Function at 0x49239c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf2552
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcc
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 0x15]
mov dword [ebp - 0x20], ecx
test eax, eax
je 0x4924c7
push 0xd27f00
lea ecx, [ebp - 0x64]
call fcn.00491860
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
call 0xd45819
mov dword [ebp - 4], 1
mov dword [ebp - 0x8c], 0xe442a8
lea esi, [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x7c], al
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x30], esi
test ebx, ebx
lea edi, [ebp - 0x64]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
jae 0x49243b
call 0xd783bd
mov ebx, dword [ebp - 0x50]
lea eax, [ebp - 0x80]
lea edx, [ebp - 0x64]
cmp ebx, 0xffffffff
jbe 0x49244b
mov ebx, 0xffffffff
mov dword [ebp - 0x3c], ebx
cmp eax, edx
je 0x492964
mov dword [ebp - 0x40], ebx
cmp ebx, 0xfffffffe
jbe 0x492466
call 0xd7837e
mov ebx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x68]
cmp esi, ebx
jb 0x49285c
test ebx, ebx
je 0x49283d
test ebx, ebx
ja 0x4927da
mov dword [ebp - 4], 0
push 0xe4a780
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x8c]
mov dword [eax], 0xe442cc
push edx
call 0xd45a96
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x4c]
cmp eax, 0x10
jae 0x4927cc
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x4c], 0xf
xor eax, eax
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x60], al
mov eax, dword [ebp + 0xc]
mov ebx, edx
test eax, eax
je 0x492e7b
movsx eax, byte [edx + 0x15]
test eax, eax
je 0x4924e3
call 0xd45800
jmp 0x49251b
mov eax, dword [edx + 8]
movsx ecx, byte [eax + 0x15]
test ecx, ecx
je 0x492502
mov ecx, dword [edx + 4]
movsx eax, byte [ecx + 0x15]
test eax, eax
je 0x492a4b
mov dword [ebp + 0x10], ecx
jmp 0x49251b
mov edx, dword [eax]
movsx ecx, byte [edx + 0x15]
test ecx, ecx
jne 0x492518
mov eax, dword [eax]
mov edx, dword [eax]
movsx ecx, byte [edx + 0x15]
test ecx, ecx
je 0x49250c
mov dword [ebp + 0x10], eax
mov eax, dword [ebx]
movsx edx, byte [eax + 0x15]
mov edi, ebx
test edx, edx
je 0x49252c
mov esi, dword [ebx + 8]
jmp 0x492541
mov edx, dword [ebx + 8]
movsx ecx, byte [edx + 0x15]
test ecx, ecx
je 0x49253b
mov esi, eax
jmp 0x492541
mov edi, dword [ebp + 0x10]
mov esi, dword [edi + 8]
cmp edi, ebx
je 0x492d9b
mov dword [eax + 4], edi
mov eax, dword [ebx]
mov dword [edi], eax
cmp edi, dword [ebx + 8]
jne 0x492559
mov ecx, edi
jmp 0x492576
mov ecx, dword [edi + 4]
movsx eax, byte [esi + 0x15]
test eax, eax
je 0x492d93
mov dword [ecx], esi
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov edx, dword [ebx + 8]
mov dword [edx + 4], edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [eax + 4]
cmp ebx, dword [eax + 4]
je 0x492d8b
mov eax, dword [ebx + 4]
cmp ebx, dword [eax]
je 0x492594
mov dword [eax + 8], edi
jmp 0x492596
mov dword [eax], edi
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
movzx eax, byte [edi + 0x14]
