Function at 0x4dedd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x100
mov eax, dword [0x568008]
xor eax, esp
mov dword [esp + 0xfc], eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov dword [esp + 0xf0], 0
lea ecx, [esp + 0x94]
mov dword [esp + 0x58], ebp
push ecx
push 0
movsx edx, byte [ebp + 1]
movsx eax, byte [ebp]
push 0xe200b
push 0
push edx
push eax
mov dword [esp + 0xfc], vtable.Gdiplus::Bitmap.0
mov dword [esp + 0xac], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov esi, dword [esp + 0x94]
push 8
mov dword [esp + 0xf0], eax
mov dword [esp + 0xec], esi
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov ebx, eax
mov dword [esp + 0x40], ebx
test ebx, ebx
je 0x4dee88
lea eax, [esp + 0x94]
mov dword [esp + 0x94], 0
push eax
xorps xmm0, xmm0
push esi
movq qword [ebx], xmm0
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov dword [ebx + 4], eax
mov edi, ebx
mov eax, dword [esp + 0x94]
mov dword [ebx], eax
jmp 0x4dee8e
xor edi, edi
mov dword [esp + 0x40], edi
movaps xmm0, xmmword [0x55d480]
xor ecx, ecx
movups xmmword [esp + 0x5c], xmm0
mov dword [esp + 0x8c], 0xb150f2f
movaps xmm0, xmmword [0x55a130]
movups xmmword [esp + 0x6c], xmm0
mov word [esp + 0x90], 0x2e
movaps xmm0, xmmword [0x558810]
movups xmmword [esp + 0x7c], xmm0
nop dword [eax]
mov al, byte [esp + 0x5c]
xor byte [esp + ecx + 0x5d], al
inc ecx
cmp ecx, 0x34
jb 0x4deed0
xorps xmm0, xmm0
mov byte [esp + 0x91], 0
lea ecx, [esp + 0x5d]
mov dword [esp + 0xdc], 0
movups xmmword [esp + 0xcc], xmm0
mov dword [esp + 0xe0], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4def10
sub ecx, edx
lea eax, [esp + 0x5d]
push ecx
push eax
lea ecx, [esp + 0xd4]
call fcn.004a2240
mov ch, 0x6f
mov byte [esp + 0x16], 0
mov cl, 0x15
mov byte [esp + 0x10], ch
mov dl, 0x1d
mov dword [esp + 0x3c], 0
xor cl, ch
mov dword [esp + 0x94], 0
xor dl, ch
mov byte [esp + 0x12], cl
mov al, 0x57
mov byte [esp + 0x13], dl
mov bl, 0xa
mov byte [esp + 0x16], 0
xor al, ch
mov dword [esp + 0xac], 0
xor bl, ch
mov byte [esp + 0x11], al
mov ah, 0x26
mov byte [esp + 0x14], bl
xor ah, ch
mov dword [esp + 0xb0], 0
xorps xmm0, xmm0
mov byte [esp + 0x15], ah
lea ecx, [esp + 0x11]
movups xmmword [esp + 0x9c], xmm0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4defa0
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0xa4]
call fcn.004a2240
mov ch, 0x5a
mov byte [esp + 0x16], 0
mov cl, 0x1d
mov byte [esp + 0x10], ch
mov dl, 0x3f
mov byte [esp + 0x16], 0
xor cl, ch
xor dl, ch
mov al, 0x38
mov byte [esp + 0x12], cl
mov bl, 0x6c
mov byte [esp + 0x13], dl
xor al, ch
xor bl, ch
mov ah, 0x37
mov byte [esp + 0x11], al
xor ah, ch
mov byte [esp + 0x14], bl
lea ecx, [esp + 0x11]
mov byte [esp + 0x15], ah
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4df000
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0xa4]
call fcn.004a1de0
mov ecx, dword [esp + 0xb0]
cmp ecx, 0x10
jb 0x4df057
mov edx, dword [esp + 0x9c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4df04d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df797
push ecx
push edx
call fcn.004a60c5
add esp, 8
