Function at 0x4146d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, 0x50df04
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
mov edx, dword [ebp + 0xc]
jmp 0x414703
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
dec ebx
mov eax, esi
test ebx, ebx
je 0x41470c
test dl, 3
jne 0x4146ec
cmp ebx, 0x20
jb 0x414921
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
sub ebx, 0x20
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
cmp ebx, 0x20
mov eax, esi
jae 0x414715
cmp ebx, 4
jb 0x41496e
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
sub ebx, 4
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4]
cmp ebx, 4
mov eax, esi
jae 0x414926
test ebx, ebx
je 0x41498b
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
dec ebx
mov eax, esi
jne 0x414972
not eax
pop edi
pop esi
pop ebx
pop ebp
ret