Function at 0x416b1a
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
push ebp
push 0x416e04
push dword fs:[0]
mov dword fs:[0], esp
mov ebx, dword [ebp + 8]
add ebx, dword [ebx + 0x3c]
shl eax, 0x1f
shl eax, 1
push eax
push 0x3406b0c7
xor dword [esp], 0x5ff7fdcb
push 0x1e94b7ad
xor dword [esp], 0x1e9493cf
call sub.gdi32.dll_SetArcDirection
pop eax
push eax
push dword [ebx + 0x50]
push eax
push 0x8000040
push eax
push 0xb65b7a88
xor dword [esp], 0x49a48577
push 0
pop eax
xor eax, dword [0x419010]
call eax
test eax, eax
je 0x416e54
push eax
pop dword [ebp - 4]
lea eax, [0]
push eax
push 0x51739b3d
ror dword [esp], 0x1e
push 0x6846ad08
ror dword [esp], 0x1a
push 0x775c0001
rol dword [esp], 0xe
call sub.gdi32.dll_CreateCompatibleBitmap
pop eax
push eax
push eax
push eax
push 0xf001f
push dword [ebp - 4]
mov eax, dword [0x419014]
call eax
cmp eax, 0
je 0x416e38
mov dword [ebp - 8], 0
or dword [ebp - 8], eax
cld
push dword [ebp + 8]
pop esi
and edi, 0
add edi, dword [ebp - 8]
push 0
pop ecx
add ecx, dword [ebx + 0x54]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
movzx edx, word [ebx + 6]
mov eax, ebx
add eax, 0xf8
imul ecx, ecx, 0
xor ecx, dword [eax + 0x10]
imul esi, esi, 0
add esi, dword [eax + 0x14]
shl edi, 0x1f
shl edi, 1
or edi, dword [eax + 0xc]
add esi, dword [ebp + 8]
add edi, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
add eax, 0x28
dec edx
jne 0x416c02
cmp dword [ebx + 0xa0], 0
je 0x416cbc
shr eax, 0x1f
shr eax, 1
or eax, dword [ebx + 0xa0]
add eax, dword [ebp - 8]
mov ecx, dword [ebx + 0xa4]
or ecx, ecx
je 0x416cbc
sub ecx, dword [eax + 4]
push ecx
shl edx, 0x1f
shl edx, 1
or edx, dword [ebp + 0xc]
sub edx, dword [ebx + 0x34]
push edx
push 0
pop edx
xor edx, eax
add edx, 8
push edx
shr edx, 0x1f
shr edx, 1
or edx, dword [eax + 4]
sub edx, 8
shr edx, 1
push edx
xor edx, edx
add edx, dword [eax]
add edx, dword [ebp - 8]
push edx
push eax
push 0
push 0x76935a81
rol dword [esp], 4
push 0xcad2af29
sub dword [esp], 0xb95fe9d5
push 0x284673b
xor dword [esp], 0x27deb3d7
push 0x3d3c216f
rol dword [esp], 8
call sub.gdi32.dll_CreateBitmap
pop eax
push dword [0x419028]
pop eax
call eax
pop ecx
test eax, eax
jne 0x416c45
cmp dword [ebx + 0x80], 0
je 0x416d87
shr edi, 0x1f
shr edi, 1
add edi, dword [ebx + 0x80]
add edi, dword [ebp - 8]
cmp dword [edi + 0x10], 0
je 0x416d87
push dword [edi + 0xc]
pop eax
add eax, dword [ebp - 8]
push eax
push 0xac700001
ror dword [esp], 0x14
call sub.gdi32.dll_GetTextColor
pop eax
push eax
push dword [0x419018]
pop eax
call eax
test eax, eax
je 0x416e0c
mov dword [ebp - 0x4c], 0
add dword [ebp - 0x4c], eax
push edi
and eax, 0
xor eax, dword [edi]
test eax, eax
je 0x416d23
push dword [edi]
pop esi
jmp 0x416d26
mov esi, dword [edi + 0x10]
add esi, dword [ebp - 8]
push dword [edi + 0x10]
pop edi
add edi, dword [ebp - 8]
cmp dword [edi], 0
je 0x416d78
lodsd eax, dword [esi]
test eax, 0x80000000
jne 0x416d46
add eax, dword [ebp - 8]
inc eax
sub eax, 0xffffffff
jmp 0x416d4b
and eax, 0x7fffffff
push eax
push 0x141d38d3
rol dword [esp], 0x16
push 0xf3077c00
sub dword [esp], 0xf30734b8
call sub.gdi32.dll_SetSystemPaletteUse
pop eax
push eax
push dword [ebp - 0x4c]
sub eax, eax
add eax, dword [0x41901c]
call eax
stosd dword es:[edi], eax
jmp 0x416d30
pop edi
add edi, 0x14
ja 0x416cd7
jmp 0x416cd7
mov edi, dword fs:[0x30]
push dword [edi + 0xc]
pop edi
mov edi, dword [edi + 0x14]
shl esi, 0x1f
shl esi, 1
xor esi, dword [ebp + 0xc]
mov eax, dword [edi + 0x10]
or eax, eax
je 0x416ddc
cmp esi, eax
je 0x416dad
push dword [edi]
pop edi
jmp 0x416d9d
shl eax, 0x1f
shl eax, 1
or eax, dword [ebx + 0x28]
or eax, eax
je 0x416dbc
add eax, dword [ebp + 0xc]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x50]
mov dword [edi + 0x18], 0
add dword [edi + 0x18], eax
sub ebx, ebx
xor ebx, dword [ebp - 8]
add ebx, dword [ebx + 0x3c]
push dword [ebp + 0xc]
pop eax
push eax
pop dword [ebx + 0x34]
push eax
push 0x46bdcf57
xor dword [esp], 0x46bdf94a
push 0x6d3c00
rol dword [esp], 0x16
call sub.user32.dll_ValidateRgn
pop eax
push dword [ebp - 8]
mov eax, dword [0x419020]
call eax
jmp 0x416e54
push eax
push 0x7ad00b69
rol dword [esp], 0xc
push 0xee341a16
sub dword [esp], 0xee33d6cb
call sub.gdi32.dll_SetTextColor
pop eax
push dword [ebp - 8]
lea eax, [0]
xor eax, dword [0x419020]
call eax
push eax
call sub.gdi32.dll_GdiGetBatchLimit
pop eax
push dword [ebp - 4]
push dword [0x419024]
pop eax
call eax
mov eax, 0
push eax
pop dword [ebp - 4]
push eax
push 0x54c511d7
xor dword [esp], 0x4b1eb739
push 0x7d653291
xor dword [esp], 0x7d6520b2
call sub.gdi32.dll_SelectClipPath
pop eax
push 0x8000
push 0
push dword [ebp + 8]
lea eax, [0]
xor eax, dword [0x41900c]
call eax
pop dword fs:[0]
add esp, 8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8