Function at 0x405ada
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push ebx
push ebp
lea ebp, [eax - 0x132f]
lea edx, [eax - 0x34a]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x28]
lea ebx, [ecx + 0x900]
push esi
mov esi, dword [esp + 0x30]
push edi
lea edi, [ecx + 0x8fd]
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc3]
mov dword [esp + 0x10], edx
mov dword [esp + 0x30], ecx
xor esi, 0xed0
lea ecx, [eax - 0x213]
mov dword [esp + 0x34], esi
lea eax, [ebp + 0x2684]
mov dword [esp + 0x40], edi
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x44], ecx
cmp ebx, eax
jge 0x405dfe
mov ecx, dword [ebp + 0xe8]
mov eax, 0xb41e3
xor ecx, dword [ebp + 0x120]
add edi, 3
sub dword [esp + 0x44], 0x72b
sub eax, ecx
add dword [ebp + 0x4c], eax
xor esi, 0x3cfe
xor dword [0x4f4044], 0xc167f
cmp dword [ebp + 0x1c], 0x134a3
ja 0x405b91
mov eax, dword [ebp + 0x98]
add eax, 0x1eda87
add dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x124]
xor ebx, ebx
mov ecx, dword [0x4f4090]
sub eax, 0x13889f
push eax
add ecx, 0x193e11
push ecx
push dword [ebp + 0x4c]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [0x4f3ff4]
add eax, 0x4800
mov dword [0x4f40c4], eax
xor edi, 0x56
mov eax, dword [ebp + 0xf4]
sub esi, 0x13d
add eax, 0x194be1
mov dword [esp + 0x40], edi
add eax, dword [edx + 0xdc]
mov dword [0x4f407c], eax
mov eax, dword [ebp + 0xcc]
mov dword [0x4f40b0], eax
cmp dword [ebp + 0x48], 0x1dc
mov dword [esp + 0x34], esi
jb 0x405c14
mov eax, 0xffff5383
sub eax, dword [0x4f4100]
add dword [ebp + 0x118], eax
jmp 0x405c25
mov eax, dword [ebp + 0xe8]
sub eax, 0xb278a
mov dword [edx + 0x11c], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x4f4090]
ja 0x405c48
mov eax, dword [0x4f3ff4]
mov eax, dword [eax + 0x108]
add eax, 0x22add4f6
mov dword [ebp + 0x80], eax
jmp 0x405c59
mov ecx, dword [0x4f3ff4]
mov eax, 0x1dbd4
sub eax, dword [ebp + 0x70]
add dword [ecx + 0x68], eax
mov eax, dword [ebp + 0xa0]
cmp eax, dword [ebp + 0x34]
je 0x405c73
mov eax, dword [0x4f3ff4]
mov dword [eax + 0xb4], 0x4142b0
mov edi, ebx
mov eax, dword [ebp + 0xb4]
mov esi, dword [edi + eax]
add edi, 4
mov eax, dword [ebp + 0x20]
add dword [ebp + 0x48], eax
mov edx, dword [0x4f3ff4]
mov ecx, dword [ebp + 0xac]
mov eax, dword [ebp + 0xe0]
add ecx, 0xffffffb8
add eax, ecx
add dword [edx + 0x1c], eax
mov ecx, dword [0x4f3ff4]
mov eax, dword [ecx + 0x124]
xor eax, dword [ecx + 0x114]
sub eax, 0x1388c2
xor dword [ecx + 0x5c], eax
mov eax, dword [ebp + 0x20]
sub eax, dword [ebp + 0x70]
inc eax
add dword [ebp + 0x98], eax
mov eax, dword [0x4f3ff4]
mov eax, dword [eax + 0x124]
xor eax, dword [ebp + 0x34]
sub eax, 0x1388dd
imul eax, dword [ebp + 0xa0]
mov dword [ebp + 0xa0], eax
mov eax, dword [0x4f3ff4]
mov ecx, dword [0x4f4104]
mov ebx, dword [ebp + 0x80]
