Function at 0x41eb50
Capabilities:
Encode data using xor

Disassembly:
add byte [edi + edx*2 + 0x5b3c0042], al
inc ecx
add byte [edi], dh
inc edx
add ah, dl
push edi
inc edx
add ah, dh
pop esp
inc ecx
add ah, ah
pop ecx
inc edx
add byte [eax - 0x7fffbda6], dl
daa
inc edx
add ah, dl
pop ebp
inc edx
add byte [edi + ebx*2], dl
inc edx
add byte [eax - 0x17ffbda1], bl
sub byte [edx], al
js 0x41e98b
inc edx
add al, cl
inc dx
add ah, dh
outsd dx, dword [esi]
inc edx
add byte [eax], dl
jno 0x41e979
add byte [edx + ebp], ch
inc edx
add byte [ebx + esi*2 + 0x74040042], dl
inc edx
add byte [eax], cl
push edi
inc edx
add byte [ecx + ebp], al
inc edx
add byte [ecx + ebp + 0x658c0042], bh
inc edx
add byte [edi + esi*2 + 0x42], ah
add ah, dh
inc edx
add byte [edi + esi*2 + 0x5e840042], al
inc edx
add byte [eax], bh
pop edi
inc edx
add byte [eax], ch
outsb dx, byte [esi]
inc edx
add byte [edi], al
push esp
inc edx
imul esi, dword [ebp + ebp*2 + 0x61], 0x41e97870
add byte [edi], al
pop es
push esp
inc edx
imul esi, dword [ebp + ebp*2 + 0x61], 0x41e8fc70
add byte [ebp + 0x41], dh
add byte [eax], al
add byte [eax], cl
inc edi
jb 0x41e9f0
or byte [edi + 0x72], al
popal
jo 0x41e9f9
imul esp, dword [ebx + 0x73], 0xc08b0000
in al, 0xe9
inc ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
jmp 0x59e9ff
popal
nop
inc eax
ljmp 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x41ea], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + ebp*8 + 0x340041], ah
add byte [eax], al
mov al, 0xe4
inc ecx
add byte [esp + esi + 0x5c380040], bl
inc ecx
add byte [esp + esi + 0x34b00040], ch
inc eax
add byte [esp + esi + 0x31ec0040], ah
inc eax
add byte [eax], cl
xor al, byte [eax]
or al, 0x79
inc edx
add byte [ebx + ebx*2], bh
inc ecx
add byte [edi], dh
inc edx
add byte [eax + 0x79], cl
inc edx
add ah, dh
pop esp
inc ecx
add byte [eax - 0x3fffbdda], ah
jns 0x41ea99
add byte [eax + 0x14004227], al
jp 0x41eaa1
add byte [edx + edi*2 + 0x42], ch
add al, dl
sub byte [edx], al
call 0x98422c95
jp 0x41eab1
add byte [eax - 0x73ffbdd7], ah
jge 0x41eab9
add byte [edx + ebp], bl
inc edx
add al, al
jge 0x41eac1
add al, dl
jge 0x41eac5
add byte [edx + ebp + 0x42], bl
add byte [eax + edi*2 + 0x29040042], ah
inc edx
add byte [ecx + ebp + 0x7c1c0042], bh
inc edx
add byte [esi + edi*2], al
inc edx
jle 0x41eadd
add byte [eax + 0x7e], al
inc edx
add byte [eax + 0x7e], ah
inc edx
jle 0x41eae5
add byte [0x6f634954], al
outsb dx, byte [esi]
mov eax, eax
mov al, 0xea
inc ecx
add byte [edi], al
add eax, 0x6f634954
outsb dx, byte [esi]
inc eax
ljmp 0x41
inc ecx
add byte [ebp + 0x41], dh
add byte [eax], al
add byte [eax], cl
inc edi
jb 0x41eb26
or byte [edi + 0x72], al
popal
jo 0x41eb2f
imul esp, dword [ebx + 0x73], 0x8b550000
in al, dx
push ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41eaed
mov eax, dword [ebp - 4]
cld
cmp eax, dword [0x4a788c]
add eax, 0x4a788c
je 0x41eaed
mov eax, dword [ebp - 4]
inc ebp
cld
push eax
call sub.gdi32.dll_DeleteObject
pop ecx
pop ebp
ret
inc eax
add byte [eax - 0x5bffbfcc], dh
xor al, 0x40
add ah, ch
xor dword [eax], eax
or byte [edx], dh
inc eax
add byte [eax + 0x100041eb], bh
push esp
push edx
jae 0x41ebb1
jne 0x41ebb6
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x41eadb
inc eax
add byte [ecx + 0x31c289d1], cl
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41eb56
ret
cld
pop ecx
pop ecx
pop ebp
ret
mov eax, eax
push ebp
mov ebp, esp
add esp, 0xfffffff8
call fcn.004035e0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 8
push eax
call sub.kernel32.dll_DeleteCriticalSection_1
cmp byte [ebp - 5], 0
jle 0x41ebe3
mov eax, dword [ebp - 4]
call fcn.004035c8
pop ecx
pop ecx
pop ebp
ret