Function at 0x10007f0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
push ebx
push esi
push edi
push 6
pop eax
mov word [ebp - 0x178], ax
push 0x74
mov ebx, 0xf9
mov eax, ebx
mov word [ebp - 0x176], ax
pop eax
mov word [ebp - 0x174], ax
push 0x2a
mov eax, ebx
mov word [ebp - 0x172], ax
pop eax
mov word [ebp - 0x170], ax
push 0x2a
lea eax, [ebx - 0x2d]
mov word [ebp - 0x16e], ax
pop eax
mov word [ebp - 0x16c], ax
push 6
lea edi, [ebx - 0x39]
mov eax, edi
mov word [ebp - 0x16a], ax
pop eax
mov word [ebp - 0x168], ax
push 0x33
lea eax, [ebx - 7]
mov word [ebp - 0x166], ax
pop eax
mov word [ebp - 0x164], ax
push 0x29
lea eax, [ebx - 0x2e]
mov word [ebp - 0x162], ax
pop eax
mov word [ebp - 0x160], ax
push 0x39
lea ecx, [ebx - 0x2f]
mov eax, ecx
mov word [ebp - 0x15e], ax
pop eax
mov word [ebp - 0x15c], ax
push 0x68
lea eax, [ebx - 0x2b]
mov word [ebp - 0x15a], ax
pop eax
mov word [ebp - 0x158], ax
push 0x19
mov eax, ebx
mov word [ebp - 0x156], ax
pop eax
mov word [ebp - 0x154], ax
push 0x2e
lea esi, [ebx - 0x35]
mov eax, esi
mov word [ebp - 0x152], ax
pop eax
mov word [ebp - 0x150], ax
push 0x36
mov eax, esi
mov word [ebp - 0x14e], ax
pop eax
mov word [ebp - 0x14c], ax
push 0x3d
mov eax, ecx
mov word [ebp - 0x14a], ax
pop eax
mov word [ebp - 0x148], ax
lea eax, [ebx - 0x13]
mov word [ebp - 0x146], ax
push 0x32
pop eax
mov word [ebp - 0x144], ax
mov eax, esi
mov word [ebp - 0x142], ax
push 0x34
pop eax
mov word [ebp - 0x140], ax
lea eax, [ebx - 0x37]
push 0x3f
mov word [ebp - 0x13e], ax
pop eax
push 0x33
mov word [ebp - 0x13c], ax
lea eax, [ebx - 0x10]
mov word [ebp - 0x13a], ax
pop eax
push 0x2e
mov word [ebp - 0x138], ax
lea eax, [ebx - 0x23]
mov word [ebp - 0x136], ax
pop eax
push 0x34
mov word [ebp - 0x134], ax
mov eax, edi
mov word [ebp - 0x132], ax
pop eax
push 0x28
mov word [ebp - 0x130], ax
mov eax, edi
mov word [ebp - 0x12e], ax
pop eax
push 0x1c
mov word [ebp - 0x12c], ax
add eax, 0x60
mov word [ebp - 0x12a], ax
pop eax
mov word [ebp - 0x128], ax
push 0x1c
lea eax, [ebx - 0x16]
mov edx, eax
mov word [ebp - 0x126], dx
pop edx
push 0x77
mov word [ebp - 0x124], dx
mov edx, eax
mov word [ebp - 0x122], dx
pop edx
push 0x5a
mov word [ebp - 0x11e], ax
pop eax
push 0x100
mov word [ebp - 0x11c], ax
lea eax, [ebp - 0x118]
push 0
push eax
mov word [ebp - 0x120], dx
mov word [ebp - 0x11a], cx
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
xor dword [ebp + eax*2 - 0x178], 0xa5005a
add eax, 2
cmp eax, 0xb0
jl 0x10008110
push 0x130
push 8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
jne 0x10008155
push str.error_0_n
push 0x7f
call fcn.10002038
pop ecx
pop ecx
mov byte [ebp - 1], 0
jmp 0x1000842a
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x186]
movzx eax, word [ebp - 0x188]
push dword [ebp + 8]
imul eax, ecx
movzx ecx, word [ebp - 0x182]
imul eax, ecx
mov dword [ebp - 0x10], eax
call fcn.10007d86
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x10008449
push str.error_2_n
push 0x91
call fcn.10002038
pop ecx
pop ecx
push 6
pop eax
push 0x74
mov word [ebp - 0x178], ax
mov eax, ebx
mov word [ebp - 0x176], ax
pop eax
push 0x2a
mov word [ebp - 0x174], ax
mov eax, ebx
mov word [ebp - 0x172], ax
pop eax
push 0x2a
mov word [ebp - 0x170], ax
mov eax, 0xcc
mov word [ebp - 0x16e], ax
pop eax
push 6
mov word [ebp - 0x16c], ax
mov eax, edi
mov word [ebp - 0x16a], ax
pop eax
push 0x33
mov word [ebp - 0x168], ax
mov eax, 0xf2
mov word [ebp - 0x166], ax
pop eax
push 0x29
mov word [ebp - 0x164], ax
mov eax, 0xcb
mov word [ebp - 0x162], ax
pop eax
push 0x39
mov word [ebp - 0x160], ax
mov eax, 0xca
mov ecx, eax
mov word [ebp - 0x15e], cx
pop ecx
push 0x68
mov word [ebp - 0x15c], cx
lea ecx, [eax + 4]
mov word [ebp - 0x15a], cx
pop ecx
push 0x19
mov word [ebp - 0x158], cx
pop ecx
push 0x2e
mov word [ebp - 0x154], cx
mov ecx, esi
mov word [ebp - 0x152], cx
pop ecx
push 0x36
mov word [ebp - 0x150], cx
mov ecx, esi
mov word [ebp - 0x14a], ax
mov word [ebp - 0x14e], cx
pop ecx
push 0x3d
pop eax
mov word [ebp - 0x148], ax
push 0x32
mov eax, 0xe6
mov word [ebp - 0x146], ax
pop eax
push 0x34
mov word [ebp - 0x144], ax
pop eax
mov word [ebp - 0x140], ax
mov eax, 0xc2
push 0x3f
mov word [ebp - 0x13e], ax
mov byte [ebp - 1], 1
mov word [ebp - 0x156], bx
mov word [ebp - 0x14c], cx
mov word [ebp - 0x142], si
pop eax
push 0x33
mov word [ebp - 0x13c], ax
mov eax, 0xe9
mov word [ebp - 0x13a], ax
pop eax
push 0x2e
mov word [ebp - 0x138], ax
mov eax, 0xd6
mov word [ebp - 0x136], ax
pop eax
push 0x34
mov word [ebp - 0x134], ax
mov eax, edi
mov word [ebp - 0x132], ax
pop eax
push 0x28
mov word [ebp - 0x130], ax
pop eax
push 0x7f
mov word [ebp - 0x12c], ax
add eax, 0x60
mov word [ebp - 0x12a], ax
pop eax
push 0x68
mov word [ebp - 0x128], ax
add ecx, 0x5f
mov eax, ecx
mov word [ebp - 0x126], ax
pop eax
push 0x7f
mov word [ebp - 0x124], ax
add eax, 0x75
mov edx, eax
mov word [ebp - 0x122], dx
pop edx
push 0x68
mov word [ebp - 0x11a], ax
mov word [ebp - 0x11e], cx
pop ecx
push 0x77
pop eax
mov word [ebp - 0x118], ax
add eax, 9
push 0x6a
mov word [ebp - 0x116], ax
pop eax
mov word [ebp - 0x114], ax
add eax, 0x2a
push 0x22
mov word [ebp - 0x112], ax
pop eax
mov word [ebp - 0x110], ax
push 0x67
lea eax, [edx + 0x26]
mov word [ebp - 0x10e], ax
pop eax
push 0x4b
mov word [ebp - 0x10c], ax
pop eax
push 0xf0
mov word [ebp - 0x10a], ax
lea eax, [ebp - 0x108]
push 0
push eax
mov word [ebp - 0x12e], di
mov word [ebp - 0x120], dx
mov word [ebp - 0x11c], cx
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
xor dword [ebp + eax*2 - 0x178], 0xa5005a
add eax, 2
cmp eax, 0xb0
jl 0x100083ef
push 0xdddddddd
push 0xeeeeeeee
push 0xffffffffffffffff
lea eax, [ebp - 0x178]
push eax
mov eax, dword [ebp + 0xc]
push 0xb0
push dword [eax]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x18
mov eax, dword [ebp + 0xc]
push dword [eax]
push 0x10009f3c
push 0xbd
call fcn.10002038
mov al, byte [ebp - 1]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx eax, byte [eax]
and dword [ebp - 8], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 1
test eax, eax
jle 0x10008485
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov eax, dword [eax]
imul eax, dword [ebp - 0xc]
inc dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x10008465
push dword [ebp - 0x14]
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
imul eax, ecx
mov dword [ebp - 8], eax
mov eax, ecx
shr eax, 0xc
and eax, 0xfff
mov edx, ecx
and edx, 0xfff
add eax, edx
shr ecx, 0x14
add eax, ecx
xor edx, edx
mov ecx, 0xff
div ecx
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 0xc
and eax, 0xfff
push 0xf
mov dword [ebp - 0x10], edx
mov edx, ecx
and edx, 0xfff
add eax, edx
shr ecx, 0x14
add eax, ecx
xor edx, edx
mov ecx, 0xff
div ecx
mov ecx, dword [ebp - 8]
mov eax, ecx
shr eax, 0x10
and eax, 0xff
mov dword [ebp - 0xc], edx
mov edx, ecx
shr edx, 8
and edx, 0xff
add eax, edx
movzx edx, cl
add eax, edx
shr ecx, 0x18
add eax, ecx
pop ecx
push 6
xor edx, edx
div ecx
pop eax
mov word [ebp - 0x2e8], ax
push 0x74
mov eax, ebx
mov word [ebp - 0x2e6], ax
pop eax
mov word [ebp - 0x2e4], ax
push 0x2a
mov eax, ebx
mov word [ebp - 0x2e2], ax
pop eax
mov word [ebp - 0x2e0], ax
push 0x2a
mov eax, 0xcc
mov word [ebp - 0x2de], ax
pop eax
mov word [ebp - 0x2dc], ax
push 6
mov eax, edi
mov word [ebp - 0x2da], ax
pop eax
mov word [ebp - 0x2d8], ax
mov eax, 0xf2
push 0x33
mov word [ebp - 0x2d6], ax
pop eax
mov word [ebp - 0x2d4], ax
mov eax, 0xcb
mov dword [ebp - 8], edx
mov word [ebp - 0x2d2], ax
push 0x29
pop eax
push 0x39
mov word [ebp - 0x2d0], ax
mov eax, 0xca
mov ecx, eax
mov word [ebp - 0x2ce], cx
pop ecx
push 0x68
mov word [ebp - 0x2cc], cx
lea ecx, [eax + 4]
mov word [ebp - 0x2ca], cx
pop ecx
push 0x19
mov word [ebp - 0x2c8], cx
pop ecx
push 0x2e
mov word [ebp - 0x2c4], cx
mov word [ebp - 0x2ba], ax
mov ecx, esi
mov word [ebp - 0x2c2], cx
pop ecx
push 0x36
mov word [ebp - 0x2c0], cx
mov ecx, esi
mov word [ebp - 0x2be], cx
pop ecx
push 0x3d
pop eax
mov word [ebp - 0x2b8], ax
push 0x32
mov eax, 0xe6
mov word [ebp - 0x2b6], ax
pop eax
push 0x34
mov word [ebp - 0x2b4], ax
pop eax
mov word [ebp - 0x2b0], ax
push 0x3f
mov eax, 0xc2
mov word [ebp - 0x2ae], ax
pop eax
mov word [ebp - 0x2ac], ax
push 0x33
mov eax, 0xe9
mov word [ebp - 0x2aa], ax
pop eax
mov word [ebp - 0x2a8], ax
push 0x2e
mov eax, 0xd6
mov word [ebp - 0x2a6], ax
pop eax
mov word [ebp - 0x2a4], ax
push 0x34
mov eax, edi
mov word [ebp - 0x2a2], ax
pop eax
push 0x28
mov word [ebp - 0x2a0], ax
pop eax
mov word [ebp - 0x29c], ax
add eax, 0x60
push 0x7f
mov word [ebp - 0x29a], ax
pop eax
mov word [ebp - 0x2bc], cx
mov word [ebp - 0x298], ax
add ecx, 0x5f
mov eax, ecx
push 0x68
mov word [ebp - 0x296], ax
pop eax
mov word [ebp - 0x294], ax
add eax, 0x75
mov edx, eax
push 0x7f
mov word [ebp - 0x292], dx
pop edx
mov word [ebp - 0x2c6], bx
mov word [ebp - 0x2b2], si
mov word [ebp - 0x29e], di
mov word [ebp - 0x290], dx
push 0x68
mov word [ebp - 0x28a], ax
mov word [ebp - 0x28e], cx
pop ecx
push 0x77
pop eax
mov word [ebp - 0x288], ax
add eax, 9
push 0x6a
mov word [ebp - 0x286], ax
pop eax
mov word [ebp - 0x284], ax
add eax, 0x2a
push 0x22
mov word [ebp - 0x282], ax
pop eax
mov word [ebp - 0x280], ax
push 0x67
lea eax, [edx + 0x26]
mov word [ebp - 0x27e], ax
pop eax
push 0x4b
mov word [ebp - 0x27c], ax
pop eax
push 0xf0
mov word [ebp - 0x27a], ax
lea eax, [ebp - 0x278]
push 0
push eax
mov word [ebp - 0x28c], cx
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
xor dword [ebp + eax*2 - 0x2e8], 0xa5005a
add eax, 2
cmp eax, 0xb0
jl 0x10008760
push dword [ebp - 8]
lea eax, [ebp - 0x2e8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push 0xb0
push dword [eax]
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov byte [ebp - 1], 1
jmp 0x10008427