imul ebx, esi
sub ecx, dword [eax + 0x7c]
add ecx, 0x18c93f
xor dword [ebp + 0x48], ecx
mov eax, dword [0x4f40b0]
mov ecx, dword [ebp + 0x84]
mov edx, ebx
shr edx, 8
mov byte [eax + ecx], dl
inc dword [ebp + 0x84]
mov eax, dword [0x4f3ff4]
mov eax, dword [eax + 0xdc]
add eax, dword [ebp + 0x70]
xor eax, 0x38
add dword [ebp + 0x78], eax
mov ecx, dword [0x4f3ff4]
mov eax, dword [ebp + 0x90]
xor eax, dword [ebp + 0x48]
add dword [ecx + 0xc4], eax
mov eax, dword [ebp + 0xf4]
xor eax, 0xffe6b3e8
add dword [ebp + 0x108], eax
mov eax, dword [0x4f3ff4]
mov ecx, dword [eax + 0xb8]
mov eax, dword [ebp + 0x84]
mov byte [ecx + eax], bl
inc dword [ebp + 0x84]
mov ecx, dword [ebp + 0x120]
mov eax, dword [0x4f402c]
lea eax, [eax + ecx*2]
dec eax
mov dword [ebp + 0x120], eax
mov eax, dword [ebp + 0x68]
sub eax, dword [0x4f4110]
add eax, 0x2571e5
xor dword [ebp + 0x34], eax
mov ecx, dword [0x4f3ff4]
mov eax, dword [ebp + 0x20]
inc eax
imul eax, dword [ecx + 0xac]
mov dword [ecx + 0xac], eax
cmp edi, 0x2ae28
jl 0x405c75
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add edx, 0x1506
mov eax, dword [ebp + 0xdc]
add ebx, 0x281
mov edi, dword [esp + 0x40]
xor eax, 0x11b8
mov esi, dword [esp + 0x34]
xor edx, 0x215
mov ecx, dword [esp + 0x44]
mov dword [ebp + 0x80], eax
mov dword [esp + 0x10], edx
jmp 0x405fef
imul eax, dword [ebp + 0xdc], 0x271c
sub eax, 0x359cf24
cmp ebx, eax
ja 0x405fef
mov eax, dword [ebp + 0x120]
sub eax, 0x2684
mov dword [esp + 0x14], ebx
xor eax, dword [esp + 0x30]
cmp ebx, eax
jbe 0x405fef
mov ecx, dword [esp + 0x30]
mov eax, edx
sub eax, esi
or eax, edi
mov dword [esp + 0x1c], eax
mov eax, esi
and eax, edx
mov dword [esp + 0x20], eax
lea eax, [ecx - 0x8e9]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
add ecx, eax
xor eax, 0x26fe
mov dword [esp + 0x18], ecx
add eax, 0xffffddf8
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x114]
sub eax, 0x4486
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + esi]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [0x4f402c]
mov ecx, dword [0x4f3ff4]
or eax, 0x132f
xor dword [esp + 0x44], eax
mov eax, dword [0x4f4104]
add eax, edi
imul eax, eax, 0x26c6
add dword [ecx + 0x114], eax
mov ecx, dword [0x4f3ff4]
mov eax, dword [ecx + 0x110]
and eax, dword [ebp + 0x10c]
and eax, 0xfe5
push eax
mov eax, dword [ecx + 0x78]
imul eax, dword [ebp + 0x78]
imul eax, eax, 0x2208
push eax
mov eax, dword [ebp + 0x74]
imul eax, dword [esp + 0x28]
push eax
mov eax, dword [ebp + 0xf4]
xor eax, dword [ebp + 0xc]
or eax, 0x26c6
push eax
mov eax, dword [ebp + 0x7c]
and eax, edi
add eax, ebx
push eax
mov eax, dword [ebp + 0xd8]
or eax, ebx
push eax
mov eax, dword [ebp + 0x34]
imul eax, dword [0x4f40d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov ecx, dword [ebp + 0x78]
mov eax, dword [esp + 0x44]
or ecx, 0x15ef
xor ecx, dword [ebp + 0x12c]
or eax, 0x27c1
mov edi, dword [0x4f4110]
mov edx, dword [ebp + 0xac]
sub edi, esi
mov esi, dword [0x4f4104]
and edx, dword [esp + 0x30]
add esi, 0xffffecd1
push eax
push ecx
push dword [esp + 0x2c]
push edx
push esi
push 0x4f3ff8
push edi
call fcn.00412d65
mov esi, dword [esp + 0x4c]
mov ebx, eax
mov eax, dword [esp + 0x60]
add esp, 0x1c
mov edx, dword [ebp + 0x88]
lea ecx, [eax + ebx]
push ecx
mov ecx, eax
mov eax, dword [ebp + 0xa0]
and eax, dword [esp + 0x1c]
or ecx, esi
sub ecx, dword [0x4f4038]
push ecx
mov ecx, dword [0x4f3ff4]
sub edx, dword [ecx + 0x10c]
push edx
push eax
mov eax, dword [ebp + 0x7c]
or eax, esi
add eax, dword [ebp + 0x9c]
push eax
mov eax, dword [ebp + 0x114]
and eax, dword [ebp + 0x130]
sub eax, dword [ebp + 0x14]
push eax
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 0x44]
mov eax, ecx
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
imul eax, edx
add edi, 2
mov dword [esp + 0x14], edi
sub ebx, eax
mov eax, dword [ebp + 0x120]
sub eax, 0x2684
xor eax, esi
mov esi, dword [esp + 0x34]
cmp edi, eax
mov edi, dword [esp + 0x40]
ja 0x405e68
mov eax, ebx
xor eax, 0xfff
cmp edx, eax
jle 0x40636f
lea eax, [edi - 0x54a]
cmp ebx, eax
jl 0x40636f
lea eax, [ebx - 0x257]
cmp esi, eax
jle 0x40616e
mov eax, 0xf109a8a1
sub eax, dword [ebp + 0x7c]
add dword [ebp + 0x80], eax
xor esi, esi
mov dword [0x4f40ac], 0x454000
mov ecx, dword [0x4f3ff4]
mov eax, dword [ebp + 0xb4]
push 0x37
mov edx, dword [esi + eax]
add esi, 4
mov eax, dword [ecx + 0x70]
imul eax, dword [ebp + 0x90]
mov dword [ecx + 0x70], eax
mov eax, dword [0x4f3ff4]
mov ecx, dword [ebp + 0x108]
mov ebx, dword [ebp + 0x80]
imul ebx, edx
sub ecx, dword [eax + 0xe8]
xor ecx, 0xfffdbbad
add dword [ebp + 0x7c], ecx
mov eax, dword [0x4f4068]
dec eax
add dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x124]
mov ecx, dword [ebp + 0x84]
sub eax, 0x1388de
imul eax, dword [ebp + 0x120]
mov dword [ebp + 0x120], eax
mov eax, dword [ebp + 0xb8]
mov byte [ecx + eax], bl
inc dword [ebp + 0x84]
mov ecx, dword [ebp + 0xdc]
xor ecx, dword [0x4f4104]
mov edx, dword [0x4f3ff4]
pop eax
sub eax, ecx
push 0x1d
add dword [edx + 0x90], eax
mov eax, dword [ebp + 0x34]
dec eax
add eax, dword [ebp + 0x48]
imul eax, dword [ebp + 0xdc]
mov dword [ebp + 0xdc], eax
mov eax, dword [0x4f4070]
add dword [ebp + 0x48], eax
mov ecx, dword [0x4f3ff4]
mov eax, dword [ebp + 0x114]
xor eax, 0x1d
sub dword [ecx + 0x118], eax
mov ecx, dword [0x4f3ff4]
pop eax
sub eax, dword [ecx + 0x20]
sub eax, dword [ebp + 0x114]
add dword [ecx + 0xc4], eax
mov eax, dword [ebp + 0x70]
sub eax, dword [ebp + 0xe8]
add eax, 0xb2d11
add dword [ebp + 0xe0], eax
mov eax, dword [0x4f4070]
sub dword [ebp + 0xf4], eax
cmp esi, 0x6e460
jl 0x406034
mov eax, dword [0x4f3ff4]
mov esi, dword [esp + 0x34]
cmp dword [eax + 0x124], 0x2de0
jb 0x406162
mov eax, dword [eax + 0x110]
xor eax, 0x8af8afbb
mov dword [0x4f4078], eax
xor edi, 0xd76
mov dword [esp + 0x40], edi
jmp 0x4061e1
mov eax, dword [0x4f3ff4]
mov eax, dword [eax + 0x114]
add eax, ecx
or eax, 0x161f
push eax
lea eax, [edi - 0x27c1]
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
imul eax, dword [esp + 0x44], 0x1dc0
mov ecx, edi
sub ecx, eax
add dword [0x4f4070], ecx
mov eax, dword [ebp + 0x90]
add eax, dword [0x4f40ec]
imul eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapLock]
mov eax, dword [0x4f40e4]
or eax, esi
cmp ebx, eax
jae 0x4061e1
imul eax, dword [ebp + 0x78], 0x20e9
mov ecx, dword [0x4f3ff4]
sub eax, dword [esp + 0x10]
or dword [ecx + 0xbc], eax
mov eax, edi
xor eax, 0xd76
cmp esi, eax
je 0x40636f
mov dword [ebp + 0xb4], 0x4c8af0
xor edi, edi
mov ecx, dword [0x4f3ff4]
mov eax, 0xb2d12
sub eax, dword [ecx + 0xe8]
sub eax, dword [ebp + 0x20]
add dword [ecx + 0x78], eax
mov eax, dword [ebp + 0x118]
sub eax, 0x160c63
imul eax, dword [ebp + 0x48]
mov dword [ebp + 0x48], eax
mov eax, dword [0x4f40ac]
mov ecx, dword [0x4f3ff4]
mov esi, dword [edi + eax]
add edi, 4
mov eax, dword [ecx + 0xfc]
sub dword [ecx + 0xe0], eax
mov eax, 0x10fd33
mov ecx, dword [0x4f3ff4]
sub eax, dword [ecx + 0x5c]
add dword [ecx + 0xdc], eax
mov ecx, dword [ebp + 0x114]
mov edx, dword [0x4f3ff4]
add ecx, 0xfff048dd
mov eax, dword [ebp + 0xc]
add eax, ecx
xor dword [edx + 8], eax
mov eax, dword [0x4f3ff4]
mov ebx, dword [ebp + 0x80]
imul ebx, esi
mov eax, dword [eax + 0xe8]
xor eax, dword [ebp + 0x7c]
sub eax, 0x13e42d
or dword [ebp + 0x10c], eax
mov edx, ebx
mov ecx, dword [0x4f407c]
mov eax, dword [0x4f40b0]
shr edx, 8
mov byte [eax + ecx], dl
inc dword [0x4f407c]
mov eax, dword [0x4f3ff4]
mov ecx, dword [eax + 0xb8]
mov eax, dword [ebp + 0x84]
mov byte [ecx + eax], bl
xor eax, eax
inc dword [ebp + 0x84]
inc eax
sub eax, dword [ebp + 0xd8]
add dword [ebp + 0x34], eax
mov ecx, dword [0x4f3ff4]
mov eax, dword [0x4f403c]
add eax, 0xffec0036
add dword [ecx + 0x110], eax
mov eax, dword [ebp + 0x114]
sub eax, dword [ebp + 0xe0]
mov ecx, dword [0x4f3ff4]
sub eax, 0x1d
add dword [ecx + 0xfc], eax
mov ecx, dword [0x4f3ff4]
mov eax, dword [ebp + 0x10c]
sub dword [0x4f40ec], eax
mov eax, dword [ecx + 0xac]
sub eax, 0x47
imul eax, dword [ecx + 0xdc]
mov dword [ecx + 0xdc], eax
mov eax, dword [ebp + 0x114]
sub eax, 0x1d
or dword [ebp + 0x108], eax
cmp edi, 0x2ae28
jl 0x4061fc
mov eax, dword [ebp + 0x7c]
mov edi, dword [esp + 0x40]
cmp eax, dword [0x4f4108]
je 0x40636f
mov ecx, dword [0x4f3ff4]
mov edx, dword [ebp + 0x78]
sub edx, dword [ecx + 0x118]
add edx, 0x161598
mov dword [0x4f4078], edx
xor edi, 0x420
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret