Function at 0x41ea00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506b85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
cmp edx, 0x2710
jne 0x41ea99
xor edx, edx
sub esp, 0x18
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], 0xf
mov byte [eax], dl
mov edx, 0x2711
call fcn.0041e600
add esp, 0x18
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x41f19d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41f193
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f1ae
jmp 0x41f193
cmp edx, 0x2721
jne 0x41eac4
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
jb 0x41eaad
mov eax, dword [ebp + 8]
push dword [ebp + 0x18]
mov ecx, 0x534e04
push eax
call fcn.0046a350
mov byte [0x53710d], 1
jmp 0x41ea62
cmp edx, 0x2731
jne 0x41eaf2
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
jb 0x41ead8
mov eax, dword [ebp + 8]
push dword [ebp + 0x18]
mov ecx, 0x534e34
push eax
call fcn.0046a350
mov byte [0x53710b], 1
jmp 0x41ea62
cmp edx, 0x2712
jne 0x41eb22
cmp dword [ebp + 0x18], 0x18
jne 0x41ea62
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
jb 0x41eb10
mov eax, dword [ebp + 8]
push 0x18
push eax
mov ecx, 0x534e1c
call fcn.0046a350
jmp 0x41ea62
cmp edx, 0x2713
jne 0x41eb49
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
jb 0x41eb36
mov eax, dword [ebp + 8]
push eax
call fcn.004ecdf7
add esp, 4
mov dword [0x533ac0], eax
jmp 0x41ea62
cmp edx, 0x272b
jne 0x41eb5d
mov byte [0x53710a], 1
jmp 0x41ea62
cmp edx, 0x2715
jne 0x41ef03
cmp dword [ebp + 0x1c], 0x10
lea esi, [ebp + 8]
jb 0x41eb75
mov esi, dword [ebp + 8]
mov ecx, 0x19
lea edi, [ebp - 0xb8]
rep movsd dword es:[edi], dword [esi]
push 0x5372d4
call fcn.004de812
add esp, 4
test eax, eax
jne 0x41f1b3
xor edi, edi
lea esp, [esp]
mov ecx, dword [0x5373d8]
mov eax, 0x2aaaaaab
mov esi, dword [0x5373d4]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x41eeeb
lea ebx, [edi + edi*2]
shl ebx, 3
lea ecx, [ebp - 0xb8]
add esi, ebx
mov dword [ebp - 0x34], ebx
xor eax, eax
lea edx, [ecx + 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ebf0
sub ecx, edx
lea eax, [ebp - 0xb8]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00402ae0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x15]
mov word [ebp - 0x15], 0x5c
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x13], 0
call fcn.0046e530
add esp, 4
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x41ec34
mov eax, dword [eax]
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x41ec3f
mov esi, dword [esi]
push ecx
push eax
push 0
mov ecx, esi
call fcn.0046feb0
mov ecx, dword [ebp - 0x38]
add esp, 0xc
mov esi, eax
cmp ecx, 0x10
jb 0x41ec83
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41ec79
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f1b9
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp ecx, 0x10
jb 0x41eccd
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41ecc3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f1b9
push ecx
push edx
call fcn.004df511
add esp, 8
cmp esi, 0xffffffff
je 0x41eefd
mov ecx, dword [ebp + 0x18]
lea eax, [ebp + 8]
add ecx, 0xffffff9c
cmp dword [ebp + 0x1c], 0x10
jb 0x41ece8
mov eax, dword [ebp + 8]
xor edx, edx
add eax, 0x64
push ecx
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
call fcn.00402ae0
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4c]
call fcn.00414100
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x41ed50
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41ed46
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f1be
push ecx
push edx
call fcn.004df511
add esp, 8
mov esi, dword [0x5373d4]
add esi, ebx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
xor ecx, ecx
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x18], 0x8ba6b4b9
mov word [ebp - 0x14], 0x100
lea esp, [esp]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 4
jb 0x41ed80
lea edi, [ebp - 0x18]
mov byte [ebp - 0x13], 0
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41ed97
mov ebx, dword [esi + 0x14]
sub edi, ecx
mov ecx, esi
cmp ebx, 0x10
jb 0x41edac
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x18]
push edi
push eax
push 0
call fcn.0046feb0
add esp, 0xc
test eax, eax
jne 0x41ede4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x18
mov esi, eax
lea eax, [ebp - 0x4c]
mov ecx, esp
push eax
call fcn.0046a770
mov ecx, esi
call fcn.00419f50
add esp, 0x18
jmp 0x41ee3c
mov dword [ebp - 0x16], 0x1009783
xor ecx, ecx
lea ecx, [ecx]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x16], al
inc ecx
cmp ecx, 2
jb 0x41edf0
mov byte [ebp - 0x13], 0
cmp ebx, 0x10
jb 0x41ee08
mov esi, dword [esi]
lea eax, [ebp - 0x16]
push eax
push esi
call fcn.004e5362
mov esi, eax
add esp, 8
test esi, esi
je 0x41ee3c
cmp dword [ebp - 0x38], 0x10
lea eax, [ebp - 0x4c]
jb 0x41ee27
mov eax, dword [ebp - 0x4c]
push esi
push dword [ebp - 0x3c]
push 1
push eax
call fcn.004ed168
push esi
call fcn.004e8be8
add esp, 0x14
mov ebx, dword [ebp - 0x34]
add ebx, dword [0x5373d4]
mov esi, dword [0x5373d8]
lea edi, [ebx + 0x18]
cmp edi, esi
je 0x41ee6a
push edi
mov ecx, ebx
call fcn.0046a5f0
add edi, 0x18
add ebx, 0x18
cmp edi, esi
jne 0x41ee52
mov esi, dword [0x5373d8]
mov ecx, dword [esi - 4]
cmp ecx, 0x10
jb 0x41ee9e
mov eax, dword [esi - 0x18]
inc ecx
cmp ecx, 0x1000
jb 0x41ee94
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f1c3
mov eax, edx
push ecx
push eax
call fcn.004df511
add esp, 8
mov dword [esi - 8], 0
mov dword [esi - 4], 0xf
mov byte [esi - 0x18], 0
sub dword [0x5373d8], 0x18
mov ecx, dword [ebp - 0x38]
cmp ecx, 0x10
jb 0x41eeeb
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41eee1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f1c3
push ecx
push edx
call fcn.004df511
add esp, 8
push 0x5372d4
call fcn.004de823
add esp, 4
jmp 0x41ea62
inc edi
jmp 0x41eba0
cmp edx, 0x2717
jne 0x41ef71
sub esp, 0x28
lea ecx, [ebp - 0x28]
mov eax, esp
lea edx, [ebp + 8]
push 0
push 1
mov dword [eax + 0x24], 0
call fcn.0046ea60
mov cl, byte [0x5372b8]
add esp, 0x30
mov al, byte [ebp - 0x28]
mov esi, dword [0x5372c4]
mov edx, dword [0x5372c0]
mov byte [ebp - 0x28], cl
mov ecx, dword [ebp - 0x1c]
mov byte [0x5372b8], al
mov eax, dword [ebp - 0x20]
mov dword [0x5372c4], ecx
lea ecx, [ebp - 0x28]
mov dword [0x5372c0], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
call fcn.00468450
mov byte [0x5370e2], 1
jmp 0x41ea62
cmp edx, 0x2719
jne 0x41efdf
sub esp, 0x28
lea ecx, [ebp - 0x28]
mov eax, esp
lea edx, [ebp + 8]
push 0
push 1
mov dword [eax + 0x24], 0
call fcn.0046ea60
mov cl, byte [0x537310]
add esp, 0x30
mov al, byte [ebp - 0x28]
mov esi, dword [0x53731c]
mov edx, dword [0x537318]
mov byte [ebp - 0x28], cl
mov ecx, dword [ebp - 0x1c]
mov byte [0x537310], al
mov eax, dword [ebp - 0x20]
mov dword [0x53731c], ecx
lea ecx, [ebp - 0x28]
mov dword [0x537318], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
call fcn.00468450
mov byte [0x537101], 1
jmp 0x41ea62
cmp edx, 0x271b
jne 0x41f04d
sub esp, 0x28
lea ecx, [ebp - 0x28]
mov eax, esp
lea edx, [ebp + 8]
push 0
push 1
mov dword [eax + 0x24], 0
call fcn.0046ea60
mov cl, byte [0x537350]
add esp, 0x30
mov al, byte [ebp - 0x28]
mov esi, dword [0x53735c]
mov edx, dword [0x537358]
mov byte [ebp - 0x28], cl
mov ecx, dword [ebp - 0x1c]
mov byte [0x537350], al
mov eax, dword [ebp - 0x20]
mov dword [0x53735c], ecx
lea ecx, [ebp - 0x28]
mov dword [0x537358], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
call fcn.00468450
mov byte [0x5370e0], 1
jmp 0x41ea62
cmp edx, 0x271d
jne 0x41f0bb
sub esp, 0x28
lea ecx, [ebp - 0x28]
mov eax, esp
lea edx, [ebp + 8]
push 0
push 1
mov dword [eax + 0x24], 0
call fcn.0046ea60
mov cl, byte [0x5373a8]
add esp, 0x30
mov al, byte [ebp - 0x28]
mov esi, dword [0x5373b4]
mov edx, dword [0x5373b0]
mov byte [ebp - 0x28], cl
mov ecx, dword [ebp - 0x1c]
mov byte [0x5373a8], al
mov eax, dword [ebp - 0x20]
mov dword [0x5373b4], ecx
lea ecx, [ebp - 0x28]
mov dword [0x5373b0], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
call fcn.00468450
mov byte [0x537100], 1
jmp 0x41ea62
cmp edx, 0x272e
jne 0x41f129
sub esp, 0x28
lea ecx, [ebp - 0x28]
mov eax, esp
lea edx, [ebp + 8]
push 0
push 1
mov dword [eax + 0x24], 0
call fcn.0046ea60
mov cl, byte [0x5373e0]
add esp, 0x30
mov al, byte [ebp - 0x28]
mov esi, dword [0x5373ec]
mov edx, dword [0x5373e8]
mov byte [ebp - 0x28], cl
mov ecx, dword [ebp - 0x1c]
mov byte [0x5373e0], al
mov eax, dword [ebp - 0x20]
mov dword [0x5373ec], ecx
lea ecx, [ebp - 0x28]
mov dword [0x5373e8], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
call fcn.00468450
mov byte [0x537109], 1
jmp 0x41ea62
cmp edx, 0x2723
jne 0x41ea62
lea edx, [ebp + 8]
lea ecx, [ebp - 0x4c]
call fcn.00402770
push eax
mov ecx, 0x534d74
call fcn.0046a5f0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0x10
jb 0x41f17b
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41f171
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f1c8
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [0x53710c], 1
jmp 0x41ea62
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004e47b0
push eax
call fcn.004de4bb
call fcn.004e47b0
call fcn.004e47b0
call fcn.004e47b0
call fcn.004e47b0
int3