Function at 0x416f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, ecx
mov dword [ebp - 0x30], 1
push esi
mov esi, edx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebx + 0x50]
shl eax, 5
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x4171ae
mov eax, dword [ebx + 0x54]
test byte [eax], 1
je 0x4171ae
mov eax, dword [esi + 4]
shl eax, 5
test eax, eax
jne 0x416f9e
xor al, al
jmp 0x416fa5
mov eax, dword [esi + 8]
mov al, byte [eax]
and al, 1
mov ecx, dword [ebp + 0x14]
xor al, 1
push edi
mov byte [ecx], al
lea ecx, [ebp - 0x30]
call fcn.0040df40
mov edi, eax
test edi, edi
jne 0x417163
mov eax, dword [esi]
add ebx, 0x4c
mov edi, dword [ebx]
imul eax, edi
test eax, eax
jle 0x417019
mov edx, esi
mov ecx, ebx
call fcn.0040ee40
lea ecx, [ebp - 0x24]
test eax, eax
js 0x416ffa
push esi
mov edx, ebx
call fcn.0040f150
mov ecx, eax
add esp, 4
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x417130
mov dword [ebp - 0x24], edi
jmp 0x41703d
push ebx
mov edx, esi
call fcn.0040f150
mov ecx, eax
add esp, 4
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x417130
neg edi
mov dword [ebp - 0x24], edi
jmp 0x41703d
push esi
mov edx, ebx
lea ecx, [ebp - 0x24]
call fcn.0040efd0
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x24]
test ecx, ecx
mov dword [ebp - 8], ecx
cmove eax, edi
mov dword [ebp - 0x24], eax
jne 0x417130
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x30]
movzx eax, byte [eax]
push eax
call fcn.0040e000
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x417130
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [edi + 1]
push eax
push 0
push esi
call sub.ntdll.dll_memset
xor eax, eax
add esp, 0xc
mov dword [ebp - 0xc], eax
test edi, edi
je 0x4170e7
movzx ecx, byte [ebp + 0x10]
mov dword [ebp - 0x14], ecx
xor esi, esi
test ecx, ecx
je 0x4170dc
mov edi, dword [ebp - 0x2c]
mov edx, eax
mov ecx, dword [ebp + 8]
shl edi, 5
add ecx, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], ecx
mov bl, byte [ecx]
nop dword [eax]
cmp edi, edx
ja 0x4170a8
xor eax, eax
jmp 0x4170c0
mov edi, dword [ebp - 0x28]
mov eax, edx
shr eax, 5
mov ecx, edx
and ecx, 0x1f
mov eax, dword [edi + eax*4]
mov edi, dword [ebp - 0x10]
shr eax, cl
and eax, 1
add edx, dword [ebp + 0xc]
mov ecx, esi
shl al, cl
inc esi
mov ecx, dword [ebp - 0x14]
or bl, al
cmp esi, ecx
jb 0x4170a0
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp + 0xc]
mov byte [eax], bl
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, edi
jb 0x417082
mov esi, dword [ebp + 8]
xor al, al
mov byte [ebp - 1], al
cmp edi, 1
jb 0x417130
mov bh, byte [esi]
mov dl, byte [esi + 1]
inc esi
mov dh, bh
mov bl, 1
mov bh, dl
movzx ecx, dh
and dl, byte [ebp - 1]
xor bh, al
mov al, bh
and al, 1
sub bl, al
movzx eax, bl
imul ecx, eax
mov al, bh
shl bl, 7
or bl, dh
and al, cl
xor bh, cl
mov ecx, dword [ebp + 8]
or al, dl
mov byte [ebp - 1], al
mov byte [esi], bh
mov dword [ebp + 8], esi
mov byte [ecx], bl
sub edi, 1
jne 0x4170f3
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x417171
mov eax, dword [ebp - 0x20]
shl eax, 2
push eax
mov eax, dword [sub.ntdll.dll_memset]
push 0
push ecx
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 0xc
push dword [ebp - 0x1c]
push 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
jmp 0x41717d
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x417180
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4171a5
mov eax, dword [ebp - 0x2c]
shl eax, 2
push eax
mov eax, dword [sub.ntdll.dll_memset]
push 0
push ecx
call eax
add esp, 0xc
push dword [ebp - 0x28]
push 0
call ebx
push eax
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0xffffb080
pop ebx
mov esp, ebp
pop ebp
ret