Function at 0x100220df
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d627
call fcn.1005cab0
sub esp, 0x5c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x38], ecx
je 0x10022298
test dl, dl
je 0x10022284
mov dword [ebp - 0x18], 0xf60
cmp dword [ebp - 0x18], 0x1270
jle 0x10022144
xor esi, esi
xor edi, edi
mov eax, esi
mov ecx, 0x10077fd8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10004c70
inc edi
cmp edi, 0x1337
jl 0x1002211e
inc esi
cmp esi, 0x7fce
jl 0x1002211c
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0xe41
jge 0x10022160
mov edx, str.rjev_fvr_ftgzmzje_gwyzmbxlz_qxzyiqj_cog_dvjwbrppr_gydkvob
mov ecx, 0x10077fd8
call fcn.10007021
or dword [ebp - 4], 0xffffffff
mov dword [ebp + 0xc], 0x13b91020
mov dword [ebp + 0xc], 0
cmp dword [ebp + 0xc], 0xffffffeb
je 0x100223ec
mov dword [ebp - 0x34], 0x55059b8b
mov dword [ebp - 0x2c], 0x84cbed56
mov dword [ebp - 0x1c], 0x2a7e9f21
mov dword [ebp - 0x30], 0x5b481d3e
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x18], 0x1e67
cmp dword [ebp - 0x18], 0x1efd
jle 0x10022218
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x50]
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100221cb
mov eax, dword [eax]
push eax
call fcn.10045eec
pop ecx
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.100052dc
inc edi
cmp edi, 0x53b1
jl 0x100221b3
inc esi
cmp esi, 0x226d
jl 0x100221b1
push 0x784
push 0x1fcd
push 0x1f92
push 0x40e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
lea eax, [ebp + 0xc]
mov edx, 0x5160
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 1
push 0x6442
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
call fcn.10021e6a
add esp, 0x24
cmp dword [ebp - 0x18], 0x1c87
jge 0x1002225b
push str.fackel_kbzxnlrh_tlmi
call fcn.10045eec
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
dec dword [ebp + 0xc]
jmp 0x10022172
push 0
push 1
push 0x1737
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x100223ec
mov dword [ebp - 0x24], 0x7c8f
cmp dword [ebp - 0x24], 0x7d57
jle 0x10022304
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x3e6a
xor edi, edi
xor esi, esi
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10077fd8
xor eax, ebx
cdq
push edx
push eax
call fcn.10004c70
inc esi
cmp esi, 0x7aaa
jl 0x100222c7
inc edi
cmp edi, 0x3373
jl 0x100222c5
mov esi, dword [ebp - 0x20]
add ebx, esi
dec dword [ebp - 0x18]
jne 0x100222c3
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x5b46
jl 0x100222ba
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0x78db
jge 0x10022323
mov edx, str.gnfdpo_dohknlw_ydhxi_rliefqbcw_jbuiluq_bijensb_dmxueth_wfazstoeh_iqnqt_xdrjwqhlg_offzwvtt_nzpiiq_odm
mov ecx, 0x10077fd8
call fcn.10007021
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x1002235e
push 0x192e
push 1
push 0x130b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x100223ec
mov dword [ebp - 0x24], 0x6c18
cmp dword [ebp - 0x24], 0x6dfe
jle 0x100223af
xor esi, esi
xor edi, edi
mov ebx, 0x7e21
mov eax, edi
lea ecx, [ebp - 0x68]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002238e
mov eax, dword [eax]
push eax
call fcn.10045eec
pop ecx
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.100052dc
add edi, esi
dec ebx
jne 0x10022377
inc esi
cmp esi, 0x3654
jl 0x10022370
cmp dword [ebp - 0x24], 0x6b35
jge 0x100223c3
push str.sjupnoku_hefwoxtxe_cght_xty_csvcba
call fcn.10045eec
pop ecx
mov eax, dword [ebp - 0x38]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x100223ec
push 0
push 0x7abc
push 0xda
push 1
mov edx, 0x2e36
mov cl, 1
call fcn.100214dc
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret