Function at 0x41137c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
mov esi, dword [eax]
test esi, esi
jne 0x4114a0
mov dword [ebp - 0x34], 0
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x30], ecx
test ecx, ecx
je 0x4114e8
mov ebx, dword [ebp - 0x34]
lea eax, [ecx + ebx*8]
mov esi, dword [eax + 4]
mov eax, dword [eax]
test eax, eax
je 0x41155d
test esi, esi
je 0x41155d
dec eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x28], eax
jmp 0x4113f0
mov esi, dword [esi]
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x41155d
test esi, esi
je 0x41155d
dec dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp edx, dword [esi + 0x10]
jne 0x4113d8
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x20]
test ebx, ebx
jle 0x411464
mov bl, byte [eax]
test bl, bl
je 0x411464
movzx ebx, bl
mov dword [ebp - 0x3c], ebx
movzx ebx, byte [ecx]
mov dword [ebp - 0x4c], ebx
mov edi, dword [ebp - 0x3c]
mov bl, byte [edi + 0x4ac480]
mov edi, dword [ebp - 0x4c]
cmp bl, byte [edi + 0x4ac480]
jne 0x411464
mov dword [ebp - 0x4c], esi
jmp 0x411457
mov bl, byte [eax]
test bl, bl
je 0x411461
movzx edi, bl
movzx ebx, byte [ecx]
mov dword [ebp - 0x3c], ebx
movzx edi, byte [edi + 0x4ac480]
mov ebx, edi
mov esi, dword [ebp - 0x3c]
cmp bl, byte [esi + 0x4ac480]
jne 0x411461
inc eax
inc ecx
dec edx
lea ebx, [edx + 1]
test ebx, ebx
jg 0x411434
mov esi, dword [ebp - 0x4c]
test edx, edx
js 0x411480
movzx eax, byte [eax]
movzx edx, byte [ecx]
mov al, byte [eax + 0x4ac480]
cmp al, byte [edx + 0x4ac480]
jne 0x4113d8
mov ebx, dword [esi + 8]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4114f6
mov ecx, dword [ebp + 8]
mov dword [esi + 8], ecx
mov edi, dword [ebp - 0x24]
mov dword [esi + 0xc], edi
mov eax, ebx
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [ebp - 0x20]
test edi, edi
jle 0x41154a
xor edx, edx
xor eax, eax
mov edi, dword [ebp - 0x24]
nop
lea ecx, [eax*8]
movzx ebx, byte [edi + edx]
movzx ebx, byte [ebx + 0x4ac480]
xor ecx, ebx
xor eax, ecx
inc edx
cmp edx, dword [ebp - 0x20]
jne 0x4114b4
xor edx, edx
div esi
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x30], ecx
test ecx, ecx
jne 0x4113b0
mov edi, dword [ebp - 0x2c]
mov esi, dword [edi + 8]
mov eax, dword [edi + 4]
jmp 0x4113bb
mov eax, dword [esi + 4]
test eax, eax
je 0x411553
mov edx, dword [esi]
mov dword [eax], edx
mov eax, dword [esi]
test eax, eax
je 0x41150d
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x411524
mov ecx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
lea edx, [edi + ecx*8]
cmp esi, dword [edx + 4]
je 0x41154e
dec dword [edx]
mov dword [esp], esi
call fcn.004098cc
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
dec eax
mov dword [edx + 4], eax
test eax, eax
jne 0x411496
mov eax, edx
call fcn.0040a7e8
jmp 0x411496
xor eax, eax
jmp 0x4114d0
mov dword [edx + 4], eax
jmp 0x411522
mov eax, dword [esi]
mov edi, dword [ebp - 0x2c]
mov dword [edi + 8], eax
jmp 0x411501
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x411496
mov dword [esp], 0x14
call fcn.00409830
mov esi, eax
mov ebx, dword [ebp + 8]
test eax, eax
je 0x411496
mov eax, dword [ebp - 0x24]
mov dword [esi + 0xc], eax
mov edx, dword [ebp - 0x20]
mov dword [esi + 0x10], edx
mov dword [esi + 8], ebx
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebx + 4]
inc eax
mov dword [ebx + 4], eax
cmp eax, 9
jbe 0x4115ad
