Function at 0x4f71ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405af0
xor eax, eax
push ebp
push 0x4f74a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f74b0
call sub.kernel32.dll_GlobalAddAtomW
push eax
push ecx
or eax, 0x15b
sub eax, 0x5f
nop
nop
nop
nop
nop
xor eax, 0xe0
and eax, 0x63
xor ecx, 0xb9
dec eax
inc ecx
pop ecx
pop eax
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405b5c
push esi
push eax
sub esi, 9
dec esi
dec eax
add esi, 0xf7
and esi, 0x58
and esi, 0x15f
and esi, 0x17d
and eax, 0x7b
xchg esi, eax
pop eax
pop esi
call sub.kernel32.dll_GetCurrentThread
push esi
push ebx
mov ebx, 0x15
and ebx, 0xc2
mov ebx, 0xc4
mov ebx, 0x155
sub esi, 0x180
inc ebx
add ebx, 0x16
pop ebx
pop esi
mov dl, 1
mov eax, dword [0x422f80]
call fcn.00428494
mov dword [ebp - 0x14], eax
push 0x4f7518
call sub.kernel32.dll_GlobalAddAtomW
mov dx, 0x20
mov eax, dword [ebp - 0x14]
call fcn.00427aa8
push 0x4f7540
call sub.kernel32.dll_GlobalAddAtomW
push ebx
add ebx, 0x7f
xchg ebx, ebx
add ebx, 0xac
inc ebx
xchg ebx, ebx
sub ebx, 0x88
nop
nop
nop
nop
nop
push ebx
pop ebx
add ebx, 0xec
pop ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0042786c
push 1
call sub.kernel32.dll_InitAtomTable
push edi
push esi
push edi
pop edi
inc edi
push esi
pop esi
dec esi
inc edi
push esi
pop esi
inc edi
inc edi
pop esi
pop edi
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f7436
inc ebx
xor esi, esi
call sub.user32.dll_GetActiveWindow
push ebx
sub ebx, 0x57
and ebx, 0x18c
inc ebx
push ebx
pop ebx
add ebx, 0x80
dec ebx
and ebx, 0x9c
sub ebx, 0x71
mov ebx, 0x135
pop ebx
lea ecx, [ebp - 0x18]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.0040c0e8
mov edi, eax
push 1
call sub.gdi32.dll_DeleteObject
push ebx
push ebx
pop ebx
inc ebx
and ebx, 0xeb
nop
nop
nop
inc ebx
xchg ebx, ebx
nop
nop
nop
nop
nop
nop
add ebx, 0x15
nop
nop
nop
nop
nop
and ebx, 0xfe
add ebx, 0x33
push ebx
pop ebx
or ebx, 0x98
pop ebx
lea eax, [ebp - 0x1c]
mov edx, edi
add dx, word [ebp - 0xc]
call fcn.00405c74
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00405e5c
call sub.kernel32.dll_GetCurrentProcessId
push eax
push edi
xor edi, 0xa
or edi, 0x173
add eax, 0x161
nop
nop
mov eax, 0x18f
add edi, 0xd4
nop
nop
nop
push edi
pop edi
and eax, 0x4f
add edi, 0x19d
push edi
pop edi
or eax, 0xd7
dec edi
pop edi
pop eax
push 1
call sub.kernel32.dll_InitAtomTable
push edi
push esi
push edi
pop edi
inc edi
push esi
pop esi
dec esi
inc edi
push esi
pop esi
inc edi
inc edi
pop esi
pop edi
call sub.kernel32.dll_GetCurrentThread
push esi
push ebx
mov ebx, 0x15
and ebx, 0xc2
mov ebx, 0xc4
mov ebx, 0x155
sub esi, 0x180
inc ebx
add ebx, 0x16
pop ebx
pop esi
inc esi
dec ebx
jne 0x4f7327
push 1
call sub.gdi32.dll_DeleteObject
push ebx
push ebx
pop ebx
inc ebx
and ebx, 0xeb
nop
nop
nop
inc ebx
xchg ebx, ebx
nop
nop
nop
nop
nop
nop
add ebx, 0x15
nop
nop
nop
nop
nop
and ebx, 0xfe
add ebx, 0x33
push ebx
pop ebx
or ebx, 0x98
pop ebx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f74a7
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405b00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405b00
ret