Function at 0x40a705
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
xor edx, edx
push ebx
push ebp
push esi
push edi
sub eax, edx
je 0x40ad38
sub eax, 1
je 0x40ab83
sub eax, 1
je 0x40ab68
sub eax, 1
je 0x40a7c6
sub eax, 1
jne 0x40ad4c
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x40]
test edi, edi
jle 0x40a76e
mov esi, dword [esp + 0x3c]
mov ecx, ebp
mov ebx, dword [esp + 0x34]
sub esi, ebp
sub ebx, ebp
mov edx, edi
mov ebp, edi
mov al, byte [esi + ecx]
add al, byte [ecx]
mov byte [ebx + ecx], al
inc ecx
sub ebp, 1
jne 0x40a75c
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
cmp edi, 2
jle 0x40a7a6
cmp ebx, 4
jle 0x40a7a6
cmp edi, 4
lea esi, [ebx - 3]
push edi
cmove esi, ebx
mov eax, esi
sub eax, edx
push eax
lea eax, [edx + ebp]
push eax
mov eax, dword [esp + 0x48]
add eax, edx
push eax
mov eax, dword [esp + 0x44]
add eax, edx
push eax
mov eax, dword [esp + 0x44]
call dword [eax + 4]
mov edx, esi
push edi
sub ebx, edx
lea eax, [edx + ebp]
push ebx
push eax
mov eax, dword [esp + 0x48]
add eax, edx
push eax
mov eax, dword [esp + 0x44]
add eax, edx
push eax
call fcn.004099dc
jmp 0x40ad4c
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
test ebp, ebp
jle 0x40a80a
sub ebx, edi
mov eax, esi
mov dword [esp + 0x30], ebx
sub eax, edi
mov ecx, edi
mov ebx, ebp
mov edi, dword [esp + 0x30]
mov edx, ebp
mov ebp, eax
mov al, byte [edi + ecx]
shr al, 1
add al, byte [ecx]
mov byte [ecx + ebp], al
inc ecx
sub ebx, 1
jne 0x40a7f0
mov edi, dword [esp + 0x3c]
mov ebp, edx
mov ebx, dword [esp + 0x40]
cmp ebp, 1
jne 0x40a86f
movzx eax, byte [esi]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
dec eax
cmp edx, eax
jg 0x40ab21
lea ecx, [edx + edi]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ecx
sub eax, edx
mov ecx, esi
sub ebx, edi
sub ecx, edi
mov edi, dword [esp + 0x38]
inc eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x30], eax
add edx, eax
mov ebp, eax
mov esi, ecx
mov eax, dword [esp + 0x14]
movzx ecx, byte [edi + ebx]
add ecx, eax
movzx eax, byte [edi]
sar ecx, 1
add ecx, eax
movzx eax, cl
mov byte [edi + esi], al
inc edi
sub ebp, 1
jne 0x40a84d
mov ebx, dword [esp + 0x40]
jmp 0x40ab15
cmp ebp, 2
jne 0x40a92a
movzx eax, byte [esi]
mov dword [esp + 0x30], eax
movzx eax, byte [esi + 1]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
add eax, 0xfffffffe
cmp edx, eax
jg 0x40ab21
lea ecx, [edx + esi]
sub eax, edx
mov dword [esp + 0x10], ecx
lea ecx, [edi + 1]
add ecx, edx
shr eax, 1
mov dword [esp + 0x14], ecx
mov ecx, ebx
sub ecx, edi
mov dword [esp + 0x1c], ecx
mov ecx, esi
sub ecx, edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x10]
sub ecx, esi
mov esi, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x24], ecx
mov ebp, eax
mov dword [esp + 0x18], eax
lea edx, [edx + eax*2]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x20]
movzx ecx, byte [ecx + ebx]
add ecx, dword [esp + 0x30]
movzx eax, byte [edi - 1]
sar ecx, 1
add ecx, eax
movzx eax, cl
mov byte [ebx], al
lea ebx, [ebx + 2]
movzx ecx, byte [edi + esi]
add ecx, dword [esp + 0x38]
mov dword [esp + 0x30], eax
movzx eax, byte [edi]
sar ecx, 1
add ecx, eax
movzx eax, cl
mov ecx, dword [esp + 0x24]
mov byte [edi + edx], al
lea edi, [edi + 2]
mov dword [esp + 0x38], eax
sub ebp, 1
jne 0x40a8e0
mov edx, dword [esp + 0x28]
jmp 0x40a866
cmp ebp, 3
jne 0x40aa00
movzx eax, byte [esi]
mov dword [esp + 0x30], eax
movzx eax, byte [esi + 1]
mov dword [esp + 0x38], eax
movzx eax, byte [esi + 2]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
lea ecx, [eax - 3]
mov dword [esp + 0x1c], ecx
cmp edx, ecx
jg 0x40ab25
lea eax, [esi + 2]
add eax, edx
lea ebp, [edi + 1]
mov dword [esp + 0x40], eax
add ebp, edx
mov eax, ebx
sub eax, edi
mov dword [esp + 0x28], eax
mov eax, esi
sub eax, edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x24], eax
mov eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x20], eax
movzx ecx, byte [edx + ebx]
add edx, 3
add ecx, dword [esp + 0x30]
movzx eax, byte [ebp - 1]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x40]
movzx ecx, cl
mov dword [esp + 0x30], ecx
mov byte [eax - 2], cl
movzx ecx, byte [edi + ebp]
add ecx, dword [esp + 0x38]
movzx eax, byte [ebp]
sar ecx, 1
add ecx, eax
movzx eax, cl
mov ecx, dword [esp + 0x40]
mov byte [esi + ebp], al
lea ebp, [ebp + 3]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
movzx ecx, byte [ecx + eax]
add ecx, dword [esp + 0x10]
movzx eax, byte [ebp - 2]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x40]
movzx ecx, cl
mov dword [esp + 0x10], ecx
mov byte [eax], cl
add eax, 3
mov dword [esp + 0x40], eax
cmp edx, dword [esp + 0x1c]
jle 0x40a98b
jmp 0x40ab15
cmp ebp, 4
jne 0x40ab21
movzx eax, byte [esi]
mov dword [esp + 0x38], eax
movzx eax, byte [esi + 1]
mov dword [esp + 0x10], eax
movzx eax, byte [esi + 2]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 3]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
lea ecx, [eax - 4]
mov dword [esp + 0x1c], ecx
cmp edx, ecx
jg 0x40ab25
lea eax, [esi + 2]
add eax, edx
mov dword [esp + 0x30], eax
lea eax, [edi + 1]
add eax, edx
mov dword [esp + 0x40], eax
mov eax, ebx
sub eax, edi
mov dword [esp + 0x28], eax
mov eax, esi
mov ebp, dword [esp + 0x28]
sub eax, edi
mov dword [esp + 0x24], eax
mov eax, ebx
mov edi, dword [esp + 0x24]
sub eax, esi
mov dword [esp + 0x20], eax
mov esi, eax
mov eax, dword [esp + 0x40]
movzx eax, byte [eax - 1]
movzx ecx, byte [edx + ebx]
add ecx, dword [esp + 0x38]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x30]
movzx ecx, cl
mov dword [esp + 0x38], ecx
mov byte [eax - 2], cl
mov eax, dword [esp + 0x40]
movzx ecx, byte [eax + ebp]
add ecx, dword [esp + 0x10]
movzx eax, byte [eax]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x40]
movzx ecx, cl
mov dword [esp + 0x10], ecx
mov byte [eax + edi], cl
mov ecx, dword [esp + 0x30]
movzx eax, byte [eax + 1]
movzx ecx, byte [ecx + esi]
add ecx, dword [esp + 0x14]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x30]
movzx ecx, cl
mov dword [esp + 0x14], ecx
mov byte [eax], cl
movzx ecx, byte [edx + ebx + 3]
add edx, 4
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
sar ecx, 1
movzx eax, byte [eax + 2]
add ecx, eax
movzx eax, cl
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], eax
mov byte [ecx + 1], al
add ecx, 4
mov eax, dword [esp + 0x40]
add eax, 4
mov dword [esp + 0x30], ecx
mov dword [esp + 0x40], eax
cmp edx, dword [esp + 0x1c]
jle 0x40aa73
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
cmp edx, eax
jge 0x40ad4c
mov ecx, esi
lea eax, [edx + edi]
sub ecx, ebp
mov dword [esp + 0x34], eax
sub ebx, edi
mov dword [esp + 0x3c], ecx
sub esi, edi
mov edi, ecx
movzx ecx, byte [eax + ebx]
movzx eax, byte [edi + edx]
add ecx, eax
mov eax, dword [esp + 0x34]
shr ecx, 1
add cl, byte [eax]
inc edx
mov byte [eax + esi], cl
inc eax
mov dword [esp + 0x34], eax
cmp edx, dword [esp + 0x44]
jl 0x40ab42
jmp 0x40ad4c
push dword [esp + 0x44]
mov eax, dword [esp + 0x34]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
call dword [eax]
jmp 0x40ad4c
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
test edi, edi
jle 0x40abac
mov ebp, esi
mov ebx, ecx
sub ebp, ecx
mov edx, edi
mov ecx, edi
mov al, byte [ebx + ebp]
mov byte [ebx], al
inc ebx
sub ecx, 1
jne 0x40ab9d
mov ecx, dword [esp + 0x34]
cmp edi, 4
jne 0x40abf8
mov edi, dword [esp + 0x44]
mov ebx, dword [ecx]
cmp edx, edi
jge 0x40ad4c
sub edi, edx
lea ebp, [edx + ecx]
sub esi, ecx
dec edi
shr edi, 2
inc edi
mov edx, dword [esi + ebp]
mov eax, ebx
xor ebx, dword [esi + ebp]
and edx, 0x7f7f7f7f
and eax, 0x7f7f7f7f
and ebx, 0x80808080
add edx, eax
xor ebx, edx
mov dword [ebp], ebx
lea ebp, [ebp + 4]
sub edi, 1
jne 0x40abcb
jmp 0x40ad4c
mov ebx, dword [esp + 0x44]
cmp edi, 1
jne 0x40ac36
movzx eax, byte [ecx]
lea ebp, [ebx - 1]
mov dword [esp + 0x40], eax
cmp edx, ebp
jg 0x40ad08
sub esi, ecx
lea edi, [edx + ecx]
sub ebp, edx
mov ecx, eax
inc ebp
add edx, ebp
movzx eax, byte [edi + esi]
add ecx, eax
mov byte [edi], cl
inc edi
sub ebp, 1
jne 0x40ac1f
mov esi, dword [esp + 0x3c]
jmp 0x40ad00
cmp edi, 2
jne 0x40ac90
movzx eax, byte [ecx]
mov dword [esp + 0x40], eax
movzx eax, byte [ecx + 1]
mov dword [esp + 0x30], eax
lea eax, [ebx - 2]
mov dword [esp + 0x38], eax
cmp edx, eax
jg 0x40ad08
mov ebx, dword [esp + 0x30]
lea ebp, [ecx + 1]
mov eax, esi
add ebp, edx
sub eax, ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x3c], eax
mov edi, eax
movzx eax, byte [edx + esi]
add edx, 2
add ecx, eax
mov byte [ebp - 1], cl
movzx eax, byte [edi + ebp]
add ebx, eax
mov byte [ebp], bl
lea ebp, [ebp + 2]
cmp edx, dword [esp + 0x38]
jle 0x40ac70
jmp 0x40acfc
cmp edi, 3
jne 0x40ad08
movzx eax, byte [ecx]
mov dword [esp + 0x30], eax
movzx eax, byte [ecx + 1]
mov dword [esp + 0x38], eax
movzx eax, byte [ecx + 2]
mov dword [esp + 0x3c], eax
lea eax, [ebx - 3]
mov dword [esp + 0x28], eax
cmp edx, eax
jg 0x40ad08
mov ebx, dword [esp + 0x38]
lea ebp, [ecx + 1]
mov eax, esi
add ebp, edx
sub eax, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov edi, eax
movzx eax, byte [edx + esi]
add ecx, eax
mov byte [ebp - 1], cl
movzx eax, byte [edi + ebp]
add ebx, eax
mov byte [ebp], bl
lea ebp, [ebp + 3]
movzx eax, byte [edx + esi + 2]
add edx, 3
add dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov byte [ebp - 2], al
cmp edx, dword [esp + 0x28]
jle 0x40acce
mov ebx, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x48]
cmp edx, ebx
jge 0x40ad4c
mov ebp, edx
lea eax, [edx + ecx]
sub ebp, edi
mov dword [esp + 0x44], eax
add ebp, ecx
sub esi, ecx
sub ebx, edx
mov al, byte [esi + eax]
mov ecx, dword [esp + 0x44]
add al, byte [ebp]
inc ebp
mov byte [ecx], al
mov eax, ecx
inc eax
mov dword [esp + 0x44], eax
sub ebx, 1
jne 0x40ad1d
jmp 0x40ad4c
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x3c]
call sub.ntdll.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x1c