Function at 0x401148
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x8c
xor eax, eax
push esi
push edi
mov byte [ebp + 4], 0
lea edi, [ebp + 5]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edx, dword [ebp + 0x7c]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
push 9
mov word [ebp - 0x24], ax
pop ecx
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x70]
movzx ecx, byte [eax]
xor esi, esi
cmp ecx, 1
mov dword [ebp + 0x58], ecx
mov dword [edx], esi
jle 0x40118f
xor eax, eax
inc eax
jmp 0x4011a0
push ebx
movzx ebx, byte [eax + 1]
cmp ebx, 0xe1
jl 0x4011a9
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
add ebp, 0x68
leave
ret 0x10
cmp ebx, 0x2d
mov dword [ebp + 0x5c], esi
jl 0x4011c4
push 0x2d
mov eax, ebx
xor edx, edx
pop ecx
div ecx
mov ecx, eax
imul ecx, ecx, 0xffffffd3
add ebx, ecx
mov dword [ebp + 0x5c], eax
cmp ebx, 9
mov dword [ebp + 0x60], esi
jl 0x4011df
push 9
mov eax, ebx
xor edx, edx
pop ecx
div ecx
mov ecx, eax
imul ecx, ecx, 0xfffffff7
add ebx, ecx
mov dword [ebp + 0x60], eax
xor eax, eax
mov cl, byte [eax + 0x41b24c]
xor cl, 0x6a
mov byte [ebp + eax - 0x24], cl
inc eax
cmp eax, 0x1a
jb 0x4011e1
lea eax, [ebp + 0x64]
call fcn.0040135c
xor eax, eax
mov dword [ebp + 0x18], esi
lea edi, [ebp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov eax, dword [ebp + 0x60]
lea ecx, [eax + ebx]
mov edi, 0x300
shl edi, cl
lea edi, [edi*4 + 0x1cd8]
push edi
call fcn.00401928
pop ecx
mov dword [ebp + 0x64], eax
test eax, eax
jne 0x401246
push 2
pop eax
lea ecx, [ebp + 0x64]
call fcn.0040137f
jmp 0x40119f
mov dword [ebp + 0x2c], eax
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x34], ebx
xor eax, eax
mov cl, byte [eax + 0x41d298]
xor cl, 0x6a
mov byte [ebp + eax + 4], cl
inc eax
cmp eax, 0xd
jb 0x40125d
mov eax, dword [ebp + 0x70]
mov ebx, dword [ebp + 0x74]
add eax, 0xe
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x4c], eax
lea eax, [ebp + 0x54]
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x44], 0xc1ba
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x1c], esi
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [ebp + 0x18], eax
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00401386
push 0x40
push 0x1000
mov esi, 0xff7
push esi
push 0
call eax
mov edi, eax
mov ecx, 0x41c2a0
sub ecx, edi
mov dl, byte [ecx + eax]
xor dl, 0x6a
mov byte [eax], dl
inc eax
dec esi
jne 0x4012c4
lea eax, [ebp + 0x2c]
push eax
call edi
push dword [ebp + 0x64]
mov esi, eax
call fcn.0040184b
pop ecx
test esi, esi
je 0x4012ed
xor eax, eax
inc eax
jmp 0x401239
cmp dword [ebp + 0x58], 1
mov ecx, dword [ebp + 0x54]
mov eax, dword [ebp + 0x7c]
mov dword [eax], ecx
jne 0x401315
and dword [ebp + 0x7c], 0
lea eax, [ebp + 0x70]
push eax
push ebx
lea esi, [ebp + 0x7c]
mov dword [ebp + 0x70], 0xfffffffb
call fcn.00401000
pop ecx
pop ecx
push 0x4000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x401239