Function at 0x407088
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc8
xor eax, eax
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov dword [ecx], reloc.ADVAPI32.DLL_DeregisterEventSource
inc eax
add ecx, 4
cmp eax, 0x10
jl 0x40709f
mov eax, 0x10
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ecx], reloc.ADVAPI32.DLL_DeregisterEventSource
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x4070b9
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 1]
mov al, byte [edx]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 2]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 3]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 4]
mov cl, byte [edx + 5]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 6]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 7]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 8]
mov cl, byte [edx + 9]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0xa]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0xb]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0xc]
mov cl, byte [edx + 0xd]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0xe]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0xf]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x10]
mov cl, byte [edx + 0x11]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x12]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x13]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x14]
mov cl, byte [edx + 0x15]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x16]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x17]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x18]
mov cl, byte [edx + 0x19]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x1a]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x1b]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x1c]
mov cl, byte [edx + 0x1d]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x1e]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x1f]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x20]
mov cl, byte [edx + 0x21]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x22]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x23]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x24]
mov cl, byte [edx + 0x25]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x26]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x27]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x28]
mov cl, byte [edx + 0x29]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x2a]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x2b]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x2c]
mov cl, byte [edx + 0x2d]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x2e]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x2f]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x30]
mov cl, byte [edx + 0x31]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x32]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x33]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x34]
mov cl, byte [edx + 0x35]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x36]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x37]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x38]
mov cl, byte [edx + 0x39]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x3a]
shl ecx, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x3b]
or eax, ecx
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, eax
mov al, byte [edx + 0x3c]
mov cl, byte [edx + 0x3d]
shl ecx, 0x10
shl eax, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 0x3e]
movzx edx, byte [edx + 0x3f]
shl ecx, 8
or eax, ecx
or eax, edx
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ebp - 0xfc], eax
mov eax, 0x10
mov ebx, dword [edx + 0x34]
mov ecx, dword [edx]
mov esi, ebx
inc eax
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
xor ecx, dword [edx + 0x1c]
shl esi, 0xf
shr ebx, 0x11
or esi, ebx
mov ebx, esi
xor ecx, ebx
mov ebx, ecx
mov esi, ecx
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
shl ebx, 0xf
shr esi, 0x11
or ebx, esi
mov esi, ecx
xor ebx, ecx
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
shl esi, 0x17
shr ecx, 9
or esi, ecx
xor ebx, esi
mov ecx, ebx
mov ebx, dword [edx + 0xc]
mov esi, ebx
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
shl esi, 7
shr ebx, 0x19
or esi, ebx
xor esi, dword [edx + 0x28]
mov ebx, esi
xor ecx, ebx
mov dword [edx + 0x40], ecx
add edx, 4
cmp eax, 0x44
jl 0x407361
xor eax, eax
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ebp - 0x24], edx
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
mov edx, dword [ebp - 0x20]
xor ecx, dword [edx + 0x10]
mov edx, dword [ebp - 0x24]
mov dword [edx], ecx
inc eax
add dword [ebp - 0x24], 4
add dword [ebp - 0x20], 4
cmp eax, 0x40
jl 0x4073d3
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
xor eax, eax
mov dword [ebp - 0x1c], ecx
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ebp - 0x20], ecx
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ebp - 0x24], ecx
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ebp - 0x28], ecx
mov ebx, dword [ebp - 0x28]
mov ecx, eax
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebx]
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov esi, dword [esi]
shl ebx, cl
mov ecx, 0x20
mov edi, dword [edi]
sub ecx, eax
shr esi, cl
or ebx, esi
mov ecx, edx
and ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov esi, edx
shr esi, 0x14
shl ecx, 0xc
or ecx, esi
mov esi, dword [ebp - 0x28]
add ecx, dword [ebp - 0x10]
add ebx, ecx
mov esi, dword [esi]
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
mov ecx, eax
shl esi, cl
mov ecx, 0x20
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
sub ecx, eax
inc eax
shr edi, cl
or esi, edi
mov ecx, edx
and ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov edi, edx
shr edi, 0x14
shl ecx, 0xc
or ecx, edi
add ecx, dword [ebp - 0x10]
add esi, ecx
shr esi, 0x19
shl ebx, 7
or ebx, esi
mov esi, edx
mov ecx, ebx
mov ebx, edx
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
shl ebx, 0xc
shr esi, 0x14
or ebx, esi
mov esi, dword [ebp - 4]
xor esi, edx
xor ebx, ecx
xor esi, dword [ebp - 8]
add esi, dword [ebp - 0xc]
add ebx, esi
mov esi, dword [ebp - 0x24]
add ebx, dword [esi]
mov esi, dword [ebp - 0x10]
xor esi, dword [ebp - 0x14]
xor esi, dword [ebp - 0x18]
add esi, dword [ebp - 0x1c]
add ecx, esi
mov esi, dword [ebp - 0x20]
add ecx, dword [esi]
mov esi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 4]
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
shr edi, 0x17
shl esi, 9
or esi, edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], edx
mov edx, ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
shl ebx, 0x13
shr esi, 0xd
or ebx, esi
mov esi, ecx
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
mov ebx, ecx
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
shl ebx, 9
shr esi, 0x17
or ebx, esi
mov esi, ecx
xor ebx, ecx
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
shr ecx, 0xf
shl esi, 0x11
or esi, ecx
xor ebx, esi
mov dword [ebp - 0x10], ebx
add dword [ebp - 0x20], 4
add dword [ebp - 0x24], 4
add dword [ebp - 0x28], 4
cmp eax, 0x10
jl 0x407453
mov eax, 0x10
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x28], ecx
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ebp - 0x24], ecx
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp - 0x20]
mov ecx, eax
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebx]
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov esi, dword [esi]
shl ebx, cl
mov ecx, 0x20
mov edi, dword [edi]
sub ecx, eax
shr esi, cl
or ebx, esi
mov ecx, edx
and ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov esi, edx
shr esi, 0x14
shl ecx, 0xc
or ecx, esi
mov esi, dword [ebp - 0x20]
add ecx, dword [ebp - 0x10]
add ebx, ecx
mov esi, dword [esi]
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
mov ecx, eax
shl esi, cl
mov ecx, 0x20
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
sub ecx, eax
inc eax
shr edi, cl
or esi, edi
mov ecx, edx
and ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov edi, edx
shr edi, 0x14
shl ecx, 0xc
or ecx, edi
mov edi, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
and edi, edx
add esi, ecx
shr esi, 0x19
shl ebx, 7
or ebx, esi
mov esi, edx
mov ecx, ebx
mov ebx, edx
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
shl ebx, 0xc
shr esi, 0x14
or ebx, esi
mov esi, dword [ebp - 4]
and esi, edx
xor ebx, ecx
or esi, edi
mov edi, dword [ebp - 4]
and edi, dword [ebp - 8]
or esi, edi
mov edi, dword [ebp - 0x10]
add esi, dword [ebp - 0xc]
add ebx, esi
mov esi, dword [ebp - 0x24]
not edi
add ebx, dword [esi]
and edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
and esi, dword [ebp - 0x14]
or esi, edi
add esi, dword [ebp - 0x1c]
add ecx, esi
mov esi, dword [ebp - 0x28]
add ecx, dword [esi]
mov esi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 4]
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
shr edi, 0x17
shl esi, 9
or esi, edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], edx
mov edx, ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
shl ebx, 0x13
shr esi, 0xd
or ebx, esi
mov esi, ecx
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
mov ebx, ecx
and ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
shl ebx, 9
shr esi, 0x17
or ebx, esi
mov esi, ecx
xor ebx, ecx
and esi, reloc.ADVAPI32.DLL_DeregisterEventSource
shr ecx, 0xf
shl esi, 0x11
or esi, ecx
xor ebx, esi
mov dword [ebp - 0x10], ebx
add dword [ebp - 0x28], 4
add dword [ebp - 0x24], 4
add dword [ebp - 0x20], 4
cmp eax, 0x40
jl 0x40758e
mov eax, dword [ebp + 8]
xor dword [eax + 8], edx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor dword [edx + 0xc], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
xor dword [eax + 0x10], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
xor dword [ecx + 0x14], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor dword [edx + 0x18], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
xor dword [eax + 0x1c], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
xor dword [ecx + 0x20], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
xor dword [edx + 0x24], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret