Function at 0x40b070
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x194
mov eax, dword [0x449874]
mov dword [esp + 0x14], 0xc955cf45
mov dword [esp + 0x18], 0xc552cb5e
mov dword [esp + 0x1c], 0xc14ac748
mov dword [esp + 0x20], 0x3d94c350
mov dword [esp + 0x24], 0x39aa3fa0
mov dword [esp + 0x28], 0x353a3bac
mov word [esp + 0x2c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x19
ja 0x40b106
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x14]
add ecx, 0xea9e04f1
xor ecx, edx
mov dword [esp + 0x114], ecx
mov ecx, dword [esp + 0x114]
add cl, 0xc3
mov edx, dword [esp]
mov byte [esp + edx + 0x14], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x1a
jb 0x40b0d0
lea esi, [esp + 0x14]
push 0x800
push 0
push esi
call eax
mov ecx, 0x44983c
push eax
call fcn.0043c0a0
xor ebx, ebx
test al, al
je 0x40b84a
push 0xe2bceb04
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449844], eax
push 0x248106fa
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449848], eax
push 0x89b8457d
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x44984c], eax
push 0x44f824fb
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449850], eax
push 0xf072343c
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449854], eax
push 0x638f2392
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449858], eax
push 0xd711af57
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x44985c], eax
push 0x1ad145e2
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449860], eax
push 0xedb83653
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449864], eax
push 0xe9e47300
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449868], eax
push 0x6b702a5b
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x44986c], eax
push 0xc135ffae
push dword [0x44983c]
call fcn.0043e3f0
add esp, 8
mov dword [0x449870], eax
lea ebp, [esp + 0x114]
mov eax, ebp
not eax
mov dword [esp + 0xc], eax
mov eax, ebp
neg eax
mov dword [esp + 8], eax
push ebp
push dword [ebx + 0x4423e4]
call fcn.004378f0
add esp, 8
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [esp + eax + 0x114], 0
lea eax, [eax + 1]
jne 0x40b280
mov ecx, dword [esp + 8]
sub ecx, eax
lea edx, [esp + 0x113]
add eax, edx
and eax, dword [esp + 0xc]
and ecx, ebp
sub eax, ecx
mov dword [esp], 0
mov ecx, esi
test eax, eax
jle 0x40b311
lea esi, [esp + eax]
add esi, 0x114
xor edi, edi
nop
nop
nop
nop
cmp byte [ebp], 0
je 0x40b300
mov eax, esp
push eax
push esi
push ebp
call fcn.0040d600
add esp, 0xc
movzx edx, word [esp]
lea ecx, [edi + 2]
mov word [esp + edi + 0x14], dx
cmp edi, 0xfb
ja 0x40b2ef
add ebp, eax
mov edi, ecx
cmp ebp, esi
jb 0x40b2c0
add ecx, esp
add ecx, 0x14
jmp 0x40b306
lea ecx, [esp + edi]
add ecx, 0x14
lea esi, [esp + 0x14]
lea ebp, [esp + 0x114]
mov word [ecx], 0
push esi
call fcn.0040b860
add esp, 4
test al, al
jne 0x40b588
add ebx, 4
cmp ebx, 0x24
jne 0x40b260
mov dword [esp + 4], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0xaa25a817
mov dword [esp + 0x18], 0xa615a427
mov dword [esp + 0x1c], 0xa26ba014
mov dword [esp + 0x20], 0xbe4abc54
mov dword [esp + 0x24], 0xba35b80c
mov dword [esp + 0x28], 0xb614b406
mov dword [esp + 0x2c], 0xb212b002
mov dword [esp + 0x30], 0x8e388c04
mov dword [esp + 0x34], 0x8a04883a
mov dword [esp + 0x38], 0x863c843d
mov dword [esp + 0x3c], 0x8208800b
mov dword [esp + 0x40], 0x9e3e9c75
mov dword [esp + 0x44], 0x9a2c9828
mov dword [esp + 0x48], 0x9625946c
mov dword [esp + 0x4c], 0x92269025
mov dword [esp + 0x50], 0x6ed46c2d
mov dword [esp + 0x54], 0x6ad468db
mov dword [esp + 0x58], 0x669264d8
mov dword [esp + 0x5c], 0x62af60a8
mov dword [esp + 0x60], 0x7eb37cae
mov dword [esp + 0x64], 0x7a88788e
mov dword [esp + 0x68], 0x76bc74b2
mov dword [esp + 0x6c], 0x728370b8
mov dword [esp + 0x70], 0x4ebe4cbf
mov dword [esp + 0x74], 0x4ab848bc
mov dword [esp + 0x78], 0x46b54482
mov dword [esp + 0x7c], 0x424140b7
mov word [esp + 0x80], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x6d
ja 0x40b484
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
lea edx, [eax + ecx]
add edx, 0x6775edc3
add eax, 0x6775edc3
not ecx
or eax, ecx
sub ecx, eax
lea eax, [edx + ecx*2]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0x94
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x6e
jb 0x40b440
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
lea edi, [esp + 0x14]
push eax
push ecx
push edi
call fcn.0040be70
add esp, 0xc
test al, al
je 0x40b848
mov dword [esp + 0x14], 0x96e6e6ac
mov dword [esp + 0x18], 0x979d55e6
mov dword [esp + 0x1c], 0xa2e9ee99
mov dword [esp + 0x20], 0xf7859c5a
mov dword [esp + 0x24], 0x848a80f5
mov dword [esp + 0x28], 0xfcfc80f4
mov dword [esp + 0x2c], 0x8c8ffbfb
mov dword [esp + 0x30], 0xf6ff8cfe
mov word [esp + 0x34], 0xd336
mov byte [esp + 0x36], 0x16
mov dword [esp + 0x37], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x40b544
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x95ee6622
xor eax, ecx
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x114]
add al, 0xae
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x40b510
mov ecx, dword [esp + 4]
movzx ebx, byte [esp + 0x14]
test bl, bl
je 0x40b60e
mov edx, edi
mov eax, ecx
jmp 0x40b56b
movzx ebx, byte [edx]
test bl, bl
je 0x40b610
mov bh, byte [ecx]
test bh, bh
je 0x40b83c
inc edx
inc ecx
lea esi, [eax + 1]
cmp bh, bl
je 0x40b582
mov eax, esi
mov ecx, esi
je 0x40b560
mov edx, edi
jmp 0x40b560
movzx eax, word [esp + 0x14]
test ax, ax
je 0x40b5bf
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx + 0x449876], ax
movzx eax, word [esp + ecx + 0x14]
add ecx, 2
test ax, ax
jne 0x40b5a0
mov word [ecx + 0x449876], 0
jmp 0x40b5c8
mov word [0x449878], 0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40b848
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x40b848
push 0x449818
call fcn.00436cc0
add esp, 4
mov bl, 1
jmp 0x40b84a
mov eax, ecx
test eax, eax
je 0x40b83c
mov dword [esp + 0x14], 0x41470210
mov dword [esp + 0x18], 0xf5344557
mov word [esp + 0x1c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 9
ja 0x40b676
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x14]
add ecx, 0x1fd16b0f
xor ecx, edx
mov dword [esp + 0x114], ecx
mov ecx, dword [esp + 0x114]
add cl, 0x1d
mov edx, dword [esp]
mov byte [esp + edx + 0x14], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xa
jb 0x40b640
movzx edx, byte [esp + 0x14]
mov ecx, eax
test dl, dl
je 0x40b6b4
lea esi, [esp + 0x14]
mov edi, esi
mov ebx, eax
mov ecx, eax
jmp 0x40b697
movzx edx, byte [edi]
test dl, dl
je 0x40b6b4
mov dh, byte [ebx]
test dh, dh
je 0x40b83c
inc edi
inc ebx
lea ebp, [ecx + 1]
cmp dh, dl
je 0x40b6ae
mov ecx, ebp
mov ebx, ebp
je 0x40b690
mov edi, esi
jmp 0x40b690
test ecx, ecx
je 0x40b83c
mov byte [ecx], 0
lea ecx, [eax + 0x22]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ecx + edx], 0
lea edx, [edx + 1]
jne 0x40b6d0
lea esi, [eax + edx]
add esi, 0x21
add eax, edx
mov edx, 0xffffffde
sub edx, eax
and edx, ecx
mov ebp, ecx
not ebp
and ebp, esi
sub ebp, edx
jne 0x40b7a2
mov byte [esp + ebp + 0x114], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [esp + eax + 0x114], 0
lea eax, [eax + 1]
jne 0x40b710
lea ecx, [esp + eax]
add ecx, 0x113
lea edx, [esp + eax]
add edx, 0x114
neg edx
lea ebx, [esp + 0x114]
and edx, ebx
mov eax, ebx
not eax
and eax, ecx
sub eax, edx
mov dword [esp], 0
lea edi, [esp + 0x14]
mov ecx, edi
test eax, eax
jle 0x40b7e5
lea esi, [esp + eax]
add esi, 0x114
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ebx], 0
je 0x40b7df
mov eax, esp
push eax
push esi
push ebx
call fcn.0040d600
add esp, 0xc
movzx edx, word [esp]
lea ecx, [ebp + 2]
mov word [esp + ebp + 0x14], dx
cmp ebp, 0x7b
ja 0x40b79b
add ebx, eax
mov ebp, ecx
cmp ebx, esi
jb 0x40b770
add ecx, esp
add ecx, 0x14
jmp 0x40b7e5
xor edx, edx
jmp 0x40b7c1
mov eax, esi
xor eax, 0x61
and esi, 1
lea ebx, [eax + esi*2]
mov byte [esp + edx + 0x114], bl
inc edx
cmp ebp, edx
je 0x40b6f8
movzx ebx, byte [ecx + edx]
mov eax, ebx
add al, 0x9f
cmp al, 0x19
ja 0x40b7b1
movzx edi, bl
lea esi, [edi - 0x52]
cmp esi, 0x1a
jb 0x40b7a6
add edi, 0xffffff94
mov esi, edi
jmp 0x40b7a6
lea ecx, [esp + ebp]
add ecx, 0x14
mov word [ecx], 0
push edi
call fcn.0040b860
add esp, 4
test al, al
je 0x40b83c
mov ebx, eax
movzx ecx, word [esp + 0x14]
mov eax, 0x449878
test cx, cx
je 0x40b821
lea edx, [esp + 0x16]
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x40b810
mov word [eax], 0
push dword [esp + 4]
call fcn.0043ae00
add esp, 4
test bl, bl
jne 0x40b5c8
jmp 0x40b848
push dword [esp + 4]
call fcn.0043ae00
add esp, 4
xor ebx, ebx
mov eax, ebx
add esp, 0x194
pop esi
pop edi
pop ebx
pop ebp
ret