Function at 0x10016865
Capabilities:
Encode data using xor

Disassembly:
push 0x3e0
mov eax, 0x100302d0
call fcn.1002a0b4
mov dword [ebp - 0x24c], 0x2947
mov dword [ebp - 0x24c], 0x1f70
mov eax, dword [ebp - 0x24c]
imul eax, eax, 0x17e4
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x24c], 0x3900
mov dword [ebp - 0x24c], 0x634a
mov eax, dword [ebp - 0x24c]
xor eax, 0x3be4
push 0x11
mov dword [ebp - 0x24c], eax
call fcn.1001e65e
pop ecx
lea esi, [ebp - 0x234]
call fcn.1000fbdb
xor ebx, ebx
xor edi, edi
cmp dword [ebp - 0x220], ebx
jbe 0x10016987
mov dword [ebp - 0x240], 0x4d9e
mov dword [ebp - 0x250], 0x2734
mov dword [ebp - 0x254], 0x6267
mov dword [ebp - 0x24c], 0x1e9d
mov dword [ebp - 0x248], 0xf7d
mov dword [ebp - 0x240], 0x3f85
mov dword [ebp - 0x244], 0xde7
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x254]
imul eax, ecx
mov ecx, dword [ebp - 0x250]
imul eax, ecx
mov ecx, dword [ebp - 0x248]
and eax, ecx
mov ecx, dword [ebp - 0x244]
mov edx, dword [ebp - 0x240]
and ecx, 0x78b9
xor ecx, edx
or eax, ecx
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x234]
call fcn.10022a16
mov ax, word [eax]
mov word [ebp + edi*2 - 0x218], ax
inc edi
cmp edi, dword [ebp - 0x220]
jb 0x100168e2
mov eax, dword [ebp - 0x220]
push ebx
push 1
lea esi, [ebp - 0x234]
mov word [ebp + eax*2 - 0x218], bx
call fcn.100161cc
push 0x10033d4c
lea ecx, [ebp - 0x3ec]
call fcn.10022d10
mov eax, 0x10033d58
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 4], ebx
call fcn.10015c70
lea edi, [ebp - 0x3ec]
lea eax, [ebp - 0x3d0]
lea esi, [ebp - 0x280]
mov byte [ebp - 4], 1
call fcn.1002aee6
push dword [ebp + 8]
mov byte [ebp - 4], 2
mov eax, dword [eax + 4]
push ebx
push 0x411
call eax
cmp dword [ebp - 0x280], ebx
mov dword [ebp - 0x24c], eax
je 0x10016a0d
push dword [ebp - 0x280]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 1
lea esi, [ebp - 0x3d0]
call fcn.100161cc
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x3ec]
call fcn.10007145
mov dword [ebp - 0x23c], 0x60c0
mov dword [ebp - 0x23c], 0x6d8d
mov dword [ebp - 0x254], 0x41ae
mov dword [ebp - 0x250], 0x1520
mov dword [ebp - 0x248], 0x2cfb
mov dword [ebp - 0x244], 0x69c6
mov dword [ebp - 0x240], 0x3586
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x244]
imul eax, ecx
mov ecx, 0x527
sub ecx, eax
add ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x250]
xor ecx, eax
mov eax, dword [ebp - 0x254]
mov edx, dword [ebp - 0x23c]
and eax, edx
or ecx, eax
cmp dword [ebp - 0x24c], ebx
mov dword [ebp - 0x23c], ecx
je 0x10017262
mov dword [ebp - 0x238], 0x5e50
mov dword [ebp - 0x254], 0x2bde
mov dword [ebp - 0x250], 0x4a7e
mov dword [ebp - 0x240], 0x34f2
mov dword [ebp - 0x23c], 0x4e09
mov dword [ebp - 0x244], 0x371a
mov dword [ebp - 0x248], 0x65d9
mov dword [ebp - 0x238], 0x46fa
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x240]
sub ecx, eax
mov eax, dword [ebp - 0x244]
sub ecx, eax
mov eax, dword [ebp - 0x248]
sub ecx, eax
mov eax, dword [ebp - 0x250]
mov edx, dword [ebp - 0x254]
and eax, edx
or ecx, eax
mov eax, dword [ebp - 0x238]
and eax, 0x11d1
or ecx, eax
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x238], 0x7ecf
mov dword [ebp - 0x240], 0x140a
mov dword [ebp - 0x23c], 0x1637
mov dword [ebp - 0x238], 0x6182
mov dword [ebp - 0x248], 0x3d8
mov dword [ebp - 0x244], 0x631f
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
imul eax, ecx
mov ecx, dword [ebp - 0x240]
imul eax, ecx
mov ecx, dword [ebp - 0x244]
mov edx, dword [ebp - 0x248]
sub edx, ecx
xor eax, edx
xor eax, 0x3b4f
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x238], 0x2d9d
mov dword [ebp - 0x240], 0x1a75
mov dword [ebp - 0x23c], 0x78a5
mov dword [ebp - 0x238], 0xe9e
mov dword [ebp - 0x248], 0x1f0a
mov dword [ebp - 0x244], 0xaf1
mov dword [ebp - 0x250], 0x732d
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
