Function at 0x41e852
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x429340
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x24
push ebx
push esi
push edi
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strlen
mov ebx, eax
add ebx, 0x244
cmp byte [ebp + 0x14], 0
pop ecx
mov dword [ebp - 0x14], 0x98
je 0x41e8b7
lea edi, [ebx + 6]
push edi
call sub.MSVCRT.dll_malloc
push edi
mov esi, eax
push 0
push esi
call sub.MSVCRT.dll_memset
push 6
push 0x438b28
push esi
call sub.MSVCRT.dll_memcpy
push ebx
lea eax, [esi + 6]
push 0x4388e4
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x28
mov ebx, edi
jmp 0x41e8d7
push ebx
call sub.MSVCRT.dll_malloc
push ebx
mov esi, eax
push 0
push esi
call sub.MSVCRT.dll_memset
push ebx
push 0x4388e4
push esi
call sub.MSVCRT.dll_memcpy
add esp, 0x1c
push 0x18
call sub.MSVCRT.dll_malloc
push 0x18
mov edi, eax
push 0
push edi
mov dword [ebp - 0x18], edi
call sub.MSVCRT.dll_memset
push 0x18
push 0x4388cc
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0x1c
push 0x43bd38
lea ecx, [ebp - 0x30]
call fcn.0040bb72
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
pop ecx
mov dword [ebp - 0x10], 8
call sub.MSVCRT.dll_rand
push 0x1a
pop ecx
cdq
idiv ecx
lea ecx, [ebp - 0x30]
add edx, 0x61
push edx
call fcn.0040c637
push eax
lea eax, [ebp - 0x30]
push str._s_c
push eax
call fcn.0040bf67
add esp, 0x10
dec dword [ebp - 0x10]
jne 0x41e922
push str..exe
lea ecx, [ebp - 0x30]
call fcn.0040bd35
cmp byte [ebp + 0x14], 0
push dword [ebp + 0x10]
je 0x41e99a
call sub.MSVCRT.dll_strlen
inc eax
push eax
push dword [ebp + 0x10]
lea eax, [esi + 0x238]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.0040c135
inc eax
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c637
push eax
lea eax, [esi + 0x106]
jmp 0x41e9cc
call sub.MSVCRT.dll_strlen
inc eax
push eax
push dword [ebp + 0x10]
lea eax, [esi + 0x232]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.0040c135
inc eax
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c637
push eax
lea eax, [esi + 0x100]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
cmp dword [ebp + 0x18], 0
je 0x41e9e2
push ebx
push esi
call dword [ebp + 0x18]
pop ecx
pop ecx
push ebx
call sub.MSVCRT.dll_malloc
push ebx
push 0
push eax
mov dword [ebp + 0x14], eax
call sub.MSVCRT.dll_memset
push ebx
push esi
push dword [ebp + 0x14]
call sub.MSVCRT.dll_memcpy
add esp, 0x1c
mov byte [edi + 0xe], bl
mov byte [edi + 0xf], bh
push 0x5c
push ebx
push esi
call fcn.0041e830
add esp, 0xc
test al, al
jne 0x41ea47
push 0
push ebx
push esi
call fcn.0041e830
add esp, 0xc
test al, al
jne 0x41ea47
push 0xa
push ebx
push esi
call fcn.0041e830
add esp, 0xc
test al, al
jne 0x41ea47
push 0xd
push ebx
push esi
call fcn.0041e830
add esp, 0xc
test al, al
je 0x41ea6e
push ebx
push dword [ebp + 0x14]
push esi
call sub.MSVCRT.dll_memcpy
mov ecx, dword [ebp - 0x14]
add esp, 0xc
inc ecx
xor eax, eax
test ebx, ebx
mov dword [ebp - 0x14], ecx
jle 0x41ea69
xor byte [eax + esi], cl
inc eax
cmp eax, ebx
jl 0x41ea61
mov byte [edi + 0x13], cl
jmp 0x41ea07
push dword [ebp + 0x14]
call sub.MSVCRT.dll_free
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0
push edi
call sub.MSVCRT.dll_memset
push 0x18
push dword [ebp - 0x18]
push edi
call sub.MSVCRT.dll_memcpy
push ebx
push esi
add edi, 0x17
push edi
call sub.MSVCRT.dll_memcpy
push dword [ebp - 0x18]
add ebx, 0x18
call sub.MSVCRT.dll_free
push esi
call sub.MSVCRT.dll_free
or dword [ebp - 4], 0xffffffff
add esp, 0x30
lea ecx, [ebp - 0x30]
call fcn.0040bc75
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret