Function at 0x4d90e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b10
xor eax, eax
push ebp
push 0x4d935e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultLCID
push edi
xchg edi, edi
add edi, 0xfd
mov edi, 0x104
push edi
pop edi
and edi, 0x1a0
or edi, 0xd9
dec edi
xchg edi, edi
and edi, 0x3a
pop edi
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405b7c
call sub.kernel32.dll_GetCurrentThread
push edi
dec edi
push edi
pop edi
mov edi, 0x17f
nop
nop
nop
nop
nop
xchg edi, edi
push edi
pop edi
inc edi
xchg edi, edi
xchg edi, edi
pop edi
mov dl, 1
mov eax, dword [0x422fcc]
call fcn.004283bc
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetUserDefaultLCID
push edi
xchg edi, edi
add edi, 0xfd
mov edi, 0x104
push edi
pop edi
and edi, 0x1a0
or edi, 0xd9
dec edi
xchg edi, edi
and edi, 0x3a
pop edi
mov dx, 0x20
mov eax, dword [ebp - 0x14]
call fcn.004279d0
call sub.kernel32.dll_GetUserDefaultLCID
push edi
xchg edi, edi
add edi, 0xfd
mov edi, 0x104
push edi
pop edi
and edi, 0x1a0
or edi, 0xd9
dec edi
xchg edi, edi
and edi, 0x3a
pop edi
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00427794
push 1
call sub.user32.dll_GetLastActivePopup
push ebx
xchg ebx, ebx
mov ebx, 0xac
and ebx, 0x3c
xchg ebx, ebx
and ebx, 0x13e
sub ebx, 0x94
pop ebx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4d9303
inc ebx
xor esi, esi
push 0x4d936c
call sub.kernel32.dll_GlobalAddAtomW
push eax
sub eax, 0xd3
dec eax
dec eax
and eax, 0x8e
dec eax
mov eax, pe_nt_image_headers32
pop eax
lea ecx, [ebp - 0x18]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.0040c188
mov edi, eax
push 1
call sub.user32.dll_IsZoomed
push edi
add edi, 0x5d
mov edi, 0xe0
push edi
pop edi
or edi, 0xe4
dec edi
mov edi, 0x8a
and edi, 0x4c
nop
nop
nop
nop
dec edi
inc edi
or edi, 0x2b
dec edi
pop edi
lea eax, [ebp - 0x1c]
mov edx, edi
add dx, word [ebp - 0xc]
call fcn.00405c94
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00405e7c
push 0x4d9388
call sub.kernel32.dll_GlobalAddAtomW
push edx
xchg edx, edx
mov edx, 0x1a7
mov edx, 0xa9
dec edx
push edx
pop edx
xor edx, 0x161
pop edx
call sub.kernel32.dll_GetCurrentThread
push edi
dec edi
push edi
pop edi
mov edi, 0x17f
nop
nop
nop
nop
nop
xchg edi, edi
push edi
pop edi
inc edi
xchg edi, edi
xchg edi, edi
pop edi
push 1
call sub.user32.dll_IsZoomed
push edi
add edi, 0x5d
mov edi, 0xe0
push edi
pop edi
or edi, 0xe4
dec edi
mov edi, 0x8a
and edi, 0x4c
nop
nop
nop
nop
dec edi
inc edi
or edi, 0x2b
dec edi
pop edi
inc esi
dec ebx
jne 0x4d9217
call sub.kernel32.dll_GetUserDefaultLCID
push edi
xchg edi, edi
add edi, 0xfd
mov edi, 0x104
push edi
pop edi
and edi, 0x1a0
or edi, 0xd9
dec edi
xchg edi, edi
and edi, 0x3a
pop edi
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9365
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405b20
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405b20
ret