Function at 0x1ef81824
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.1ef24d8c
xor eax, eax
push ebp
push 0x1ef81a9e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
lea eax, [ebp - 0x10]
call fcn.1ef248d8
push edi
push esi
add esi, 0x123
mov esi, 0x23
xchg edi, edi
xchg esi, esi
dec esi
and esi, 0x1a5
and esi, 0xa6
pop esi
pop edi
push 1
call sub.user32.dll_IsMenu
push ecx
xor ecx, 7
xchg ecx, ecx
inc ecx
mov ecx, 0xb7
push ecx
pop ecx
pop ecx
mov dl, 1
mov eax, dword [0x1ef329bc]
call fcn.1ef23a94
mov dword [ebp - 0x1c], eax
push 1
call sub.kernel32.dll_GetStdHandle_1
push edx
and edx, 0x15b
xchg edx, edx
push edx
pop edx
dec edx
nop
nop
xchg edx, edx
add edx, 0x17f
nop
nop
nop
nop
nop
mov edx, 0x89
and edx, 0x14c
inc edx
xchg edx, edx
mov edx, 0x150
pop edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x20
call fcn.1ef8173c
push 1
call sub.gdi32.dll_GetStockObject
push edx
push esi
nop
nop
nop
add esi, 0x116
xchg edx, edx
dec esi
dec esi
xor edx, 0x195
nop
nop
nop
nop
pop esi
pop edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x1ef81a05
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
push 1
call sub.gdi32.dll_DeleteEnhMetaFile
push eax
and eax, 0x130
or eax, 0xc8
xor eax, 0xcd
mov eax, 0xd1
and eax, 0x2d
pop eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.1ef28ad0
mov dword [ebp - 0x18], eax
push 1
call sub.user32.dll_IsMenu
push ecx
xor ecx, 7
xchg ecx, ecx
inc ecx
mov ecx, 0xb7
push ecx
pop ecx
pop ecx
mov eax, dword [ebp - 8]
add dword [ebp - 0x18], eax
push esi
sub esi, 0x60
xchg esi, esi
mov esi, 0x148
add esi, 0xd3
push esi
pop esi
and esi, 0x70
add esi, 0x20
dec esi
add esi, 0x1ac
nop
nop
nop
nop
nop
xchg esi, esi
dec esi
pop esi
call sub.kernel32.dll_GetCurrentThreadId_1
lea eax, [ebp - 0x2c]
mov dl, byte [ebp - 0x18]
call fcn.1ef24ac0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
call fcn.1ef24ba4
push 1
call sub.gdi32.dll_GetStockObject
push edx
push esi
nop
nop
nop
add esi, 0x116
xchg edx, edx
dec esi
dec esi
xor edx, 0x195
nop
nop
nop
nop
pop esi
pop edx
push 1
call sub.user32.dll_IsMenu
push ecx
xor ecx, 7
xchg ecx, ecx
inc ecx
mov ecx, 0xb7
push ecx
pop ecx
pop ecx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x1ef81928
call sub.kernel32.dll_GetUserDefaultLCID
push eax
xor eax, 0x16b
dec eax
add eax, 0x1aa
mov eax, 0xc6
and eax, 0x48
nop
nop
nop
nop
nop
nop
nop
nop
and eax, 0x23
inc eax
xor eax, 0x9a
add eax, 0x14e
push eax
pop eax
add eax, 0xd7
pop eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.1ef2492c
push edi
push edx
and edx, 0x4f
xchg edi, edi
dec edi
sub edi, 0x10d
xor edi, 0x12c
or edi, 0x9c
inc edx
and edi, 0x190
xor edi, 0x72
xor edx, 0x116
pop edx
pop edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1ef81aa5
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.1ef248fc
lea eax, [ebp - 0x10]
call fcn.1ef248d8
lea eax, [ebp - 4]
call fcn.1ef248d8
ret