Function at 0x1000b850
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
push ebx
mov ebx, dword [esp + 0x48]
add edx, 0xffffd253
lea eax, [ecx - 0x415]
add ebx, 0xfffffec1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
add eax, 0xffffd07e
mov dword [esp + 0x2c], edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
push ebp
add eax, 0xfffffc54
mov dword [esp + 0x10], ebx
push esi
mov esi, dword [esp + 0x3c]
mov ebp, edx
mov dword [esp + 0xc], eax
lea eax, [ecx - 0x3524]
mov dword [esp + 0x38], eax
push edi
lea eax, [esi - 0x32d]
mov dword [esp + 0x54], ebp
lea edi, [ecx - 0x787]
cmp dword [esp + 0x44], eax
je 0x1000bf6e
mov ecx, dword [esp + 0x44]
lea eax, [esi + 0x7f]
mov esi, dword [esp + 0x34]
cmp ecx, eax
jge 0x1000bc07
push 0x2ff7
push 0x3451
push 0x31ce
push esi
push 0x2efc
push 0x31ce
call fcn.1000c360
mov dword [esi + 0x218], eax
mov ecx, ebp
mov ebx, dword [esp + 0x5c]
mov dword [esi + 0x1f8], 0
mov eax, dword [esi + 0x194]
xor dword [esi + 0x90], eax
inc eax
mov dword [esi + 0x194], eax
mov eax, dword [esi + 0x108]
mov edx, dword [esp + 0x2c]
mov eax, dword [eax + 0x1c4]
xor eax, 0x31b1
mov dword [esi + 0x210], eax
mov eax, dword [esi + 0x1a4]
add eax, 0x3372
mov dword [esi + 0x128], eax
lea eax, [ebp + 0x3372]
push eax
mov eax, dword [esp + 0x58]
add eax, 0x3233
push eax
lea eax, [ebx + 0x2dad]
push eax
lea eax, [edx + 0x3ce]
push eax
lea eax, [ecx + 0x2ff7]
push eax
lea eax, [ecx + 0x3451]
push eax
lea eax, [edx - 0x213]
mov edx, dword [esp + 0x40]
push eax
push esi
lea eax, [edx + 0x11a]
push eax
lea eax, [ebx + 0x3372]
push eax
lea eax, [ecx + 0x34dd]
push eax
lea eax, [edx - 0x2b4]
push eax
call fcn.10003e20
add esp, 0x48
mov ebx, eax
mov dword [esp + 0x18], ebx
add edi, 0x413
push esi
push 0x3524
push 0x2f82
push 0x2d9d
push 0x31ce
push 0x2f82
call fcn.1000d330
mov eax, dword [esi + 0x28]
push 0x2d89
push esi
mov dword [esi + 0xa8], eax
call fcn.10006ae0
lea eax, [esi + 8]
mov edx, 0x2ff7
xor dword [esi + 0xc], eax
add esp, 0x20
mov eax, dword [esi + 0x218]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x178]
mov eax, dword [eax + 0x1e8]
xor eax, 0xe
cmp eax, edx
jb 0x1000ba3d
mov ecx, dword [esi + 0x7c]
lea ebx, [esi + 0x174]
mov ebp, dword [esi + 0x178]
imul ecx, ebx
inc edx
mov dword [esi + 0x7c], ecx
mov eax, dword [ebp + 0x1e8]
xor eax, 0xe
cmp edx, eax
jbe 0x1000ba21
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x54]
mov ecx, dword [esi + 0x38]
add ebp, 0x2ff7
mov eax, dword [esi + 0x30]
or eax, 0x3451
push 0x3239
imul eax, dword [ecx + 8]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x214]
mov dword [esi + 0x3c], eax
mov eax, 0xffffd277
mov ecx, dword [esi + 0x178]
sub eax, dword [esi + 0x50]
add dword [ecx + 0x94], eax
mov ecx, 0xffffcc8e
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x178]
sub ecx, dword [eax + 0x160]
lea eax, [esi + 0x134]
add dword [edx + 0x74], ecx
add dword [esi + 0x120], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x1fc]
mov dword [esi + 0xa8], eax
call fcn.10006ae0
mov ecx, dword [esi + 0x38]
add esp, 8
imul eax, dword [ecx + 0x1c4], 0xc9d8842e
cmp eax, 0x34dd
jae 0x1000bad9
mov eax, dword [esi + 0x124]
