Function at 0x411287
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
call fcn.004119d9
test eax, eax
jne 0x4112a7
xor al, al
jmp 0x411847
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Polymorphing_file___s__to___s_..._n
call fcn.00411222
mov ecx, dword [ebp - 4]
add esp, 0xc
cmp word [ecx], 0x5a4d
je 0x4112cc
xor bl, bl
jmp 0x41183c
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov ecx, eax
add eax, 4
cmp dword [ecx], 0x4550
mov dword [ebp - 0xc], eax
jne 0x4112c5
add dword [ebp - 0xc], 0x14
push esi
push edi
mov ebx, eax
push 0x322
push str.___sizeof_Encoder:__0x_8.8X_n
mov dword [ebp - 0x28], ebx
call fcn.00411222
mov eax, dword [ebp - 0xc]
xor esi, esi
and dword [ebp - 0x10], esi
xor edi, edi
add eax, 0xe0
cmp word [ebx + 2], si
pop ecx
pop ecx
mov dword [ebp - 8], edi
mov dword [ebp + 8], eax
jbe 0x411377
push dword [0x431964]
push dword [ebp + 8]
call sub.MSVCRT.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x41133b
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0x322
jb 0x41133b
mov dword [ebp - 8], eax
push str..text
push dword [ebp + 8]
call sub.MSVCRT.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x411351
mov esi, dword [ebp + 8]
push str..data
push dword [ebp + 8]
call sub.MSVCRT.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x411367
mov edi, dword [ebp + 8]
movzx eax, word [ebx + 2]
inc dword [ebp - 0x10]
add dword [ebp + 8], 0x28
cmp dword [ebp - 0x10], eax
jl 0x411318
push dword [ebp - 8]
push str.___Encoder_section:_0x_8.8X_n
call fcn.00411222
push esi
push str.___Code_section:____0x_8.8X_n
call fcn.00411222
push edi
push str.___Data_section:____0x_8.8X_n
call fcn.00411222
add esp, 0x18
cmp dword [ebx + 4], 0xffffffff
jne 0x411568
push str.___File_is_already_encryped__decrypting..._n
call fcn.00411222
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
add eax, 0x6f
push 4
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], ecx
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx + 0x77]
push 4
push eax
lea eax, [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx + 0x73]
push 4
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 0x14]
inc eax
push eax
call sub.MSVCRT.dll_malloc
xor edx, edx
add esp, 0x2c
cmp eax, edx
mov dword [ebp - 0x10], eax
je 0x411568
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
add eax, dword [ebp - 4]
dec ecx
je 0x411495
dec ecx
je 0x41146d
dec ecx
je 0x41144d
dec ecx
jne 0x4114aa
cmp dword [esi + 0x10], edx
jbe 0x4114aa
mov ecx, dword [edx + eax]
mov ebx, ecx
shl ebx, 0x1f
shr ecx, 1
or ebx, ecx
mov dword [edx + eax], ebx
add edx, 4
cmp edx, dword [esi + 0x10]
jb 0x411434
jmp 0x4114aa
xor ecx, ecx
cmp dword [esi + 0x10], edx
jbe 0x4114aa
mov edx, dword [ecx + eax]
mov ebx, edx
shr ebx, 0x1f
add edx, edx
or ebx, edx
mov dword [ecx + eax], ebx
add ecx, 4
cmp ecx, dword [esi + 0x10]
jb 0x411454
jmp 0x4114aa
cmp dword [esi + 0x10], edx
jbe 0x4114aa
push 0xfffffffffffffffe
pop edx
lea ecx, [eax + 2]
sub edx, eax
mov ax, word [ecx - 2]
mov bx, word [ecx]
mov word [ecx - 2], bx
mov word [ecx], ax
add ecx, 4
lea eax, [edx + ecx]
cmp eax, dword [esi + 0x10]
jb 0x41147a
jmp 0x4114aa
xor ecx, ecx
cmp dword [esi + 0x10], edx
jbe 0x4114aa
mov edx, dword [ebp - 0x18]
xor dword [ecx + eax], edx
add ecx, 4
cmp ecx, dword [esi + 0x10]
jb 0x41149c
mov eax, dword [edi + 0x14]
mov ecx, dword [ebp + 8]
add eax, dword [ebp - 4]
dec ecx
je 0x411528
dec ecx
je 0x4114ff
dec ecx
je 0x4114df
dec ecx
jne 0x41153d
xor edx, edx
cmp dword [edi + 0x10], edx
jbe 0x41153d
mov ecx, dword [edx + eax]
mov ebx, ecx
shl ebx, 0x1f
shr ecx, 1
or ebx, ecx
mov dword [edx + eax], ebx
add edx, 4
cmp edx, dword [edi + 0x10]
jb 0x4114c6
jmp 0x41153d
xor ecx, ecx
cmp dword [edi + 0x10], ecx
jbe 0x41153d
mov edx, dword [ecx + eax]
mov ebx, edx
shr ebx, 0x1f
add edx, edx
or ebx, edx
mov dword [ecx + eax], ebx
add ecx, 4
cmp ecx, dword [edi + 0x10]
jb 0x4114e6
jmp 0x41153d
cmp dword [edi + 0x10], 0
jbe 0x41153d
push 0xfffffffffffffffe
pop edx
lea ecx, [eax + 2]
sub edx, eax
mov ax, word [ecx - 2]
mov bx, word [ecx]
mov word [ecx - 2], bx
mov word [ecx], ax
add ecx, 4
lea eax, [ecx + edx]
cmp eax, dword [edi + 0x10]
jb 0x41150d
jmp 0x41153d
xor ecx, ecx
cmp dword [edi + 0x10], ecx
jbe 0x41153d
mov edx, dword [ebp - 0x18]
xor dword [ecx + eax], edx
add ecx, 4
cmp ecx, dword [edi + 0x10]
jb 0x41152f
push 4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x10
push eax
call sub.MSVCRT.dll_memcpy
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
call sub.MSVCRT.dll_memcpy
push dword [ebp - 0x10]
call sub.MSVCRT.dll_free
add esp, 0x1c
cmp dword [ebp - 8], 0
je 0x41182d
test esi, esi
je 0x41182d
test edi, edi
je 0x41182d
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x14]
add eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x14], eax
call fcn.00411aac
mov ebx, 0xfe
push ebx
push 1
call fcn.00411aba
push ebx
push 1
mov byte [ebp + 8], al
call fcn.00411aba
push ebx
push 1
mov byte [ebp + 9], al
call fcn.00411aba
push ebx
push 1
mov byte [ebp + 0xa], al
call fcn.00411aba
mov byte [ebp + 0xb], al
push dword [ebp + 8]
push str.___Encryption_key:__0x_8.8X..._n
call fcn.00411222
push 4
push 1
call fcn.00411aba
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
or dword [eax + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
inc eax
push eax
call sub.MSVCRT.dll_malloc
add esp, 0x34
test eax, eax
mov dword [ebp - 0x18], eax
je 0x41182d
push dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
push dword [eax + 0x10]
lea ebx, [eax + 0x10]
push dword [edi + 0x10]
mov eax, dword [ebp - 8]
push dword [edi + 0xc]
add eax, 0xc
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [eax]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0041184b
mov eax, dword [ebp - 8]
push 4
add eax, 0xc
push eax
push ebx
call sub.MSVCRT.dll_memcpy
mov ecx, dword [ebp - 8]
mov eax, 0xe0000020
mov dword [ecx + 0x24], eax
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x24], 0xc0000040
mov ebx, dword [esi + 0x14]
add ebx, dword [ebp - 4]
add esp, 0xc
dec eax
je 0x411714
dec eax
je 0x4116dc
dec eax
je 0x4116ad
dec eax
jne 0x411738
push dword [ebp + 8]
push str.___Code:_Using_bitwise_left_rotate_encoding..._n
call fcn.00411222
xor eax, eax
cmp dword [esi + 0x10], eax
pop ecx
pop ecx
jbe 0x411738
mov ecx, dword [eax + ebx]
mov edx, ecx
shr edx, 0x1f
add ecx, ecx
or edx, ecx
mov dword [eax + ebx], edx
add eax, 4
cmp eax, dword [esi + 0x10]
jb 0x411691
jmp 0x411738
push dword [ebp + 8]
push str.___Code:_Using_bitwise_right_rotate_encoding..._n
call fcn.00411222
pop ecx
pop ecx
xor ecx, ecx
cmp dword [esi + 0x10], ecx
jbe 0x411738
mov eax, dword [ecx + ebx]
mov edx, eax
shl edx, 0x1f
shr eax, 1
or edx, eax
mov dword [ecx + ebx], edx
add ecx, 4
cmp ecx, dword [esi + 0x10]
jb 0x4116c3
jmp 0x411738
push dword [ebp + 8]
push str.___Code:_Using_Word_swap_encoding..._n
call fcn.00411222
cmp dword [esi + 0x10], 0
pop ecx
pop ecx
jbe 0x411738
push 0xfffffffffffffffe
pop edx
lea eax, [ebx + 2]
sub edx, ebx
mov cx, word [eax - 2]
mov bx, word [eax]
mov word [eax - 2], bx
mov word [eax], cx
add eax, 4
lea ecx, [edx + eax]
cmp ecx, dword [esi + 0x10]
jb 0x4116f9
jmp 0x411738
push dword [ebp + 8]
push str.___Code:_Using_XOR_encoding..._n
call fcn.00411222
xor eax, eax
cmp dword [esi + 0x10], eax
pop ecx
pop ecx
jbe 0x411738
mov ecx, dword [ebp + 8]
xor dword [eax + ebx], ecx
add eax, 4
cmp eax, dword [esi + 0x10]
jb 0x41172a
mov esi, dword [edi + 0x14]
mov eax, dword [ebp - 0x10]
add esi, dword [ebp - 4]
dec eax
je 0x4117f2
dec eax
je 0x4117ba
dec eax
je 0x41178b
dec eax
jne 0x411814
push dword [ebp + 8]
push str.___Data:_Using_bitwise_left_rotate_encoding..._n
call fcn.00411222
xor eax, eax
cmp dword [edi + 0x10], eax
pop ecx
pop ecx
jbe 0x411814
mov ecx, dword [eax + esi]
mov edx, ecx
shr edx, 0x1f
add ecx, ecx
or edx, ecx
mov dword [eax + esi], edx
add eax, 4
cmp eax, dword [edi + 0x10]
jb 0x41176f
jmp 0x411814
push dword [ebp + 8]
push str.___Data:_Using_bitwise_right_rotate_encoding..._n
call fcn.00411222
pop ecx
pop ecx
xor ecx, ecx
cmp dword [edi + 0x10], ecx
jbe 0x411814
mov eax, dword [ecx + esi]
mov edx, eax
shl edx, 0x1f
shr eax, 1
or edx, eax
mov dword [ecx + esi], edx
add ecx, 4
cmp ecx, dword [edi + 0x10]
jb 0x4117a1
jmp 0x411814
push dword [ebp + 8]
push str.___Data:_Using_Word_swap_encoding..._n
call fcn.00411222
cmp dword [edi + 0x10], 0
pop ecx
pop ecx
jbe 0x411814
push 0xfffffffffffffffe
pop edx
lea eax, [esi + 2]
sub edx, esi
mov cx, word [eax - 2]
mov si, word [eax]
mov word [eax - 2], si
mov word [eax], cx
add eax, 4
lea ecx, [edx + eax]
cmp ecx, dword [edi + 0x10]
jb 0x4117d7
jmp 0x411814
mov ebx, dword [ebp + 8]
push ebx
push str.___Data:_Using_XOR_encoding..._n
call fcn.00411222
xor eax, eax
cmp dword [edi + 0x10], eax
pop ecx
pop ecx
jbe 0x411814
xor dword [eax + esi], ebx
add eax, 4
cmp eax, dword [edi + 0x10]
jb 0x411809
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x24]
call sub.MSVCRT.dll_memcpy
push dword [ebp - 0x18]
call sub.MSVCRT.dll_free
add esp, 0x10
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
call fcn.00411a61
pop edi
mov bl, 1
pop esi
mov ecx, dword [ebp - 0x1c]
call fcn.00411a57
mov al, bl
pop ebx
leave
ret 8