Function at 0x403340
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov dword [ebp - 0x10], edx
mov eax, 0xc000000d
mov dword [ebp - 0x14], ecx
push ebx
push esi
push edi
test edx, edx
je 0x4034d1
mov al, byte [edx]
mov ebx, edx
mov dword [ebp - 4], 0xc0000001
lea ebx, [ebx]
cmp al, 0x2e
je 0x40337e
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x403370
xor ebx, ebx
sub ebx, edx
cmp ebx, 0x104
jae 0x4034ce
test ebx, ebx
je 0x4033bb
xor ecx, ecx
test ebx, ebx
je 0x4033b1
jmp 0x4033a0
movzx eax, byte [ecx + edx]
mov word [ebp + ecx*2 - 0x440], ax
inc ecx
cmp ecx, ebx
jb 0x4033a0
xor eax, eax
mov word [ebp + ebx*2 - 0x440], ax
lea ecx, [ebp - 0x440]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4033c4
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov word [ebp - 0x1c], ax
add eax, 2
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x440]
mov dword [ebp - 0x18], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov dword [ebp - 8], eax
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4034ce
mov ecx, dword [ebp - 8]
mov edx, 0x20a
mov edi, edi
cmp word [eax + 0x2e], dx
jae 0x4034c6
mov ecx, dword [eax + 0x30]
lea edx, [ebp - 0x238]
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x403425
cmp word [ebp - 0x238], 0
lea eax, [ebp - 0x238]
je 0x403462
movzx edx, word [eax]
lea ecx, [edx - 0x41]
cmp cx, 0x19
lea ecx, [edx + 0x20]
jbe 0x403456
mov ecx, edx
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x403445
lea ecx, [ebp - 0x238]
lea edx, [ecx + 2]
jmp 0x403470
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403470
sub ecx, edx
xor esi, esi
sar ecx, 1
mov edx, 0xb12d667
lea edi, [ecx*2 + 2]
test edi, edi
je 0x4034b6
movzx ecx, byte [ebp + esi - 0x238]
mov eax, edx
shl eax, 5
inc esi
add ecx, eax
mov eax, edx
shr eax, 2
add ecx, eax
xor edx, ecx
cmp esi, edi
jb 0x403491
cmp edx, 0xc73d5fac
je 0x4034d8
mov eax, dword [ebp - 0xc]
mov edx, 0x20a
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp eax, ecx
jne 0x403410
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x18]
test edx, edx
je 0x4034ce
push 0
push 0
push 0x2e2813d1
lea ecx, [ebp - 0x24]
call fcn.00403580
test eax, eax
js 0x4034ce
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
call dword [ebp - 0x24]
test eax, eax
js 0x4034ce
mov edx, dword [ebp - 0x10]
add edx, ebx
lea ecx, [edx + 1]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403515
sub ecx, esi
je 0x4034ce
xor eax, eax
xor esi, esi
cmp byte [edx + 1], 0x23
mov dword [ebp - 8], eax
jne 0x40355a
cmp ecx, 1
jbe 0x40355a
lea eax, [ebp - 8]
push eax
lea ecx, [edx + 2]
call fcn.00406870
test eax, eax
js 0x4034d1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
push eax
push esi
push esi
call fcn.00403580
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
lea esi, [edx + 1]
mov edx, dword [ebp - 0x20]
push eax
push esi
push 0
call fcn.00403580
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret