Function at 0x511170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov byte [ebp - 0xd], 0x1e
push 0
push 0
push 0
lea ecx, [ebp - 0x298]
call fcn.00511780
mov byte [ebp - 0x21], 0x8b
mov dword [ebp - 0x288], 0xee39
mov al, byte [ebp - 0x21]
mov byte [ebp - 0x2a0], al
cmp byte [ebp - 0x2a0], 0x8b
je 0x5111b3
jmp 0x511338
movzx ecx, byte [ebp - 0x21]
cmp ecx, 0x51
jg 0x51125d
movzx edx, byte [ebp - 0x21]
sub edx, 0x87
cmp edx, 0x26
je 0x511235
mov al, byte [ebp - 0x21]
mov byte [ebp - 0x2a4], al
cmp byte [ebp - 0x2a4], 0x98
je 0x5111ec
cmp byte [ebp - 0x2a4], 0xad
je 0x511229
jmp 0x511233
movzx ecx, byte [ebp - 0x21]
shl ecx, 1
mov byte [ebp - 0x21], cl
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x21]
push ecx
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0x284], eax
movzx edx, byte [ebp - 0x21]
or edx, 0x56
mov byte [ebp - 0x21], dl
call fcn.00511170
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [ebp - 0x20], eax
jmp 0x511233
movzx eax, byte [ebp - 0x21]
sar eax, 6
mov byte [ebp - 0x21], al
jmp 0x511258
movzx ecx, byte [ebp - 0x21]
and ecx, 0x43
cmp ecx, 0x62
je 0x511258
push 0
push 0x7f
mov edx, dword [ebp - 0x29c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [ebp - 0x27c], eax
jmp 0x511333
movzx eax, byte [ebp - 0x21]
add eax, 0x81
cmp eax, 0xfb
je 0x511333
movzx ecx, byte [ebp - 0x21]
xor ecx, 0xc9
mov byte [ebp - 0xd], cl
mov edx, dword [section..data]
mov dword [ebp - 0x18], edx
mov al, byte [ebp - 0x21]
mov byte [ebp - 0x2a8], al
cmp byte [ebp - 0x2a8], 0x8b
je 0x5112a7
cmp byte [ebp - 0x2a8], 0xab
je 0x51130d
jmp 0x511333
mov cl, byte [ebp - 0xd]
mov byte [ebp - 0x2ac], cl
cmp byte [ebp - 0x2ac], 0x42
je 0x5112bb
jmp 0x5112fe
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2b0], edx
cmp dword [ebp - 0x2b0], 0x5431c1c9
je 0x5112f2
cmp dword [ebp - 0x2b0], 0x58d6686d
je 0x5112de
jmp 0x5112fc
push 0x61
push 0xf1
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
call fcn.00511630
jmp 0x5112fc
mov dword [ebp - 0x284], 0x1d70b16f
jmp 0x51130b
movzx eax, byte [ebp - 0x21]
push eax
call fcn.00511710
add esp, 4
jmp 0x511333
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x284]
push edx
lea eax, [ebp - 0x21]
push eax
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov dword [ebp - 0x280], eax
jmp 0x5113da
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x2b8555a9
je 0x51135e
cmp dword [ebp - 0x2b4], 0xcf6f6124
je 0x51139a
jmp 0x5113da
call fcn.00511170
mov ecx, dword [section..data]
add ecx, 0x78b70eed
mov dword [ebp - 0x18], ecx
push 0x4a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov dword [ebp - 0x280], eax
push 0x5c
push 0x25
mov edx, 0x52
mov ecx, dword [ebp - 0x284]
call fcn.00511530
jmp 0x5113da
lea eax, [ebp - 0x278]
push eax
push str.C:DetectAppreciated
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x14], eax
mov ecx, dword [section..data]
sub ecx, 0x5d1903b1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
push 0xf8
mov eax, dword [ebp - 0x284]
push eax
mov ecx, dword [ebp - 0x284]
push ecx
call fcn.005116a0
mov edx, dword [section..data]
and edx, 0x3365591f
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x284], 0x8c2a89ec
mov eax, dword [ebp - 0x284]
add eax, 0x6710483a
mov dword [ebp - 0x284], eax
mov ecx, dword [section..data]
add ecx, 0x3991f5b3
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x288]
sub edx, 0xe5
mov dword [ebp - 0x288], edx
mov eax, dword [section..data]
add eax, 0x2f83cdda
mov dword [ebp - 0x18], eax
mov ecx, dword [section..data]
sub ecx, 0x43ff0000
mov dword [ebp - 0x18], ecx
mov edx, dword [section..data]
shl edx, 0x12
mov dword [ebp - 0x18], edx
movzx eax, byte [ebp - 0x21]
or eax, 0x10
mov byte [ebp - 0xd], al
mov ecx, dword [ebp - 0x284]
xor ecx, 0x5ecf4cde
mov dword [ebp - 0x284], ecx
movzx edx, byte [ebp - 0xd]
sar edx, 5
mov byte [ebp - 0x21], dl
mov eax, dword [section..data]
and eax, 0x34b0bc53
mov dword [ebp - 0x18], eax
mov ecx, dword [section..data]
sub ecx, 0x12298450
mov dword [ebp - 0x18], ecx
mov edx, dword [section..data]
add edx, 0xb746f90
mov dword [ebp - 0x18], edx
movzx eax, byte [ebp - 0xd]
add eax, 0xdd
mov byte [ebp - 0x21], al
mov ecx, dword [ebp - 0x284]
add ecx, 0x260cbbec
mov dword [ebp - 0x284], ecx
movzx edx, byte [ebp - 0x21]
and edx, 0xf1
mov byte [ebp - 0xd], dl
mov eax, dword [ebp - 0x284]
add eax, 0x5aa80059
mov dword [ebp - 0x284], eax
mov ecx, dword [section..data]
sub ecx, 0x37f5b89a
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x7004da81
mov dword [ebp - 0x284], edx
mov eax, dword [section..data]
add eax, 0x9d7f99b
mov dword [ebp - 0x18], eax
mov ecx, dword [section..data]
or ecx, 0x6c713a41
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x288], 0xe1b3
ja 0x5113da
mov eax, dword [section..data]
mov esp, ebp
pop ebp
ret