Function at 0x4e2a20
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x52a098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x20
mov edi, ecx
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov esi, eax
mov dword [0x53b164], esi
test esi, esi
je 0x4e2ceb
push 0x38
push 0
push 0x53b2b8
call fcn.004b5690
add esp, 0xc
mov dword [0x53b2d8], 1
mov dword [0x53b2d0], 1
mov dword [0x53b2c0], 0x15
mov dword [0x53b2ec], 0
mov eax, dword [esi]
push 0x53af7c
push 0x53b2b8
push 0x40
push edi
push 1
push 0
push esi
call dword [eax + 0x40]
test eax, eax
je 0x4e2cfd
mov eax, dword [0x53b164]
push 0x53af7c
push 0x53b2b8
push 0x20
mov ecx, dword [eax]
push edi
push 1
push 0
push eax
call dword [ecx + 0x40]
test eax, eax
je 0x4e2cfd
cmp eax, 0x8876086a
jg 0x4e2bf1
je 0x4e2bb6
cmp eax, 0x8876017c
je 0x4e2b79
cmp eax, 0x88760868
jne 0x4e2bf8
movaps xmm0, xmmword [0x520410]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x282f
mov byte [ebp - 0x2a], 0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x11
jb 0x4e2b06
movaps xmm0, xmmword [str._eHSDBUy]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 0x2a], 0
movaps xmm0, xmmword [0x5204a0]
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0xf45
mov byte [ebp - 6], 0
nop dword [eax]
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x21
jb 0x4e2b40
push 0x30
lea eax, [ebp - 0x3b]
push eax
lea eax, [ebp - 0x27]
mov byte [ebp - 6], 0
push eax
push dword [0x53b284]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [str.3wZAVPGk]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 8], 0x1d57
movaps xmm0, xmmword [0x5205b0]
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 6], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x21
jb 0x4e2ba0
push 0x30
push str.D3DERR_OUTOFVIDEOMEMORY
jmp 0x4e2b53
movaps xmm0, xmmword [0x5207a0]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 8], 0x7933
movaps xmm0, xmmword [0x520400]
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 6], 0
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x21
jb 0x4e2bd8
push 0x30
push str.D3DERR_NOTAVAILABLE
jmp 0x4e2b53
cmp eax, 0x8876086c
je 0x4e2c6e
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.0044e390
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x4e2c0c
mov edx, dword [edx]
movaps xmm0, xmmword [0x520610]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 8], 0x551f
movaps xmm0, xmmword [0x5203a0]
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 6], 0
nop
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x21
jb 0x4e2c30
push 0x30
push edx
lea eax, [ebp - 0x27]
mov byte [ebp - 6], 0
push eax
push dword [0x53b284]
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x40]
call fcn.00444c00
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x520760]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x7e7e73
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x12
jb 0x4e2c82
movaps xmm0, xmmword [0x520450]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 0x29], 0
movaps xmm0, xmmword [0x5207d0]
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x3379
mov byte [ebp - 6], 0
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x21
jb 0x4e2cb5
push 0x30
lea eax, [ebp - 0x3b]
mov byte [ebp - 6], 0
push eax
lea eax, [ebp - 0x27]
push eax
push dword [0x53b284]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0049ca3f
mov esp, ebp
pop ebp
ret