or eax, 0x2ff7
sub dword [esi + 0xc], eax
add dword [esi + 0xd8], 0x2d89
imul eax, dword [ecx + 0x1c4], 0x58f81759
mov dword [esp + 0x48], eax
cmp eax, 0x2d8b
jge 0x1000bb1a
mov edx, dword [esi + 0x124]
mov eax, 0x2d8b
mov ecx, dword [esi + 0xc]
add edx, 0x2ff7
sub eax, dword [esp + 0x48]
xor ecx, edx
sub eax, 1
jne 0x1000bb10
mov dword [esi + 0xc], ecx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
add eax, 0x310f
cmp edx, eax
jg 0x1000bf64
lea eax, [edx + 0x14f]
cmp dword [esp + 0x44], eax
jg 0x1000bed8
mov eax, dword [esi + 0x200]
push 0x32ca
push esi
mov dword [esi + 0xa8], eax
call fcn.10006ae0
mov eax, dword [esi + 0x204]
mov edx, 0x31b0
mov dword [esi + 0xa8], eax
add esp, 8
mov edi, dword [esi + 0x178]
mov eax, dword [edi + 0x1c4]
dec eax
cmp eax, edx
jb 0x1000bb96
mov ecx, dword [esi + 8]
add ecx, 0x60
inc edx
add ecx, esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 0x1c4]
dec eax
cmp edx, eax
jbe 0x1000bb82
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx + 0x1c4]
add eax, 0x3ab
cmp dword [esi + 0x84], eax
jae 0x1000bbb6
xor dword [ecx + 0xe0], 0x8f4e377
push 0x355c
push esi
call fcn.10006ae0
mov eax, dword [esi + 0x208]
add esp, 8
mov dword [esi + 0xa8], eax
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x10c]
imul ecx, dword [ecx + 0xc], 0xffffd277
add dword [edx + 8], ecx
mov edx, dword [esi + 0x10c]
mov ecx, dword [edx + 0xe0]
or dword [esi + 0x1b4], ecx
dec dword [edx + 0xe0]
mov eax, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov eax, dword [esi + 0x124]
and eax, edx
cmp dword [esi + 0x1e8], eax
je 0x1000bb1e
mov eax, dword [esi + 0xf0]
add ecx, 0x355c
xor eax, dword [esi + 0xd8]
add ecx, edi
sub eax, 0x2ff7
mov dword [esp + 0x48], ecx
push eax
or ecx, 0x2dad
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [esi + 0x1e8]
mov ecx, eax
mov edx, dword [esp + 0x40]
or ecx, 0x31b0
mov dword [esp + 0x2c], ecx
sub ebp, eax
mov ecx, dword [esi + 0x10c]
add edx, 0xffffcb23
mov eax, dword [esp + 0x48]
sub ecx, 0x2dad
mov dword [esp + 0x28], ecx
add eax, 0xffffcef1
mov ecx, dword [esi + 0x6c]
xor ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x14c]
or ecx, dword [esp + 0x3c]
mov ebx, dword [esi + 0xf0]
sub ecx, 0x355c
mov edi, dword [esi + 0x40]
sub ebx, dword [esi + 0xa4]
xor edi, dword [esp + 0x54]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x44]
add ebx, dword [esp + 0x38]
add ecx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0xd8]
or eax, ecx
push eax
mov eax, dword [esp + 0x3c]
and eax, 0x2dad
lea edx, [ecx + 0x678f]
push edx
push esi
push eax
mov eax, dword [esp + 0x4c]
imul eax, dword [esp + 0x54]
or eax, 0x32ca
push eax
push edi
mov edi, dword [esp + 0x30]
push ebx
push ebp
push dword [esp + 0x3c]
mov ebp, dword [esp + 0x68]
mov eax, ebp
and eax, 0x310f
push eax
push dword [esp + 0x48]
mov eax, edi
push dword [esp + 0x50]
or eax, dword [esp + 0x40]
push dword [esp + 0x58]
imul eax, dword [esp + 0x70]
push dword [esp + 0x60]
push eax
imul eax, dword [esp + 0x74], 0x3524
push eax
call fcn.10004740
mov ecx, dword [esi + 0x7c]
add esp, 0x40
imul ecx, dword [esi + 0x128]
movzx edx, word [esi + 0x174]
mov dword [esp + 0x10], eax
push ecx
movzx ecx, word [esi + 0x128]
imul edx, ecx
and dx, word [esi + 0x70]
movzx eax, dx
push eax
mov eax, edi
xor eax, 0x30
push eax
mov eax, dword [esi + 0xc]
or eax, 0x310f
push eax
mov eax, dword [esi + 0x108]
or eax, dword [esi + 0xa0]
add eax, dword [esi + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov eax, dword [esi + 0x1c4]
mov ecx, dword [esi + 0x10c]
xor eax, edi
add dword [esi + 0x120], eax
mov eax, ecx
mov edx, dword [esp + 0x40]
mov ebx, dword [esi + 0x134]
add edx, 0xffffcb23
imul eax, edx
mov edi, dword [esp + 0x3c]
sub edi, dword [esi + 0x14]
add edi, dword [esp + 0x10]
add dword [esi + 0x124], eax
mov eax, dword [esi + 0xac]
xor eax, ebx
mov edx, dword [esi + 0x124]
xor eax, ebp
sub ebx, dword [esp + 0x54]
mov dword [esi + 0xac], eax
and ebx, 0x3451
lea eax, [ecx - 0x2d89]
sub ebp, dword [esi + 8]
or eax, dword [esi + 0x14c]
add ebp, 0x310f
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x84]
imul eax, dword [esp + 0x48]
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x2c], ebx
add ecx, 0x62bf
lea ebx, [edx - 0x2efc]
mov edx, dword [esi + 0x7c]
or edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x44]
sub edx, 0x31ce
add eax, 0xffffcb23
imul eax, dword [esp + 0x18]
imul eax, eax, 0x310f
push eax
mov eax, dword [esp + 0x44]
or eax, dword [esp + 0x50]
push ecx
push eax
mov eax, dword [esp + 0x48]
xor eax, dword [esp + 0x54]
push edx
push esi
push edi
push eax
push ebx
push dword [esp + 0x50]
push ebp
push dword [esp + 0x54]
call fcn.10004210
mov ecx, dword [esi + 0x1b4]
add esp, 0x30
imul ecx, dword [esp + 0x44]
mov edi, eax
mov ebp, dword [esp + 0x54]
mov ebx, dword [esp + 0x18]
mov edx, dword [esi + 0x120]
push ecx
mov ecx, dword [esi + 0xa0]
add ecx, dword [esp + 0x14]
and ecx, ebp
push ecx
mov ecx, dword [esi + 0x50]
xor ecx, ebx
push ecx
mov eax, edx
or edx, ebp
or eax, dword [esp + 0x48]
and edx, 0x2d9d
push eax
push edx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esp + 0x10]
add eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
xor edi, eax
mov eax, dword [esi + 0x58]
and eax, dword [esi + 0xf0]
sub dword [esi + 0x7c], eax
mov eax, dword [esi + 0x190]
xor eax, dword [esp + 0x3c]
or eax, dword [esi + 0x1e8]
mov edx, dword [esp + 0x38]
xor ebp, eax
lea eax, [ecx - 0x34dd]
or edx, eax
jmp 0x1000bb22
mov eax, dword [esi + 8]
or eax, ebp
cmp dword [esp + 0x14], eax
jae 0x1000bf64
mov edx, dword [esi + 0x1e8]
imul edx, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
mov ecx, eax
or edx, ebx
cmp eax, edx
jb 0x1000bf1e
mov esi, dword [esp + 0x40]
add esi, 0xffffcb23
xor esi, 0x2d9d
nop
add ecx, 2
imul ebp, esi
cmp ecx, edx
jae 0x1000bf10
mov esi, dword [esp + 0x34]
and edi, 0x3451
cmp eax, edi
jge 0x1000bbfb
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
xor edx, ebp
mov ebp, dword [esp + 0x10]
sub edi, eax
nop word [eax + eax]
mov eax, ebx
xor ebx, edx
imul eax, ebp
and eax, dword [esi + 0x1b8]
imul ecx, eax
sub edi, 1
jne 0x1000bf40
mov eax, dword [esp + 0x40]
pop edi
mov dword [esi + 0x14], ecx
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x20
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret