Function at 0x411ff6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x411fff
mov eax, dword [ebp - 4]
add esp, 0xfffffb58
push ebx
push esi
push edi
mov dword [ebp - 0x34], edx
mov esi, eax
mov eax, 0x42cf44
call fcn.00424fbc
mov eax, 0xdac
call fcn.0040a360
push eax
call fcn.00410f14
pop ecx
xor edx, edx
mov eax, esi
call fcn.00407ad8
test al, al
je 0x412082
cmp byte [esi + 0x257b], 0
jne 0x412082
add esp, 0xfffffff8
xor edx, edx
mov eax, esp
call fcn.00401f50
xor edx, edx
mov eax, esi
call fcn.00402fe8
mov eax, 0xdae
call fcn.0040a360
push eax
call fcn.00410f14
pop ecx
xor eax, eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4129d4
mov edx, 0x78
mov eax, esi
call fcn.00407ef4
mov edx, 0x78
mov eax, esi
call fcn.0040856c
cmp byte [esi + 0x18c2], 0x78
jne 0x4120c3
mov cx, word [0x4329f4]
not cx
cmp cx, word [esi + 0x18c0]
jne 0x4120c3
cmp byte [esi + 0x18cc], 0x14
jbe 0x412369
lea eax, [ebp - 0x3c]
xor edx, edx
call fcn.00401f50
lea eax, [ebp - 0x44]
xor edx, edx
call fcn.00401f50
mov ecx, dword [eax]
mov dword [esi + 0x2564], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0x2568], ecx
add esp, 0xfffffff8
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], edx
xor edx, edx
mov eax, esi
call fcn.00402fe8
lea edx, [ebp - 0x20ac]
mov ecx, 0x2000
mov eax, esi
call fcn.00402eb4
mov edi, eax
test edi, edi
je 0x412308
xor ebx, ebx
jmp 0x4122e1
mov eax, edi
sub eax, ebx
cmp eax, 0x1a
jb 0x4122e0
cmp byte [ebp + ebx - 0x20aa], 0x78
jne 0x4122e0
lea edx, [ebp - 0x209a]
push 8
add edx, ebx
push str.Protect_
push edx
call fcn.00424e24
add esp, 0xc
test eax, eax
jne 0x4122e0
xor eax, eax
xor ecx, ecx
mov al, byte [ebp + ebx - 0x20ab]
mov cl, byte [ebp + ebx - 0x20ac]
shl eax, 8
lea edx, [ebp - 0x20aa]
add cx, ax
add edx, ebx
mov word [esi + 0x18c0], cx
mov ecx, 0x18
or eax, 0xffffffff
call fcn.004092e8
not ax
cmp ax, word [esi + 0x18c0]
jne 0x4122e0
mov dl, byte [ebp + ebx - 0x20aa]
xor eax, eax
mov byte [esi + 0x18c2], dl
xor ecx, ecx
mov al, byte [ebp + ebx - 0x20a8]
mov cl, byte [ebp + ebx - 0x20a9]
shl eax, 8
xor edx, edx
add cx, ax
xor eax, eax
mov word [esi + 0x18c4], cx
xor ecx, ecx
mov cl, byte [ebp + ebx - 0x20a6]
mov dl, byte [ebp + ebx - 0x20a7]
shl ecx, 8
add dx, cx
mov word [esi + 0x18c6], dx
xor edx, edx
mov dl, byte [ebp + ebx - 0x20a4]
mov al, byte [ebp + ebx - 0x20a5]
movzx ecx, dx
shl ecx, 8
xor edx, edx
add eax, ecx
mov dl, byte [ebp + ebx - 0x20a3]
xor ecx, ecx
mov cl, byte [ebp + ebx - 0x20a2]
shl edx, 0x10
shl ecx, 0x18
add eax, edx
add eax, ecx
xor edx, edx
mov dword [esi + 0x18c8], eax
xor ecx, ecx
mov al, byte [ebp + ebx - 0x20a1]
mov byte [esi + 0x18cc], al
xor eax, eax
mov dl, byte [ebp + ebx - 0x209f]
mov al, byte [ebp + ebx - 0x20a0]
shl edx, 8
add ax, dx
mov word [esi + 0x18ce], ax
xor eax, eax
mov al, byte [ebp + ebx - 0x209d]
mov cl, byte [ebp + ebx - 0x209e]
movzx edx, ax
shl edx, 8
xor eax, eax
add ecx, edx
mov al, byte [ebp + ebx - 0x209c]
xor edx, edx
mov dl, byte [ebp + ebx - 0x209b]
shl eax, 0x10
shl edx, 0x18
add ecx, eax
add ecx, edx
mov dword [esi + 0x18d0], ecx
push 8
lea ecx, [esi + 0x18d4]
push str.Protect_
push ecx
call fcn.00424b60
add esp, 0xc
add esp, 0xfffffff8
