Function at 0x46ebed
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push 0x493ac4
push esi
call dword [0xd57abc]
xor eax, dword [0x714cd070]
jo 0x46e893
dec esp
jno 0x46e92e
sub byte [ebp - 0x5ca9ffed], ah
push eax
inc esp
dec ebp
add bh, bh
adc eax, 0x183bc
xor eax, dword [0x4c9470]
push str.FlsGetValue
push esi
mov dword [0x4d4454], eax
aas
jo 0x46e86e
dec esp
add byte [eax + 0x30], ch
movsd dword es:[edi], dword [esi]
dec ecx
add byte [esi - 0x5d], dl
push esp
inc esp
dec ebp
add byte [edi], bh
adc eax, 0x7f499949
xor eax, dword [0x4cd070]
push 0x2749a53c
and dword [ebx + 0x8d4458], esp
call dword [0xd0992f]
imul eax, dword [0xf6bdd070], 0x68
cmp ah, byte [ebp - 0x5ca9e2b7]
pop esp
ja 0x46e961
jo 0x46e8d8
mov ebp, 0xa53a68f6
dec ecx
sbb eax, 0x775ca356
dec ebp
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
xor eax, dword [0x3dd065]
push 0x49a5d3
push esi
mov dword [0x4d446f], eax
call dword [0xdd99bc]
sbb dword [ebp + 0x70], ecx
ror byte [eax + eax + 0x68], 1
js 0x46e914
jo 0x46e906
dec esp
add byte [eax + 0x78], ch
invalid
dec ecx
add byte [esi - 0x80], dl
adc eax, 0xff004d44
adc eax, 0x49d1ad
xor eax, dword [0x4cd070]
push 0x5a49a588
push esi
mov dword [0x4d4468], eax
jmp dword [edi + 0x499ebc]
xor eax, 0x4cd070
je 0x46e9cb
jo 0x46e934
dec esp
add byte [ebx - 0x5b], dh
movsd dword es:[edi], dword [esi]
dec ecx
add byte [esi - 0x5d], dl
insb byte es:[edi], dx
inc esp
dec ebp
add al, bl
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
xor eax, dword [0x1fd070]
push 0x49a532
push esi
mov dword [0x4d4470], eax
call dword [0x8e4999f0]
in eax, 5
jo 0x46e962
dec esp
add byte [eax - 0x18], ch
movsd dword es:[edi], dword [esi]
dec ecx
add byte [esi - 0x5d], dl
jg 0x46e9e1
dec ebp
add bh, bh
adc eax, 0x4999d3
cdq
dec ecx
invalid
call dword [0x4999d3]
xor eax, 0x4cd07005
add byte [eax - 0x3d], ch
movsd dword es:[edi], dword [esi]
dec ecx
add byte [esi - 0x5d], dl
js 0x46e99f
dec ebp
add bh, bh
cmp al, 0x99
dec ecx
add byte [ebx], dh
add eax, 0x4cd00f
push 0xc4a5fc
push esi
mov dword [0x4d441b], eax
invalid
dec ebp
add bh, bh
fidivr dword [ecx + ebx*4 + 0x533e749]
pop eax
inc edx
dec esp
add byte [eax + 0x14], ch
xor byte [ecx], cl
push edi
mov dword [0x54d4442], eax
call dword [0xea1214bc]
inc esp
dec ebp
add eax, 0x14bc15ff
adc ch, dl
xor eax, dword [0x4ca170]
push 0x4949a62c
push esi
in al, 0x84
popal
dec ebp
add bh, bh
adc eax, 0x3a49994e
rol dword [0x9dffd070], cl
push 0x2ba663
mov dword [0xb44d4488], eax
push esi
call dword [0xa549e7bc]
xor eax, dword [0x4cd061]
push 0x8b49a654
push esi
mov dword [0x4dd28c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor eax, dword [reloc.DuiLib.dll__SetFixedXY_CControlUI_DuiLib__UAEXUtagSIZE___Z]
jecxz 0x46eaa7
cmpsb byte [esi], byte es:[edi]
dec ecx
or dword [edx - 0x5b], edi
nop
inc esp
dec ebp
add bh, bh
adc eax, 0x493cbc
xor eax, dword [0x4cd0ce]
std
nop
cdq
dec ecx
push esi
mov dword [0xe14d4494], eax
bound edx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
dec ebp
loope 0x46eaba
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
xor eax, dword [0x4cd070]
inc eax
push 0xd10049a6
mov dword [0xa44d4498], eax
int1
adc eax, 0x4d4999bc
xor edi, dword [0x4cd070]
push 0x80d1a6c0
push esi
mov dword [0x4dc29c], eax
call dword [0xd04969bc]
xor eax, dword [0x4cd017]
push 0xc612a6d4
pop ss
ror byte [eax + eax + 0x68], 1
aam 0xa6
adc al, dh
push esi
mov dword [0xad7c4492], eax
call dword [0xa399de]
xor eax, dword [0x4c7968]
push str.GetFileInformationByHandleEx
push esi
push edx
add byte [eax - 0x1c], ch
cmpsb byte [esi], byte es:[edi]
dec ecx
add byte [esi + 0x52], dl
movsb byte es:[edi], byte [esi]
inc edi
fld qword [eax]
inc dword [ebx - 0x7db66644]
xor eax, dword [0x4cd070]
dec ecx
xor byte [ebx], 5
add eax, 0x4cd070
jo 0x46ea8d
dec esp
add byte [eax + 4], ch
mov bl, 0x49
add byte [esi + 0x78], dl
mov es, word [ebp + ecx*2 + 0xd]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor eax, dword [0x4cd070]
push 0x49b304
push esi
js 0x46ea55
inc esp
dec ebp
or eax, 0x99bc15ff
dec ecx
add byte [ebx], dh
add eax, 0x4cd070
cmp dword [eax], esp
cmpsd dword [esi], dword es:[edi]
dec ecx
add byte [esi - 0x5d], dl
lodsb al, byte [esi]
xchg dword [ebp], ecx
call dword [0x49e4bc]
xor edi, ebp
jo 0x46eabb
dec esp
xor eax, 0x496ff468
add byte [esi - 0x5d], dl
dec edi
test byte [ebp], 0xff
jecxz 0x46eab7
outsb dx, byte [esi]
dec ecx
add byte [ebx], dh
add eax, 0x4cd070
push str.WakeConditionVariable
push esi
mov dword [0x4f44b4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, dword [ebx]
jo 0x46eae9
and byte [eax], al
push 0x1e49a774
push esi
mov dword [0x9b443c], eax
call dword [0xd99912]
xor eax, dword [0x4cd0b0]
push str.SleepConditionVariableCS
fisttp qword [edx - 0x44]
inc esp
dec ebp
add bh, bh
adc eax, 0xcd1c99bc
xor eax, dword [0x4cd070]
push fcn.004968ac
push esi
mov dword [0x4d44c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, ecx
jo 0x46ebb4
dec esp
add byte [ebx + 0x21], dh
cmpsd dword [esi], dword es:[edi]
dec ecx
add byte [ebx + 0x4d44c4], ah
dec esp
mov esp, 0xb8004999
add eax, 0x4cd070
push 0x6349a7d8
push esi
mov dword [0x4d07c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xchg edx, eax
ljmp 0xf468
jo 0x46eb5c
dec esp
add byte [eax - 0xc], ch
cmpsd dword [esi], dword es:[edi]
dec ecx
add byte [esi - 0x5d], dl
jno 0x46ebdb
push ss
add bh, bh
adc eax, 0x4999d5
xor ecx, dword [ebx + esi*2 + 0x68004cd0]
or al, 0xa8
mov word [eax], es
push esi
mov dword [0x4d06d0], eax
jle 0x46ebc7
mov esp, 0x33004999
dec ecx
add byte [ebx], dh
add eax, 0x4cd070
inc ebp
sub byte [eax - 0x5cfeffb7], ch
jo 0x46eb8a
dec esp
add byte [ebp + 0x28], al
test al, 0x49
add byte [ecx], al
mov dword [0x4d446f], eax
outsd dx, dword [esi]
inc esp
dec ebp
add bh, bh
cmp eax, sym.imp.KERNEL32.dll_GetProcAddress
xor eax, dword [0x4cd070]
sbb eax, dword [eax - 0x58]
dec ecx
add byte [0x92ad8a3], dl
invalid
sub cl, byte [ecx]
add byte [ebx + 0x5c99bc15], dh
add byte [ebx], dh
add eax, 0x4cd070
push str.CloseThreadpoolWork
dec ecx
add byte [edi - 0x5d], ch
fadd qword [ebp + ecx*2]
jo 0x46ebb8
dec esp
add byte [eax + 0x58], ch
test al, 0x49
dec ecx
add byte [edi - 0x5d], ch
fadd qword [ebp + ecx*2]
mov al, 0x15
mov esp, 0x3300d799
add eax, 0x90d070
push 0x320c33
add byte [esi - 0x5d], dl
loopne 0x46ebc3
dec ebp
add bh, bh
xchg edi, eax
mov esp, 0x33001b99
clc
jo 0x46ebe6
dec esp
add byte [ecx + 0x7c], bh
test al, 0x49
pushfd
xor dword [0xb49d449d], 0x99bc15ff
dec ecx
add byte [ebx], dh
add eax, 0x4cd070
add al, 0x8c
test al, 0xa9
add byte [esi - 0x5d], dl
call 0xff478c7f
in eax, dx
dec ebp
cmp eax, 0x5330049
and al, dl
loope 0x46ec75
in al, dx
inc esp
dec ebp
add byte [ebx], dh
ficomp dword [esi - 0x3d]
push ebp
mov ebp, esp
push esi
mov esi, dword [0x4d4460]
xor esi, dword [0x224cd070]
into
adc al, 0xff
push ebp
adc bl, dl
into
push dword [ebp - 6]
push dword [ebp + 8]
call 0xed46fded
inc ecx
dec ecx
jmp 0x46ec84
sahf
jne 0x46ec84
xchg ecx, eax
sbb edx, dword [edx - 1]
adc eax, 0x49aebc
xor eax, eax
inc eax
pop esi
pop ebp
ret