Function at 0x4cfa28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ee4
xor eax, eax
push ebp
push 0x4cfccd
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetActiveWindow
push eax
push esi
mov esi, 0x45
xor eax, 0x4b
mov esi, 0x148
or eax, 0x51
pop esi
pop eax
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405f50
push ecx
push edi
add ecx, 0xa7
dec ecx
nop
nop
add ecx, 0xfc
dec ecx
nop
nop
pop edi
pop ecx
call sub.KERNEL32.DLL_GetUserDefaultLCID
push edi
push edx
inc edx
or edx, 0x64
xchg edx, edx
or edx, 0x59
nop
nop
nop
nop
nop
pop edx
pop edi
mov dl, 1
mov eax, dword [0x4243dc]
call fcn.0042a2fc
mov dword [ebp - 0x14], eax
call sub.KERNEL32.DLL_GetCurrentProcessId
push esi
push ebx
inc esi
push esi
pop esi
mov ebx, 0x9c
push ebx
pop ebx
nop
nop
nop
nop
mov ebx, 0x110
xor esi, 0x5f
and esi, 0x11d
nop
nop
or esi, 0xe7
pop ebx
pop esi
mov dx, 0x20
mov eax, dword [ebp - 0x14]
call fcn.00429910
call sub.KERNEL32.DLL_GetCurrentThread
push esi
inc esi
dec esi
nop
nop
or esi, 0x3d
xor esi, 0x178
or esi, 0x14b
inc esi
sub esi, 0x3e
or esi, 0x112
add esi, 0x151
sub esi, 0xf6
pop esi
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.004296d4
call sub.KERNEL32.DLL_GetCurrentThreadId_1
push ebx
push esi
add esi, 0xb4
xor ebx, 0x103
dec esi
mov ebx, 0xdd
xchg ebx, esi
push esi
pop esi
dec ebx
pop esi
pop ebx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4cfc5d
inc ebx
xor esi, esi
call sub.KERNEL32.DLL_GetCurrentThread
push esi
inc esi
dec esi
nop
nop
or esi, 0x3d
xor esi, 0x178
or esi, 0x14b
inc esi
sub esi, 0x3e
or esi, 0x112
add esi, 0x151
sub esi, 0xf6
pop esi
lea ecx, [ebp - 0x18]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.0040ca04
mov edi, eax
push edx
xchg edx, edx
or edx, 0xc8
nop
nop
nop
nop
and edx, 5
and edx, 0x127
sub edx, 0x6c
xor edx, 0x174
pop edx
call sub.user32.dll_DestroyCaret
push ebx
add ebx, 0x1a2
dec ebx
or ebx, 0xf6
nop
nop
nop
nop
xor ebx, 0x148
push ebx
pop ebx
push ebx
pop ebx
pop ebx
lea eax, [ebp - 0x1c]
mov edx, edi
add dx, word [ebp - 0xc]
call fcn.00406068
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00406220
call sub.KERNEL32.DLL_GetCurrentProcessId
push esi
push ebx
inc esi
push esi
pop esi
mov ebx, 0x9c
push ebx
pop ebx
nop
nop
nop
nop
mov ebx, 0x110
xor esi, 0x5f
and esi, 0x11d
nop
nop
or esi, 0xe7
pop ebx
pop esi
call sub.user32.dll_DestroyCaret
push ebx
add ebx, 0x1a2
dec ebx
or ebx, 0xf6
nop
nop
nop
nop
xor ebx, 0x148
push ebx
pop ebx
push ebx
pop ebx
pop ebx
inc esi
dec ebx
jne 0x4cfb64
call sub.KERNEL32.DLL_GetTickCount_1
push edi
push eax
nop
xor eax, 0x52
nop
nop
nop
nop
nop
mov edi, 0x158
add eax, 0x18c
dec edi
nop
nop
nop
nop
nop
sub eax, 0x189
inc edi
add edi, 0x118
and eax, 0x91
or eax, 0xbb
and edi, 0x73
push edi
pop edi
pop eax
pop edi
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405efc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfcd4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405ef4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405ef4
ret