Function at 0x49391c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov byte [ebp - 9], 0xff
mov dl, 1
mov eax, dword [0x492084]
call fcn.004920e0
mov dword [ebp - 0x10], eax
xor edi, edi
push ebp
push 0x493b22
push dword fs:[edi]
mov dword fs:[edi], esp
mov eax, dword [ebp - 0x10]
call fcn.0049222c
test eax, eax
jne 0x493b0c
mov eax, ebx
call fcn.00404d74
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.0049215c
cmp al, 1
jne 0x493b0c
test dword [ebp - 4], 0xffffff00
jne 0x4939a1
mov ecx, dword [ebp - 4]
mov eax, 1
shl eax, cl
mov edx, dword [ebp - 0x10]
and eax, dword [edx + 0x24]
jne 0x4939a1
call fcn.004042fc
jmp 0x493b29
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0x40
call fcn.0040324c
mov byte [ebp - 0x11], 0x6e
mov cl, byte [ebp - 8]
test cl, cl
jb 0x4939da
inc ecx
mov dl, 0
lea eax, [ebp - 0x74]
xor ebx, ebx
mov bl, dl
mov bl, byte [esi + ebx]
mov byte [eax], bl
xor ebx, ebx
mov bl, dl
mov bl, byte [esi + ebx]
xor byte [ebp - 0x11], bl
inc edx
inc eax
dec cl
jne 0x4939c1
mov eax, dword [ebp - 8]
mov dl, byte [ebp - 0x11]
mov byte [ebp + eax - 0x73], dl
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x20
call fcn.0040324c
mov dword [ebp - 0x34], 0x10020
mov ebx, dword [ebp - 4]
and ebx, 0xffffff00
test ebx, ebx
jne 0x493a16
mov ecx, dword [ebp - 4]
mov eax, 1
shl eax, cl
mov dword [ebp - 0x30], eax
jmp 0x493a1c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], 0x6e
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
add eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x1c
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0x10]
call fcn.00492420
test eax, eax
je 0x493a63
call fcn.004042fc
jmp 0x493b29
push 0x32
call sub.KERNEL32.DLL_Sleep_1
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x20
call fcn.0040324c
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0x40
call fcn.0040324c
mov dword [ebp - 0x34], 0x10020
test ebx, ebx
jne 0x493aa2
mov ecx, dword [ebp - 4]
mov eax, 1
shl eax, cl
mov dword [ebp - 0x30], eax
jmp 0x493aa8
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], 0x6f
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x40
mov dword [ebp - 0x18], 0x1c
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0x10]
call fcn.004923f0
test eax, eax
jne 0x493b0c
mov al, byte [ebp - 0x73]
and al, 0x7f
add al, 2
mov byte [ebp - 9], al
mov ebx, esi
mov eax, ebx
xor ecx, ecx
mov edx, 0x100c
call fcn.0040324c
xor ecx, ecx
mov cl, byte [ebp - 9]
mov edx, ebx
lea eax, [ebp - 0x74]
call fcn.00402954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493b29
mov eax, dword [ebp - 0x10]
call fcn.00403ac4
ret
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4