imul eax, ecx
mov ecx, dword [ebp - 0x240]
xor eax, ecx
mov ecx, dword [ebp - 0x244]
mov edx, dword [ebp - 0x248]
and ecx, edx
or eax, ecx
mov ecx, dword [ebp - 0x250]
and ecx, 0x53ef
or eax, ecx
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x238], 0x537d
mov dword [ebp - 0x240], 0x7230
mov dword [ebp - 0x23c], 0x29f0
mov dword [ebp - 0x238], 0x5398
mov eax, dword [ebp - 0x238]
imul eax, eax, 0x5ea
add eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x240]
or eax, ecx
push str.EnumProcessModules
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x238], eax
call fcn.10022d10
mov eax, 0x10033d88
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 4], 3
call fcn.10015c70
mov byte [ebp - 4], 4
cmp dword [ebp - 0x2bc], 8
mov eax, dword [ebp - 0x2d0]
jae 0x10016cc2
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x290], esi
jne 0x10016ced
or dword [ebp - 0x258], 0xffffffff
push 0x10036050
lea eax, [ebp - 0x258]
push eax
call fcn.1000e891
cmp dword [ebp - 0x2d8], 0x10
mov eax, dword [ebp - 0x2ec]
jae 0x10016d02
lea eax, [ebp - 0x2ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0x28c], eax
jne 0x10016d2b
mov dword [ebp - 0x260], 0xfffffffe
push 0x10036050
lea eax, [ebp - 0x260]
jmp 0x10016ce7
lea ecx, [ebp - 0x29c]
push ecx
push 4
lea ecx, [ebp - 0x268]
push ecx
push dword [ebp - 0x24c]
mov byte [ebp - 4], 5
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 1
lea esi, [ebp - 0x2d4]
call fcn.100161cc
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2f0]
call fcn.10007145
cmp edi, ebx
je 0x10016ee8
mov dword [ebp - 0x238], 0x5d27
mov dword [ebp - 0x248], 0x5ef2
mov dword [ebp - 0x244], 0x5b58
mov dword [ebp - 0x240], 0x5984
mov dword [ebp - 0x23c], 0x5ad8
mov dword [ebp - 0x238], 0x2180
mov dword [ebp - 0x250], 0x7311
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
sub ecx, eax
mov eax, dword [ebp - 0x240]
and ecx, eax
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0x248]
push 0x10033d9c
xor ecx, eax
mov eax, dword [ebp - 0x250]
add eax, 0x75d6
xor ecx, eax
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x238], 0x3030
mov dword [ebp - 0x23c], 0x46fc
mov dword [ebp - 0x238], 0x1260
mov eax, dword [ebp - 0x238]
mov ecx, 0xffff967e
sub ecx, eax
add ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x238], ecx
lea ecx, [ebp - 0x328]
call fcn.10022d10
mov eax, 0x10033db0
lea ecx, [ebp - 0x360]
mov dword [ebp - 4], 6
call fcn.10015c70
lea edi, [ebp - 0x328]
lea eax, [ebp - 0x360]
lea esi, [ebp - 0x288]
mov byte [ebp - 4], 7
call fcn.1002aee6
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov byte [ebp - 4], 8
push dword [ebp - 0x268]
mov eax, dword [eax + 4]
push dword [ebp - 0x24c]
call eax
cmp dword [ebp - 0x288], ebx
je 0x10016ea3
push dword [ebp - 0x288]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 1
lea esi, [ebp - 0x360]
call fcn.100161cc
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x328]
call fcn.10007145
mov dword [ebp - 0x238], 0x6f8b
mov dword [ebp - 0x238], 0x26c7
mov eax, dword [ebp - 0x238]
and eax, 0x233c
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x238], 0x1386
push str.CharLowerW
lea ecx, [ebp - 0x344]
mov dword [ebp - 0x238], 0x17f8
call fcn.10022d10
mov eax, 0x10033dd0
lea ecx, [ebp - 0x398]
mov dword [ebp - 4], 9
call fcn.10015c70
lea edi, [ebp - 0x344]
lea eax, [ebp - 0x398]
lea esi, [ebp - 0x270]
mov byte [ebp - 4], 0xa
call fcn.1002aee6
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0xb
mov eax, dword [eax + 4]
push ecx
call eax
cmp dword [ebp - 0x270], ebx
je 0x10016f62
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x398]
call fcn.100161cc
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp - 0x344]
call fcn.10007145
mov dword [ebp - 0x238], 0x765f
mov dword [ebp - 0x23c], 0x690c
mov dword [ebp - 0x240], 0x2c28
mov dword [ebp - 0x238], 0x4899
mov dword [ebp - 0x248], 0x5c6a
mov dword [ebp - 0x244], 0x563b
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
sub ecx, eax
add ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x244]
mov edx, dword [ebp - 0x248]
imul eax, edx
xor eax, 0x2e99
or ecx, eax
push 0x27
mov dword [ebp - 0x238], ecx
call fcn.1001e65e
cmp dword [eax + 0x18], 8
pop ecx
jb 0x10017002
mov eax, dword [eax + 4]
jmp 0x10017005
add eax, 4
lea ecx, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10017031
cmp dx, bx
je 0x1001702d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10017031
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1001700b
xor eax, eax
jmp 0x10017036
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x100171e5
mov dword [ebp - 0x238], 0x7652
mov dword [ebp - 0x248], 0x1241
mov dword [ebp - 0x244], 0x464c
mov dword [ebp - 0x250], 0x4619
mov dword [ebp - 0x23c], 0x1899
mov dword [ebp - 0x238], 0x7a54
mov dword [ebp - 0x240], 0x1ca2
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
sub ecx, eax
mov eax, dword [ebp - 0x240]
and ecx, eax
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0x248]
and ecx, 0x6486
or ecx, eax
mov eax, dword [ebp - 0x250]
or ecx, eax
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x238], 0x76f4
push str.EnumWindows
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x238], 0x54ff
call fcn.10022d10
mov eax, str.user32.dll
lea ecx, [ebp - 0x30c]
mov dword [ebp - 4], 0xc
call fcn.10015c70
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x2f4], 8
mov eax, dword [ebp - 0x308]
jae 0x10017110
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x298], esi
jne 0x1001713a
or dword [ebp - 0x264], 0xffffffff
push 0x10036050
lea eax, [ebp - 0x264]
jmp 0x10016ce7
cmp dword [ebp - 0x2a0], 0x10
mov eax, dword [ebp - 0x2b4]
jae 0x1001714f
lea eax, [ebp - 0x2b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0x294], eax
jne 0x1001717b
mov dword [ebp - 0x25c], 0xfffffffe
push 0x10036050
lea eax, [ebp - 0x25c]
jmp 0x10016ce7
push dword [ebp + 8]
mov byte [ebp - 4], 0xe
push 0x1001dbf4
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push edi
lea esi, [ebp - 0x30c]
call fcn.100161cc
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp - 0x2b8]
call fcn.10007145
mov dword [ebp - 0x238], 0x66e9
mov dword [ebp - 0x23c], 0x1ae9
mov dword [ebp - 0x238], 0x2332
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
sub eax, 0x313a
and eax, ecx
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x238], 0x1538
mov dword [ebp - 0x250], 0x41
mov dword [ebp - 0x248], 0x712b
mov dword [ebp - 0x244], 0x280f
mov dword [ebp - 0x240], 0x476a
mov dword [ebp - 0x23c], 0x3a77
mov dword [ebp - 0x238], 0x5663
mov eax, dword [ebp - 0x238]
add eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x240]
xor eax, ecx
mov ecx, dword [ebp - 0x244]
xor eax, ecx
mov ecx, dword [ebp - 0x248]
mov edx, dword [ebp - 0x250]
xor ecx, edx
or eax, ecx
or eax, 0x5f79
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x238], 0x568e
mov dword [ebp - 0x244], 0x32c5
mov dword [ebp - 0x240], 0x259a
mov dword [ebp - 0x23c], 0x581f
mov dword [ebp - 0x238], 0x7b36
mov eax, dword [ebp - 0x238]
mov ecx, 0x5a62
sub ecx, eax
add ecx, dword [ebp - 0x23c]
push 0x10033e0c
add ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x244]
xor ecx, eax
mov dword [ebp - 0x238], ecx
lea ecx, [ebp - 0x3b4]
call fcn.10022d10
mov eax, 0x10033e18
lea ecx, [ebp - 0x37c]
mov dword [ebp - 4], 0xf
call fcn.10015c70
lea edi, [ebp - 0x3b4]
lea eax, [ebp - 0x37c]
lea esi, [ebp - 0x278]
mov byte [ebp - 4], 0x10
call fcn.1002aee6
push dword [ebp - 0x24c]
mov byte [ebp - 4], 0x11
call dword [eax + 4]
cmp dword [ebp - 0x278], ebx
je 0x1001731e
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 1
lea esi, [ebp - 0x37c]
call fcn.100161cc
push ebx
push 1
lea ecx, [ebp - 0x3b4]
call fcn.10007145
call fcn.1002415b
ret