mov eax, dword [esp + 0x130]
xor edx, edx
mov dword [esp + 0x54], edx
test eax, eax
je 0x4df6dd
nop dword [eax]
mov dword [esp + 0x10], 0
xor esi, esi
nop word [eax + eax]
mov dword [esp + 0xac], 0
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
movups xmmword [esp + 0x9c], xmm0
cmp eax, edx
jb 0x4df7f6
sub eax, edx
mov ecx, 1
cmp eax, ecx
cmovb ecx, eax
cmp dword [esp + 0x134], 0x10
lea eax, [esp + 0x120]
cmovae eax, dword [esp + 0x120]
push ecx
add eax, edx
lea ecx, [esp + 0xa0]
push eax
call fcn.004a2240
mov eax, dword [esp + 0xdc]
xorps xmm0, xmm0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc8], 0
movups xmmword [esp + 0xb4], xmm0
cmp eax, esi
jb 0x4df7f6
sub eax, esi
mov ecx, 1
cmp eax, ecx
cmovb ecx, eax
cmp dword [esp + 0xe0], 0x10
lea eax, [esp + 0xcc]
cmovae eax, dword [esp + 0xcc]
push ecx
add eax, esi
lea ecx, [esp + 0xb8]
push eax
call fcn.004a2240
mov ebp, dword [esp + 0xb0]
lea eax, [esp + 0x9c]
mov ebx, dword [esp + 0x9c]
lea ecx, [esp + 0xb4]
push dword [esp + 0xac]
mov edi, dword [esp + 0xb8]
cmp ebp, 0x10
mov edx, dword [esp + 0xc8]
cmovae eax, ebx
cmp dword [esp + 0xcc], 0x10
push eax
cmovae ecx, edi
call fcn.004a23e0
mov byte [esp + 0x23], al
add esp, 8
mov eax, dword [esp + 0xc8]
cmp eax, 0x10
jb 0x4df1c5
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x4df1bb
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df797
push ecx
push edi
call fcn.004a60c5
add esp, 8
cmp ebp, 0x10
jb 0x4df1f5
lea ecx, [ebp + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4df1eb
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df797
push ecx
push ebx
call fcn.004a60c5
add esp, 8
cmp byte [esp + 0x1b], 0
jne 0x4df218
inc esi
cmp esi, 0x21
jge 0x4df212
mov eax, dword [esp + 0x130]
mov edx, dword [esp + 0x54]
jmp 0x4df080
mov ebx, dword [esp + 0x10]
jmp 0x4df21a
mov ebx, esi
mov eax, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
sub eax, edx
sar eax, 4
cmp eax, ebx
jbe 0x4df7f1
add ebx, ebx
mov dword [esp + 0x98], 0
lea eax, [esp + 0x98]
push eax
movzx ecx, byte [edx + ebx*8]
movzx eax, byte [edx + ebx*8 + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + ebx*8 + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + ebx*8 + 0xc]
shl ecx, 8
or ecx, eax
push ecx
call dword [sym.imp.gdiplus.dll_GdipCreateSolidFill]
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x98]
push 1
push 1
push dword [esp + 0x9c]
push esi
push ebp
push dword [ebx]
call dword [sym.imp.gdiplus.dll_GdipFillRectangleI]
test eax, eax
je 0x4df29e
mov dword [ebx + 4], eax
mov ch, 0x2d
mov byte [esp + 0x2a], 0
mov al, 0x1f
mov byte [esp + 0x24], ch
mov cl, al
mov byte [esp + 0x2a], 0
mov dl, 0x43
mov dword [esp + 0x104], 0
xor cl, ch
mov dword [esp + 0x108], 0
xor dl, ch
mov byte [esp + 0x26], cl
mov bl, 0x1b
mov byte [esp + 0x27], dl
xor al, ch
xor bl, ch
mov ah, 0x18
mov byte [esp + 0x25], al
xor ah, ch
mov byte [esp + 0x28], bl
xorps xmm0, xmm0
mov byte [esp + 0x29], ah
lea ecx, [esp + 0x25]
movups xmmword [esp + 0xf4], xmm0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4df300
sub ecx, edx
lea eax, [esp + 0x25]
push ecx
push eax
lea ecx, [esp + 0xfc]
call fcn.004a2240
mov bh, 0x4a
mov byte [esp + 0x4c], 0
mov cl, 7
mov byte [esp + 0x44], bh
mov ch, 0x18
mov byte [esp + 0x4c], 0
mov dl, 0x20
mov dword [esp + 0xac], 0
xor cl, bh
mov dword [esp + 0xb0], 0
xor ch, bh
mov byte [esp + 0x46], cl
mov al, 0x3a
mov byte [esp + 0x4a], ch
mov bl, 0x1e
lea ecx, [esp + 0x45]
mov ah, 0x1b
mov dh, 0x32
xor dl, bh
xor al, bh
xor bl, bh
mov byte [esp + 0x47], dl
xor ah, bh
mov byte [esp + 0x45], al
xor dh, bh
mov byte [esp + 0x48], bl
xorps xmm0, xmm0
mov byte [esp + 0x4b], dh
mov byte [esp + 0x49], ah
lea edx, [ecx + 1]
movups xmmword [esp + 0x9c], xmm0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4df390
sub ecx, edx
lea eax, [esp + 0x45]
push ecx
push eax
lea ecx, [esp + 0xa4]
call fcn.004a2240
mov dh, 0xc
mov byte [esp + 0x33], 0
mov dl, 0x79
mov byte [esp + 0x2c], dh
mov cl, 0x4e
mov byte [esp + 0x33], 0
xor cl, dh
xor dl, dh
mov al, 0x7d
mov byte [esp + 0x2f], dl
mov bl, 0x3e
mov byte [esp + 0x2e], cl
mov ah, 0x75
mov ch, 0x66
xor al, dh
xor bl, dh
xor ah, dh
mov byte [esp + 0x2d], al
xor ch, dh
mov byte [esp + 0x30], bl
lea edx, [esp + 0x2d]
mov byte [esp + 0x32], ch
mov byte [esp + 0x31], ah
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4df3f2
mov ebx, dword [esp + 0x9c]
lea eax, [esp + 0x2d]
sub edx, ecx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0xb0], 0x10
lea ecx, [esp + 0x9c]
push edx
mov edx, dword [esp + 0xb0]
cmovae ecx, ebx
push eax
call fcn.004a23e0
add esp, 8
test al, al
je 0x4df61a
mov dh, 2
mov byte [esp + 0x3b], 0
mov cl, 0x4e
mov byte [esp + 0x34], dh
mov dl, 0x60
mov byte [esp + 0x3b], 0
mov ch, cl
mov dword [esp + 0xc4], 0
xor cl, dh
mov dword [esp + 0xc8], 0
mov al, 0x33
mov byte [esp + 0x36], cl
mov bl, 0x51
mov ah, 0x47
xor al, dh
xor dl, dh
xor bl, dh
mov byte [esp + 0x37], dl
xor ah, dh
mov byte [esp + 0x35], al
xor ch, dh
mov byte [esp + 0x38], bl
mov byte [esp + 0x3a], ch
xorps xmm0, xmm0
lea ecx, [esp + 0x35]
mov byte [esp + 0x39], ah
movups xmmword [esp + 0xb4], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4df4a0
sub ecx, edx
lea eax, [esp + 0x35]
push ecx
push eax
lea ecx, [esp + 0xbc]
call fcn.004a2240
mov ch, 0x5c
mov byte [esp + 0x22], 0
mov cl, 0xd
mov byte [esp + 0x1c], ch
mov al, 6
mov byte [esp + 0x22], 0
mov dl, 0x2e
lea edi, [esp + 0x1d]
mov bl, 0x3e
xor al, ch
xor cl, ch
mov byte [esp + 0x1d], al
xor dl, ch
mov byte [esp + 0x1e], cl
xor bl, ch
mov byte [esp + 0x1f], dl
mov ah, 0x6b
mov byte [esp + 0x20], bl
xor ah, ch
lea ecx, [edi + 1]
mov byte [esp + 0x21], ah
nop word [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x4df500
mov ebp, dword [esp + 0xc8]
sub edi, ecx
cmp edi, ebp
ja 0x4df54c
cmp ebp, 0x10
lea eax, [esp + 0x1d]
push edi
lea esi, [esp + 0xb8]
cmovae esi, dword [esp + 0xb8]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
mov byte [edi + esi], 0
add esp, 0xc
mov esi, dword [esp + 0xc8]
mov ebx, dword [esp + 0xb4]
jmp 0x4df5dd
cmp edi, 0x7fffffff
ja 0x4df7ec
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4df56c
mov esi, 0x7fffffff
jmp 0x4df58a
mov ecx, ebp
mov eax, 0x7fffffff
shr ecx, 1
sub eax, ecx
cmp ebp, eax
jbe 0x4df582
mov esi, 0x7fffffff
jmp 0x4df58a
lea eax, [ecx + ebp]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
call fcn.004a2390
mov ebx, eax
lea eax, [esp + 0x1d]
push edi
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [edi + ebx], 0
cmp ebp, 0x10
jb 0x4df5dd
mov ecx, dword [esp + 0xb4]
inc ebp
mov eax, ecx
cmp ebp, 0x1000
jb 0x4df5d3
mov ecx, dword [eax - 4]
add ebp, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df797
push ebp
push ecx
call fcn.004a60c5
add esp, 8
cmp esi, 0x10
jb 0x4df60b
inc esi
mov eax, ebx
cmp esi, 0x1000
jb 0x4df601
mov ebx, dword [eax - 4]
add esi, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df797
push esi
push ebx
call fcn.004a60c5
add esp, 8
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x98]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0xb0]
cmp eax, 0x10
jb 0x4df651
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4df647
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df797
push ecx
push ebx
call fcn.004a60c5
add esp, 8
mov ecx, dword [esp + 0x108]
cmp ecx, 0x10
jb 0x4df68d
mov edx, dword [esp + 0xf4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4df683
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df797
push ecx
push edx
call fcn.004a60c5
add esp, 8
mov eax, dword [esp + 0x58]
lea edi, [esi + 1]
push ebp
movsx esi, byte [eax]
call dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
mov ecx, dword [esp + 0x94]
xor ebp, ebp
mov edx, dword [esp + 0x54]
inc edx
cmp edi, esi
mov dword [esp + 0x54], edx
lea eax, [ecx + 1]
cmovne ebp, edi
cmovne eax, ecx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x130]
cmp edx, eax
jb 0x4df070
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x58]
movsx eax, byte [ebp]
mov dword [esp + 0x4c], eax
movsx eax, byte [ebp + 1]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x44]
push ecx
push eax
lea ecx, [esp + 0xec]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
call fcn.004a51e0
mov esi, eax
test edi, edi
je 0x4df724
push dword [edi]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push edi
call dword [sym.imp.gdiplus.dll_GdipFree]
mov ecx, dword [esp + 0xe0]
cmp ecx, 0x10
jb 0x4df75c
mov edx, dword [esp + 0xcc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4df752
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df797
push ecx
push edx
call fcn.004a60c5
add esp, 8
push dword [esp + 0xe8]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov ecx, dword [esp + 0x134]
cmp ecx, 0x10
jb 0x4df7a7
mov edx, dword [esp + 0x120]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4df79d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4df79d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004a60c5
add esp, 8
lea ecx, [esp + 0x114]
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], 0xf
mov byte [esp + 0x120], 0
call fcn.004a2490
mov ecx, dword [esp + 0x10c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a6087
add esp, 0x100
ret
call fcn.004a18f0
call fcn.004a38f0
call fcn.004a20c0
int3