movzx edx, byte [ebx + 0x14]
mov byte [edi + 0x14], dl
mov byte [ebx + 0x14], al
movsx eax, byte [ebx + 0x14]
cmp eax, 1
je 0x492a72
push ebx
call 0xd44091
pop ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 8]
test eax, eax
je 0x4925ce
add eax, 0xffffffff
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 0x94]
test edx, edx
ja 0x4926e7
mov edx, dword [ebp - 0x98]
mov eax, dword [edx + 0x18]
cmp eax, 0x10
jae 0x4926d3
mov dword [edx + 0x18], 0xf
mov eax, dword [ebp - 0x98]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x98]
mov edx, dword [eax + 0x18]
cmp edx, 0x10
jb 0x492678
mov eax, dword [eax + 4]
jmp 0x49267b
add eax, 4
mov ecx, dword [ebp - 0xa0]
mov byte [eax], 0
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x9c]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 0x98]
mov dword [ebx + 0x18], ecx
mov edi, dword [ebp - 0x98]
mov esi, dword [ebp - 0x94]
mov dword [edi + 0x14], esi
mov edx, dword [ebp - 0x98]
mov eax, dword [edx + 0x18]
cmp eax, 0x10
jb 0x4926be
mov edx, dword [edx + 4]
jmp 0x4926c1
add edx, 4
mov eax, dword [ebp - 0x94]
mov byte [edx + eax], 0
mov ebx, dword [ebp - 0x40]
jmp 0x492479
push dword [edx + 4]
call 0xd44091
pop ecx
mov edx, dword [ebp - 0x98]
jmp 0x492651
mov ecx, dword [ebp - 0x98]
mov eax, dword [ecx + 0x18]
cmp eax, 0x10
jb 0x4926fa
mov ecx, dword [ecx + 4]
jmp 0x4926fd
add ecx, 4
mov ebx, dword [ebp - 0xa0]
movzx eax, byte [ebp - 0xb4]
mov byte [ebp - 0xb8], al
push edx
add ebx, 1
push ecx
push ebx
push dword [ebp - 0x9c]
call 0xd45ae0
add esp, 0x10
jmp 0x49263f
push dword [ebp - 0x60]
call 0xd44091
pop ecx
jmp 0x4924b5
mov ebx, dword [ebp - 0x30]
mov ecx, dword [ebx + 0x18]
cmp ecx, 0x10
jb 0x4927ea
mov ebx, dword [ebx + 4]
jmp 0x4927ed
add ebx, 4
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x18]
cmp eax, 0x10
jb 0x4927fd
mov edx, dword [edx + 4]
jmp 0x492800
add edx, 4
add edx, dword [ebp - 0x28]
push dword [ebp - 0x3c]
movzx eax, byte [ebp - 0x44]
mov byte [ebp - 0x48], al
push edx
push ecx
push ebx
call 0xd45ae0
add esp, 0x10
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 0x30]
mov edx, dword [eax + 0x18]
cmp edx, 0x10
jb 0x492831
mov eax, dword [eax + 4]
jmp 0x492834
add eax, 4
mov byte [eax + ecx], 0
jmp 0x492481
mov dword [ebp - 0x6c], 0
cmp esi, 0x10
jb 0x49284e
mov eax, dword [ebp - 0x7c]
jmp 0x492851
lea eax, [ebp - 0x7c]
mov byte [eax], 0
mov ebx, dword [ebp - 0x40]
jmp 0x492479
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0xac], ebx
mov ecx, ebx
lea eax, [ebp - 0x80]
or ecx, 0xf
cmp ecx, 0xfffffffe
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xa0], ecx
jbe 0x492898
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xa0], ebx
jmp 0x4928af
mov ebx, ecx
mov ecx, esi
shr ecx, 1
mov eax, 0xaaaaaaab
mul ebx
shr edx, 1
cmp ecx, edx
ja 0x492941
mov dword [ebp - 0x9c], 0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0xb0]
add eax, 1
mov dword [ebp - 0xb0], eax
jne 0x4928db
xor eax, eax
mov dword [ebp - 0xb0], eax
