Function at 0x4076d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov dword [ebp - 0x51c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
mov dword [ebp - 0x518], str.AdminToolsFolder
mov ecx, 0x406033
mov dword [ebp - 0x510], 0x30
mov dword [ebp - 0x514], ecx
lea edi, [ebp - 0x484]
mov dword [ebp - 0x500], ecx
mov esi, 0x405efd
mov dword [ebp - 0x4ec], ecx
mov edx, 0x40635b
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x50c], ebx
mov dword [ebp - 0x508], ebx
mov dword [ebp - 0x504], str.AppDataFolder
mov dword [ebp - 0x4fc], 0x1a
mov dword [ebp - 0x4f8], ebx
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], str.CommonAppDataFolder
mov dword [ebp - 0x4e8], 0x23
mov dword [ebp - 0x4e4], ebx
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x4dc], str.CommonFiles64Folder
mov dword [ebp - 0x4d8], 0x4065cf
push 0x2b
pop eax
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4ac], eax
xor eax, eax
mov dword [ebp - 0x4d0], ebx
mov dword [ebp - 0x4cc], ebx
mov dword [ebp - 0x4c8], str.CommonFilesFolder
mov dword [ebp - 0x4bc], ebx
mov dword [ebp - 0x4b8], ebx
mov dword [ebp - 0x4b4], str.CommonFiles6432Folder
mov dword [ebp - 0x4b0], esi
mov dword [ebp - 0x4a8], ebx
mov dword [ebp - 0x4a4], ebx
mov dword [ebp - 0x4a0], str.CompatibilityMode
mov dword [ebp - 0x49c], edx
mov dword [ebp - 0x498], 0xc
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x490], ebx
mov dword [ebp - 0x48c], str.Date
mov dword [ebp - 0x488], 0x40609a
stosd dword es:[edi], eax
push 6
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x478], str.ComputerName
lea edi, [ebp - 0x470]
mov dword [ebp - 0x474], 0x405f95
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x460], ecx
lea edi, [ebp - 0x45c]
mov dword [ebp - 0x464], str.DesktopFolder
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x44c], ecx
pop ecx
mov dword [ebp - 0x450], str.FavoritesFolder
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], str.FontsFolder
mov dword [ebp - 0x438], 0x406033
mov dword [ebp - 0x434], 0x14
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
xor eax, eax
mov dword [ebp - 0x428], str.InstallerName
mov dword [ebp - 0x424], 0x4061b5
lea edi, [ebp - 0x420]
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x414], str.InstallerVersion
lea edi, [ebp - 0x40c]
mov dword [ebp - 0x410], 0x4061e2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x400], str.LocalAppDataFolder
lea edi, [ebp - 0x3e4]
mov dword [ebp - 0x3fc], 0x406033
mov dword [ebp - 0x3f8], 0x1c
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x3f0], ebx
mov dword [ebp - 0x3ec], str.LogonUser
mov dword [ebp - 0x3e8], 0x40623e
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x3d8], str.MyPicturesFolder
lea edi, [ebp - 0x3bc]
mov dword [ebp - 0x3d4], 0x406033
mov dword [ebp - 0x3d0], 0x27
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x3c4], str.NativeMachine
mov dword [ebp - 0x3c0], 0x4062dc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 9
mov dword [ebp - 0x380], ecx
pop ecx
push 0xb
mov dword [ebp - 0x3ac], edx
mov dword [ebp - 0x398], edx
mov dword [ebp - 0x384], edx
mov dword [ebp - 0x370], edx
mov dword [ebp - 0x35c], edx
mov dword [ebp - 0x348], edx
mov dword [ebp - 0x334], edx
mov dword [ebp - 0x320], edx
mov dword [ebp - 0x3b0], str.NTProductType
mov dword [ebp - 0x3a8], 4
mov dword [ebp - 0x3a4], ebx
mov dword [ebp - 0x3a0], ebx
mov dword [ebp - 0x39c], str.NTSuiteBackOffice
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x390], ebx
mov dword [ebp - 0x38c], ebx
mov dword [ebp - 0x388], str.NTSuiteDataCenter
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x374], str.NTSuiteEnterprise
mov dword [ebp - 0x36c], 7
mov dword [ebp - 0x368], ebx
mov dword [ebp - 0x364], ebx
mov dword [ebp - 0x360], str.NTSuitePersonal
mov dword [ebp - 0x358], 8
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x34c], str.NTSuiteSmallBusiness
mov dword [ebp - 0x344], ecx
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x338], str.NTSuiteSmallBusinessRestricted
mov dword [ebp - 0x330], 0xa
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x324], str.NTSuiteWebServer
pop edx
mov dword [ebp - 0x308], eax
lea edi, [ebp - 0x2f4]
xor eax, eax
mov dword [ebp - 0x31c], edx
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x310], str.PersonalFolder
mov dword [ebp - 0x30c], 0x406033
mov dword [ebp - 0x304], ebx
mov dword [ebp - 0x300], ebx
mov dword [ebp - 0x2fc], str.Privileged
mov dword [ebp - 0x2f8], 0x40651f
stosd dword es:[edi], eax
push 0x26
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
mov dword [ebp - 0x2cc], eax
mov edi, 0x406033
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2a4], eax
xor eax, eax
mov dword [ebp - 0x2bc], edi
mov dword [ebp - 0x294], edi
lea edi, [ebp - 0x27c]
mov dword [ebp - 0x2a8], esi
mov esi, 0x4069ee
mov dword [ebp - 0x2e8], str.ProcessorArchitecture
mov dword [ebp - 0x2e4], 0x4067ee
mov dword [ebp - 0x2e0], 0xe
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], str.ProgramFiles64Folder
