Function at 0x472bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d38
xor eax, eax
push ebp
push 0x472e37
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultLCID
push edx
push eax
and edx, 0xae
push eax
pop eax
and edx, 0x9f
nop
nop
nop
nop
mov edx, 0x122
dec edx
add eax, 0xa7
dec edx
mov edx, 0xbb
xor edx, 0xf
push edx
pop edx
pop eax
pop edx
lea eax, [ebp - 0x10]
call fcn.004048b8
push esi
push eax
or eax, 0x8d
and esi, 0x174
nop
nop
nop
nop
xor eax, 0x2c
add eax, 0xe4
dec esi
xor eax, 0x8c
push eax
pop eax
pop eax
pop esi
call sub.user32.dll_GetActiveWindow
push edi
push ecx
dec edi
xor edi, 0xb2
nop
nop
mov edi, 0x173
nop
nop
nop
nop
nop
xor edi, 0xa5
pop ecx
pop edi
mov dl, 1
mov eax, dword [0x4129b8]
call fcn.00403a74
mov dword [ebp - 0x1c], eax
call sub.kernel32.dll_GetCurrentThread
push edx
push eax
mov eax, 0x104
or edx, 0x51
add eax, 0x187
xor edx, 0xe0
push eax
pop eax
and edx, 0x94
pop eax
pop edx
mov dl, 0x20
mov eax, dword [ebp - 0x1c]
call fcn.00416570
push esi
push esi
pop esi
and esi, 0xc
mov esi, 0x98
push esi
pop esi
dec esi
xchg esi, esi
xor esi, 0xb4
nop
nop
nop
nop
nop
pop esi
call sub.user32.dll_GetKBCodePage
push ecx
mov ecx, 0x159
inc ecx
and ecx, 0xee
inc ecx
mov ecx, 0x145
push ecx
pop ecx
push ecx
pop ecx
pop ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.00416358
call sub.kernel32.dll_GetTickCount
push ebx
xor ebx, 0x3a
xor ebx, 0xf6
nop
nop
nop
nop
nop
xchg ebx, ebx
or ebx, 0xcc
and ebx, 0x17c
inc ebx
xchg ebx, ebx
push ebx
pop ebx
xor ebx, 0x18d
pop ebx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x472de7
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
call sub.user32.dll_GetKBCodePage
push ecx
mov ecx, 0x159
inc ecx
and ecx, 0xee
inc ecx
mov ecx, 0x145
push ecx
pop ecx
push ecx
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.00408c58
mov dword [ebp - 0x18], eax
push 1
call sub.user32.dll_OpenIcon
lea eax, [ebp - 0x2c]
mov dl, byte [ebp - 0x18]
add dl, byte [ebp - 8]
call fcn.00404aa0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
call fcn.00404b84
push 0x472e44
call sub.kernel32.dll_GlobalAddAtomA
push ebx
add ebx, 0x127
or ebx, 0x20
mov ebx, 0xe3
sub ebx, 0xfa
inc ebx
or ebx, 0x49
dec ebx
mov ebx, 0x115
pop ebx
call sub.kernel32.dll_GetUserDefaultLCID
push edx
push eax
and edx, 0xae
push eax
pop eax
and edx, 0x9f
nop
nop
nop
nop
mov edx, 0x122
dec edx
add eax, 0xa7
dec edx
mov edx, 0xbb
xor edx, 0xf
push edx
pop edx
pop eax
pop edx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x472d2a
push 0x472e4c
call sub.kernel32.dll_GlobalAddAtomA
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.0040490c
push eax
push edi
push eax
pop eax
or eax, 0x14c
xor edi, 0x20
xchg edi, eax
nop
pop edi
pop eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472e3e
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004048dc
lea eax, [ebp - 0x10]
call fcn.004048b8
lea eax, [ebp - 4]
call fcn.004048b8
ret