Function at 0x41ef72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6309f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x11f4
call fcn.005bc5e0
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], ebx
cmp dword [edi + 0x1a8], ebx
je 0x41f4bc
lea esi, [edi + 0x1d0]
mov eax, dword [esi]
cmp eax, ebx
je 0x41efc5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
test byte [0x71b750], 4
je 0x41f006
push str.___pause_before_create_window
lea ecx, [esp + 0x20]
call fcn.004030bf
mov dword [esp + 0x120c], ebx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0x1b0]
call fcn.00402291
or dword [esp + 0x120c], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x24]
call fcn.0040337f
mov eax, dword [0x6f2e50]
add eax, 0x118
cmp dword [eax + 0x18], 8
jb 0x41f01b
mov eax, dword [eax + 4]
jmp 0x41f01e
add eax, 4
push eax
lea ecx, [esp + 0xc8]
call fcn.004030bf
xor esi, esi
inc esi
mov dword [esp + 0x120c], esi
cmp dword [esp + 0xd8], ebx
je 0x41f0a7
push str.___openid_authkey
lea ecx, [esp + 0x54]
call fcn.004030bf
mov byte [esp + 0x120c], 2
lea ecx, [esp + 0xc4]
push ecx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0040f28a
add esp, 0xc
mov byte [esp + 0x120c], 3
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0x1b0]
call fcn.00402291
mov byte [esp + 0x120c], 2
push ebx
push esi
lea ecx, [esp + 0x24]
call fcn.0040337f
mov byte [esp + 0x120c], 1
push ebx
push esi
lea ecx, [esp + 0x58]
call fcn.0040337f
cmp dword [edi + 0x1ec], ebx
je 0x41f108
push 0x30
lea eax, [esp + 0x55]
push ebx
push eax
mov byte [esp + 0x5c], bl
call fcn.005b79e0
add esp, 0xc
lea eax, [esp + 0x50]
push 0x31
push eax
call fcn.005edc30
lea eax, [edi + 0x1d8]
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x41f0e2
mov eax, dword [eax + 4]
jmp 0x41f0e5
add eax, 4
push 0x3c
push ebx
push eax
call fcn.005edb60
add esp, 0xc
push 0x31
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x1a0]
push eax
call fcn.005b9d42
add esp, 0xc
mov esi, str.killhackbot
lea edi, [esp + 0x98]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [esp + 0xa4]
stosd dword es:[edi], eax
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x14], ebx
call fcn.005ba54e
pop ecx
lea eax, [esp + 0x48]
push eax
call fcn.005bab4b
pop ecx
mov esi, eax
push 0xa
lea eax, [esp + 0xe4]
push eax
push dword [esi + 4]
call fcn.0060a7be
add esp, 0xc
push 0xa
lea eax, [esp + 0x104]
push eax
mov eax, dword [esi + 4]
inc eax
push eax
call fcn.0060a7be
add esp, 0xc
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0x44]
push str._s_s_s
push eax
call fcn.005bab72
mov eax, dword [esi + 4]
lea eax, [eax + eax + 0x340a]
add esp, 0x14
mov dword [esp + 0x18], eax
xor eax, eax
cmp byte [esp + eax + 0x38], bl
je 0x41f1b3
inc dword [esp + 0x10]
inc eax
cmp eax, 0x14
jl 0x41f1a3
push 0x70
xor esi, esi
pop edi
cmp dword [esp + 0x10], ebx
jbe 0x41f1dd
mov ecx, edi
lea eax, [esp + esi + 0x38]
sar ecx, 8
xor byte [eax], cl
movsx eax, byte [eax]
add eax, edi
imul eax, eax, 0x77
add eax, 0x6f
inc esi
mov edi, eax
cmp esi, dword [esp + 0x10]
jb 0x41f1be
lea eax, [esp + 0x164]
push eax
mov dword [esp + 0x114], 0x686084
call fcn.00416157
mov byte [esp + 0x120c], 4
lea eax, [esp + 0x114]
push eax
xor edi, edi
lea eax, [esp + 0x114]
inc edi
push eax
mov dword [esp + 0x1c], edi
call fcn.0041ad25
mov dword [esp + 0x120c], 5
mov eax, dword [esp + 0x110]
mov eax, dword [eax + 4]
mov dword [esp + eax + method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
lea eax, [esp + 0x114]
push eax
call fcn.0041647b
mov byte [esp + 0x120c], 7
push 2
push str.003254
lea ecx, [esp + 0x11c]
call fcn.004164e9
test eax, eax
jne 0x41f28b
mov eax, dword [esp + 0x110]
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x110]
mov eax, dword [ecx + 8]
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x41f284
or eax, 4
push ebx
push eax
call fcn.004183f7
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x114]
push eax
call fcn.0041b4d4
pop ecx
pop ecx
lea esi, [esp + 0x110]
call fcn.00420452
push 0xa
lea eax, [esp + 0xf4]
push eax
push dword [esp + 0x20]
call fcn.0060a7be
add esp, 0xc
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0x20]
call fcn.004028e2
mov byte [esp + 0x120c], 8
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.00406919
pop ecx
pop ecx
mov byte [esp + 0x120c], 0xa
push ebx
push edi
lea ecx, [esp + 0x24]
call fcn.00403762
cmp dword [esp + 0xc0], 8
mov edx, dword [esp + 0xac]
jae 0x41f319
lea edx, [esp + 0xac]
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1ac], 8
jb 0x41f32d
mov ecx, dword [edi + 0x198]
jmp 0x41f333
lea ecx, [edi + 0x198]
lea eax, [edi + 0x1d0]
push eax
push edx
call fcn.00406ebd
pop ecx
pop ecx
cmp eax, ebx
je 0x41f370
push ebx
push dword [0x6f2e9c]
lea eax, [esp + 0x58]
push eax
call fcn.00411edc
mov byte [esp + 0x120c], 0xb
lea eax, [esp + 0x50]
push eax
mov ecx, edi
call fcn.0041fbed
jmp 0x41f457
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x400
push esi
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [edi + 0x1ac], 8
jb 0x41f3a2
mov eax, dword [edi + 0x198]
jmp 0x41f3a8
lea eax, [edi + 0x198]
push eax
push dword [esp + 0x14]
push esi
push str.ERROR_EXECUTE_PROCESS
call fcn.00402e56
mov esi, eax
call fcn.00405362
push eax
push str._s__code_d__msg_s__runPath_s_
lea eax, [esp + 0x214]
push 0x800
push eax
call fcn.004211b0
add esp, 0x1c
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push dword [0x6f2e9c]
lea eax, [esp + 0x58]
push eax
call fcn.00411edc
mov byte [esp + 0x120c], 0xc
lea eax, [esp + 0x200]
push eax
lea ecx, [esp + 0x20]
call fcn.004030bf
mov byte [esp + 0x120c], 0xd
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x80]
call fcn.00403484
mov byte [esp + 0x120c], 0xc
push ebx
push 1
lea ecx, [esp + 0x24]
call fcn.0040337f
lea eax, [esp + 0x50]
push eax
mov ecx, edi
call fcn.0041fd44
push ebx
push 0x68326c
call fcn.005e4f60
pop ecx
pop ecx
mov byte [esp + 0x120c], 0xa
lea eax, [esp + 0x50]
push eax
call fcn.00411fd4
mov byte [esp + 0x120c], 7
push ebx
push 1
lea ecx, [esp + 0xb0]
call fcn.0040337f
mov byte [esp + 0x120c], 1
lea ecx, [esp + 0x164]
call fcn.0041ab56
lea ecx, [esp + 0x164]
call fcn.00418714
or dword [esp + 0x120c], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0xcc]
call fcn.0040337f
jmp 0x41f543
push ebx
push dword [0x6f2e9c]
lea eax, [esp + 0x58]
push eax
call fcn.00411edc
mov dword [esp + 0x120c], 0xe
push str.RUN_PATH_EMPTY
push ecx
call fcn.00402e56
pop ecx
mov esi, eax
call fcn.00405362
push eax
lea ecx, [esp + 0x20]
call fcn.004030bf
mov byte [esp + 0x120c], 0xf
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x80]
call fcn.00403484
mov byte [esp + 0x120c], 0xe
push ebx
push 1
lea ecx, [esp + 0x24]
call fcn.0040337f
lea eax, [esp + 0x50]
push eax
mov ecx, edi
call fcn.0041fd44
or dword [esp + 0x120c], 0xffffffff
lea eax, [esp + 0x50]
push eax
call fcn.00411fd4
mov ecx, dword [esp + 0x1204]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4