Function at 0x40497c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push edi
lea edi, [eax - 0x3ea1]
xor edx, 0x68b
lea ebx, [eax - 0x97c]
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x14]
mov ecx, edi
xor ecx, 0x3b66
mov dword [esp + 0xc], ebx
add eax, 0xfffff854
cmp eax, ecx
jge 0x404c07
mov eax, ebx
xor eax, 0xe09
cmp edx, eax
je 0x404c07
xor edx, 0x4a
push ebp
push esi
cmp edi, edx
jg 0x404ba6
mov ecx, dword [0x517e7c]
mov esi, dword [esp + 0x24]
mov eax, dword [ecx + 0xd8]
cmp eax, dword [esi + 0xac]
ja 0x4049f9
mov dword [esi + 0xb4], section..data
jmp 0x404a08
mov eax, dword [esi + 0xf4]
add eax, dword [esi + 0x20]
add dword [ecx + 0x90], eax
xor ebx, ebx
mov ebp, ebx
mov eax, dword [esi + 0xb4]
mov ecx, dword [eax + ebp]
add ebp, 4
mov eax, dword [esi + 0x20]
inc eax
imul eax, dword [esi + 0x118]
mov dword [esi + 0x118], eax
mov edx, dword [0x52aa20]
imul edx, ecx
mov ecx, dword [0x517e7c]
mov eax, dword [ecx + 0x118]
sub eax, 0x160c63
imul eax, dword [ecx + 0xc4]
mov dword [ecx + 0xc4], eax
mov ecx, dword [esi + 0x84]
mov eax, dword [esi + 0xb8]
mov byte [ecx + eax], dl
inc dword [esi + 0x84]
mov ecx, dword [0x517e7c]
mov eax, dword [ecx + 0x1c]
sub eax, 0x12
xor dword [0x52aa64], eax
mov eax, dword [ecx + 0x44]
xor eax, dword [0x52aab4]
xor eax, 0x13ffd7
or dword [esi + 0x5c], eax
mov eax, dword [0x52aa4c]
xor eax, 0x48
or dword [esi + 0x7c], eax
mov ecx, dword [0x517e7c]
mov eax, dword [0x52aa94]
add eax, 0x194c18
or dword [ecx + 8], eax
mov eax, 0xfff09a7f
sub eax, dword [esi + 0x68]
add dword [esi + 0x124], eax
mov ecx, dword [0x517e7c]
mov eax, dword [esi + 0x110]
xor eax, 0x30
add dword [ecx + 0xd8], eax
cmp ebp, 0x29910
jl 0x404a0c
mov dword [esi + 0x100], 0x52a9a0
mov eax, dword [0x52aaac]
sub dword [esi + 0x44], eax
mov eax, dword [0x517e7c]
push 0x12
mov eax, dword [eax + 0x98]
add eax, 0x190e11
xor dword [esi + 0x1c], eax
mov eax, dword [0x517e7c]
mov ecx, dword [eax + 0x20]
xor ecx, dword [esi + 0x1c]
pop eax
sub eax, ecx
mov ecx, dword [esi + 0xcc]
add dword [esi + 0xdc], eax
mov eax, dword [0x52aa80]
inc eax
imul eax, dword [esi + 0x124]
mov dword [esi + 0x124], eax
mov eax, dword [esi + 0xa4]
xor dword [ecx + ebx], eax
add ebx, 4
mov eax, dword [esi + 0x1c]
xor eax, dword [esi + 0x7c]
xor eax, 0x18c92d
or dword [esi + 0x90], eax
mov eax, dword [0x52aa1c]
add eax, 0xffe736c2
imul eax, dword [esi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [0x52aa70]
add dword [0x52aa44], eax
cmp ebx, 0x7cb8c
jl 0x404adf
mov eax, dword [esi + 0xcc]
mov dword [esi + 0xb0], eax
mov eax, dword [0x517e7c]
push dword [eax + 0x134]
mov eax, dword [eax + 0x11c]
add eax, dword [esi + 0xb8]
push eax
push dword [esi + 0x100]
call dword [0x52aa50]
mov dword [esi + 0xf0], eax
jmp 0x404c05
mov ebx, dword [esp + 0x24]
mov eax, dword [ebx + 0x24]
mov esi, dword [ebx + 0xe8]
neg eax
cmp esi, eax
jne 0x404c05
mov eax, dword [esp + 0x20]
mov ebp, edi
add eax, 0xffffc4d4
or ebp, 0x40b1
add eax, dword [esp + 0x14]
mov edi, eax
mov eax, dword [0x517e7c]
push ebp
mov eax, dword [eax + 0x9c]
or eax, 0x3a61
imul eax, eax, 0x3ea1
push eax
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
push edi
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov ecx, dword [ebx + 0x24]
add esi, 4
neg ecx
cmp esi, ecx
je 0x404bd0
mov edi, dword [esp + 0x18]
pop esi
pop ebp
xor edi, 0x39a7
mov eax, edi
pop edi
pop ebx
ret