Function at 0x4636a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0x17
mov eax, dword [ebp - 0x24]
xor al, 0x4f
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x24]
inc al
xor al, 0x4e
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 0x24]
add al, 2
xor al, 0x50
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x24]
add al, 3
xor al, 0x52
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
add al, 4
xor al, 0x45
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x24]
add al, 5
xor al, 0x53
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x24]
add al, 6
mov byte [ebp - 0x19], 0
xor al, 0x53
xor edx, edx
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0x20]
mov al, byte [ebp + edx - 0x20]
mov ecx, dword [ebp - 0x24]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x20], cl
inc edx
cmp edx, 7
jb 0x463704
lea edx, [ebp - 0x20]
mov byte [ebp - 0x19], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x463723
push ebx
sub edx, ecx
lea eax, [ebp - 0x20]
cmp dword [0x49d030], 0x10
mov ecx, 0x49d01c
push esi
cmovae ecx, dword [0x49d01c]
push edi
push edx
mov edx, dword [0x49d02c]
push eax
call fcn.00476770
add esp, 8
test al, al
je 0x463803
cmp byte [0x49da32], 0
je 0x46390b
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x10]
push 0
push 4
push eax
mov eax, dword [0x49d900]
add eax, dword [0x49d81c]
push eax
push dword [0x49d9d0]
call edi
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0
push 4
push eax
mov eax, dword [0x49d844]
mov ecx, esi
shl ecx, 4
add eax, 0xfffffff0
add ecx, dword [0x49da20]
add eax, ecx
push eax
push dword [0x49d9d0]
call edi
mov ebx, dword [ebp - 0x14]
lea eax, [esi - 1]
cmp eax, 0x3f
ja 0x46390b
push 0
push 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x49d908]
add eax, dword [0x49d81c]
push eax
push dword [0x49d9d0]
call edi
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push 0
push 4
push eax
mov eax, dword [0x49d908]
add eax, ebx
push eax
push dword [0x49d9d0]
call edi
cmp esi, dword [ebp - 0xc]
jmp 0x463897
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0xc]
push 0
push 4
push eax
mov eax, dword [0x49d900]
add eax, dword [0x49d81c]
push eax
push dword [0x49d9d0]
call edi
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push 0
push 4
push eax
mov eax, dword [0x49d844]
mov ecx, esi
shl ecx, 4
add eax, 0xfffffff0
add ecx, dword [0x49da20]
add eax, ecx
push eax
push dword [0x49d9d0]
call edi
mov ebx, dword [ebp - 0x18]
lea eax, [esi - 1]
cmp eax, 0x3f
ja 0x46390b
push 0
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x49d908]
add eax, dword [0x49d81c]
push eax
push dword [0x49d9d0]
call edi
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 0
push 4
push eax
mov eax, dword [0x49d908]
add eax, ebx
push eax
push dword [0x49d9d0]
call edi
cmp esi, dword [ebp - 0x10]
je 0x46390b
push 0
push 1
lea eax, [ebp - 5]
push eax
mov eax, dword [0x49d838]
add eax, ebx
push eax
push dword [0x49d9d0]
call edi
cmp byte [ebp - 5], 0
jne 0x46390b
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0xc]
push 0
push 4
push eax
mov eax, dword [0x49d918]
add eax, dword [0x49d844]
push eax
push dword [0x49d9d0]
mov dword [ebp - 0xc], 5
call esi
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
mov eax, dword [0x49d918]
add eax, dword [0x49d844]
push eax
push dword [0x49d9d0]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476b4c
mov esp, ebp
pop ebp
ret