mov edx, dword [ebx]
lea ecx, [edx + edx]
cmp eax, ecx
ja 0x411648
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x411622
mov edi, dword [ebp - 0x34]
lea eax, [eax + edi*8]
test eax, eax
je 0x4115fc
mov ecx, dword [eax]
test ecx, ecx
je 0x4115f3
mov edx, dword [eax + 4]
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
test edx, edx
je 0x4115fc
mov dword [esi], edx
mov eax, dword [edx + 4]
mov dword [esi + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x4117b4
mov dword [eax], esi
mov dword [edx + 4], esi
xor ebx, ebx
jmp 0x411496
mov dword [eax], 1
mov dword [eax + 4], esi
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
mov dword [esi], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x41160e
mov dword [eax + 4], esi
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 8], esi
xor ebx, ebx
jmp 0x411496
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebx + 8]
mov dword [esi], eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x411634
mov dword [eax + 4], esi
mov dword [esi + 4], 0
mov edi, dword [ebp - 0x2c]
mov dword [edi + 8], esi
xor ebx, ebx
jmp 0x411496
lea ebx, [eax + eax]
shl eax, 4
cmp eax, 0x400
jbe 0x41165a
mov ebx, pe_nt_image_headers32
cmp edx, ebx
je 0x4115ad
call fcn.004094c0
shl ebx, 3
mov dword [esp], ebx
call fcn.00409830
mov dword [ebp - 0x1c], eax
call fcn.004094d8
cmp dword [ebp - 0x1c], 0
je 0x4115ad
mov edi, dword [ebp - 0x2c]
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call fcn.004098cc
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0xc], eax
call fcn.0040974c
shr eax, 3
mov dword [ebp - 0x28], eax
mov dword [edi], eax
mov ecx, eax
shl ecx, 3
xor eax, eax
mov edi, dword [ebp - 0x1c]
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 8]
mov dword [eax + 8], 0
test ecx, ecx
je 0x411780
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x30], edx
mov ebx, dword [ecx + 0xc]
mov dword [ebp - 0x34], ebx
test edx, edx
jle 0x411779
xor edx, edx
xor eax, eax
mov dword [ebp - 0x3c], ecx
lea ebx, [eax*8]
mov ecx, dword [ebp - 0x34]
movzx edi, byte [ecx + edx]
movzx edi, byte [edi + 0x4ac480]
xor ebx, edi
xor eax, ebx
inc edx
cmp edx, dword [ebp - 0x30]
jne 0x4116e1
mov ecx, dword [ebp - 0x3c]
mov ebx, dword [ecx]
xor edx, edx
div dword [ebp - 0x28]
mov edi, dword [ebp - 0x1c]
lea eax, [edi + edx*8]
test eax, eax
je 0x41174b
mov edi, dword [eax]
test edi, edi
je 0x411742
mov edx, dword [eax + 4]
inc edi
mov dword [eax], edi
mov dword [eax + 4], ecx
test edx, edx
je 0x41174b
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x411771
mov dword [eax], ecx
mov dword [edx + 4], ecx
mov ecx, ebx
jmp 0x4116be
mov dword [eax], 1
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x41175d
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov edi, dword [ebp - 0x2c]
mov dword [edi + 8], ecx
mov ecx, ebx
jmp 0x4116be
mov eax, dword [ebp - 0x2c]
mov dword [eax + 8], ecx
jmp 0x411738
mov ebx, dword [ecx]
mov eax, dword [ebp - 0x1c]
jmp 0x411714
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
jmp 0x4117a1
lea edx, [eax*8]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4ac480]
xor edx, edi
xor eax, edx
inc ecx
dec ebx
test ebx, ebx
jg 0x41178a
mov ecx, dword [ebp - 0x2c]
xor edx, edx
div dword [ecx]
mov dword [ebp - 0x34], edx
jmp 0x4115ad
mov eax, dword [ebp - 0x2c]
mov dword [eax + 8], esi
jmp 0x4115e9