jmp 0x492922
mov ecx, eax
xor edx, edx
mov eax, 0xffffffff
div ecx
cmp eax, 1
jae 0x492922
mov dword [ebp - 0xbc], 0
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xcc]
call 0xd4582a
mov dword [ebp - 0xcc], 0xe40cb4
lea eax, [ebp - 0xcc]
push 0xe4a720
push eax
call 0xd45a96
mov eax, dword [ebp - 0xb0]
push eax
call 0xd44027
pop ecx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 4], 1
jmp 0x492631
mov eax, ecx
neg eax
add eax, 0xfffffffe
cmp esi, eax
ja 0x4928af
lea eax, [esi + ecx]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xa0], eax
jmp 0x4928af
mov edx, dword [ebp - 0x6c]
cmp edx, ebx
jae 0x492973
call 0xd783bd
mov edx, dword [ebp - 0x6c]
mov eax, edx
sub eax, ebx
cmp eax, 0xffffffff
mov esi, eax
jb 0x492983
mov esi, 0xffffffff
test esi, esi
ja 0x4929f4
test edx, edx
jae 0x492993
call 0xd783bd
mov edx, dword [ebp - 0x6c]
test edx, edx
mov ebx, edx
jb 0x49299e
mov ebx, 0
test ebx, ebx
jbe 0x492481
mov ecx, dword [ebp - 0x68]
cmp ecx, 0x10
jb 0x4929b6
mov esi, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
jmp 0x4929bc
lea esi, [ebp - 0x7c]
lea eax, [ebp - 0x7c]
mov byte [ebp - 0xa8], 0
add eax, ebx
sub edx, ebx
push edx
push eax
push ecx
push esi
call 0xd45b5b
add esp, 0x10
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
sub edx, ebx
mov dword [ebp - 0x6c], edx
cmp eax, 0x10
jb 0x4929e8
mov eax, dword [ebp - 0x7c]
jmp 0x4929eb
lea eax, [ebp - 0x7c]
mov byte [eax + edx], 0
jmp 0x492481
mov ecx, dword [ebp - 0x68]
cmp ecx, 0x10
jb 0x492a04
mov edi, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x7c]
jmp 0x492a0a
lea edi, [ebp - 0x7c]
lea edx, [ebp - 0x7c]
mov byte [ebp - 0xa4], 0
add edi, ebx
sub ecx, ebx
add ebx, esi
add ebx, edx
sub eax, esi
push eax
push ebx
push ecx
push edi
call 0xd45b5b
add esp, 0x10
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
sub edx, esi
mov dword [ebp - 0x6c], edx
cmp eax, 0x10
jb 0x492a3c
mov eax, dword [ebp - 0x7c]
jmp 0x492a3f
lea eax, [ebp - 0x7c]
mov byte [eax + edx], 0
mov edx, dword [ebp - 0x6c]
jmp 0x492987
cmp edx, dword [ecx + 8]
jne 0x4924fd
mov dword [ebp + 0x10], ecx
mov edx, ecx
mov ecx, dword [ecx + 4]
movsx eax, byte [ecx + 0x15]
test eax, eax
jne 0x4924fd
cmp edx, dword [ecx + 8]
je 0x492a54
jmp 0x4924fd
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 4]
cmp esi, dword [edx + 4]
je 0x492a86
movsx eax, byte [esi + 0x14]
cmp eax, 1
je 0x492a8f
mov byte [esi + 0x14], 1
jmp 0x4925b7
mov edi, dword [ecx]
cmp esi, edi
je 0x492c1d
movsx eax, byte [edi + 0x14]
test eax, eax
je 0x492bcc
movsx eax, byte [edi + 0x15]
test eax, eax
jne 0x492ad2
mov eax, dword [edi + 8]
movsx edx, byte [eax + 0x14]
mov dword [ebp - 0xb0], eax
cmp edx, 1
jne 0x492b48
mov eax, dword [edi]
movsx edx, byte [eax + 0x14]
cmp edx, 1
jne 0x492aed
mov byte [edi + 0x14], 0
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 4]
mov esi, ecx
mov ecx, dword [ecx + 4]
cmp esi, dword [edx + 4]
je 0x492a86
movsx eax, byte [esi + 0x14]
