Function at 0x49a834
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405940
xor eax, eax
push ebp
push 0x49aa8f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_IsIconic
push ecx
dec ecx
push ecx
pop ecx
dec ecx
xor ecx, 0xc3
pop ecx
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.004059ac
push eax
add eax, 0xe0
or eax, 0x11b
and eax, 0x8b
nop
sub eax, 0x79
inc eax
push eax
pop eax
sub eax, 0x162
or eax, 7
pop eax
call sub.kernel32.dll_GetCurrentThread
push ecx
xchg ecx, ecx
inc ecx
push ecx
pop ecx
or ecx, 0xa9
dec ecx
xchg ecx, ecx
push ecx
pop ecx
add ecx, 0x132
add ecx, 7
sub ecx, 0x167
mov ecx, 0x197
mov ecx, 0xa
pop ecx
mov dl, 1
mov eax, dword [0x41d3ac]
call fcn.00422a94
mov dword [ebp - 0x1c], eax
call sub.kernel32.dll_GetCurrentProcessId
push ebx
push edi
or ebx, 0xe4
and edi, 7
xchg edi, edi
mov ebx, 0x144
dec edi
sub ebx, 3
pop edi
pop ebx
mov dx, 0x20
mov eax, dword [ebp - 0x1c]
call fcn.004220a8
push eax
push ecx
and eax, 0x88
nop
nop
nop
nop
nop
dec eax
inc eax
or eax, 0xd3
push ecx
pop ecx
and eax, 0xb1
or eax, 1
push eax
pop eax
sub eax, 0xe
and eax, 0x9b
pop ecx
pop eax
call sub.kernel32.dll_GetCurrentProcessId
push ebx
push edi
or ebx, 0xe4
and edi, 7
xchg edi, edi
mov ebx, 0x144
dec edi
sub ebx, 3
pop edi
pop ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.00421e6c
call sub.kernel32.dll_GetCurrentThread
push ecx
xchg ecx, ecx
inc ecx
push ecx
pop ecx
or ecx, 0xa9
dec ecx
xchg ecx, ecx
push ecx
pop ecx
add ecx, 0x132
add ecx, 7
sub ecx, 0x167
mov ecx, 0x197
mov ecx, 0xa
pop ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x49aa4f
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
call sub.user32.dll_GetActiveWindow
push ecx
push ebx
and ebx, 0x186
inc ecx
xor ebx, 0x105
dec ecx
dec ebx
dec ecx
or ecx, 5
pop ebx
pop ecx
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.0040b8f4
mov dword [ebp - 0x18], eax
call sub.user32.dll_GetActiveWindow
push ecx
push ebx
and ebx, 0x186
inc ecx
xor ebx, 0x105
dec ecx
dec ebx
dec ecx
or ecx, 5
pop ebx
pop ecx
lea eax, [ebp - 0x2c]
mov dx, word [ebp - 0x18]
add dx, word [ebp - 8]
call fcn.00405ac4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
call fcn.00405c7c
call sub.kernel32.dll_GetCurrentProcessId
push ebx
push edi
or ebx, 0xe4
and edi, 7
xchg edi, edi
mov ebx, 0x144
dec edi
sub ebx, 3
pop edi
pop ebx
push 1
call sub.user32.dll_IsIconic
push ecx
dec ecx
push ecx
pop ecx
dec ecx
xor ecx, 0xc3
pop ecx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x49a9a7
push 0x49aa9c
call sub.kernel32.dll_GlobalAddAtomW
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00405958
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49aa96
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405950
lea eax, [ebp - 0x10]
call fcn.00405948
lea eax, [ebp - 4]
call fcn.00405948
ret