Function at 0x484a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x79d723
mov eax, dword fs:[0]
push eax
sub esp, 0x39c
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x84]
movups xmmword [ebp - 0x84], xmm0
movups xmmword [ebp - 0x74], xmm0
call fcn.00411040
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00483a50
push eax
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.00404120
lea edx, [ebp - 0x84]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x244]
call fcn.00577690
lea ecx, [ebp - 0x244]
call fcn.00404490
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404490
cmp byte [edi + 0x180], 0
mov ecx, 0xdf
je 0x484cae
push 0xf003f
push 0
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x484c1b
mov eax, 0x14
mov dword [ebp - 0x60], 0xc900f7
mov dword [ebp - 0x64], eax
xor ecx, ecx
mov dword [ebp - 0x5c], 0xd500df
mov dword [ebp - 0x58], 0xfe00ef
mov dword [ebp - 0x54], 0xde00f3
mov dword [ebp - 0x50], 0xa000ae
mov dword [ebp - 0x4c], 0xa600a5
mov dword [ebp - 0x48], 0xe500b6
mov dword [ebp - 0x44], 0xa600a0
mov dword [ebp - 0x40], 0xa500a1
mov dword [ebp - 0x3c], 0xaf00af
mov dword [ebp - 0x38], 0xcc
nop
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x60], ax
inc ecx
mov eax, dword [ebp - 0x64]
cmp ecx, eax
jb 0x484b80
xor ecx, ecx
mov dword [ebp - 0x234], 7
mov word [ebp + eax*2 - 0x60], cx
xor eax, eax
mov dword [ebp - 0x238], ecx
lea ecx, [ebp - 0x60]
mov word [ebp - 0x248], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x484bc0
sub ecx, edx
lea eax, [ebp - 0x60]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.004044f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x34]
call fcn.00404120
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
call fcn.00404490
mov cl, byte [ebp - 0x18]
jmp 0x484c24
xor cl, cl
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x18], cl
mov byte [ebp - 4], 5
test cl, cl
jne 0x484c7a
lea eax, [edi + 0x138]
push eax
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x14]
call fcn.00421280
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x88]
test al, al
js 0x484c74
movsx eax, al
lea ecx, [ebp - 0x1fd]
push ecx
lea ecx, [ebp - 0xa4]
mov byte [ebp - 0x1fd], 0
push ecx
mov eax, dword [eax*4 + 0x7d56d8]
call eax
add esp, 8
mov cl, byte [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 7
test cl, cl
js 0x484ca3
movsx eax, cl
lea ecx, [ebp - 0x1fd]
push ecx
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x1fd], 0
push ecx
mov eax, dword [eax*4 + 0x7d56d8]
call eax
add esp, 8
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [edi + 0x1e4], 0
je 0x4850ea
mov dword [ebp - 0x22c], 7
xor ecx, ecx
mov dword [ebp - 0x228], 0xdd0097
mov dword [ebp - 0x224], 0xd700df
mov dword [ebp - 0x220], 0xc900d9
mov dword [ebp - 0x21c], 0xbf00db
nop
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x228], ax
inc ecx
mov eax, dword [ebp - 0x22c]
cmp ecx, eax
jb 0x484cf0
xor ecx, ecx
mov word [ebp + eax*2 - 0x228], cx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x318]
push 0x7cd378
lea eax, [ebp - 0x14]
push eax
call fcn.00485ac0
push 0x7cd378
push 0x7d7dd8
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 8
call fcn.004486b0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2b8]
push 3
xor eax, eax
mov dword [ebp - 0x2a8], 0
push 0x7d7dbc
mov dword [ebp - 0x2a4], 7
mov word [ebp - 0x2b8], ax
call fcn.004044f0
lea eax, [edi + 0x1b4]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00404120
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x318]
push eax
push ecx
lea ecx, [ebp - 0x268]
call fcn.004481e0
mov byte [ebp - 4], 0xc
mov eax, 8
mov dword [ebp - 0x218], eax
xor ecx, ecx
mov dword [ebp - 0x214], 0xda00cb
mov dword [ebp - 0x210], 0xcf00d2
mov dword [ebp - 0x20c], 0xce00dd
mov dword [ebp - 0x208], 0xcc00d5
mov dword [ebp - 0x204], 0xc0
nop dword [eax]
nop word [eax + eax]
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x214], ax
inc ecx
mov eax, dword [ebp - 0x218]
cmp ecx, eax
jb 0x484e00
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov word [ebp + eax*2 - 0x214], cx
xor eax, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x214]
mov word [ebp - 0x2c], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x484e40
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.004044f0
push 0
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00421920
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00404490
lea ecx, [ebp - 0x268]
call fcn.00446830
push fcn.00420a60
push 3
push 0x30
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x11
push eax
call fcn.0076d1e5
mov dword [ebp - 0x214], 7
xor ecx, ecx
mov dword [ebp - 0x210], 0xdd0097
mov dword [ebp - 0x20c], 0xd700df
mov dword [ebp - 0x208], 0xc900d9
mov dword [ebp - 0x204], 0xbf00db
nop dword [eax]
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x210], ax
inc ecx
mov eax, dword [ebp - 0x214]
cmp ecx, eax
jb 0x484ee0
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x3a8]
push 0x7cd378
lea eax, [ebp - 0x14]
push eax
call fcn.00485ac0
push 0x7cd378
push 0x7d7dd8
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0x12
call fcn.004486b0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x348]
push 3
xor eax, eax
mov dword [ebp - 0x338], 0
push 0x7d7dbc
mov dword [ebp - 0x334], 7
mov word [ebp - 0x348], ax
call fcn.004044f0
lea eax, [edi + 0x19c]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x330]
call fcn.00404120
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3a8]
push eax
push ecx
lea ecx, [ebp - 0x288]
call fcn.004481e0
mov byte [ebp - 4], 0x16
mov eax, 8
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov dword [ebp - 0x28], 0xda00cb
mov dword [ebp - 0x24], 0xcf00d2
mov dword [ebp - 0x20], 0xce00dd
mov dword [ebp - 0x1c], 0xcc00d5
mov dword [ebp - 0x18], 0xc0
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
jb 0x484fd0
xor ecx, ecx
mov dword [ebp - 0x230], 7
mov word [ebp + eax*2 - 0x28], cx
xor eax, eax
mov dword [ebp - 0x234], ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 0x244], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x485010
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x244]
call fcn.004044f0
push 0
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00421920
add esp, 0x10
mov byte [ebp - 4], 0x18
mov al, byte [ebp - 0x88]
test al, al
js 0x485084
movsx eax, al
lea ecx, [ebp - 0x1fd]
push ecx
lea ecx, [ebp - 0xa4]
mov byte [ebp - 0x1fd], 0
push ecx
mov eax, dword [eax*4 + 0x7d56d8]
call eax
add esp, 8
lea ecx, [ebp - 0x244]
mov byte [ebp - 0x88], 0xff
call fcn.00404490
lea ecx, [ebp - 0x288]
call fcn.00446830
push fcn.00420a60
push 3
push 0x30
lea eax, [ebp - 0x3a8]
mov byte [ebp - 4], 0x11
push eax
call fcn.0076d1e5
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x38]
test al, al
js 0x4850e6
movsx eax, al
lea ecx, [ebp - 0x1fd]
push ecx
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x1fd], 0
push ecx
mov eax, dword [eax*4 + 0x7d56d8]
call eax
add esp, 8
mov byte [ebp - 4], 0
push 0x158
lea eax, [ebp - 0x1fc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 4
lea ecx, [ebp - 0x1fc]
mov eax, esp
push edi
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00482ad0
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 0x1a
call fcn.00483840
lea ecx, [ebp - 0x1fc]
call fcn.004849c0
mov edx, dword [ebp - 0x7c]
push ecx
mov ecx, dword [ebp - 0x80]
call fcn.00413a10
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x80]
add esp, 4
mov dword [ebp - 0x7c], eax
call fcn.004132d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret