Function at 0x41b227
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x48d84c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x45c]
push edi
push eax
call fcn.00421b32
mov eax, dword [ebp - 0x45c]
pop ecx
push 0xc
pop ecx
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x458]
mov esi, 0x47c430
lea edi, [ebp - 0x3c]
push 0x16
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x460], eax
pop ecx
xor ebx, ebx
mov dx, word [ebp + ecx*2 - 0x3e]
lea eax, [ebp + ecx*2 - 0x3c]
xor word [eax], dx
dec ecx
cmp ecx, ebx
jg 0x41b274
push ebx
push ebx
push 3
push ebx
push 1
mov eax, 0x18be
xor word [ebp - 0x3c], ax
push 0x80000000
lea eax, [ebp - 0x3c]
push eax
push 0x47c424
mov esi, str.KERNEL32
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
mov edi, eax
mov eax, 0x4c4b40
mov dword [ebp - 0x450], eax
cmp edi, 0xffffffff
jne 0x41b2d3
push eax
call fcn.0041f5c9
pop ecx
mov dword [ebp - 0x454], eax
jmp 0x41b326
push ebx
push edi
push str.GetFileSize
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
push eax
mov dword [ebp - 0x450], eax
call fcn.0041f5c9
pop ecx
push ebx
lea ecx, [ebp - 0x450]
push ecx
push dword [ebp - 0x450]
mov dword [ebp - 0x454], eax
push eax
push edi
push 0x47c3f8
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
push edi
push 0x47c3ec
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x464]
mov eax, dword [ebp - 0x460]
mov edi, dword [ebp + 8]
xor edx, edx
sub ecx, dword [ebp - 0x45c]
sbb eax, dword [ebp - 0x458]
cmp eax, edx
jg 0x41b42e
jl 0x41b355
cmp ecx, edi
ja 0x41b42e
cmp dword [ebp + 0xc], ebx
je 0x41b392
mov edx, 0x7d0
xor ecx, ecx
cmp dword [ebp - 0x450], ebx
jbe 0x41b38d
mov eax, dword [ebp - 0x454]
lea edi, [ecx + eax]
mov al, byte [ebp - 0x45c]
xor byte [edi], al
mov al, byte [edi]
sub al, byte [ebp - 0x45c]
inc ecx
mov byte [edi], al
cmp ecx, dword [ebp - 0x450]
jb 0x41b369
dec edx
jne 0x41b35f
jmp 0x41b3e3
xor edi, edi
cmp dword [ebp - 0x450], ebx
jbe 0x41b3e3
mov eax, dword [ebp - 0x454]
lea ecx, [edi + eax]
mov al, byte [ebp - 0x45c]
xor byte [ecx], al
mov al, byte [ecx]
sub al, byte [ebp - 0x45c]
mov byte [ecx], al
mov eax, edi
and eax, 0x800003ff
jns 0x41b3c7
dec eax
or eax, 0xfffffc00
inc eax
jne 0x41b3da
push 1
push 0x47c3e4
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
inc edi
cmp edi, dword [ebp - 0x450]
jb 0x41b39c
push 0x64
push 0x47c3e4
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
lea eax, [ebp - 0x464]
push eax
call fcn.00421b32
mov eax, dword [ebp - 0x460]
pop ecx
mov ecx, dword [ebp - 0x464]
sub ecx, dword [ebp - 0x45c]
sbb eax, dword [ebp - 0x458]
xor edx, edx
cmp eax, edx
jl 0x41b355
jg 0x41b42e
cmp ecx, dword [ebp + 8]
jbe 0x41b355
lea eax, [ebp - 0x44c]
push eax
push 0x104
push str.GetTempPathW
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
mov eax, dword [str.e_v_]
mov dword [ebp - 0xc], eax
mov eax, dword [0x47c3d0]
push 2
mov dword [ebp - 8], eax
pop ecx
mov dx, word [ebp + ecx*2 - 0xe]
lea eax, [ebp + ecx*2 - 0xc]
xor word [eax], dx
dec ecx
cmp ecx, ebx
jg 0x41b45c
mov eax, 0x5b6f
xor word [ebp - 0xc], ax
lea eax, [ebp - 0x244]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x44c]
push eax
push str.GetTempFileNameW
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x244]
push eax
push 0x47c424
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x41b4fa
push ebx
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
push dword [ebp - 0x454]
push edi
push 0x47c3ac
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
push edi
push 0x47c3ec
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
lea eax, [ebp - 0x244]
push eax
push str.DeleteFileW
push esi
call fcn.0041b1f4
pop ecx
pop ecx
call eax
push dword [ebp - 0x454]
call fcn.0041f057
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0041ef3e
leave
ret