Function at 0x40117a
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
push ebx
xor esi, esi
call dword [0x475488]
cmp word [ebx], si
je 0x4011c1
mov edx, ebx
push ebp
xor eax, eax
cmp word [edi], ax
je 0x4011b3
mov ecx, edi
lea esp, [esp]
mov ebp, esi
imul ebp, eax
add bp, word [ecx + 2]
add eax, 1
xor word [edx], bp
cmp word [edi + eax*2], 0
lea ecx, [edi + eax*2]
jne 0x40119a
add esi, 1
cmp word [ebx + esi*2], 0
lea edx, [ebx + esi*2]
jne 0x40118d
pop ebp
pop esi
ret

Function at 0x43121d
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x7a
mov ebx, 0xae7e00f8
aaa
mov ecx, 0xeb7e9e62
salc
sbb ch, bh
call 0x501ae0d1
into
xlatb
dec edi
jge 0x4311f7
movsb byte es:[edi], byte [esi]
mov dh, byte [ebp + 0x23]
add al, 0x65
xor al, 0xb4
insd dword es:[edi], dx
xor dword [edx - 0x2d79962b], edi
out 0xc, eax
push ebx
ficomp dword [esi - 0x6d27dfbc]
pop ss
jnp 0x431209
retf 0x7b9a

Function at 0x432855
Capabilities:
Encode data using xor

Disassembly:
fistp word [edx + 0x2c]
mov edx, dword [eax + 0x703a8c86]
aad 0xca
sahf

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd6c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd6c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x657620
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x485be8
Capabilities:
Encode data using xor

Disassembly:
and byte [esi], bl
inc edx
pop ecx
dec edx
sub dh, byte [bx - 0x35]
xor al, byte [edi + ebx*8 - 0x7d95ecc5]
cdq
loope 0x485c41
fsubr dword [esi + 0x75890ef1]
or eax, 0xb2b37173
jle 0x485c65
xor eax, 0xab280b6a
in al, 0xd2
lcall 0xeae6, 0x639470d7
add eax, 0x8e32e5c2
or byte [edi - 0x44], 0x9b
xor cl, byte [esi - 0x6443b07e]
fldcw word [ecx + 0x12]
sub byte [ecx + 0x58], ah
add al, 0x20
fmul qword [edx + ebx*2 - 0x1d0e82e6]
cmp dword [edi - 0x37], edx
mov bh, 0xd8
push 0xddfa3ee
je 0x485c19
pop ds
mov bl, 0x4a
xor ah, byte [ebp + 0x4c]
sub dword [edx + edi*8 - 0x13], 0xffffffa4
insb byte es:[edi], dx
cli
in eax, dx
movsb byte es:[edi], byte [esi]
cld
mov ebx, 0xe457c33
stosd dword es:[edi], eax
jmp 0xdb80c463
invalid

Function at 0x4b103a
Capabilities:
Encode data using xor

Disassembly:
or al, dh
jmp dword [edx]
out 0xb1, al
dec ebx
fistp qword [ebp - 0x2d661c4c]
leave
jecxz 0x4b0fdb
ror cl, cl
pop es
adc eax, 0xd6834f05
jne 0x4b1040
invalid

Function at 0x4e0f6a
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
push ebx
xor esi, esi
call dword [0x475488]
cmp word [ebx], si
je 0x4e0fb1
mov edx, ebx
push ebp
xor eax, eax
cmp word [edi], ax
je 0x4e0fa3
mov ecx, edi
lea esp, [esp]
mov ebp, esi
imul ebp, eax
add bp, word [ecx + 2]
add eax, 1
xor word [edx], bp
cmp word [edi + eax*2], 0
lea ecx, [edi + eax*2]
jne 0x4e0f8a
add esi, 1
cmp word [ebx + esi*2], 0
lea edx, [ebx + esi*2]
jne 0x4e0f7d
pop ebp
pop esi
ret