Function at 0x41ec00
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ebp
lea ebp, [ecx - 0x34e3]
mov ebx, ecx
mov ecx, dword [esp + 0x28]
xor edx, 0x2b95
push esi
mov esi, dword [esp + 0x18]
add ecx, 0x629
push edi
mov edi, dword [esp + 0x28]
mov eax, ecx
add esi, 0xa51
mov dword [esp + 0x20], edx
xor eax, 0x7873
mov dword [esp + 0x28], esi
xor edi, 0x1f63
mov dword [esp + 0x24], ebp
xor ebx, 0x34e3
mov dword [esp + 0x1c], ecx
cmp ebp, eax
jge 0x41edd8
mov eax, edx
xor eax, 0x40a5
cmp esi, eax
mov esi, dword [esp + 0x2c]
je 0x41ed96
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov eax, dword [esi + 0xe8]
add eax, dword [esi + 0xc]
mov ebp, dword [esi + 0xac]
xor eax, 0x179cbf
imul eax, dword [esi + 0xc0]
mov ebx, dword [esi + 0x50]
mov dword [esp + 0x30], ebx
add ebx, 0xffe878cb
mov dword [esi + 0xc0], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x4c]
xor eax, ebp
sub ebp, dword [esp + 0x10]
xor eax, 0x53
add ebp, 0x14
or dword [esi + 0xe4], eax
mov eax, dword [esi + 0xb4]
add eax, ebx
mov ebx, dword [esp + 0x2c]
xor dword [esi + 0xc8], eax
mov eax, dword [esi + 0x48]
mov esi, dword [ecx + eax]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x9c]
mov edi, dword [ecx + 0x94]
lea eax, [edx - 0xf9ec3]
xor dword [ecx + 0xdc], eax
lea eax, [edi - 0x53]
or dword [ecx + 0x84], eax
xor edi, 0x53
mov ecx, dword [ecx + 0x24]
mov eax, ecx
xor eax, dword [ebx + 0x4c]
sub eax, 0x11
or eax, edx
mov edx, ebx
mov dword [edx + 0x9c], eax
lea eax, [ecx - 0x10]
xor dword [edx + 4], eax
mov eax, 0x24d992
mov ecx, dword [edx + 0x38]
sub eax, dword [esp + 0x30]
imul ecx, esi
mov esi, edx
add dword [esi + 0xd4], eax
mov eax, dword [esi + 0x60]
mov edx, ecx
sub dword [esi + 0xa0], edi
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x3c]
mov ebx, dword [esp + 0x14]
shr edx, 0x10
mov dword [esi + 0xac], ebp
mov byte [ecx + eax], dl
mov ecx, ebx
inc dword [esi + 0x3c]
mov edx, dword [esi + 0x3c]
mov eax, dword [esi + 0x60]
shr ecx, 8
mov byte [edx + eax], cl
inc dword [esi + 0x3c]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x60]
mov byte [ecx + eax], bl
mov ecx, dword [esp + 0x28]
inc dword [esi + 0x3c]
add ecx, 4
mov dword [esp + 0x28], ecx
cmp ecx, 0xcb70
jl 0x41ec78
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
xor ecx, 0x1343
cmp ebp, ecx
je 0x41ee69
mov eax, dword [esi + 0xc0]
cmp eax, dword [esi + 4]
jbe 0x41edc2
mov eax, dword [esi + 0x84]
sub eax, dword [esi + 0x24]
xor eax, 0xe5e0a721
mov dword [esi + 0x38], eax
jmp 0x41edcc
add dword [esi + 0xac], 0xffffaae4
mov dword [esi + 0x48], 0x446878
jmp 0x41ee69
mov esi, dword [esp + 0x2c]
mov eax, edi
and eax, dword [esi + 0x10]
imul eax, dword [esi + 0xe8]
mov ebp, dword [esi + 0xd4]
cmp ebp, eax
jb 0x41ee69
imul eax, ebx, 0x3076
xor eax, 0x3dc2
mov dword [esp + 0x30], eax
cmp edi, eax
je 0x41ee54
imul edi, ecx, 0x309a
mov eax, ebx
sub eax, edx
or eax, ecx
mov ecx, dword [esi + 0xc0]
push eax
mov eax, dword [esi + 0x4c]
add ecx, 0x34e3
add eax, ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
xor eax, 0x3252
push eax
mov eax, dword [esi + 0x74]
imul eax, ecx
or ecx, dword [esp + 0x34]
push eax
mov eax, ebx
or eax, 0x369a
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov ecx, edi
inc ebp
and ecx, dword [esi + 0x10]
imul ecx, dword [esi + 0xe8]
cmp ebp, ecx
mov ecx, dword [esp + 0x1c]
jae 0x41ee01
pop edi
pop esi
xor edx, 0x309a
pop ebp
mov eax, edx
pop ebx
pop ecx
pop ecx
ret