Function at 0x412d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov edx, dword [ebp + 8]
mov dword [ebp - 0x70], 0
mov eax, dword [edx]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebx + 0x5c]
mov edi, dword [ebx + 0x60]
shr eax, 2
and edi, 4
and eax, 1
or eax, edi
jne 0x412d35
mov eax, dword [ebx + 0xe0]
test eax, eax
je 0x412d98
lea ecx, [ebp - 0x58]
mov dword [esp], ecx
call fcn.00415eb0
mov dword [ebp - 0x24], 0
mov eax, dword [ebx + 0xe0]
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
call fcn.00412080
test eax, eax
mov esi, eax
je 0x412dc0
lea eax, [eax - 0x7f2bb729]
cmp eax, 1
setbe dl
cmp esi, 0x7f2bb755
sete al
or eax, edx
test al, 1
jne 0x412f11
cmp esi, 0x7f2bb758
mov edx, esi
je 0x412f11
add esp, 0x7c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0xe4]
test eax, eax
jne 0x412d35
lea eax, [ebx + 0xd0]
mov dword [esp], eax
call fcn.00432040
xor edx, edx
test eax, eax
jne 0x412d8e
jmp 0x412d35
mov eax, dword [ebp - 0x6c]
call fcn.004129a0
test eax, eax
mov esi, eax
je 0x412e22
cmp eax, 0x7f2bb73c
je 0x412fbe
cmp eax, 0x7f2bb743
je 0x413111
cmp eax, 0x7f2bb744
je 0x412f9b
cmp esi, 0x7f2bb756
je 0x413139
mov eax, 1
mov edx, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp + 8]
call fcn.00412c10
add esp, 0x7c
mov edx, esi
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x5c]
test al, 4
jne 0x412edb
mov dword [ebp - 0x20], str.inode
lea eax, [ebp - 0x58]
mov edi, dword [ebx + 0x60]
mov dword [esp + 8], eax
mov eax, 0x16
and edi, 4
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.00415f50
test eax, eax
je 0x4130eb
test edi, edi
je 0x412e80
lea ecx, [ebp - 0x58]
mov eax, 0x17
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00415f50
test eax, eax
je 0x412e22
xor edx, edx
test edi, edi
jne 0x412f91
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0xe0]
test ecx, ecx
je 0x412f88
cmp eax, dword [ebx + 0x54]
jb 0x412f91
lea esi, [esi]
lea edi, [edi]
cld
xor eax, eax
lea edi, [ebx + 0xd0]
mov dword [ebx + 0xe0], eax
xor eax, eax
mov ecx, 4
mov dword [ebx + 0xe4], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
call fcn.00412010
mov eax, dword [ebx + 0x5c]
test al, 4
je 0x412f80
test byte [ebx + 0x60], 4
jne 0x412f80
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx + 0xc]
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x412f28
lea esi, [esi]
xor ebx, ebx
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
jmp 0x412e0e
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x58]
call fcn.00412820
add esp, 0x7c
mov edx, eax
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x58]
mov dword [esp + 8], eax
mov eax, 0x18
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.00415f50
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x58]
mov eax, dword [ecx + 0x20]
mov dword [esp + 8], edx
mov dword [esp], ecx
cmp eax, 1
sbb eax, eax
add eax, 0x2c
mov dword [esp + 4], eax
call fcn.00415f50
test eax, eax
je 0x413166
mov ecx, dword [ebp + 8]
or dword [ecx + 0x18], 0x100
or dword [ebx + 0x60], 4
mov eax, dword [ecx]
or dword [eax + 8], 6
mov edx, dword [ebp - 0x6c]
jmp 0x412f00
cmp eax, 0xa
ja 0x412eb0
mov edx, 1
jmp 0x412eb0
lea eax, [ebp - 0x58]
mov dword [esp + 8], eax
mov eax, 0x25
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.00415f50
test eax, eax
jne 0x412dfb
mov edx, dword [ebp + 8]
mov edi, dword [ebp - 0x6c]
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x60]
and ecx, 4
test byte [eax + 0x5c], 4
mov dword [ebp - 0x74], ecx
je 0x4130cc
mov dword [esp], edx
lea eax, [ebp - 0x58]
mov ebx, 0x15
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
call fcn.00415f50
test eax, eax
mov edx, 0x7f2bb73c
je 0x4130c5
mov ebx, dword [edi + 0xc]
xor esi, esi
cmp dword [ebx], 0x98393bc0
je 0x413154
mov dword [ebx], 0x98393bc0
mov dword [ebx + 4], 0x4000000
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0xc]
mov eax, dword [ecx]
xor ecx, ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 4], ecx
mov dword [esp], edx
sub eax, 0xc
mov dword [esp + 8], eax
call sub.cygwin1.dll_memset
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov eax, dword [eax + 0x14]
xchg ah, al
ror eax, 0x10
xchg ah, al
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x38]
mov dword [ebx + 0x14], 0x1000000
xchg ah, al
ror eax, 0x10
xchg ah, al
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x68]
mov dword [esp], eax
call fcn.00432010
xor eax, eax
mov edx, dword [ebp + eax*4 - 0x68]
inc eax
xor esi, edx
cmp eax, 3
jle 0x413072
mov eax, dword [edi + 8]
mov ecx, esi
xchg ch, cl
ror ecx, 0x10
xchg ch, cl
mov dword [ebx + 0x18], ecx
mov dword [esp], eax
call fcn.00411f20
mov dword [esp], 1
lea eax, [edi + 8]
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call fcn.00411df0
mov dword [edi + 0x44], 1
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp + 8]
call fcn.00412010
xor edx, edx
mov esi, edx
jmp 0x412dfb
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x58]
call fcn.00412820
cmp eax, 1
sbb edx, edx
not edx
and edx, 0x7f2bb73c
mov esi, edx
jmp 0x412dfb
mov edx, dword [ebp + 8]
test byte [edx + 0x18], 1
jne 0x412ed8
or dword [ebx + 0x5c], 4
mov edx, dword [edx]
mov eax, dword [edx + 8]
and eax, 0xfffffdff
or eax, 6
mov dword [edx + 8], eax
jmp 0x412ed8
lea edx, [ebp - 0x58]
mov eax, 0x26
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call fcn.00415f50
test eax, eax
je 0x412fbe
jmp 0x412def
lea ecx, [ebp - 0x58]
mov edi, 0x27
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
jmp 0x412fb1
cmp dword [ebx + 4], 0x3000000
jne 0x413012
jmp 0x41301f
lea eax, [ebp - 0x58]
mov edi, 0x19
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.00415f50
test eax, eax
je 0x412f80
movzx eax, word [ebx + 0x3a]
mov dword [ebp - 0x70], 1
mov ecx, dword [ebp + 8]
and eax, 0xfffffffe
mov word [ebx + 0x3a], ax
jmp 0x412f7a