Function at 0x41a658
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx + 0x158]
mov rax, rdi
shr rax, 4
lea rbp, [rax + rdi + 0x400]
cmp rbp, rdi
jae 0x41a69a
mov eax, 0x80004005
jmp 0x41ad88
mov rax, qword [rcx + 0x170]
mov qword [rcx + 0x168], rax
lea r15, [0x0045bf00]
xor r13d, r13d
cmp rax, r13
jne 0x41a7c6
mov rdx, qword [rcx + 0x178]
cmp rdx, r13
je 0x41a6d0
cmp rdi, qword [rcx + 0x180]
je 0x41a706
mov rcx, r15
call qword [0x0045bf08]
mov qword [rsi + 0x180], r13
mov qword [rsi + 0x178], r13
mov rdx, rdi
mov rcx, r15
call qword [0x0045bf00]
mov qword [rsi + 0x178], rax
cmp rax, r13
je 0x41a706
mov qword [rsi + 0x180], rdi
cmp qword [rsi + 0x178], r13
jne 0x41a719
mov eax, 0x8007000e
jmp 0x41ad88
mov edx, dword [rsi + 0x1a8]
cmp edx, r13d
jne 0x41a78c
mov eax, dword [rsi + 0x88]
mov dword [rsp + 0x48], eax
mov r10d, 0x159a55e5
mov r9d, 0x1f123bb5
mov rdx, qword [rsi + 0x180]
mov r11, qword [rsi + 0x178]
mov r8, r13
cmp rdx, r13
jbe 0x41a79f
movzx ecx, r10w
imul ecx, ecx, 0x9069
shr r10d, 0x10
add r10d, ecx
movzx ecx, r9w
imul ecx, ecx, 0x4650
shr r9d, 0x10
add r9d, ecx
mov dword [rsp + 0x44], r9d
mov al, byte [rsp + 0x48]
xor al, r9b
mov byte [r8 + r11], al
inc r8
cmp r8, rdx
jb 0x41a750
jmp 0x41a79f
mov r8d, dword [rsi + 0x88]
lea rcx, [rsi + 0x178]
call fcn.00419e3c
mov rdx, qword [rsi + 0x180]
mov rcx, qword [rsi + 0x178]
call fcn.00451510
mov dword [rsi + 0x150], eax
mov rax, qword [rsi + 0x178]
mov qword [rsi + 0x168], rax
cmp qword [rsi + 0x58], r13
je 0x41a831
mov rbx, qword [rsi + 0x158]
mov rdx, qword [rsi + 0x188]
cmp rdx, r13
je 0x41a7e8
cmp rbx, qword [rsi + 0x190]
je 0x41a81e
mov rcx, r15
call qword [0x0045bf08]
mov qword [rsi + 0x190], r13
mov qword [rsi + 0x188], r13
mov rdx, rbx
mov rcx, r15
call qword [0x0045bf00]
mov qword [rsi + 0x188], rax
cmp rax, r13
je 0x41a81e
mov qword [rsi + 0x190], rbx
cmp qword [rsi + 0x188], r13
jne 0x41a831
mov eax, 0x8007000e
jmp 0x41ad88
mov edi, 0x30
lea r14, [0x00455d40]
cmp qword [rsi + 0x138], r13
jne 0x41a898
mov rcx, rdi
call fcn.004021d0
mov rbx, rax
cmp rax, r13
je 0x41a867
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov dword [rax + 0x18], r13d
mov qword [rax], r14
jmp 0x41a86a
mov rbx, r13
mov qword [rsi + 0x130], rbx
cmp rbx, r13
je 0x41a87f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rcx, qword [rsi + 0x138]
cmp rcx, r13
je 0x41a891
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x138], rbx
mov rbx, qword [rsi + 0x130]
mov rdx, qword [rbx + 8]
cmp rdx, r13
je 0x41a8ae
cmp rbp, qword [rbx + 0x10]
je 0x41a8d8
mov rcx, r15
call qword [0x0045bf08]
mov qword [rbx + 0x10], r13
mov qword [rbx + 8], r13
mov rdx, rbp
mov rcx, r15
call qword [0x0045bf00]
mov qword [rbx + 8], rax
cmp rax, r13
je 0x41a8d8
mov qword [rbx + 0x10], rbp
mov rax, qword [rsi + 0x130]
cmp qword [rax + 8], r13
jne 0x41a8ef
mov eax, 0x8007000e
jmp 0x41ad88
cmp qword [rsi + 0x1a0], r13
jne 0x41a94a
mov rcx, rdi
call fcn.004021d0
mov rbx, rax
cmp rax, r13
je 0x41a919
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov dword [rax + 0x18], r13d
mov qword [rax], r14
jmp 0x41a91c
mov rbx, r13
mov qword [rsi + 0x198], rbx
cmp rbx, r13
je 0x41a931
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rcx, qword [rsi + 0x1a0]
cmp rcx, r13
je 0x41a943
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x1a0], rbx
mov rbx, qword [rsi + 0x198]
mov rdx, qword [rbx + 8]
mov edi, 5
cmp rdx, r13
je 0x41a965
cmp qword [rbx + 0x10], rdi
je 0x41a98f
mov rcx, r15
call qword [0x0045bf08]
mov qword [rbx + 0x10], r13
mov qword [rbx + 8], r13
mov rdx, rdi
mov rcx, r15
call qword [0x0045bf00]
mov qword [rbx + 8], rax
cmp rax, r13
je 0x41a98f
mov qword [rbx + 0x10], rdi
mov rax, qword [rsi + 0x198]
cmp qword [rax + 8], r13
jne 0x41a9a6
mov eax, 0x8007000e
jmp 0x41ad88
mov r14d, 0xffffffff
mov dword [rax + 0x2c], r14d
mov byte [rax + 0x28], 1
mov byte [rax + 0x29], r13b
mov qword [rax + 0x20], r13
mov qword [rsp + 0xc8], r13
mov rbx, qword [rsi + 0x58]
cmp rbx, r13
je 0x41a9e5
cmp rbx, r13
je 0x41a9db
