Function at 0x1011be20
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x11ad127c]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
lea eax, [esp + 0x24]
mov dword [0x11d20664], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x38]
mov dword [0x11d0d278], edi
lea eax, [edi - 2]
cmp eax, 0x3e
ja 0x1011c153
mov eax, edi
and eax, 0xfffffffe
cmp eax, 0x40
ja 0x1011c153
xor esi, esi
test edi, edi
je 0x1011bf01
cmp edi, 0x40
jne 0x1011beb0
xor ecx, ecx
mov eax, esi
xor edx, edx
bts ecx, eax
cmp eax, 0x20
cmovae edx, ecx
xor ecx, edx
cmp eax, 0x40
cmovae edx, ecx
not ecx
not edx
mov dword [esp + esi*8 + 0x48], ecx
mov dword [esp + esi*8 + 0x4c], edx
inc esi
cmp esi, 0x40
jb 0x1011be85
jmp 0x1011bf01
xor ebx, ebx
xor ecx, ecx
mov eax, edi
xor esi, esi
bts ebx, eax
cmp eax, 0x20
cmovae ecx, ebx
xor ebx, ecx
cmp eax, 0x40
cmovae ecx, ebx
add ebx, 0xffffffff
adc ecx, 0xffffffff
mov dword [esp + 0x1c], ecx
xor ecx, ecx
xor edx, edx
mov eax, esi
bts ecx, eax
cmp eax, 0x20
cmovae edx, ecx
xor ecx, edx
cmp eax, 0x40
cmovae edx, ecx
not ecx
not edx
and ecx, ebx
and edx, dword [esp + 0x1c]
mov dword [esp + esi*8 + 0x48], ecx
mov dword [esp + esi*8 + 0x4c], edx
inc esi
cmp esi, edi
jb 0x1011bed3
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
lea eax, [esp + 0x20]
push eax
push 0
mov dword [esp + 0x28], 0
call esi
test eax, eax
jne 0x1011c153
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1011c153
mov eax, 0xaaaaaaab
xor ecx, ecx
mul dword [esp + 0x20]
mov ebx, edx
mov edx, 0x18
shr ebx, 4
mov eax, ebx
mov dword [esp + 0x10], ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10450898
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1011c153
lea ecx, [esp + 0x20]
push ecx
push eax
call esi
test eax, eax
je 0x1011c147
test ebx, ebx
je 0x1011c034
mov ecx, dword [esp + 0x1c]
add ecx, 8
mov dword [esp + 0x14], ecx
nop dword [eax + eax]
mov eax, dword [ecx - 4]
mov ebx, dword [ecx - 8]
sub eax, 0
je 0x1011bfe0
sub eax, 2
jne 0x1011c022
cmp byte [ecx], 1
jne 0x1011c022
xor esi, esi
test edi, edi
je 0x1011c022
nop
xor edx, edx
mov eax, esi
bts edx, eax
xor ecx, ecx
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
xor ecx, ecx
and edx, ebx
or edx, ecx
je 0x1011bfd9
mov ecx, ebx
xor eax, eax
not ecx
not eax
and dword [esp + esi*8 + 0x48], ecx
and dword [esp + esi*8 + 0x4c], eax
inc esi
cmp esi, edi
jb 0x1011bfb0
jmp 0x1011c01e
cmp byte [ecx], 1
jne 0x1011c022
xor eax, eax
test edi, edi
je 0x1011c022
nop dword [eax + eax]
xor esi, esi
mov ecx, eax
bts esi, ecx
xor edx, edx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
xor edx, edx
and esi, ebx
or esi, edx
je 0x1011c019
mov edx, ebx
xor ecx, ecx
not edx
not ecx
and dword [esp + eax*8 + 0x48], edx
and dword [esp + eax*8 + 0x4c], ecx
inc eax
cmp eax, edi
jb 0x1011bff0
mov ecx, dword [esp + 0x14]
add ecx, 0x18
sub dword [esp + 0x10], 1
mov dword [esp + 0x14], ecx
jne 0x1011bf90
xor edx, edx
mov dword [0x11d20664], 0
mov dword [esp + 0x10], edx
test edi, edi
je 0x1011c147
lea esi, [esp + 0x48]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], eax
or eax, ecx
mov dword [esp + 0x18], ecx
je 0x1011c137
lea ebx, [edx + 1]
cmp ebx, edi
jae 0x1011c137
xor edx, edx
mov eax, ebx
bts edx, eax
xor ecx, ecx
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
mov eax, dword [esp + 0x14]
cmovae ecx, edx
and edx, eax
and ecx, dword [esp + 0x18]
or edx, ecx
je 0x1011c111
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, dword [esp + ebx*8 + 0x48]
and ecx, dword [esp + ebx*8 + 0x4c]
or edx, ecx
je 0x1011c10d
mov edx, dword [0x11d20664]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esp + ebx*8 + 0x48], 0
mov dword [edx*8 + 0x11d0d280], eax
mov dword [edx*8 + 0x11d0d284], ebx
inc edx
mov dword [esp + ebx*8 + 0x4c], 0
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [0x11d20664], edx
mov dword [esp + 0x18], ecx
jmp 0x1011c111
mov eax, dword [esp + 0x14]
inc ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
cmp ebx, edi
jb 0x1011c070
mov edx, dword [esp + 0x10]
inc edx
add esi, 8
mov dword [esp + 0x10], edx
jmp 0x1011c050
inc edx
add esi, 8
mov dword [esp + 0x10], edx
cmp edx, edi
jb 0x1011c050
push dword [esp + 0x1c]
call fcn.10450877
add esp, 4
mov ecx, dword [esp + 0x24c]
mov eax, dword [0x11d20664]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1045066c
mov esp, ebp
pop ebp
ret