cmp eax, 1
je 0x492a8f
jmp 0x492a86
movzx eax, byte [ecx + 0x14]
mov byte [edi + 0x14], al
mov edx, 1
mov byte [ecx + 0x14], dl
mov edi, dword [edi]
mov byte [edi + 0x14], dl
mov eax, dword [ecx]
mov edx, dword [eax + 8]
mov dword [ecx], edx
mov edi, dword [eax + 8]
movsx edx, byte [edi + 0x15]
test edx, edx
je 0x492b43
mov edi, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [edi + 4]
cmp ecx, dword [edx + 4]
je 0x492b3e
mov edx, dword [ecx + 4]
cmp ecx, dword [edx + 8]
je 0x492b30
mov dword [edx], eax
jmp 0x492b33
mov dword [edx + 8], eax
mov dword [eax + 8], ecx
mov dword [ecx + 4], eax
jmp 0x492a86
mov dword [edx + 4], eax
jmp 0x492b33
mov dword [edi + 4], ecx
jmp 0x492b13
mov eax, dword [edi]
movsx edx, byte [eax + 0x14]
cmp edx, 1
jne 0x492aed
mov eax, dword [ebp - 0xb0]
mov byte [eax + 0x14], 1
mov eax, dword [edi + 8]
mov byte [edi + 0x14], 0
mov edx, dword [eax]
mov dword [edi + 8], edx
mov edx, dword [eax]
mov dword [ebp - 0xb0], eax
movsx eax, byte [edx + 0x15]
test eax, eax
je 0x492bc7
mov edx, dword [ebp - 0xb0]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 4]
cmp edi, dword [edx + 4]
je 0x492bbc
mov eax, dword [edi + 4]
cmp edi, dword [eax]
je 0x492ba2
mov edx, dword [ebp - 0xb0]
mov dword [eax + 8], edx
jmp 0x492baa
mov edx, dword [ebp - 0xb0]
mov dword [eax], edx
mov eax, dword [ebp - 0xb0]
mov dword [eax], edi
mov dword [edi + 4], eax
mov edi, dword [ecx]
jmp 0x492aed
mov eax, dword [ebp - 0xb0]
mov dword [edx + 4], eax
jmp 0x492baa
mov dword [edx + 4], edi
jmp 0x492b79
mov byte [edi + 0x14], 1
mov eax, dword [ecx]
mov byte [ecx + 0x14], 0
mov edx, dword [eax + 8]
mov dword [ecx], edx
mov edx, dword [eax + 8]
movsx edi, byte [edx + 0x15]
test edi, edi
je 0x492c18
mov edi, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [edi + 4]
cmp ecx, dword [edx + 4]
je 0x492c13
mov edx, dword [ecx + 4]
cmp ecx, dword [edx + 8]
je 0x492c03
mov dword [edx], eax
jmp 0x492c06
mov dword [edx + 8], eax
mov dword [eax + 8], ecx
mov edi, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x492aa5
mov dword [edx + 4], eax
jmp 0x492c06
mov dword [edx + 4], ecx
jmp 0x492be6
mov edi, dword [ecx + 8]
movsx eax, byte [edi + 0x14]
test eax, eax
je 0x492d3b
movsx eax, byte [edi + 0x15]
test eax, eax
jne 0x492ad2
mov eax, dword [edi]
movsx edx, byte [eax + 0x14]
mov dword [ebp - 0xb0], eax
cmp edx, 1
jne 0x492cb3
mov eax, dword [edi + 8]
movsx edx, byte [eax + 0x14]
cmp edx, 1
je 0x492ace
movzx eax, byte [ecx + 0x14]
mov byte [edi + 0x14], al
mov edx, 1
mov byte [ecx + 0x14], dl
mov edi, dword [edi + 8]
mov byte [edi + 0x14], dl
mov eax, dword [ecx + 8]
mov edx, dword [eax]
mov dword [ecx + 8], edx
mov edi, dword [eax]
movsx edx, byte [edi + 0x15]
test edx, edx
je 0x492cae
mov edi, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [edi + 4]
cmp ecx, dword [edx + 4]
je 0x492ca9
mov edx, dword [ecx + 4]
cmp ecx, dword [edx]
je 0x492c9d
mov dword [edx + 8], eax
jmp 0x492c9f
mov dword [edx], eax
mov dword [eax], ecx
mov dword [ecx + 4], eax
jmp 0x492a86
mov dword [edx + 4], eax
jmp 0x492c9f
mov dword [edi + 4], ecx
jmp 0x492c80
mov eax, dword [edi + 8]
movsx edx, byte [eax + 0x14]
cmp edx, 1
jne 0x492c59
mov eax, dword [ebp - 0xb0]
mov byte [eax + 0x14], 1
mov eax, dword [edi]
mov byte [edi + 0x14], 0
mov edx, dword [eax + 8]
mov dword [ebp - 0xb0], eax
mov dword [edi], edx
mov edx, dword [eax + 8]
movsx eax, byte [edx + 0x15]
test eax, eax
je 0x492d36
mov edx, dword [ebp - 0xb0]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 4]
cmp edi, dword [edx + 4]
je 0x492d2b
mov eax, dword [edi + 4]
cmp edi, dword [eax + 8]
je 0x492d0e
mov edx, dword [ebp - 0xb0]
mov dword [eax], edx
jmp 0x492d17
mov edx, dword [ebp - 0xb0]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xb0]
mov dword [eax + 8], edi
mov dword [edi + 4], eax
mov edi, dword [ecx + 8]
jmp 0x492c59
mov eax, dword [ebp - 0xb0]
mov dword [edx + 4], eax
jmp 0x492d17
mov dword [edx + 4], edi
jmp 0x492ce5
mov byte [edi + 0x14], 1
mov eax, dword [ecx + 8]
mov byte [ecx + 0x14], 0
mov edx, dword [eax]
mov dword [ecx + 8], edx
mov edx, dword [eax]
movsx edi, byte [edx + 0x15]
test edi, edi
je 0x492d86
mov edi, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [edi + 4]
cmp ecx, dword [edx + 4]
je 0x492d81
mov edx, dword [ecx + 4]
cmp ecx, dword [edx]
je 0x492d72
mov dword [edx + 8], eax
jmp 0x492d74
mov dword [edx], eax
mov dword [eax], ecx
mov edi, dword [ecx + 8]
mov dword [ecx + 4], eax
jmp 0x492c2c
mov dword [edx + 4], eax
jmp 0x492d74
mov dword [edx + 4], ecx
jmp 0x492d55
mov dword [eax + 4], edi
jmp 0x492596
mov dword [esi + 4], ecx
jmp 0x492568
mov ecx, dword [ebx + 4]
movsx eax, byte [esi + 0x15]
test eax, eax
je 0x492e73
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [eax + 4]
cmp ebx, dword [eax + 4]
je 0x492e6b
cmp ebx, dword [ecx]
je 0x492dc5
mov dword [ecx + 8], esi
jmp 0x492dc7
mov dword [ecx], esi
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
cmp ebx, dword [eax]
je 0x492e23
cmp ebx, dword [eax + 8]
jne 0x4925aa
movsx edx, byte [esi + 0x15]
test edx, edx
je 0x492df6
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0xb0]
mov dword [eax + 8], edx
jmp 0x4925aa
mov edx, dword [esi + 8]
movsx edi, byte [edx + 0x15]
mov dword [ebp - 0xb0], esi
test edi, edi
jne 0x492de8
mov edx, dword [ebp - 0xb0]
mov edi, dword [edx + 8]
clc
inc ebx
and eax, 0xf6629553
adc bl, byte [edx - 0x7ac2558a]
daa
retf 0x3532
fnstenv [0x3b6136e3]
xor dword [ebp - 0x64], 0x15
mov dword [0x514bb241], eax
movsb byte es:[edi], byte [esi]
mov dword [0xe18d0b9a], eax
mov cl, pe_nt_image_headers32
in eax, 0x53
xchg ebp, eax
arpl word [eax - 0x2238418a], dx
shl dword [ecx + 0x56170e35], cl
invalid
dec ecx
push edi
neg ah
into
inc edx
sub byte [ebp*4 + 0x7e9d96c5], 0x68
invalid
lodsd eax, dword [esi]
lds edx, [esi - 0x39978163]
pop ebp
mov bl, 0x48
adc al, 0xd1
mov ah, 0xb5
out 0xd5, eax
and dword [ecx + 0x2dc362a0], edx
ret