Function at 0x10010b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea edx, [eax + 0x1380]
push esi
mov ecx, eax
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
cmp eax, edx
ja 0x10010fcc
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
cmp ecx, 0x7018
ja 0x10010cd0
je 0x10010c98
cmp ecx, 0x6ef8
ja 0x10010c3d
je 0x10010c21
mov eax, ecx
sub eax, 0x5f1f
je 0x10010fd5
sub eax, 0xf19
je 0x10010bf5
sub eax, 0x60
jne 0x10010fba
push 4
lea eax, [ebp - 0x14]
push 0x101625b8
push eax
call fcn.100fdb50
add esp, 0xc
jmp 0x10010fba
movzx ecx, word [0x101625a8]
mov dl, byte [0x101625aa]
mov eax, dword [0x101625ac]
mov word [ebp - 0x1c], cx
movzx ecx, word [0x101625b0]
mov byte [ebp - 0x1a], dl
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], cx
jmp 0x10010fba
push 2
lea edx, [ebp - 0x11]
push 0x101625b4
push edx
call fcn.100fdb50
add esp, 0xc
mov byte [ebp - 0x10], 0x69
jmp 0x10010fba
mov eax, ecx
sub eax, 0x6f58
je 0x10010c56
sub eax, 0x60
jne 0x10010fba
not esi
jmp 0x10010fba
mov cl, byte [0x101625a6]
mov ax, word [0x101625a4]
mov edi, dword [ebp - 0xc]
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov esi, eax
mov edx, eax
shl esi, 0x10
and edx, 0xff00
add esi, edx
shr eax, 8
and eax, 0xff00
shl esi, 8
add esi, eax
movzx eax, byte [ecx + 3]
add esi, eax
jmp 0x10010fba
cmp dword [ebx], 0
je 0x10010fba
mov eax, dword [ebp + 8]
test al, 3
je 0x10010fba
movzx edx, byte [eax]
mov ecx, esi
shr ecx, 0x18
xor ecx, edx
shl esi, 8
xor esi, dword [ecx*4 + 0x10178268]
dec dword [ebx]
inc eax
cmp dword [ebx], 0
mov dword [ebp + 8], eax
jne 0x10010ca1
jmp 0x10010fba
cmp ecx, 0x7138
ja 0x10010f73
je 0x10010f49
mov eax, ecx
sub eax, 0x7078
je 0x10010d57
sub eax, 0x60
jne 0x10010fba
cmp dword [ebx], 4
jb 0x10010d4c
lea esp, [esp]
xor esi, dword [edi + 4]
add edi, 4
mov eax, esi
shr eax, 0x10
mov ecx, esi
and eax, 0xff
mov edx, dword [eax*4 + 0x10178a68]
shr ecx, 8
and ecx, 0xff
xor edx, dword [ecx*4 + 0x10178668]
mov eax, esi
shr eax, 0x18
xor edx, dword [eax*4 + 0x10178e68]
and esi, 0xff
xor edx, dword [esi*4 + 0x10178268]
add dword [ebx], 0xfffffffc
cmp dword [ebx], 4
mov esi, edx
jae 0x10010d00
add edi, 4
mov dword [ebp + 8], edi
jmp 0x10010fba
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
cmp dword [ebx], 0x20
jb 0x10010fba
jmp 0x10010d70
xor ecx, ecx
mov dword [ebp - 4], 8
lea esp, [esp]
cmp ecx, 0x4d
ja case.0x10010d90.1
movzx edx, byte [ecx + 0x1001100c]
jmp dword [edx*4 + 0x10010ff4]
mov eax, esi
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x10178a68]
mov edx, esi
shr edx, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x10178668]
mov edx, esi
shr edx, 0x18
xor eax, dword [edx*4 + 0x10178e68]
and esi, 0xff
xor eax, dword [esi*4 + 0x10178268]
add edi, 4
xor eax, dword [edi]
mov esi, eax
jmp case.0x10010d90.1
mov eax, esi
shr eax, 0x10
mov edx, esi
shr edx, 8
and edx, 0xff
and eax, 0xff
mov eax, dword [eax*4 + 0x10178a68]
xor eax, dword [edx*4 + 0x10178668]
mov edx, esi
shr edx, 0x18
xor eax, dword [edx*4 + 0x10178e68]
and esi, 0xff
xor eax, dword [esi*4 + 0x10178268]
add edi, 4
xor eax, dword [edi]
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov edx, dword [edx*4 + 0x10178a68]
mov esi, eax
shr esi, 8
and esi, 0xff
xor edx, dword [esi*4 + 0x10178668]
mov esi, eax
shr esi, 0x18
xor edx, dword [esi*4 + 0x10178e68]
and eax, 0xff
xor edx, dword [eax*4 + 0x10178268]
add dword [ebx], 0xffffffe0
mov esi, edx
jmp case.0x10010d90.1
mov eax, esi
shr eax, 0x10
mov edx, esi
and eax, 0xff
mov eax, dword [eax*4 + 0x10178a68]
shr edx, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x10178668]
mov edx, esi
shr edx, 0x18
xor eax, dword [edx*4 + 0x10178e68]
and esi, 0xff
xor eax, dword [esi*4 + 0x10178268]
mov esi, eax
jmp case.0x10010d90.1
mov eax, esi
shr eax, 0x10
mov edx, esi
shr edx, 8
and edx, 0xff
and eax, 0xff
mov eax, dword [eax*4 + 0x10178a68]
xor eax, dword [edx*4 + 0x10178668]
mov edx, esi
shr edx, 0x18
xor eax, dword [edx*4 + 0x10178e68]
and esi, 0xff
xor eax, dword [esi*4 + 0x10178268]
add edi, 8
xor eax, dword [edi - 4]
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov edx, dword [edx*4 + 0x10178a68]
mov esi, eax
shr esi, 8
and esi, 0xff
xor edx, dword [esi*4 + 0x10178668]
mov esi, eax
shr esi, 0x18
xor edx, dword [esi*4 + 0x10178e68]
and eax, 0xff
xor edx, dword [eax*4 + 0x10178268]
xor edx, dword [edi]
mov esi, edx
jmp case.0x10010d90.1
add edi, 4
xor esi, dword [edi]
add ecx, 0xb
dec dword [ebp - 4]
jne 0x10010d80
cmp dword [ebx], 0x20
jae 0x10010d70
jmp 0x10010fba
cmp dword [ebx], 0
je 0x10010f6f
mov edi, edi
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov ecx, esi
shr ecx, 0x18
xor ecx, edx
shl esi, 8
xor esi, dword [ecx*4 + 0x10178268]
inc eax
dec dword [ebx]
mov dword [ebp + 8], eax
jne 0x10010f50
not esi
jmp 0x10010fba
mov eax, ecx
sub eax, 0x7198
je 0x10010faa
sub eax, 0x60
jne 0x10010fba
mov eax, esi
mov ecx, esi
and eax, 0xff00
mov edx, esi
shl ecx, 0x10
add eax, ecx
shr edx, 8
shl eax, 8
and edx, 0xff00
shr esi, 0x18
add eax, edx
pop edi
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov ecx, dword [ebp - 8]
add ecx, 0x60
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp - 0xc]
jbe 0x10010ba4
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax + 1]
mov ax, word [eax]
shl ax, 8
or dx, ax
mov word [ebp - 8], dx
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret