Function at 0x417995
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4690fc
call fcn.004685c0
sub esp, 0x250
push ebx
xor ebx, ebx
mov eax, 0x48ab94
mov dword [ebp - 4], ebx
cmp dword [0x48aba8], 0x10
push esi
cmovae eax, dword [0x48ab94]
push edi
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x30], ebx
call fcn.0044759e
pop ecx
mov byte [ebp - 0x4c], bl
lea edx, [ebp - 0x50]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x50], eax
call fcn.004157f9
pop ecx
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040c930
lea ecx, [ebp - 0x94]
call fcn.00413b3d
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040d946
mov edi, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040d946
mov ecx, dword [ebp - 0xd0]
xorps xmm0, xmm0
movlpd qword [ebp - 0x5c], xmm0
mov eax, ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ebx
test ecx, ecx
je 0x417a54
call fcn.0040b03f
mov eax, ebx
mov byte [ebp - 4], 5
cmp edi, eax
je 0x417e1a
mov byte [ebp - 4], 6
mov cl, 0x70
mov dword [ebp - 0x46], 0xe3eef870
mov edx, ebx
mov dword [ebp - 0x42], 0xa1fbeae3
mov dword [ebp - 0x3e], 0xfbeeeb
not cl
xor byte [ebp + edx - 0x45], cl
inc edx
cmp edx, 0xa
jae 0x417a8e
mov cl, byte [ebp - 0x46]
jmp 0x417a7d
lea esi, [edi + 0x20]
mov byte [ebp - 0x3b], bl
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x4c], esi
push eax
mov ecx, esi
call fcn.0040bc87
push ecx
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 7
push ecx
mov ecx, eax
call fcn.004143b3
mov edi, dword [ebp - 0x30]
lea edx, [ebp - 0x45]
or edi, 4
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x30], edi
call fcn.00414712
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00413d07
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 6
call fcn.00413b3d
test bl, bl
je 0x417dfb
lea eax, [ebp - 0xf8]
mov ecx, esi
push eax
call fcn.0040bc4c
push ecx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 8
push ecx
mov ecx, eax
call fcn.004143b3
or edi, 0x20
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0xa
call fcn.00413b3d
cmp dword [ebp - 0xa0], 0x10
lea esi, [ebp - 0xb4]
mov edi, dword [ebp - 0xa4]
cmovae esi, dword [ebp - 0xb4]
xor ebx, ebx
test edi, edi
je 0x417b8b
push pe_nt_image_headers32
lea eax, [ebp - 0x1fc]
push ebx
push eax
call fcn.004436b0
or ecx, 0xffffffff
mov byte [ebp - 0x1a0], 1
lea eax, [edi - 1]
add esp, 0xc
cmp eax, ecx
cmovb ecx, eax
add ecx, esi
jmp 0x417b79
cmp ecx, esi
je 0x417b8b
dec ecx
movzx eax, byte [ecx]
mov al, byte [ebp + eax - 0x1fc]
test al, al
je 0x417b74
sub ecx, esi
jmp 0x417b8e
or ecx, 0xffffffff
lea eax, [ecx + 1]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00413194
lea ecx, [ebp - 0xb4]
cmp ecx, eax
je 0x417bbc
mov byte [ebp - 0x50], bl
push dword [ebp - 0x50]
push eax
call fcn.00413e7a
lea ecx, [ebp - 0xcc]
call fcn.00413d07
mov cl, 0x2c
mov dword [ebp - 0x23], 0xbfb2842c
mov dword [ebp - 0x1f], 0xa0a7b6bf
mov edx, ebx
mov byte [ebp - 0x1b], bl
not cl
xor byte [ebp + edx - 0x22], cl
inc edx
cmp edx, 7
jae 0x417bed
mov cl, byte [ebp - 0x23]
jmp 0x417bdc
mov byte [ebp - 0x1b], bl
call fcn.00435972
lea edx, [ebp - 0x22]
mov ecx, eax
call fcn.004354d9
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], bl
call fcn.00413d68
lea ecx, [ebp - 0x74]
call fcn.0040d215
lea ecx, [ebp - 0x74]
call fcn.00413d07
mov cl, 0x6c
mov dword [ebp - 0x2c], 0xf2fcc16c
mov dword [ebp - 0x28], 0xf4fdfafe
mov edx, ebx
mov byte [ebp - 0x24], bl
not cl
xor byte [ebp + edx - 0x2b], cl
inc edx
cmp edx, 7
jae 0x417c4b
mov cl, byte [ebp - 0x2c]
jmp 0x417c3a
lea edx, [ebp - 0x2b]
mov byte [ebp - 0x24], bl
lea ecx, [ebp - 0xb4]
call fcn.00414712
mov edx, ebx
test al, al
je 0x417cfd
movaps xmm0, xmmword [0x47f9c0]
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 0xf2e7e2
mov cl, byte [ebp - 0x70]
not cl
xor byte [ebp + edx - 0x6f], cl
inc edx
cmp edx, 0x12
jb 0x417c78
mov byte [ebp - 0x5d], bl
call fcn.00435972
lea edx, [ebp - 0x6f]
mov ecx, eax
call fcn.004354d9
push eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], 0xf
mov byte [ebp - 0x94], bl
call fcn.00413d68
push ecx
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0xcc]
push eax
mov byte [ebp - 4], 0xb
call fcn.004143b3
lea edx, [ebp - 0x94]
lea ecx, [ebp - 0xcc]
call fcn.00416050
lea ecx, [ebp - 0xcc]
call fcn.00413d07
lea ecx, [ebp - 0x94]
call fcn.00413d07
mov esi, pe_nt_image_headers32
jmp 0x417dc9
mov cl, 0x66
mov dword [ebp - 0x1a], 0xf8fdb766
mov word [ebp - 0x16], 0xed
not cl
xor byte [ebp + edx - 0x19], cl
inc edx
cmp edx, 4
jae 0x417d1d
mov cl, byte [ebp - 0x1a]
jmp 0x417d0c
mov byte [ebp - 0x15], bl
mov cl, 0x65
mov dword [ebp - 0x3a], 0xf6fbcd65
mov edx, ebx
mov dword [ebp - 0x36], 0xe9eefff6
mov word [ebp - 0x32], 0xc6
not cl
xor byte [ebp + edx - 0x39], cl
inc edx
cmp edx, 8
jae 0x417d49
mov cl, byte [ebp - 0x3a]
jmp 0x417d38
mov byte [ebp - 0x31], bl
call fcn.00435972
lea edx, [ebp - 0x39]
mov ecx, eax
call fcn.004354d9
lea ecx, [ebp - 0xb4]
mov edx, eax
push ecx
lea ecx, [ebp - 0x74]
call fcn.0041c88a
pop ecx
lea ecx, [ebp - 0x19]
mov byte [ebp - 4], 0xc
push ecx
mov edx, eax
lea ecx, [ebp - 0x94]
call fcn.0041c91b
pop ecx
mov esi, eax
push ecx
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0xcc]
push eax
mov byte [ebp - 4], 0xd
call fcn.004143b3
mov edx, esi
lea ecx, [ebp - 0xcc]
call fcn.00416050
lea ecx, [ebp - 0xcc]
call fcn.00413d07
lea ecx, [ebp - 0x94]
call fcn.00413d07
lea ecx, [ebp - 0x74]
call fcn.00413d07
mov esi, 0x800
lea ecx, [ebp - 0xb4]
call fcn.00413d07
mov eax, dword [ebp - 0x30]
or eax, esi
mov dword [ebp - 0x30], eax
jmp 0x417dfd
xor ebx, ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 5
call fcn.0040c97a
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x5c]
jmp 0x417a58
test esi, esi
je 0x417e25
mov ecx, esi
call fcn.0040b03f
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x417e34
call fcn.0040b03f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret