Function at 0x4fa130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1d8
mov esi, esp
mov dword [esi + 0x1c0], ebp
mov dword [esi + 0x1c4], esp
mov dword [esi + 0x1d0], 0xffffffff
mov dword [esi + 0x1cc], 0x5792a0
mov eax, edx
movdqa xmm0, xmmword [0x589990]
mov dword [esi + 4], ecx
lea ecx, [esi + 0x1c8]
mov edx, dword fs:[0]
mov dword [esi + 0x1c8], edx
mov dword fs:[0], ecx
movdqu xmmword [esi + 0x1c], xmm0
mov byte [esi + 0x2c], 0
lea ecx, [esi + 0xc]
lea edx, [esi + 0x1c]
push eax
call fcn.0053c490
add esp, 4
cmp dword [esi + 0xc], 0x80000000
je 0x4fa1cb
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4fa1cb
mov ecx, dword [esi + 0x10]
shl eax, 4
add ecx, 0xc
nop dword [eax]
mov byte [ecx], 0
add ecx, 0x10
add eax, 0xfffffff0
jne 0x4fa1c0
lea ecx, [esi + 0xc]
mov edx, 1
mov dword [esi + 0x1d0], 0
call fcn.0053f200
mov eax, dword [esi + 0xc]
cmp eax, 0x80000000
jne 0x4fa1f8
mov eax, dword [esi + 4]
mov byte [eax + 0xc], 2
jmp 0x4fa404
mov edi, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x30]
mov dword [esi + 8], edi
mov dword [esi], edx
push edi
call fcn.004f2020
mov ebx, dword [esi + 8]
add esp, 4
cmp dword [esi + 0x30], 0x80000007
jne 0x4fa22a
mov eax, dword [esi + 4]
mov byte [eax + 0xc], 2
jmp 0x4fa3bd
test ebx, ebx
je 0x4fa39f
mov eax, dword [esi]
cmp ebx, 1
mov edi, dword [eax + 8]
je 0x4fa3a1
lea edx, [ebx + 0xfffffff]
xor ecx, ecx
mov eax, edx
and eax, 0xfffffff
cmp eax, 8
jb 0x4fa379
movd xmm0, edi
mov edi, dword [esi]
and edx, 7
mov ecx, eax
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x589850]
sub ecx, edx
mov ebx, ecx
movdqa xmm2, xmm1
add edi, 0x88
nop
movd xmm3, dword [edi - 0x40]
movd xmm5, dword [edi - 0x50]
movd xmm4, dword [edi - 0x70]
movd xmm6, dword [edi - 0x20]
movd xmm7, dword [edi - 0x30]
punpckldq xmm5, xmm3
movd xmm3, dword [edi - 0x60]
punpckldq xmm7, xmm6
movdqa xmm6, xmm1
pxor xmm1, xmm0
punpckldq xmm4, xmm3
movd xmm3, dword [edi]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edi - 0x10]
sub edi, 0xffffff80
add ebx, 0xfffffff8
punpckldq xmm5, xmm3
punpcklqdq xmm7, xmm5
movdqa xmm5, xmm4
pxor xmm5, xmm0
pcmpgtd xmm1, xmm5
movdqa xmm5, xmm2
pxor xmm2, xmm0
pand xmm6, xmm1
pandn xmm1, xmm4
por xmm1, xmm6
movdqa xmm6, xmm7
pxor xmm6, xmm0
pcmpgtd xmm2, xmm6
pand xmm5, xmm2
pandn xmm2, xmm7
por xmm2, xmm5
jne 0x4fa280
movdqa xmm4, xmm2
movdqa xmm3, xmm1
test edx, edx
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm1, xmm3
movdqa xmm4, xmm2
pxor xmm1, xmm0
pxor xmm4, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm3, xmm0
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
movd edi, xmm3
je 0x4fa3a1
mov edx, dword [esi]
sub eax, ecx
shl ecx, 4
lea ecx, [ecx + edx + 0x18]
nop word cs:[eax + eax]
nop
mov edx, dword [ecx]
cmp edi, edx
cmovbe edi, edx
add ecx, 0x10
dec eax
jne 0x4fa390
jmp 0x4fa3a1
xor edi, edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x1d0], 0
lea edx, [esi + 0x30]
push edi
call fcn.004f9390
add esp, 4
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x4fa3ee
mov eax, dword [esi]
lea edi, [eax + 4]
jmp 0x4fa3d6
add edi, 0x10
dec ebx
je 0x4fa3ee
cmp dword [edi - 4], 0
je 0x4fa3d0
push dword [edi]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4fa3d0
cmp dword [esi + 0x18], 0
je 0x4fa404
push dword [esi]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 0x1c8]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret