Function at 0x10004bfa
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
jmp 0x10004c15
jmp 0x10004c27
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [0x1004abdc], 0
mov dword [0x1004cc58], eax
je 0x10004c54
xor ecx, ecx
mov al, 0x68
sub al, cl
xor byte [ecx + 0x1004abc0], al
inc ecx
cmp ecx, 8
jb 0x10004c3d
mov byte [0x1004abdc], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x1004abc0
call ebx
cmp byte [0x1004aa45], 0
mov dword [0x1004cd84], eax
je 0x10004c88
xor ecx, ecx
mov al, 0xd
sub al, cl
xor byte [ecx + str.C_bdmgp_aho], al
inc ecx
cmp ecx, 0xb
jb 0x10004c71
mov byte [0x1004aa45], 0
push str.C_bdmgp_aho
call ebx
cmp dword [0x1004cd84], 0
mov dword [0x1004cd6c], eax
je 0x100050d9
test eax, eax
je 0x100050d9
cmp byte [0x1004ab0a], 0
je 0x10004ccb
xor ecx, ecx
mov al, 0xb2
sub al, cl
xor byte [ecx + 0x1004ad20], al
inc ecx
cmp ecx, 0xa
jb 0x10004cb4
mov byte [0x1004ab0a], 0
push 0x1004ad20
call ebx
mov dword [0x1004cc30], eax
test eax, eax
je 0x100050d9
push 0xc
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.PSAPI.DLL_GetModuleInformation]
push eax
call esi
mov ecx, dword [0x1004cc30]
mov eax, dword [ebp - 8]
mov dword [0x1004cc4c], ecx
dec ecx
add eax, ecx
mov dword [0x1004cc64], eax
lea eax, [ebp - 0xc]
push 0xc
push eax
push dword [0x1004cd6c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 8]
mov ecx, dword [0x1004cd6c]
dec eax
add eax, ecx
mov dword [0x1004ce9c], ecx
cmp byte [0x1004aa43], 0
mov dword [0x1004cea0], eax
je 0x10004d5a
xor ecx, ecx
mov al, 0x8c
sub al, cl
xor byte [ecx + 0x1004ab3c], al
inc ecx
cmp ecx, 7
jb 0x10004d43
mov byte [0x1004aa43], 0
push 0x1004ab3c
call fcn.10003486
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10003793
mov ecx, eax
call fcn.10001974
cmp byte [0x1004aa42], 0
mov dword [0x1004cec4], eax
je 0x10004dab
xor ecx, ecx
mov al, 0xe9
sub al, cl
xor byte [ecx + 0x1004ac24], al
inc ecx
cmp ecx, 4
jb 0x10004d94
mov byte [0x1004aa42], 0
push 0x1004ac24
call fcn.10003486
push eax
call ebx
push eax
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10004b02
mov ecx, eax
call fcn.10001974
xor ebx, ebx
mov dword [0x1004cea8], eax
cmp byte [0x1004a9bc], bl
je 0x10004df6
mov ecx, ebx
mov al, 0xcc
sub al, cl
xor byte [ecx + 0x1004ad40], al
inc ecx
cmp ecx, 0x41
jb 0x10004de0
mov byte [0x1004a9bc], bl
push 0x1004ad40
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10003e94
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ad2b], 0
mov dword [0x1004cd74], eax
je 0x10004e3d
mov ecx, ebx
mov al, 0xce
sub al, cl
xor byte [ecx + 0x1004ac6c], al
inc ecx
cmp ecx, 0x2e
jb 0x10004e27
mov byte [0x1004ad2b], bl
push 0x1004ac6c
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x100042a0
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ad9e], 0
mov dword [0x1004cc54], eax
je 0x10004e84
mov ecx, ebx
mov al, 0x7f
sub al, cl
xor byte [ecx + 0x1004ab48], al
inc ecx
cmp ecx, 0x39
jb 0x10004e6e
mov byte [0x1004ad9e], bl
push 0x1004ab48
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10004897
mov ecx, eax
call fcn.10001974
cmp byte [0x1004aa31], 0
je 0x10004ec6
mov ecx, ebx
mov al, 0xe5
sub al, cl
xor byte [ecx + 0x1004ac2c], al
inc ecx
cmp ecx, 0x3c
jb 0x10004eb0
mov byte [0x1004aa31], bl
push 0x1004ac2c
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x1000439d
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ab82], 0
mov dword [0x1004cd90], eax
je 0x10004f0d
mov ecx, ebx
mov al, 0x38
sub al, cl
xor byte [ecx + str._avRQzVFF__EYN_Lhrh_PTMSKW], al
inc ecx
cmp ecx, 0x3a
jb 0x10004ef7
mov byte [0x1004ab82], bl
push str._avRQzVFF__EYN_Lhrh_PTMSKW
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10003ead
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ad13], 0
mov dword [0x1004cd8c], eax
je 0x10004f54
mov ecx, ebx
mov al, 0xe6
sub al, cl
xor byte [ecx + 0x1004ab84], al
inc ecx
cmp ecx, 0x38
jb 0x10004f3e
mov byte [0x1004ad13], bl
push 0x1004ab84
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10003526
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ac1f], 0
mov dword [0x1004ceb0], eax
je 0x10004f9b
mov ecx, ebx
mov al, 0x1d
sub al, cl
xor byte [ecx + str._NkldbXutrCdga_ylHRH_ptmsk], al
inc ecx
cmp ecx, 0x3e
jb 0x10004f85
mov byte [0x1004ac1f], bl
push str._NkldbXutrCdga_ylHRH_ptmsk
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10003560
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ad9f], 0
mov dword [0x1004cd70], eax
je 0x10004fe2
mov ecx, ebx
mov al, 0x6b
sub al, cl
xor byte [ecx + 0x1004acc8], al
inc ecx
cmp ecx, 0x3f
jb 0x10004fcc
mov byte [0x1004ad9f], bl
push 0x1004acc8
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10003596
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ab44], 0
mov dword [0x1004cc60], eax
je 0x10005029
mov ecx, ebx
mov al, 0x9d
sub al, cl
xor byte [ecx + 0x1004ac9c], al
inc ecx
cmp ecx, 0x2b
jb 0x10005013
mov byte [0x1004ab44], bl
push 0x1004ac9c
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x100035d0
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ac20], 0
mov dword [0x1004ceb8], eax
je 0x10005070
mov ecx, ebx
mov al, 0xde
sub al, cl
xor byte [ecx + 0x1004a9fc], al
inc ecx
cmp ecx, 0x34
jb 0x1000505a
mov byte [0x1004ac20], bl
push 0x1004a9fc
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10003618
mov ecx, eax
call fcn.10001974
cmp byte [0x1004ab46], 0
mov dword [0x1004cc50], eax
je 0x100050b3
mov ecx, ebx
mov al, 0xe7
sub al, cl
xor byte [ecx + 0x1004a9b0], al
inc ecx
cmp ecx, 0xb
jb 0x1000509d
mov byte [0x1004ab46], bl
push 0x1004a9b0
push dword [0x1004cc30]
call esi
test eax, eax
je 0x100050d9
mov edx, 0x10004a2c
mov ecx, eax
call fcn.10001974
mov dword [0x1004cea4], eax
mov al, 1
jmp 0x100050db
xor al, al
pop edi
pop esi
pop ebx
leave
ret