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov qword [rsp + 0xc8], rbx
jmp 0x41a9ff
mov rbx, qword [rsi + 0x50]
cmp rbx, r13
je 0x41a9f7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xb0], r13
mov rax, qword [rbx]
lea r8, [rsp + 0xb0]
lea rdx, [0x0045add0]
mov rcx, rbx
call qword [rax]
mov rdi, qword [rsp + 0xb0]
cmp rdi, r13
je 0x41aaa3
mov rax, qword [rsi + 0x158]
mov qword [rsp + 0x30], rax
lea rcx, [rsi + 0x30]
lea r8, [rsp + 0xb8]
mov edx, dword [rsi + 0x28]
call fcn.00419010
mov qword [rsp + 0xb8], rax
neg rax
sbb r9, r9
lea rax, [rsp + 0xb8]
and r9, rax
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsi + 0x1b0]
call fcn.0040ea4c
mov edi, eax
cmp eax, r13d
je 0x41aad6
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x41aa93
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov eax, edi
jmp 0x41ad88
mov edx, r13d
cmp dword [rsi + 0x1b8], r13d
jbe 0x41aad6
mov rcx, qword [rsi + 0x1b0]
mov rax, qword [rcx]
cmp byte [rax + 4], r13b
je 0x41aacf
inc edx
add rcx, 8
cmp edx, dword [rsi + 0x1b8]
jb 0x41aab6
jmp 0x41aad6
mov edi, 0x80070057
jmp 0x41ab3e
mov qword [rsp + 0xc0], r13
mov rax, qword [rbx]
lea r8, [rsp + 0xc0]
lea rdx, [0x0045adb0]
mov rcx, rbx
call qword [rax]
mov rcx, qword [rsp + 0xc0]
cmp rcx, r13
je 0x41ab4e
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x1a0]
call qword [rax + 0x18]
mov edi, eax
cmp eax, r13d
je 0x41ab4e
mov rcx, qword [rsp + 0xc0]
cmp rcx, r13
je 0x41ab2a
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x41ab3e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov eax, edi
jmp 0x41ad88
mov qword [rsp + 0xb8], r13
mov rax, qword [rbx]
lea r8, [rsp + 0xb8]
lea rdx, [0x0045ad20]
mov rcx, rbx
call qword [rax]
mov rcx, qword [rsp + 0xb8]
cmp rcx, r13
je 0x41ad49
mov rax, qword [rcx]
lea rdx, [rsi + 0xcc]
mov ebp, 0x10
mov r8d, ebp
call qword [rax + 0x18]
mov edi, eax
cmp eax, r13d
je 0x41abdb
mov rcx, qword [rsp + 0xb8]
cmp rcx, r13
je 0x41abae
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rcx, qword [rsp + 0xc0]
cmp rcx, r13
je 0x41abc2
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x41abd6
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x41ad20
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
mov rcx, qword [rsi + 0x58]
cmp rcx, r13
je 0x41ac18
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rsi + 0x58]
mov rax, qword [rcx]
mov r8d, ebp
lea rdx, [rsp + 0x50]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0xb8]
jmp 0x41ad49
mov ecx, 0x28
call fcn.004021d0
mov rdi, rax
cmp rax, r13
je 0x41ac3a
mov dword [rax + 8], r13d
lea rax, [0x00455d60]
mov qword [rdi], rax
jmp 0x41ac3d
mov rdi, r13
mov qword [rsp + 0x30], rdi
cmp rdi, r13
je 0x41ac51
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + VariantCopy]
nop
lea rax, [rsp + 0x50]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x18], r13
mov ecx, 0x20
call fcn.004021d0
mov rbp, rax
cmp rax, r13
je 0x41ac89
mov dword [rax + 8], r13d
lea rax, [0x00455db8]
mov qword [rbp], rax
mov byte [rbp + 0xc], 1
jmp 0x41ac8c
mov rbp, r13
mov qword [rsp + 0x40], rbp
cmp rbp, r13
je 0x41aca1
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + VariantCopy]
nop
mov dword [rbp + 0x10], r14d
mov qword [rbp + 0x18], r13
mov rcx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
call qword [rax + 0x18]
mov esi, eax
cmp eax, r13d
je 0x41ad2d
mov rdx, qword [rbp]
mov rcx, rbp
call qword [rdx + 0x10]
nop
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x10]
nop
mov rcx, qword [rsp + 0xb8]
cmp rcx, r13
je 0x41acf6
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0xc0]
cmp rcx, r13
je 0x41ad0a
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x41ad1e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov edi, esi
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov eax, edi
jmp 0x41ad88
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xb8]
cmp rcx, r13
je 0x41ad55
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0xc0]
cmp rcx, r13
je 0x41ad69
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x41ad7d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret