Function at 0x10056a10
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100c21f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x100c1bb8]
xor edx, edx
div dword [0x100c1bbc]
add eax, 0x1f1e7b82
or eax, 0x6312c385
sub eax, 0xa71b1caf
mov ecx, 0xec63e11b
xor edx, edx
div ecx
add eax, 0x8277d27e
sub eax, 0x55e6b139
add eax, 0x2b29afa6
imul eax, eax, 0xf4b6dba6
and eax, 0xfd102981
and eax, 0xb4ff24ec
add eax, 0xbf015c1d
and eax, 0x28e51430
sub eax, 0xb1465d72
and eax, 0x300af3f4
imul eax, eax, 0xce19b326
imul eax, eax, 0x777b8abf
imul eax, eax, 0xa2aa18dc
sub eax, 0xf4ba8013
sub eax, 0xe6899933
xor eax, 0x1d4a09cc
or eax, 0x2d040223
add eax, 0xa4d94165
mov ecx, 0xd46b5d6b
xor edx, edx
div ecx
or eax, 0xd31573ef
mov ecx, 0xaacb2bff
xor edx, edx
div ecx
or eax, 0x67ee5cf9
sub eax, 0x37b4b7e2
imul eax, eax, 0xfb7ce62a
add eax, 0x3514269
and eax, 0x4c9dee37
sub eax, 0xf93c1ba2
and eax, 0x8f4e2cab
xor eax, 0x1166b165
add eax, 0x8d93e30
imul eax, eax, 0xebca4d29
add eax, 0xac5d88a3
and eax, 0xfce48dc3
sub eax, 0xf651dccf
or eax, 0xce8b17a2
and eax, 0x6fa12cf8
mov ecx, 0x836b89c9
xor edx, edx
div ecx
and eax, 0xc58d691b
mov ecx, 0x6a3e6af8
xor edx, edx
div ecx
and eax, 0x320a0bfa
mov ecx, 0x175e3429
xor edx, edx
div ecx
sub eax, 0x8239b812
or eax, 0xb1f46368
xor eax, 0x2f5be00a
mov ecx, 0xcd22bcb3
xor edx, edx
div ecx
sub eax, 0xcc86d27b
and eax, 0x7b7ec819
sub eax, 0x7ede3271
and eax, 0x317f558c
sub eax, 0x29f2e7b7
mov ecx, 0x330e3481
xor edx, edx
div ecx
and eax, 0x384f51f2
and eax, 0x1294e375
and eax, 0xe2b98edd
sub eax, 0xabefc506
or eax, 0x68c59325
and eax, 0x5f2b3f36
imul eax, eax, 0xf534ed1c
sub eax, 0x53b44ab5
and eax, 0x9f43e6b5
sub eax, 0x2b7024a7
imul eax, eax, 0x72c1fcb9
mov ecx, 0x16e774b5
xor edx, edx
div ecx
and eax, 0x36d0cba5
and eax, 0x75ebcb7
mov ecx, 0x58689a81
xor edx, edx
div ecx
add eax, 0xd42b586a
xor eax, 0x91a34de7
cmp eax, 0x6fce9cc
je 0x1005741a
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
mov eax, 0xa9f25725
mov dword [ebp - 0x1c], eax
push eax
mov esi, esp
mov dword [ebp - 0x20], esi
push eax
mov ecx, esp
mov dword [ebp - 0x2c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x24], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1006d150
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10039210
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [ebp - 0x16], cl
cmp eax, 0x47e3f3d7
jb 0x10056bdf
mov al, byte [ebp - 0x16]
test al, 1
jne 0x10056ce4
jmp 0x10057079
mov eax, dword [0x100c1bc8]
imul eax, dword [0x100c1bcc]
add eax, 0xb7c3d592
and eax, 0xb5cc1355
sub eax, 0x194d4bb7
sub eax, 0x2c4e351a
mov ecx, 0x1c2de74c
xor edx, edx
div ecx
imul eax, eax, 0xe456ca31
and eax, 0xba9ee6e3
mov ecx, 0xb6a37021
xor edx, edx
div ecx
add eax, 0xf7122f0f
xor eax, 0xbcf8bfec
sub eax, 0x3b39b2e4
imul eax, eax, 0x10523ff1
and eax, 0x6c27c40d
imul eax, eax, 0x8c90dff0
imul eax, eax, 0x3d1b2a33
or eax, 0xee8d2c9
and eax, 0x7823e754
sub eax, 0x50e2d073
sub eax, 0xb2b4e153
add eax, 0xc138708d
sub eax, 0xf26ded53
xor eax, 0xcf7e070b
add eax, 0x764eca79
and eax, 0x10c013c4
sub eax, 0x49f4fcc4
mov ecx, 0x63f5a1eb
xor edx, edx
div ecx
and eax, 0x3cbcb0c2
sub eax, 0x9ce15283
xor eax, 0xafbe5a48
xor eax, 0xfdd6dc
imul eax, eax, 0x4d231612
sub eax, 0x40479f5d
and eax, 0xbfb49232
imul eax, eax, 0xcc90e2de
or eax, 0xe39f0327
and eax, 0xe0c4561b
mov ecx, 0x8d421c5f
xor edx, edx
div ecx
xor eax, 0x74bdbdd3
imul eax, eax, 0x8383ebd6
mov ecx, 0xf62143e8
xor edx, edx
div ecx
imul eax, eax, 0x3c2823c5
sub eax, 0xb8760123
imul eax, eax, 0xcd1f18cb
imul eax, eax, 0x2ecf7922
add eax, 0x2d96f7cd
imul eax, eax, 0xef2b0609
mov ecx, 0xf604612d
xor edx, edx
div ecx
mov ecx, 0x1110c2ff
xor edx, edx
div ecx
mov ecx, 0x878f905a
xor edx, edx
div ecx
mov ecx, 0x9746a310
xor edx, edx
div ecx
imul eax, eax, 0x45db5e88
and eax, 0xc03dbfc2
sub eax, 0x265d168f
sub eax, 0xe5d13a59
sub eax, 0x1413b07f
xor eax, 0x765e108d
sub eax, 0xfab79639
xor eax, 0x5754ea7f
or eax, 0xd989a703
sub eax, 0xc2c02be2
and eax, 0x67c770ad
and eax, 0x24291908
sub eax, 0xf20e4783
or eax, 0x9da039d4
or eax, 0xa8f696f8
imul eax, eax, 0x1af5b5d5
add eax, 0x79527ad9
add eax, 0xecfdcb0a
sub eax, 0xf08af1cb
and eax, 0x82fe52de
add eax, 0xa44658b4
add eax, 0x81779b3f
cmp eax, 0x831b43da
jb 0x100574f3
mov eax, dword [0x100c1bd0]
add eax, dword [0x100c1bd4]
mov ecx, 0x156f6409
xor edx, edx
div ecx
imul eax, eax, 0x2d33fa15
mov ecx, 0x560c8b84
xor edx, edx
div ecx
imul eax, eax, 0x5df05f94
and eax, 0x66cac68b
mov ecx, 0x93000045
xor edx, edx
div ecx
and eax, 0x7882b32f
and eax, 0x330fbce
mov ecx, 0x38ffc5c8
xor edx, edx
div ecx
or eax, 0xd3d2beb0
sub eax, 0xed2749b0
xor eax, 0xb2f00a26
or eax, 0x923e59f9
and eax, 0xf5c2d3f3
sub eax, 0xc2731885
and eax, 0x26623c99
xor eax, 0x9f3b45b
add eax, 0x7f003ee7
xor eax, 0x53896c1d
add eax, 0x7d925835
imul eax, eax, 0xdedaa09c
and eax, 0xee652084
and eax, 0xdfb37822
imul eax, eax, 0xa47a4d6a
mov ecx, 0x137c888d
xor edx, edx
div ecx
add eax, 0xb5bf3a27
or eax, 0xfae03c5d
or eax, 0x8295181f
add eax, 0xd6da7be7
mov ecx, 0x13b9bf03
xor edx, edx
div ecx
mov ecx, 0xb02ea593
xor edx, edx
div ecx
sub eax, 0x4297a6bd
add eax, 0x4313bbdd
add eax, 0xc583a961
xor eax, 0xde583bd3
xor eax, 0x468971f1
mov ecx, 0x6f1a9da6
xor edx, edx
div ecx
xor eax, 0xa6a7faea
xor eax, 0xee6489e7
and eax, 0x7af2f70e
add eax, 0xb1733597
and eax, 0xfd7776b3
or eax, 0xef3763ec
or eax, 0x63dd4b1a
imul eax, eax, 0x3b9c459e
and eax, 0xd988c840
add eax, 0x89f2e71f
imul eax, eax, 0x7f10b36a
and eax, 0xddcae659
sub eax, 0x9e74836
or eax, 0x9e40342a
mov ecx, 0xbc754c4b
xor edx, edx
div ecx
add eax, 0x142d7b98
mov ecx, 0x5a9484e0
xor edx, edx
div ecx
mov ecx, 0x1715eb3
xor edx, edx
div ecx
mov ecx, 0x75d4faf8
xor edx, edx
div ecx
and eax, 0xd694c8d5
or eax, 0xac220946
and eax, 0xb57475e2
xor eax, 0x40cccf3c
xor eax, 0x25db27ae
mov ecx, 0x1519f1a3
xor edx, edx
div ecx
or eax, 0x6879313f
xor eax, 0x343f1106
add eax, 0x78a43d31
and eax, 0x6eda6738
sub eax, 0xd98a5ee7
add eax, 0x671cdba
mov ecx, 0x5b94f06
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
or ecx, 0xdf07a94a
sub ecx, 0xf179209d
imul ecx, ecx, 0x3c43ce6c
mov dword [ebp - 0x30], ecx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x30]
cmp eax, 0x681eaf95
je 0x10056e94
jmp 0x10057079
mov eax, dword [0x100c1bd8]
or eax, dword [0x100c1bdc]
sub eax, 0x2a768f49
mov ecx, 0x980a8ec0
xor edx, edx
div ecx
add eax, 0x525344d2
and eax, 0x3ad8b577
or eax, 0xc77a85cb
sub eax, 0x8b66b418
sub eax, 0x1f742153
and eax, 0x6d557685
and eax, 0x7e8c7775
add eax, 0xa91b5bd5
and eax, 0x5da916f7
mov ecx, 0x977caa21
xor edx, edx
div ecx
and eax, 0x68e05358
mov ecx, 0x1fae82eb
xor edx, edx
div ecx
imul eax, eax, 0xe7c85848
and eax, 0xff7b24e0
or eax, 0xf405d9fb
mov ecx, 0xb653666e
xor edx, edx
div ecx
add eax, 0x29d3609b
xor eax, 0x7fc04fa9
imul eax, eax, 0x93f9f1be
xor eax, 0x1acd00
and eax, 0xe5fb60c8
xor eax, 0x4acadf67
xor eax, 0xd325c8e6
mov ecx, 0xcfab8262
xor edx, edx
div ecx
add eax, 0x5db8d850
xor eax, 0xbef60df5
add eax, 0xbc2057c8
mov ecx, 0x58ab9d86
xor edx, edx
div ecx
xor eax, 0xb66dddd7
or eax, 0x14f1cf64
imul eax, eax, 0xcd0c538a
and eax, 0x31197df7
add eax, 0x2b6d4eea
mov ecx, 0xf67eba3f
xor edx, edx
div ecx
add eax, 0xac3708a3
add eax, 0xc6ddef6
add eax, 0xffe4ba9f
or eax, 0x5d023ccf
and eax, 0x806faedc
sub eax, 0x5f5e5cff
or eax, 0xda115e62
or eax, 0xefebebb2
or eax, 0x6584a47e
or eax, 0xb4e8b97b
add eax, 0x289491c2
or eax, 0xe2a75a47
sub eax, 0xc7a2657e
imul eax, eax, 0x1ffd46f0
sub eax, 0xc1bdda41
sub eax, 0x6fa4a9c6
add eax, 0xcb37690c
mov ecx, 0x3c2c1591
xor edx, edx
div ecx
and eax, 0xde218c71
and eax, 0xade06883
and eax, 0x3d8e3d40
imul eax, eax, 0xf2d4126e
add eax, 0x364dc184
add eax, 0x5fca07cf
imul eax, eax, 0x7bbfa211
add eax, 0x96132fee
sub eax, 0x8f979056
or eax, 0x40378b9a
sub eax, 0x6209ceed
mov ecx, 0x540adbf6
xor edx, edx
div ecx
sub eax, 0x2c65e47b
and eax, 0x40418d01
add eax, 0x227775e2
xor eax, 0x59c23bc
and eax, 0x46f71ea2
add eax, 0xf0ec118
cmp eax, 0x588d7e39
jae 0x10057511
mov eax, dword [0x100c1be0]
xor edx, edx
div dword [0x100c1be4]
imul eax, eax, 0x60c2e91c
mov ecx, 0xd7812e51
xor edx, edx
div ecx
and eax, 0x5d078ea2
and eax, 0x92c03bdc
mov ecx, 0x67ff8ecb
xor edx, edx
div ecx
and eax, 0x14a7e137
sub eax, 0xc46da419
add eax, 0x2047a6d6
add eax, 0x57e58fc
and eax, 0x18a22bea
or eax, 0xc96d5045
sub eax, 0xcd828c23
sub eax, 0xb38c6ea0
xor eax, 0xeef79835
xor eax, 0xabbba125
or eax, 0xb4080517
imul eax, eax, 0x99d0d512
xor eax, 0xf1810b6
mov ecx, 0x41cb42ed
xor edx, edx
div ecx
xor eax, 0x9f1d0dc4
imul eax, eax, 0x5edb08cb
imul eax, eax, 0x935555a1
or eax, 0x2e03b254
add eax, 0xf7ba5a55
add eax, 0x95e19efd
add eax, 0x382c8320
mov ecx, 0x5191a099
xor edx, edx
div ecx
xor eax, 0x129f8942
mov ecx, 0xcee1d9fb
xor edx, edx
div ecx
and eax, 0xaacd8c25
add eax, 0x2ecfabbe
mov ecx, 0x8a41feaa
xor edx, edx
div ecx
or eax, 0xfd4e1030
imul eax, eax, 0x4d1b59e3
add eax, 0x990f7288
xor eax, 0xecada74c
sub eax, 0xbf1cae41
sub eax, 0x1c529ca6
and eax, 0x684a3b90
sub eax, 0x1fd3e7ab
mov ecx, 0xa922bb79
xor edx, edx
div ecx
xor eax, 0x49614274
or eax, 0x16d5b70e
mov ecx, 0x91107d53
xor edx, edx
div ecx
xor eax, 0x94766c8c
add eax, 0xe9533856
add eax, 0xdb8d4a14
or eax, 0xb041680b
sub eax, 0x33399e3f
or eax, 0x8ac54f06
and eax, 0xcef724c1
mov ecx, 0x1a9379f4
xor edx, edx
div ecx
or eax, 0x2b4403d7
xor eax, 0xbba8ea19
sub eax, 0x26620241
sub eax, 0x4a5df919
add eax, 0x6ea4534c
add eax, 0xb5c1dad2
imul eax, eax, 0x1ff87dad
and eax, 0x502b3358
and eax, 0xdfecb490
and eax, 0xcf714066
and eax, 0xb8327544
and eax, 0x95af262b
xor eax, 0xc42fbeb
imul eax, eax, 0x1c04c3b6
sub eax, 0x39870431
xor eax, 0x1a798300
and eax, 0x7bfb8431
xor eax, 0xf5eaf362
mov ecx, 0xe940536b
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, 0x98e6c2e4
mov dword [ebp - 0x38], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x34], ecx
cmp eax, 0xf2a37bbc
ja 0x10057221
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006978f
mov eax, dword [ebp - 0x34]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [ebp - 0x44], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x40], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x3c], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1006d150
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10039210
add esp, 0xc
jmp 0x10056bdf
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x10056e94
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10057221