Function at 0x40ac85
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
xor edx, edx
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x34]
sub eax, edx
je 0x40b21a
sub eax, 1
je 0x40b0a4
sub eax, 1
je 0x40b091
sub eax, 1
je 0x40ad55
sub eax, 1
jne 0x40b225
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x48], edx
jle 0x40ad00
mov ebx, ebp
mov eax, edi
mov ebp, dword [esp + 0x48]
sub ebx, ecx
sub eax, ecx
mov esi, ecx
mov edx, ebp
mov edi, eax
mov al, byte [ebx + esi]
add al, byte [esi]
mov byte [edi + esi], al
inc esi
sub ebp, 1
jne 0x40ace6
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x3c]
cmp dword [esp + 0x48], 2
jle 0x40ad35
cmp ebx, 4
jle 0x40ad35
cmp dword [esp + 0x48], 4
lea esi, [ebx - 3]
push dword [esp + 0x48]
cmove esi, ebx
mov eax, esi
sub eax, edx
push eax
lea eax, [edx + ecx]
push eax
lea eax, [edx + ebp]
push eax
lea eax, [edx + edi]
push eax
mov eax, dword [esp + 0x44]
call dword [eax + 4]
mov edx, esi
push dword [esp + 0x48]
mov eax, dword [esp + 0x44]
sub ebx, edx
push ebx
add eax, edx
push eax
lea eax, [edx + ebp]
push eax
lea eax, [edx + edi]
push eax
call fcn.00409f5c
jmp 0x40b225
mov ecx, dword [esp + 0x40]
mov eax, edi
sub ecx, ebp
sub eax, ebp
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], eax
cmp dword [esp + 0x48], edx
jle 0x40b056
mov edi, dword [esp + 0x48]
mov esi, ebp
mov edx, edi
mov ebx, eax
mov al, byte [ecx + esi]
shr al, 1
add al, byte [esi]
mov byte [ebx + esi], al
inc esi
sub edi, 1
jne 0x40ad7b
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
cmp edx, 1
jne 0x40ade0
movzx eax, byte [edi]
lea esi, [ebx - 1]
cmp edx, esi
jg 0x40b05e
sub esi, edx
lea edi, [edx + ebp]
mov ebp, dword [esp + 0x38]
inc esi
mov edx, ebx
movzx ecx, byte [ecx + edi]
add ecx, eax
movzx eax, byte [edi]
sar ecx, 1
add ecx, eax
movzx eax, cl
mov ecx, dword [esp + 0x30]
mov byte [edi + ebp], al
inc edi
sub esi, 1
jne 0x40adb6
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
jmp 0x40b05e
cmp edx, 2
jne 0x40ae7f
movzx eax, byte [edi]
mov dword [esp + 0x10], eax
movzx eax, byte [edi + 1]
mov dword [esp + 0x14], eax
lea eax, [ebx - 2]
cmp edx, eax
jg 0x40b05e
lea ecx, [edx + edi]
sub eax, edx
mov dword [esp + 0x40], ecx
sub esi, edi
mov edi, dword [esp + 0x38]
lea ecx, [ebp + 1]
mov ebp, dword [esp + 0x30]
add ecx, edx
shr eax, 1
inc eax
mov ebx, eax
lea edx, [edx + eax*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], edx
mov edx, ecx
movzx ecx, byte [esi + eax]
add ecx, dword [esp + 0x10]
movzx eax, byte [edx - 1]
sar ecx, 1
add ecx, eax
movzx eax, cl
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov byte [ecx], al
movzx ecx, byte [edx + ebp]
add ecx, dword [esp + 0x14]
movzx eax, byte [edx]
sar ecx, 1
add ecx, eax
movzx eax, cl
mov byte [edi + edx], al
lea edx, [edx + 2]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
add eax, 2
mov dword [esp + 0x40], eax
sub ebx, 1
jne 0x40ae2d
mov edx, dword [esp + 0x18]
jmp 0x40af41
cmp edx, 3
jne 0x40af56
movzx eax, byte [edi]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 1]
mov dword [esp + 0x10], eax
movzx eax, byte [edi + 2]
mov dword [esp + 0x18], eax
lea eax, [ebx - 3]
mov dword [esp + 0x24], eax
cmp edx, eax
jg 0x40b05e
lea eax, [edi + 2]
mov ebx, ecx
add eax, edx
mov dword [esp + 0x40], eax
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x38]
add eax, edx
mov dword [esp + 0x20], eax
mov eax, esi
sub eax, edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
movzx ecx, byte [edx + esi]
add edx, 3
add ecx, dword [esp + 0x14]
movzx eax, byte [edi - 1]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x40]
movzx ecx, cl
mov dword [esp + 0x14], ecx
mov byte [eax - 2], cl
movzx ecx, byte [ebx + edi]
add ecx, dword [esp + 0x10]
movzx eax, byte [edi]
sar ecx, 1
add ecx, eax
movzx eax, cl
mov ecx, dword [esp + 0x40]
mov byte [edi + ebp], al
lea edi, [edi + 3]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
movzx ecx, byte [ecx + eax]
add ecx, dword [esp + 0x18]
movzx eax, byte [edi - 2]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x40]
movzx ecx, cl
mov dword [esp + 0x18], ecx
mov byte [eax], cl
add eax, 3
mov dword [esp + 0x40], eax
cmp edx, dword [esp + 0x24]
jle 0x40aed2
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
jmp 0x40b05e
cmp edx, 4
jne 0x40b05e
movzx eax, byte [edi]
mov dword [esp + 0x18], eax
movzx eax, byte [edi + 1]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 2]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + 3]
mov dword [esp + 0x20], eax
lea eax, [ebx - 4]
mov dword [esp + 0x28], eax
cmp edx, eax
jg 0x40b05e
lea eax, [edi + 2]
mov ebx, ecx
add eax, edx
mov dword [esp + 0x10], eax
lea eax, [ebp + 1]
add eax, edx
mov dword [esp + 0x40], eax
mov eax, esi
sub eax, edi
mov edi, dword [esp + 0x38]
mov ebp, eax
mov eax, dword [esp + 0x40]
movzx eax, byte [eax - 1]
movzx ecx, byte [edx + esi]
add ecx, dword [esp + 0x18]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x10]
movzx ecx, cl
mov dword [esp + 0x18], ecx
mov byte [eax - 2], cl
mov eax, dword [esp + 0x40]
movzx ecx, byte [eax + ebx]
add ecx, dword [esp + 0x14]
movzx eax, byte [eax]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x40]
movzx ecx, cl
mov dword [esp + 0x14], ecx
mov byte [eax + edi], cl
mov ecx, dword [esp + 0x10]
movzx eax, byte [eax + 1]
movzx ecx, byte [ecx + ebp]
add ecx, dword [esp + 0x1c]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x10]
movzx ecx, cl
mov dword [esp + 0x1c], ecx
mov byte [eax], cl
movzx ecx, byte [edx + esi + 3]
add edx, 4
add ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
sar ecx, 1
movzx eax, byte [eax + 2]
add ecx, eax
movzx eax, cl
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov byte [ecx + 1], al
add ecx, 4
mov eax, dword [esp + 0x40]
add eax, 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0x40], eax
cmp edx, dword [esp + 0x28]
jle 0x40afaf
jmp 0x40af41
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], ecx
cmp edx, ebx
jge 0x40b225
sub edi, dword [esp + 0x48]
lea esi, [edx + ebp]
movzx ecx, byte [ecx + esi]
movzx eax, byte [edi + edx]
add ecx, eax
mov eax, dword [esp + 0x38]
shr ecx, 1
add cl, byte [esi]
inc edx
mov byte [eax + esi], cl
inc esi
mov ecx, dword [esp + 0x30]
cmp edx, ebx
jl 0x40b06d
jmp 0x40b225
mov eax, dword [esp + 0x40]
push ebx
push eax
mov eax, dword [esp + 0x38]
push ebp
push edi
call dword [eax]
jmp 0x40b225
mov esi, ebp
sub esi, edi
cmp dword [esp + 0x48], edx
jle 0x40b1f8
mov ebx, dword [esp + 0x48]
mov ecx, edi
mov edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
inc ecx
sub ebx, 1
jne 0x40b0ba
mov ebx, dword [esp + 0x44]
cmp edx, 4
jne 0x40b10d
mov ebp, dword [edi]
cmp edx, ebx
jge 0x40b225
sub ebx, edx
add edi, edx
dec ebx
shr ebx, 2
inc ebx
mov edx, dword [edi + esi]
mov eax, ebp
xor ebp, dword [edi + esi]
and edx, 0x7f7f7f7f
and eax, 0x7f7f7f7f
and ebp, 0x80808080
add edx, eax
xor ebp, edx
mov dword [edi], ebp
lea edi, [edi + 4]
sub ebx, 1
jne 0x40b0e1
jmp 0x40b225
cmp edx, 1
jne 0x40b144
movzx eax, byte [edi]
lea ecx, [ebx - 1]
mov dword [esp + 0x34], eax
cmp edx, ecx
jg 0x40b1f8
sub ecx, edx
lea ebp, [edx + edi]
mov edx, ebx
inc ecx
mov ebx, eax
movzx eax, byte [esi + ebp]
add ebx, eax
mov byte [ebp], bl
inc ebp
sub ecx, 1
jne 0x40b12e
mov ebx, edx
jmp 0x40b1f8
cmp edx, 2
jne 0x40b191
movzx eax, byte [edi]
mov dword [esp + 0x40], eax
movzx eax, byte [edi + 1]
mov dword [esp + 0x3c], eax
lea eax, [ebx - 2]
cmp edx, eax
jg 0x40b1f8
mov ebx, dword [esp + 0x40]
lea ecx, [edi + 1]
add ecx, edx
mov edi, eax
movzx eax, byte [edx + ebp]
add edx, 2
add ebx, eax
mov byte [ecx - 1], bl
movzx eax, byte [esi + ecx]
add dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov byte [ecx], al
lea ecx, [ecx + 2]
cmp edx, edi
jle 0x40b16e
jmp 0x40b1f0
cmp edx, 3
jne 0x40b1f8
movzx eax, byte [edi]
mov dword [esp + 0x30], eax
movzx eax, byte [edi + 1]
mov dword [esp + 0x3c], eax
movzx eax, byte [edi + 2]
mov dword [esp + 0x40], eax
lea eax, [ebx - 3]
cmp edx, eax
jg 0x40b1f8
mov ebx, dword [esp + 0x30]
lea ecx, [edi + 1]
add ecx, edx
mov edi, eax
movzx eax, byte [edx + ebp]
add ebx, eax
mov byte [ecx - 1], bl
movzx eax, byte [esi + ecx]
add dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov byte [ecx], al
lea ecx, [ecx + 3]
movzx eax, byte [edx + ebp + 2]
add edx, 3
add dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov byte [ecx - 2], al
cmp edx, edi
jle 0x40b1bf
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x34]
cmp edx, ebx
jge 0x40b225
mov ecx, edx
lea ebp, [edx + edi]
sub ecx, dword [esp + 0x48]
add ecx, edi
sub ebx, edx
mov al, byte [esi + ebp]
add al, byte [ecx]
inc ecx
mov byte [ebp], al
inc ebp
sub ebx, 1
jne 0x40b209
jmp 0x40b225
push ebx
push ebp
push edi
call sub.ntdll.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x1c