Function at 0x48faec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405af0
xor eax, eax
push ebp
push 0x48fee4
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKBCodePage
mov dl, 1
mov eax, dword [0x4232d0]
call fcn.00403bcc
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetCurrentThread
push ecx
inc ecx
and ecx, 0x187
dec ecx
nop
nop
nop
nop
nop
sub ecx, 0x173
mov ecx, 0xd1
or ecx, 0xd5
inc ecx
inc ecx
or ecx, 0xe4
pop ecx
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
call sub.user32.dll_GetKBCodePage
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004284ec
push 0x48fef8
call sub.kernel32.dll_GlobalAddAtomW
push edi
push ebx
dec ebx
push edi
pop edi
and edi, 0xf
add ebx, 0x11b
add edi, 0x16
xor edi, 0xe6
sub edi, 0x41
nop
nop
nop
nop
xchg edi, ebx
xor ebx, 0x58
xor ebx, 0x194
add edi, 0x5f
add edi, 0x131
and ebx, 0x157
pop ebx
pop edi
push 0
push 0
mov eax, dword [ebx]
call fcn.004284ec
push ecx
xchg ecx, ecx
sub ecx, 0x14c
and ecx, 0x19a
xchg ecx, ecx
mov ecx, 0xa7
nop
nop
nop
nop
push ecx
pop ecx
xchg ecx, ecx
dec ecx
dec ecx
and ecx, 0xfa
pop ecx
call sub.user32.dll_GetActiveWindow
mov ecx, dword [ebx]
mov dl, 1
mov eax, dword [0x4871ec]
call fcn.00487590
mov dword [ebp - 0xc], eax
push 1
call sub.kernel32.dll_InitAtomTable
push ebx
push eax
nop
add ebx, 0x90
nop
nop
nop
push eax
pop eax
sub ebx, 0x123
nop
nop
push ebx
pop ebx
xor ebx, 0xfd
dec eax
pop eax
pop ebx
xor eax, eax
push ebp
push 0x48fde8
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_InitAtomTable
push ebx
push eax
nop
add ebx, 0x90
nop
nop
nop
push eax
pop eax
sub ebx, 0x123
nop
nop
push ebx
pop ebx
xor ebx, 0xfd
dec eax
pop eax
pop ebx
lea edx, [ebp - 0x40c]
mov ecx, 0x400
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
push edx
push ecx
add edx, 0xb9
or ecx, 0x16e
add ecx, 0x126
pop ecx
pop edx
test ebx, ebx
jle 0x48fd96
push 1
call sub.gdi32.dll_DeleteObject
lea edx, [ebp - 0x40c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.00428758
push 1
call sub.kernel32.dll_InitAtomTable
push edi
push ecx
push edi
pop edi
sub ecx, 0x140
nop
nop
mov ecx, 0x32
xor edi, 0x12d
or ecx, 0x178
xchg ecx, ecx
and ecx, 0xa
xchg edi, ecx
push ecx
pop ecx
add ecx, 0xe5
or edi, 0xcc
pop ecx
pop edi
push ebx
push eax
nop
add ebx, 0x90
nop
nop
nop
push eax
pop eax
sub ebx, 0x123
nop
nop
push ebx
pop ebx
xor ebx, 0xfd
dec eax
pop eax
pop ebx
lea edx, [ebp - 0x40c]
mov ecx, 0x400
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
push edx
push ecx
add edx, 0xb9
or ecx, 0x16e
add ecx, 0x126
pop ecx
pop edx
push 0x48ff18
call sub.kernel32.dll_GlobalAddAtomW
push 1
call sub.kernel32.dll_InitAtomTable
push edi
push ecx
push edi
pop edi
sub ecx, 0x140
nop
nop
mov ecx, 0x32
xor edi, 0x12d
or ecx, 0x178
xchg ecx, ecx
and ecx, 0xa
xchg edi, ecx
push ecx
pop ecx
add ecx, 0xe5
or edi, 0xcc
pop ecx
pop edi
push ebx
push eax
nop
add ebx, 0x90
nop
nop
nop
push eax
pop eax
sub ebx, 0x123
nop
nop
push ebx
pop ebx
xor ebx, 0xfd
dec eax
pop eax
pop ebx
test ebx, ebx
jg 0x48fc8a
push 0x48ff6c
call sub.kernel32.dll_GlobalAddAtomW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fdef
push 0x48ffb0
call sub.kernel32.dll_GlobalAddAtomW
mov eax, dword [ebp - 0xc]
call fcn.00403bfc
push 1
call sub.kernel32.dll_InitAtomTable
push ebx
push eax
nop
add ebx, 0x90
nop
nop
nop
push eax
pop eax
sub ebx, 0x123
nop
nop
push ebx
pop ebx
xor ebx, 0xfd
dec eax
pop eax
pop ebx
ret