Function at 0x1001b550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100423a6
mov eax, dword fs:[0]
push eax
mov eax, 0x4064
call fcn.10027a00
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0xe609e8], 5
jne 0x1001b84c
mov dword [ebp - 0x405c], 0
mov dword [ebp - 0x4058], 0
mov dword [ebp - 0x4054], 0
push 0
lea eax, [ebp - 0x4070]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x4060]
mov dword [ebp - 0x4070], 1
push eax
mov dword [ebp - 0x406c], 0
mov dword [ebp - 0x4068], 0
mov dword [ebp - 0x4064], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
lea ecx, [ebp - 0x405c]
call fcn.1001a750
test al, al
je 0x1001b7eb
mov edi, dword [ebp - 0x4058]
sub edi, dword [ebp - 0x405c]
je 0x1001b7eb
push dword [ebp - 0x4060]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
xor esi, esi
mov dword [ebp - 0x404c], 0
test edi, edi
je 0x1001b841
nop word [eax + eax]
mov byte [ebp - 0x4028], 0xc2
call fcn.1002ca75
and eax, 0x800000ff
jns 0x1001b65a
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x4025], al
xor ecx, ecx
mov eax, dword [ebp - 0x404c]
mov ebx, 0x14
mov edx, eax
mov byte [ebp - 0x4024], 0x15
inc eax
mov dword [ebp - 0x4020], ecx
mov dword [ebp - 0x401c], edi
mov dword [ebp - 0x4050], edx
mov dword [ebp - 0x404c], eax
nop
cmp esi, edi
jae 0x1001b6af
mov eax, dword [ebp - 0x405c]
inc ecx
mov al, byte [eax + esi]
inc esi
mov byte [ebp + ebx - 0x4010], al
inc ebx
cmp ebx, 0x3fe2
jl 0x1001b690
mov eax, ebx
mov dword [ebp - 0x4020], ecx
shr eax, 8
cmp dword [0x10157b80], 0
mov byte [ebp - 0x4027], al
mov byte [ebp - 0x4026], bl
movups xmm0, xmmword [ebp - 0x4028]
mov dword [ebp - 0x4000], edx
movups xmmword [ebp - 0x4010], xmm0
jle 0x1001b6f4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x10157b80], 0
jg 0x1001b6e3
mov edx, 0xfb
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x1004fad4]
xor al, dl
mov byte [ebp + ecx - 0x4038], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x1001b700
push dword [ebp - 0x4050]
lea eax, [ebp - 0x4038]
mov byte [ebp - 0x402a], 0
push eax
push 0
push 0x10157d08
call fcn.10015910
add esp, 0x10
mov dword [ebp - 0x4030], 0
lea eax, [ebp - 0x4010]
mov word [ebp - 0x402c], 0
xorps xmm0, xmm0
mov byte [ebp - 0x402a], 0
movq qword [ebp - 0x4038], xmm0
push ebx
push eax
call fcn.10003f10
mov bl, al
xor edx, edx
mov eax, 8
nop dword [eax]
mov cl, byte [edx + str.ldo_zndt_31q]
xor cl, al
mov byte [ebp + edx - 0x4048], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0xe
jb 0x1001b780
movzx eax, bl
push eax
lea eax, [ebp - 0x4048]
mov byte [ebp - 0x403a], 0
push eax
push 0
push 0x10157d08
call fcn.10015910
add esp, 0x10
mov dword [ebp - 0x4040], 0
mov word [ebp - 0x403c], 0
xorps xmm0, xmm0
movq qword [ebp - 0x4048], xmm0
mov byte [ebp - 0x403a], 0
cmp esi, edi
jb 0x1001b640
jmp 0x1001b841
mov edx, 0x36
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ecx + str.md_K_RnVP4]
xor al, dl
mov byte [ebp + ecx - 0x4028], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x1001b800
mov byte [ebp - 0x4013], 0
push ecx
lea eax, [ebp - 0x4028]
mov byte [ebp - 4], 1
push eax
push ecx
mov edx, 2
mov ecx, 0x10161dd8
call fcn.1001f420
add esp, 0xc
lea ecx, [ebp - 0x405c]
call fcn.1001b2c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026898
mov esp, ebp
pop ebp
ret