mov dword [ebp - 0x2d0], 0x4065cf
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x2c0], str.ProgramFilesFolder
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2ac], str.ProgramFiles6432Folder
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], str.ProgramMenuFolder
mov dword [ebp - 0x290], 2
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x284], str.RebootPending
mov dword [ebp - 0x280], 0x406566
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x406033
mov dword [ebp - 0x268], ecx
lea edi, [ebp - 0x218]
mov dword [ebp - 0x26c], eax
mov ecx, 0x40666b
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x230], eax
xor eax, eax
mov dword [ebp - 0x270], str.SendToFolder
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], str.ServicePackLevel
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], 3
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], str.StartMenuFolder
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], str.StartupFolder
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], str.SystemFolder
mov dword [ebp - 0x21c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20c], str.System64Folder
mov dword [ebp - 0x208], ecx
lea edi, [ebp - 0x1f0]
mov dword [ebp - 0x200], ebx
xor eax, eax
mov dword [ebp - 0x1fc], ebx
xor ecx, ecx
mov dword [ebp - 0x1f8], str.SystemLanguageID
inc ecx
mov dword [ebp - 0x204], ecx
mov edx, 0x406033
mov dword [ebp - 0x1f4], 0x405e67
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x1e4], str.TempFolder
lea edi, [ebp - 0x1dc]
mov dword [ebp - 0x1e0], 0x406851
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x1cc], edx
lea edi, [ebp - 0x1a0]
mov dword [ebp - 0x1d0], str.TemplateFolder
mov dword [ebp - 0x1c8], 0x15
mov dword [ebp - 0x1c4], ebx
mov dword [ebp - 0x1c0], ebx
mov dword [ebp - 0x1bc], str.TerminalServer
mov dword [ebp - 0x1b8], 0x40635b
mov dword [ebp - 0x1b4], 0xd
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], str.UserUILanguageID
mov dword [ebp - 0x1a4], 0x405ecb
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x194], str.UserLanguageID
lea edi, [ebp - 0x18c]
mov dword [ebp - 0x190], 0x405e99
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x180], str.VersionMsi
lea edi, [ebp - 0x178]
mov dword [ebp - 0x17c], 0x406927
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x12c], edx
lea edi, [ebp - 0x114]
mov dword [ebp - 0x16c], str.VersionNT
mov edx, 0x406330
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], str.VersionNT64
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x150], 2
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], str.WindowsBuildNumber
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], 0xf
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], str.WindowsFolder
mov dword [ebp - 0x128], 0x24
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], str.WindowsVolume
mov dword [ebp - 0x118], 0x406bd7
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x108], str.WixBundleAction
mov ecx, 0x406640
mov dword [ebp - 0x104], edx
xor esi, esi
mov dword [ebp - 0x100], ebx
inc esi
mov dword [ebp - 0xfc], ebx
mov eax, 0x44b524
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], esi
lea esi, [ebp - 0x50c]
mov dword [ebp - 0xf4], str.WixBundleExecutePackageCacheFolder
mov dword [ebp - 0xf0], ecx
mov edx, dword [0x46b3fc]
call fcn.0042def1
dec ebx
ror eax, 0x11
not ecx
rol eax, 0x19
and esi, edi
add eax, 0x89dcfa8
test edi, esp
jb 0x407ec8
hlt
inc edx
xchg edx, eax
xor esi, eax
mov esi, 0x5ebf88c
mov ecx, dword [0x46ba92]
test eax, 0x21101cd6
jb 0x407f79
sub ecx, dword [0x46b494]
add esi, esi
call fcn.004042ab
mov esi, dword [0x46b866]
xor eax, eax
rol edx, 1
not eax
shl eax, 0xc
xor esi, eax
or esi, edi
ror eax, 0x1f
xor ecx, esp
ror eax, 0xf
xor edx, esp
xor edx, eax
mov edi, edx
xor esi, eax
mov eax, 0x212b7100
not eax
call fcn.0042e4bf
mov ecx, 0x2f521000
dec esi
xor edx, dword [0x46ba35]
shr edx, 1
mov dword [0x46b9ff], ecx
dec eax
xchg eax, eax
call fcn.0042e4bf
xchg edx, eax
shr edi, 0x18
call fcn.0042e4bf
and esi, dword [0x46b19c]
ret 0xefc1
xor eax, 0x46b19c
xor dword [0x46b9e4], 0xe13d61c
xchg esi, eax
shl eax, 8
loop 0x407f56
not esi
call fcn.0042e4bf
mov esi, 0x212136
mov ecx, 0x4fff8d0
ror edx, 0x10
xor edx, dword [0x46b1b0]
ror eax, 0x10
mov dword [0x46b318], 0x228d74f3
rol ebx, 0x14
test esp, ebx
jo 0x407f6f
inc edi
mov ebx, dword [0x46b8f1]
inc esi
rol eax, 7
shr esi, 0x17
mov dword [0x46b063], ebx
xor dword [0x46bb18], 0x1f5d1045
loop 0x407fa0
sub ebx, esp
mov eax, 0x2441c134
rol eax, 0x12
mov ecx, 0x1b715ad
xor dword [0x46b4b0], 0x4a83884
xor dword [0x46b653], 0x13c6b20
mov esi, dword [0x46b290]
call fcn.0040568d
shr edx, 0x1b
inc esi
mov dword [0x46ba0a], 0x5a98864
shl edx, 6
inc esi
add dword [0x46ba6f], esi
call fcn.00403a8d
sub dword [sym.imp.CRYPT32.dll_CryptHashPublicKeyInfo], 0x802fd8
cmp al, 0xba
inc esi
add al, bl
das
add byte [eax], 0x81
and eax, 0x46b81c
fcomp qword [ebp - 0x511dfec2]