Function at 0x615ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x434
push ebx
push esi
push edi
lea ebx, [eax + 0xab]
mov eax, dword [eax + 0xa3]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebx], 0
jne 0x615ef6
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x719e94]
mov ecx, dword [str.NpflUvhelx]
mov edx, dword [0x719e90]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
xor eax, eax
mov cl, byte [esp + eax + 0x20]
xor cl, al
xor cl, 1
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0xb
jl 0x615f15
lea edx, [esp + 0x20]
push edx
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebx]
push ecx
push 0
push 0x1f0fff
call eax
test eax, eax
mov dword [esp + 0x1c], eax
je 0x615eeb
mov edx, dword [ebx]
push edx
push str.LCAPTURE_HOOK_KEEP_ALIVE_EVENT
push str._s_d
mov esi, 0x104
lea edi, [esp + 0x3c]
call fcn.004af0d0
add esp, 0xc
push 4
call fcn.0069e704
mov esi, eax
add esp, 4
test esi, esi
jne 0x61600e
call fcn.004b05b0
mov dword [esp + 0x14], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x9b]
test esi, esi
je 0x615faf
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0069d0cc
add esp, 4
mov edx, dword [esp + 0x14]
mov dword [edi + 0x9b], edx
mov ecx, dword [ebx]
mov eax, dword [edi + 0xa3]
push ecx
mov dword [edi + 0xb5], eax
push str.LCAPTURE_HOOK_RESTART_CAPTURE_EVENT
push str._s_d
mov esi, 0x104
lea edi, [esp + 0x3c]
call fcn.004af0d0
add esp, 0xc
mov edx, edi
push edx
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
mov byte [esp + 0x13], 0
je 0x61602a
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x61607c
lea eax, [esp + 0x30]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov dword [esp + 0x14], esi
jmp 0x615f90
lea eax, [esp + 0x238]
push eax
mov eax, str.gamecapturehook3
call fcn.004a6a60
test al, al
je 0x616081
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push 0x6f1618
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x6160c7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x238]
push edx
push eax
call fcn.006168e0
test al, al
je 0x616081
mov byte [esp + 0x13], 1
mov ecx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call ebx
cmp byte [esp + 0x13], 0
jne 0x6160ba
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x9b]
test esi, esi
je 0x6160b0
mov edx, dword [esi]
push edx
call ebx
push esi
call fcn.0069d0cc
add esp, 4
mov dword [edi + 0x9b], 0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0
call ebx
push eax
call edi
cmp dword [esp + 0x14], 0
push esi
setne byte [esp + 0x1f]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [esp + 0x1b], 0
je 0x616066
lea edx, [esp + 0x2c]
push edx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_IsWow64Process]
push eax
call esi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
push edi
call esi
cmp dword [esp + 0x14], 0
sete al
test al, al
je 0x616066
lea ecx, [esp + 0x238]
push ecx
push edi
call fcn.00616b90
jmp 0x616078