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], edx
add esp, 0xfffffff8
mov eax, esp
mov edx, ebx
call fcn.00401f50
lea eax, [ebp - 0x4c]
call fcn.004022f4
mov edx, dword [ebp - 0x4c]
mov dword [esi + 0x2564], edx
mov edx, dword [ebp - 0x48]
mov dword [esi + 0x2568], edx
jmp 0x4122e9
inc ebx
cmp edi, ebx
ja 0x412124
add esp, 0xfffffff8
mov edx, 0x1fe8
mov eax, esp
call fcn.00401f50
lea edx, [ebp - 0x54]
lea eax, [ebp - 0x3c]
call fcn.00402344
jmp 0x4120e8
add esp, 0xfffffff8
lea ebx, [esi + 0x2564]
mov eax, dword [ebx]
mov dword [esp], eax
mov edx, dword [ebx + 4]
mov dword [esp + 4], edx
add esp, 0xfffffff8
mov eax, esp
xor edx, edx
call fcn.00401f50
call fcn.0040246c
test al, al
je 0x412369
add esp, 0xfffffff8
xor edx, edx
mov eax, esp
call fcn.00401f50
xor edx, edx
mov eax, esi
call fcn.00402fe8
mov eax, 0xdae
call fcn.0040a360
push eax
call fcn.00410f14
pop ecx
xor eax, eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x4129d4
mov eax, 0xdb0
call fcn.0040a360
push eax
call fcn.00410f14
lea eax, [esi + 0x2564]
pop ecx
mov edx, dword [eax]
mov dword [ebp - 0x5c], edx
mov ecx, dword [eax + 4]
lea eax, [esi + 0x2564]
mov dword [ebp - 0x58], ecx
mov edx, dword [eax]
mov dword [ebp - 0x64], edx
mov ecx, dword [eax + 4]
xor eax, eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x68], eax
mov word [ebp - 0x20], 8
movzx edx, word [esi + 0x18ce]
shl edx, 9
lea eax, [ebp - 0xc]
call fcn.00403418
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 0x14
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.00424bd0
add esp, 0xc
add esp, 0xfffffff8
xor edx, edx
mov eax, esp
call fcn.00401f50
xor edx, edx
mov eax, esi
call fcn.00402fe8
jmp 0x4124ae
call fcn.00409258
add esp, 0xfffffff8
mov ecx, dword [ebp - 0x5c]
mov edx, pe_nt_image_headers32
mov dword [esp], ecx
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
add esp, 0xfffffff8
mov eax, esp
call fcn.00401f50
call fcn.004024b4
test al, al
je 0x41244e
mov ebx, dword [ebp - 0x5c]
mov eax, pe_nt_image_headers32
sub eax, ebx
lea edx, [ebp - 0x22ac]
push eax
add edx, ebx
push 0
push edx
call fcn.00424bd0
add esp, 0xc
lea eax, [ebp - 0x70]
xor edx, edx
call fcn.00401f50
mov ecx, dword [eax]
mov dword [ebp - 0x5c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x58], ecx
jmp 0x412466
cmp dword [ebp - 0x5c], 0x200
mov ebx, pe_nt_image_headers32
jae 0x41245f
dec dword [ebp - 0x58]
sub dword [ebp - 0x5c], 0x200
lea edx, [ebp - 0x22ac]
mov ecx, ebx
mov eax, esi
call fcn.00402eb4
mov edx, dword [ebp - 0x68]
shl edx, 9
add edx, dword [ebp - 0xc]
mov word [ebp - 0x20], 0x14
xor eax, eax
mov cl, byte [ebp + eax - 0x22ac]
xor byte [edx + eax], cl
inc eax
cmp eax, 0x200
jl 0x412486
inc dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
movzx edx, word [esi + 0x18ce]
cmp eax, edx
jb 0x4124ae
xor ecx, ecx
mov dword [ebp - 0x68], ecx
add esp, 0xfffffff8
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
mov edx, dword [ebp - 0x58]
mov dword [esp + 4], edx
add esp, 0xfffffff8
mov eax, esp
xor edx, edx
call fcn.00401f50
call fcn.0040248c
test al, al
jne 0x4123ec
add esp, 0xfffffff8
mov ecx, dword [ebp - 0x64]
add esp, 0xfffffff8
add esp, 0xfffffff8
mov dword [esp], ecx
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
add esp, 0xfffffff8
mov edx, dword [esi + 0x18d0]
mov eax, esp
add edx, edx
call fcn.00401f50
lea eax, [esp + 0x10]
call fcn.004022f4
add esp, 0xfffffff8
mov edx, 0x1a
mov eax, esp
call fcn.00401f50
lea eax, [esp + 0x10]
call fcn.004022f4
xor edx, edx
mov eax, esi
call fcn.00402fe8
xor edx, edx
mov dword [ebp - 0x74], edx
mov word [ebp - 0x20], 0x14
jmp 0x41256e
lea edx, [ebp - 0x22ac]
mov ecx, pe_nt_image_headers32
mov eax, esi
call fcn.00402eb4
mov edx, dword [ebp - 0x74]
shl edx, 9
add edx, dword [ebp - 0xc]
mov word [ebp - 0x20], 0x14
xor eax, eax
mov cl, byte [ebp + eax - 0x22ac]
xor byte [edx + eax], cl
inc eax
cmp eax, 0x200
jl 0x412559
inc dword [ebp - 0x74]
movzx eax, word [esi + 0x18ce]
cmp eax, dword [ebp - 0x74]
jg 0x412536
add esp, 0xfffffff8
xor edx, edx
mov eax, esp
call fcn.00401f50
xor edx, edx
mov eax, esi
call fcn.00402fe8
add esp, 0xfffffff8
mov ecx, dword [ebp - 0x64]
mov edx, 0x1a
mov dword [esp], ecx
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
add esp, 0xfffffff8
mov eax, esp
call fcn.00401f50
lea eax, [ebp - 0x7c]
call fcn.004022f4
mov word [ebp - 0x20], 0x14
mov edx, dword [ebp - 0x64]
xor ecx, ecx
mov dword [ebp - 0x5c], edx
xor eax, eax
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x84], eax
xor edx, edx
mov dword [ebp - 0x68], edx
jmp 0x412931
call fcn.00409258
add esp, 0xfffffff8
mov ecx, dword [ebp - 0x5c]
mov edx, pe_nt_image_headers32
mov dword [esp], ecx
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
add esp, 0xfffffff8
mov eax, esp
call fcn.00401f50
call fcn.004024b4
test al, al
je 0x412644
mov ebx, dword [ebp - 0x5c]
mov eax, pe_nt_image_headers32
sub eax, ebx
lea edx, [ebp - 0x22ac]
push eax
add edx, ebx
push 0
push edx
call fcn.00424bd0
add esp, 0xc
lea eax, [ebp - 0x8c]
xor edx, edx
call fcn.00401f50
mov ecx, dword [eax]
mov dword [ebp - 0x5c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x58], ecx
jmp 0x41265c
cmp dword [ebp - 0x5c], 0x200
mov ebx, pe_nt_image_headers32
jae 0x412655
dec dword [ebp - 0x58]
sub dword [ebp - 0x5c], 0x200
lea edx, [ebp - 0x22ac]
mov ecx, ebx
mov eax, esi
call fcn.00402eb4
mov dword [ebp - 0x90], eax
mov word [ebp - 0x20], 0x14
lea edx, [ebp - 0x22ac]
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x34]
call fcn.00402e48
lea edx, [ebp - 0x22ac]
mov ecx, pe_nt_image_headers32
or eax, 0xffffffff
call fcn.004092e8
mov ebx, eax
lea edx, [ebp - 0x98]
mov eax, esi
call fcn.00403040
add esp, 0xfffffff8
mov ecx, dword [ebp - 0x7c]
mov dword [esp], ecx
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], eax
xor edx, edx
mov eax, esi
call fcn.00402fe8
mov eax, esi
call fcn.00403090
mov edi, eax
mov eax, esi
and edi, 0xff
call fcn.00403090
xor edx, edx
mov dl, al
shl edx, 8
add di, dx
add esp, 0xfffffff8
mov word [ebp - 0x9a], di
mov eax, esp
mov edx, 2
call fcn.00401f50
lea edx, [ebp - 0xa4]
lea eax, [ebp - 0x7c]
call fcn.00402344
add esp, 0xfffffff8
mov ecx, dword [ebp - 0x98]
mov dword [esp], ecx
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
xor edx, edx
mov eax, esi
call fcn.00402fe8
cmp bx, word [ebp - 0x9a]
je 0x412918
mov edx, dword [ebp - 0x80]
inc edx
shl edx, 9
push edx
mov ecx, dword [ebp - 0x80]
shl ecx, 9
push ecx
push dword [ebp - 0x80]
mov eax, 0xdb2
call fcn.0040a360
push eax
call fcn.00410f14
add esp, 0x10
push pe_nt_image_headers32
lea edx, [ebp - 0x22ac]
push edx
lea ecx, [ebp - 0x24ac]
push ecx
call fcn.00424b60
add esp, 0xc
mov eax, dword [ebp - 0x68]
shl eax, 9
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa9], 0
xor eax, eax
mov edx, dword [ebp - 0xa8]
mov cl, byte [edx + eax]
xor byte [ebp + eax - 0x22ac], cl
inc eax
cmp eax, 0x200
jl 0x41278e
lea edx, [ebp - 0x22ac]
mov ecx, pe_nt_image_headers32
or eax, 0xffffffff
call fcn.004092e8
mov ebx, eax
cmp bx, word [ebp - 0x9a]
jne 0x4127d0
mov byte [ebp - 0xa9], 1
jmp 0x41289e
push pe_nt_image_headers32
lea eax, [ebp - 0x24ac]
push eax
lea edx, [ebp - 0x22ac]
push edx
call fcn.00424b60
add esp, 0xc
mov word [ebp - 0x20], 0x14
xor edi, edi
mov eax, dword [ebp - 0xa8]
mov ecx, pe_nt_image_headers32
mov dl, byte [eax + edi]
xor byte [ebp + edi - 0x22ac], dl
lea edx, [ebp - 0x22ac]
or eax, 0xffffffff
call fcn.004092e8
mov ebx, eax
cmp bx, word [ebp - 0x9a]
jne 0x41282a
mov byte [ebp - 0xa9], 1
jmp 0x412833
inc edi
cmp edi, 0x200
jl 0x4127f3
cmp byte [ebp - 0xa9], 0
jne 0x41289e
push pe_nt_image_headers32
lea eax, [ebp - 0x24ac]
push eax
lea edx, [ebp - 0x22ac]
push edx
call fcn.00424b60
add esp, 0xc
mov word [ebp - 0x20], 0x14
mov edi, 0x1ff
mov eax, dword [ebp - 0xa8]
mov ecx, pe_nt_image_headers32
mov dl, byte [eax + edi]
xor byte [ebp + edi - 0x22ac], dl
lea edx, [ebp - 0x22ac]
or eax, 0xffffffff
call fcn.004092e8
mov ebx, eax
cmp bx, word [ebp - 0x9a]
jne 0x412899
mov byte [ebp - 0xa9], 1
jmp 0x41289e
dec edi
test edi, edi
jge 0x412862
cmp byte [ebp - 0xa9], 0
je 0x412901
add esp, 0xfffffff8
mov eax, dword [ebp - 0x34]
add esp, 0xfffffff8
mov edx, esp
call fcn.00403040
add esp, 0xfffffff8
mov edx, dword [ebp - 0x90]
mov eax, esp
call fcn.00401f50
lea eax, [esp + 0x10]
call fcn.0040231c
xor edx, edx
mov eax, dword [ebp - 0x34]
call fcn.00402fe8
lea edx, [ebp - 0x22ac]
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x34]
call fcn.00402e48
mov eax, 0xdb4
call fcn.0040a360
push eax
call fcn.00410f14
pop ecx
jmp 0x412918
mov eax, 0xdb6
call fcn.0040a360
push eax
call fcn.00410f14
pop ecx
inc dword [ebp - 0x84]
inc dword [ebp - 0x80]
inc dword [ebp - 0x68]
mov edx, dword [ebp - 0x68]
movzx ecx, word [esi + 0x18ce]
cmp edx, ecx
jb 0x412931
xor eax, eax
mov dword [ebp - 0x68], eax
add esp, 0xfffffff8
mov edx, dword [ebp - 0x5c]
mov dword [esp], edx
mov ecx, dword [ebp - 0x58]
mov dword [esp + 4], ecx
add esp, 0xfffffff8
mov eax, esp
xor edx, edx
call fcn.00401f50
call fcn.0040248c
test al, al
jne 0x4125df
add esp, 0xfffffff8
mov ecx, dword [ebp - 0x64]
mov dword [esp], ecx
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
xor edx, edx
mov eax, esi
call fcn.00402fe8
add esp, 0xfffffff8
mov eax, esp
xor ecx, ecx
mov edx, 0x80000000
call fcn.00401f80
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.004032f0
add esp, 0xfffffff8
xor edx, edx
mov eax, esp
call fcn.00401f50
xor edx, edx
mov eax, esi
call fcn.00402fe8
cmp dword [ebp - 0x84], 0
je 0x4129b3
mov eax, 1
jmp 0x4129b8
mov eax, 2
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004013a0
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret