Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
shr ecx, 5
lea eax, [ecx - 4]
mov dword [ebp - 4], esi
cmp eax, 0xa
ja 0x40137e
push ebx
xor eax, eax
push edi
test ecx, ecx
je 0x401043
mov edx, dword [ebp + 8]
sub edx, 0x4afa6c
lea ecx, [ecx]
mov edi, dword [edx + eax*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [eax*4 + 0x4afa6c], edi
inc eax
cmp eax, ecx
jb 0x401030
lea eax, [ecx + 1]
mov dword [ecx*4 + 0x4afa6c], ecx
cmp eax, 0xf
jae 0x401064
mov ecx, 0xf
lea edi, reloc.NETAPI32.dll_NetApiBufferFree
sub ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
xor eax, eax
add esi, 8
mov dword [ebp + 0xc], eax
xor ecx, ecx
mov edi, edi
add eax, 8
xor edx, edx
jmp 0x401080
mov edi, dword [edx + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov ebx, dword [edx + reloc.NETAPI32.dll_NetApiBufferFree]
xor edi, dword [ebx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
lea ebx, [eax - 8]
rol edi, 3
xor edi, ebx
xor dword [edx + 0x4afa6c], edi
mov edi, dword [edx + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov ebx, dword [edx + reloc.NETAPI32.dll_NetApiBufferFree]
xor edi, dword [ebx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
lea ebx, [eax - 4]
rol edi, 3
xor edi, ebx
xor dword [edx + 0x4afa70], edi
mov edi, dword [ecx + eax + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov ebx, dword [ecx + eax + reloc.NETAPI32.dll_NetApiBufferFree]
xor edi, dword [ebx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov ebx, dword [ecx + eax + reloc.NETAPI32.dll_NetApiBufferFree]
rol edi, 3
xor edi, dword [ecx + eax + reloc.NETAPI32.dll_NetApiBufferFree]
add edx, 0x14
xor edi, eax
mov dword [ecx + eax + 0x4afa6c], edi
mov edi, dword [ecx + eax + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
xor edi, dword [ebx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
lea ebx, [eax + 4]
rol edi, 3
xor edi, ebx
xor dword [ecx + eax + 0x4afa70], edi
mov edi, dword [ecx + eax + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov ebx, dword [ecx + eax + reloc.NETAPI32.dll_NetApiBufferFree]
xor edi, dword [ebx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
lea ebx, [eax + 8]
rol edi, 3
xor edi, ebx
xor dword [ecx + eax + 0x4afa74], edi
add eax, 0x14
cmp edx, 0x3c
jb 0x401080
mov edx, 4
lea esp, [esp]
xor eax, eax
mov edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
and edi, 0x1ff
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
add edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
add eax, 0x14
rol edi, 9
mov dword [eax + 0x4afa58], edi
mov edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
and edi, 0x1ff
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
add edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
rol edi, 9
mov dword [eax + 0x4afa5c], edi
mov edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
and edi, 0x1ff
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
add edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
rol edi, 9
mov dword [eax + 0x4afa60], edi
mov edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
and edi, 0x1ff
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
add edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
rol edi, 9
mov dword [eax + 0x4afa64], edi
mov edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
and edi, 0x1ff
mov edi, dword [edi*4 + reloc.NETAPI32.dll_NetApiBufferFree]
add edi, dword [eax + reloc.NETAPI32.dll_NetApiBufferFree]
rol edi, 9
mov dword [eax + 0x4afa68], edi
cmp eax, 0x3c
jb 0x401172
dec edx
jne 0x401170
mov edx, dword [0x4af3cc]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi - 4], eax
mov edx, dword [0x4af3d0]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi], eax
mov edx, dword [0x4af3d4]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 4], eax
mov edx, dword [0x4af3d8]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 8], eax
mov edx, dword [0x4af3dc]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 0xc], eax
mov edx, dword [0x4af3e0]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 0x10], eax
mov edx, dword [0x4af3e4]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 0x14], eax
mov edx, dword [0x4af3e8]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 0x18], eax
mov edx, dword [reloc.NETAPI32.dll_NetWkstaTransportEnum]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 0x1c], eax
mov edx, dword [0x4af3f0]
mov eax, dword [edx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
inc eax
dec ecx
add esi, 0x28
mov dword [ebp + 0xc], eax
cmp eax, 4
jb 0x401070
mov esi, dword [ebp - 4]
add esi, 0x18
mov dword [ebp + 0xc], 0x10
mov ecx, dword [esi]
mov edx, ecx
or edx, 3
mov eax, edx
shr eax, 1
mov edi, edx
not edi
xor eax, edi
and eax, 0x7fffffff
mov edi, eax
shr edi, 2
mov ebx, eax
shr ebx, 1
and edi, ebx
and eax, edi
mov edi, eax
mov ebx, eax
shr edi, 6
shr ebx, 3
and edi, ebx
and eax, edi
je 0x401372
add eax, eax
lea edi, [eax + eax]
or eax, edi
and ecx, 3
lea edi, [eax*4]
or eax, edi
mov edi, dword [ecx*4 + reloc.NETAPI32.dll_NetApiBufferFree]
mov cl, byte [esi - 4]
rol edi, cl
mov ecx, eax
shl ecx, 4
or ecx, eax
and edi, ecx
and edi, 0xfffffffc
xor edx, edi
mov dword [esi], edx
add esi, 8
dec dword [ebp + 0xc]
jne 0x401312
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8