Function at 0x414994
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, 0x50df04
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov edi, eax
shr edi, 8
mov edx, dword [ebp + 0xc]
shr esi, 0x18
and edi, 0xff00
and esi, 0xff
add esi, edi
mov edi, eax
and edi, 0xff00
and eax, 0xff
shl edi, 8
shl eax, 0x18
add esi, edi
add esi, eax
mov eax, esi
not eax
jmp 0x4149f7
movzx edi, byte [edx]
mov esi, eax
inc edx
shr esi, 0x18
xor esi, edi
shl eax, 8
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, eax
dec ebx
mov eax, esi
test ebx, ebx
je 0x414a00
test dl, 3
jne 0x4149dd
cmp ebx, 0x20
jb 0x414c35
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
sub ebx, 0x20
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov eax, esi
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
cmp ebx, 0x20
mov eax, esi
jae 0x414a09
cmp ebx, 4
jb 0x414c86
xor eax, dword [edx]
add edx, 4
mov edi, eax
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0xff
sub ebx, 4
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
mov edi, eax
shr edi, 0x10
and edi, 0xff
shr eax, 0x18
xor esi, dword [ecx + edi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, dword [ecx + eax*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
cmp ebx, 4
mov eax, esi
jae 0x414c3a
test ebx, ebx
je 0x414ca6
movzx edi, byte [edx]
mov esi, eax
inc edx
shr esi, 0x18
xor esi, edi
shl eax, 8
mov esi, dword [ecx + esi*4 + reloc.ADVAPI32.DLL_DeregisterEventSource]
xor esi, eax
dec ebx
mov eax, esi
jne 0x414c8a
not eax
mov edx, eax
mov ecx, eax
shr ecx, 8
shr edx, 0x18
and ecx, 0xff00
and edx, 0xff
add edx, ecx
mov ecx, eax
and ecx, 0xff00
and eax, 0xff
shl ecx, 8
shl eax, 0x18
add edx, ecx
add edx, eax
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret