Function at 0x49cb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x50dc10]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
test esi, esi
jne 0x49cb46
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
mov eax, dword [0x52e838]
test eax, eax
jne 0x49cb67
push ecx
push esi
call dword [sym.imp.USER32.dll_RemovePropA]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
push edi
push 0x585
push str.LibMain.c
add eax, 0xd84
push 0
push eax
call fcn.0047efe0
mov edi, dword [0x52e83c]
add esp, 0x10
test edi, edi
je 0x49cbce
mov eax, 0x3ce4585
mov ecx, esi
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3f1
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ecx*4 + 8]
mov edi, dword [eax + edi]
mov dword [ebp - 0x18], eax
test edi, edi
je 0x49cbce
nop
cmp dword [edi], esi
je 0x49cbf4
mov dword [ebp - 0x10], edi
mov edi, dword [edi + 0x34]
test edi, edi
jne 0x49cbc0
mov eax, dword [0x52e838]
add eax, 0xd84
push eax
call fcn.00480f30
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
mov esi, edx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x49cc00
sub esi, ecx
mov eax, esi
and eax, 3
je 0x49cc2d
push eax
mov eax, esi
and eax, 0xfc
add eax, edx
push eax
lea eax, [ebp - 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp - 8]
add esp, 0xc
mov edx, dword [ebp - 0xc]
sar esi, 2
test esi, esi
je 0x49cc3d
xor ebx, dword [edx + esi*4 - 4]
dec esi
test esi, esi
jne 0x49cc34
mov eax, 0xba2e8ba3
xor ecx, ecx
mul ebx
mov dword [ebp - 8], ecx
shr edx, 3
imul eax, edx, 0xb
sub ebx, eax
lea eax, [ebx + 2]
mov esi, dword [edi + eax*4]
lea eax, [edi + eax*4]
mov dword [ebp - 0x14], eax
test esi, esi
je 0x49cbce
mov ebx, dword [ebp - 0xc]
mov eax, dword [esi]
mov ecx, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x49cc90
test dl, dl
je 0x49cc8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x49cc90
add eax, 2
add ecx, 2
test dl, dl
jne 0x49cc70
xor eax, eax
jmp 0x49cc95
sbb eax, eax
or eax, 1
test eax, eax
je 0x49cca8
mov dword [ebp - 8], esi
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x49cc68
jmp 0x49cbce
mov ecx, dword [ebp - 8]
mov ebx, dword [esi + 4]
mov eax, dword [esi + 0x10]
test ecx, ecx
je 0x49ccba
mov dword [ecx + 0x10], eax
jmp 0x49ccbf
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
push dword [esi + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
push dword [esi]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
dec dword [edi + 4]
add esp, 0xc
mov eax, dword [0x52e83c]
dec dword [eax + 4]
cmp dword [edi + 4], 0
jne 0x49cd13
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0x34]
test eax, eax
je 0x49ccf7
mov dword [eax + 0x34], ecx
jmp 0x49cd02
mov eax, dword [0x52e83c]
mov edx, dword [ebp - 0x18]
mov dword [edx + eax], ecx
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [0x52e83c]
add esp, 4
dec dword [ecx]
mov ecx, dword [0x52e838]
add ecx, 0xd84
push ecx
call fcn.00480f30
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e2538
mov esp, ebp
pop ebp
ret