Function at 0x1002ece9
Capabilities:
Compress data via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edx, dword [0x1005c95c]
mov eax, dword [0x1005c960]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov esi, edx
and esi, 0xfffffffe
and ecx, 1
or ecx, esi
not ecx
or ecx, edx
cmp ecx, 0xffffffff
sete byte [ebp - 0xd]
cmp eax, 0xa
setl byte [ebp - 0xe]
mov ecx, 0x1ad96dc7
cmp ecx, 0xcbdf7543
jle 0x1002ed99
cmp ecx, 0x9d23560
jle 0x1002ee15
cmp ecx, 0x336213f7
jg 0x1002eefe
cmp ecx, 0x9d23561
je 0x1002f062
cmp ecx, 0x1ad96dc7
jne 0x1002ed28
mov al, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov edx, eax
xor dl, 1
and dl, cl
xor cl, 1
mov ah, al
xor ah, cl
and ah, al
and cl, al
or cl, dl
mov al, ah
xor al, cl
test al, 1
mov edx, 0x7106b1b
mov esi, 0x336213f8
cmovne edx, esi
test cl, 1
mov ecx, edx
cmovne ecx, esi
test ah, 1
cmove ecx, edx
jmp 0x1002ed28
cmp ecx, 0xb1d0a286
jle 0x1002ee43
cmp ecx, 0xc6f1dcc6
jg 0x1002ef2c
cmp ecx, 0xb1d0a287
je 0x1002f06c
cmp ecx, 0xb838fce5
jne 0x1002ed28
mov ecx, dword [0x1005c95c]
lea eax, [ecx + 1]
imul eax, ecx
not al
or al, 0xfe
cmp al, 0xff
setne al
cmp dword [0x1005c960], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x7106b1b
mov ebx, 0x8e133a00
cmovne ecx, ebx
test dl, dl
mov edx, 0x7106b1b
cmovne ecx, edx
test al, al
cmove ecx, ebx
jmp 0x1002ed28
cmp ecx, 0xe18964ea
jle 0x1002efdd
cmp ecx, 0xe18964eb
je 0x1002f0ce
cmp ecx, 0x7106b1b
jne 0x1002ed28
mov ecx, 0x336213f8
jmp 0x1002ed28
cmp ecx, 0x8e133a00
je 0x1002f0ef
cmp ecx, 0xa5c4a5b2
je 0x1002f0f9
cmp ecx, 0xa9593d0d
jne 0x1002ed28
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005c8d8], eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [0x1005c95c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x5ff59cbd
mov edx, eax
and edx, 0xa00a6342
or edx, ecx
xor edx, 0xa00a6343
and eax, 0xfffffffe
or eax, edx
xor eax, 0xdd18e4c8
xor eax, 0x22e71b37
sete al
setne cl
cmp dword [0x1005c960], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, dl
xor al, ah
test dl, dl
mov ecx, 0xe18964eb
mov edx, 0xd94fd6b1
cmovne ecx, edx
test ah, ah
mov esi, 0xe18964eb
cmovne ecx, esi
test al, al
cmove ecx, edx
jmp 0x1002ed28
cmp ecx, 0x336213f8
je 0x1002f103
cmp ecx, 0x78e86dbd
jne 0x1002ed28
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0xcbdf7544
jmp 0x1002ed28
cmp ecx, 0xc6f1dcc7
je 0x1002f14d
cmp ecx, 0xcbafb316
jne 0x1002ed28
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x14], eax
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x6c0064
mov dword [eax + 8], 0x6c
mov dword [eax], 0x74006e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
movups xmm0, xmmword [str.RtlDecompressBuffer]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0x726566
mov ecx, dword [0x1005c95c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x1005c960], 0xa
setl dl
xor al, dl
mov ah, al
mov ebx, 0xa5c4a5b2
mov edi, 0xb838fce5
cmovne ebx, edi
not ah
test ah, dl
cmovne ebx, edi
test al, al
mov ecx, ebx
cmovne ecx, edi
test ah, dl
cmove ecx, ebx
jmp 0x1002ed28
cmp ecx, 0xcbdf7544
jne 0x1002f1b4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [0x1005c95c]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov ebx, edx
and ebx, 0xfffffffe
and ecx, 1
or ecx, ebx
not ecx
or ecx, edx
xor ecx, 0xffffffff
sete cl
setne dl
cmp dword [0x1005c960], 0xa
setge ch
setl dh
and ch, cl
mov bl, dh
xor bl, dl
and bl, dh
and dh, dl
or dh, ch
mov dl, bl
xor dl, dh
test dh, dh
mov ecx, 0x78e86dbd
mov esi, 0x9d23561
cmovne ecx, esi
test bl, bl
mov edi, 0x78e86dbd
cmove ecx, edi
mov dword [ebp - 0x20], eax
test dl, dl
cmovne ecx, esi
jmp 0x1002ed28
mov ecx, 0xc6f1dcc7
jmp 0x1002ed28
mov ecx, dword [0x1005c95c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xbe484953
and eax, 0x41b7b6ac
or eax, edx
xor eax, 0x41b7b6ad
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x1005c960], 0xa
setge cl
mov edx, eax
xor dl, cl
or cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0xcbdf7544
mov ebx, 0x78e86dbd
cmovne ecx, ebx
test dl, dl
cmove ecx, ebx
test al, al
mov eax, 0xcbdf7544
cmove ecx, eax
jmp 0x1002ed28
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005c8d8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, 0xa9593d0d
jmp 0x1002ed28
mov ecx, 0xb1d0a287
jmp 0x1002ed28
mov ecx, 0xcbafb316
jmp 0x1002ed28
mov ecx, dword [0x1005c95c]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x1005c960], 0xa
setl dl
setge dh
or dh, al
xor dl, cl
mov eax, edx
xor al, dh
test dl, dl
mov ecx, 0xa5c4a5b2
mov esi, 0xcbafb316
cmovne ecx, esi
test dh, 1
mov edx, 0xa5c4a5b2
cmovne ecx, edx
test al, 1
cmove ecx, esi
jmp 0x1002ed28
mov ecx, dword [0x1005c95c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xbb16930b
and eax, 0x44e96cf4
or eax, edx
xor eax, 0x44e96cf5
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x1005c960], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0xa9593d0d
mov ebx, 0xe18964eb
cmovne ecx, ebx
test dl, dl
cmove ecx, ebx
test al, al
mov eax, 0xa9593d0d
cmove ecx, eax
jmp 0x1002ed28
cmp ecx, 0xd94fd6b1
jne 0x1002ed28
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret