79b], bl
inc ecx
cmp ecx, 0x29f5f833
jne 0x40dd40
mov dword [esp + 4], 0x2383215f
mov dword [esp + 8], 0x279f2594
mov word [esp + 0xc], 0x3938
mov dword [esp + 0xe], 0
mov byte [esp + 0x12], 0
mov ecx, 0xf6e0cc88
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x91f337c]
xor edi, ecx
mov edx, edi
and edx, 0x57
add edx, edx
xor edi, 0xa8
sub edx, edi
mov byte [esp + ecx + 0x91f337c], dl
inc ecx
cmp ecx, 0xf6e0cc97
jne 0x40dda0
push 0x493e0
push eax
mov edi, dword [esp + 8]
push edi
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0040ffa0
add esp, 0x1c
mov ebx, eax
push edi
call fcn.0040c740
add esp, 4
mov eax, dword [esi + 0x60]
add dword [esi + 4], eax
mov dword [esi + 0x60], 0
jmp 0x40de06
mov bl, 1
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret