Function at 0x6348e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x178
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x10], 0xd2b765d0
push edi
push 0x65b653
mov dword [esp + 0x14], 0x299b739f
mov dword [esi], 0x6d150c
mov dword [esi + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0xc], eax
add eax, 8
push eax
call fcn.004463f0
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x634a35
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1c], ecx
test ecx, ecx
je 0x63494e
push ecx
add eax, 8
push 0x65b653
push eax
call fcn.004b3b20
mov eax, dword [esi + 0x18]
add esp, 0xc
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x18]
call fcn.00452360
push 4
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.00452bb0
push 4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
call fcn.00452bb0
push 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
call fcn.00452bb0
lea ecx, [esp + 0x18]
call fcn.004523a0
mov edx, 1
mov edi, eax
lea ebx, [edx + 3]
movzx eax, byte [edx + edi - 1]
lea ecx, [edx - 1]
and ecx, 7
add ecx, dword [esi + 0x18]
xor byte [ecx], al
mov ecx, edx
movzx eax, byte [edx + edi]
and ecx, 7
add ecx, dword [esi + 0x18]
xor byte [ecx], al
lea ecx, [edx + 1]
movzx eax, byte [edx + edi + 1]
and ecx, 7
add ecx, dword [esi + 0x18]
xor byte [ecx], al
lea ecx, [edx + 2]
movzx eax, byte [edx + edi + 2]
and ecx, 7
add ecx, dword [esi + 0x18]
add edx, 4
xor byte [ecx], al
sub ebx, 1
jne 0x6349a1
lea ecx, [esp + 0x80]
call fcn.00431460
push 8
push dword [esi + 0x18]
lea ecx, [esp + 0x88]
call fcn.004d6190
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x634a20
mov eax, dword [esi + 0x18]
push ecx
add eax, 8
lea ecx, [esp + 0x84]
push eax
push eax
call fcn.004d6230
lea ecx, [esp + 0x80]
call fcn.00403120
lea ecx, [esp + 0x18]
call fcn.00403120
push 0x65b653
mov dword [esp + 0x14], 0xd2b765d0
mov dword [esp + 0x18], 0x299b739f
mov dword [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0xc], eax
add eax, 8
push eax
call fcn.004463f0
add esp, 4
mov dword [esi + 0x20], eax
test eax, eax
je 0x634b79
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], ecx
test ecx, ecx
je 0x634a92
push ecx
add eax, 8
push 0x65b653
push eax
call fcn.004b3b20
mov eax, dword [esi + 0x20]
add esp, 0xc
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x18]
call fcn.00452360
push 4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
call fcn.00452bb0
push 4
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.00452bb0
push 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
call fcn.00452bb0
lea ecx, [esp + 0x18]
call fcn.004523a0
mov edx, 1
mov edi, eax
lea ebx, [edx + 3]
movzx eax, byte [edi + edx - 1]
lea ecx, [edx - 1]
and ecx, 7
add ecx, dword [esi + 0x20]
xor byte [ecx], al
mov ecx, edx
movzx eax, byte [edx + edi]
and ecx, 7
add ecx, dword [esi + 0x20]
xor byte [ecx], al
lea ecx, [edx + 1]
movzx eax, byte [edi + edx + 1]
and ecx, 7
add ecx, dword [esi + 0x20]
xor byte [ecx], al
lea ecx, [edx + 2]
movzx eax, byte [edi + edx + 2]
and ecx, 7
add ecx, dword [esi + 0x20]
add edx, 4
xor byte [ecx], al
sub ebx, 1
jne 0x634ae5
lea ecx, [esp + 0x80]
call fcn.00431460
push 8
push dword [esi + 0x20]
lea ecx, [esp + 0x88]
call fcn.004d6190
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x634b64
mov eax, dword [esi + 0x20]
push ecx
add eax, 8
lea ecx, [esp + 0x84]
push eax
push eax
call fcn.004d6230
lea ecx, [esp + 0x80]
call fcn.00403120
lea ecx, [esp + 0x18]
call fcn.00403120
lea ecx, [esi + 0x72]
call fcn.00431460
lea ecx, [esi + 0x174]
call fcn.00452360
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], ax
mov byte [esi + 0x32], al
mov eax, dword [esp + 0x188]
mov dword [esi + 0x14], eax
mov eax, esi
pop edi
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x1e0], 0xffffffff
pop esi
pop ebx
add esp, 0x178
ret 4