Function at 0x1001b850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, ebx
push esi
push edi
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], edi
mov esi, dword [edi + 0x48]
xor esi, ebx
mov dword [ebp - 8], esi
test ebx, ebx
je 0x1001b896
mov ebx, dword [ebp + 0xc]
movzx ecx, byte [ebx + edx - 1]
mov eax, esi
shl eax, 5
add ecx, eax
mov eax, esi
shr eax, 2
add ecx, eax
xor esi, ecx
sub edx, 1
jne 0x1001b876
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
dec ecx
and ecx, esi
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [ebp - 0xc], eax
test edi, edi
je 0x1001b90f
nop dword [eax]
movzx eax, byte [edi + 7]
cmp ebx, eax
jne 0x1001b908
mov ecx, dword [ebp + 0xc]
lea edx, [edi + 0x10]
mov esi, ebx
sub esi, 4
jb 0x1001b8d6
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1001b8db
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1001b8c5
cmp esi, 0xfffffffc
je 0x1001b93f
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1001b908
cmp esi, 0xfffffffd
je 0x1001b93f
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1001b908
cmp esi, 0xfffffffe
je 0x1001b93f
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1001b908
cmp esi, 0xffffffff
je 0x1001b93f
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1001b93f
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x1001b8b0
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jl 0x1001b9d7
mov edi, dword [ebp + 8]
cmp eax, 0x7fffffff
jne 0x1001b95f
push 1
push edi
call fcn.1000f330
cmp dword [esi + 0x1c], 0x7fffffff
je 0x1001ba24
jmp 0x1001b95f
mov edx, dword [ebp - 4]
mov al, byte [edi + 5]
mov cl, byte [edx + 0x4c]
xor cl, 0x18
test al, cl
je 0x1001b954
xor al, 0x18
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [esi + 0x20]
cmp esi, 0x1fffffff
jg 0x1001b9c0
mov ebx, dword [edi + 0x10]
add esi, esi
mov edi, dword [ebx + 0x20]
cmp esi, edi
jge 0x1001b980
push esi
push edi
push dword [ebx + 0x18]
call fcn.1001be50
lea eax, [esi*4]
push eax
lea eax, [edi*4]
push eax
push dword [ebx + 0x18]
mov eax, dword [ebp + 8]
push eax
call fcn.10014ff0
test eax, eax
jne 0x1001b9ab
cmp esi, edi
jge 0x1001b9bd
push edi
push esi
push dword [ebx + 0x18]
jmp 0x1001b9b8
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x20], esi
cmp esi, edi
jle 0x1001b9bd
push esi
push edi
push eax
call fcn.1001be50
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x18]
dec ecx
and ecx, edi
lea eax, [eax + ecx*4]
mov dword [ebp - 0xc], eax
jmp 0x1001b9da
mov edi, dword [ebp - 8]
lea eax, [ebx + 0x11]
push eax
push 4
push dword [ebp + 8]
call fcn.1000f3f0
mov esi, eax
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x10]
mov dword [esi + 8], edi
mov byte [esi + 6], 0
push ecx
mov byte [esi + ebx + 0x10], 0
call sub.ntdll.dll_memcpy
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov byte [esi + 7], bl
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ecx], esi
pop edi
inc dword [eax + 0x1c]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 4
push edi
call fcn.1000cb00
int3