Function at 0x100113c0
Capabilities:
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100acd36
mov eax, dword fs:[0]
push eax
sub esp, 0xa58
mov eax, dword [0x100de040]
xor eax, esp
mov dword [esp + 0xa50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100de040]
xor eax, esp
push eax
lea eax, [esp + 0xa6c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa7c]
push 0x1ff
xor ebx, ebx
lea eax, [esp + 0x869]
push ebx
push eax
mov edi, ecx
call fcn.10064e10
mov ecx, dword [ebp + 0x350]
mov edx, dword [ebp + 0x348]
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x884], ecx
mov ecx, dword [ebp + 0x24]
add esp, 0xc
shrd eax, ecx, 9
push 0x280
mov dword [esp + 0x878], edx
lea edx, [esp + 0x30]
push ebx
push edx
mov dword [esp + 0x870], 0x5120372
mov dword [esp + 0x874], 2
shr ecx, 9
mov dword [esp + 0x88c], eax
call fcn.10064e10
add esp, 0xc
lea esi, [esp + 0x2c]
mov dword [esp + 0x52c], ebx
mov dword [esp + 0x530], ebx
mov dword [esp + 0x534], ebx
mov dword [esp + 0x538], ebx
mov dword [esp + 0x53c], ebx
call fcn.10013d80
mov dword [esp + 0xa74], ebx
mov dword [ebp + 0x60], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0xa7c], 1
mov eax, dword [edi]
mov edx, dword [eax + 0x2c]
lea ecx, [esp + 0x24]
push ecx
push edi
call edx
test eax, eax
jne 0x100115ec
cmp dword [esp + 0x1c], ebx
je 0x100115ec
cmp dword [esp + 0x18], ebx
je 0x100115ec
lea eax, [esp + 0x18]
push eax
call fcn.10013660
test al, al
je 0x100115ec
mov eax, 1
or dword [esp + 0x86c], eax
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x360], ebx
jne 0x10011566
mov ecx, dword [ebp + 0x348]
push 0x100e33b4
push ecx
call fcn.100628bb
add esp, 8
mov dword [ebp + 0x360], eax
cmp eax, ebx
jne 0x10011555
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea esi, [esp + 0x2c]
call fcn.10013c90
mov eax, 0x8007000e
jmp 0x10011920
mov ecx, dword [ebp + 0x348]
push ecx
push ebx
push eax
call fcn.10064e10
add esp, 0xc
push 0x40
lea edi, [esp + 0x888]
lea esi, [esp + 0x30]
call fcn.10013cc0
test eax, eax
jne 0x1001159a
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea esi, [esp + 0x2c]
call fcn.10013c90
mov eax, 0x80004005
jmp 0x10011920
lea eax, [esp + 0x2c]
call fcn.10013f80
push 0x40
lea edi, [esp + 0x8d8]
lea esi, [esp + 0x30]
call fcn.10013cc0
test eax, eax
jne 0x100115c0
mov eax, dword [esp + 0x18]
push eax
jmp 0x10011581
lea eax, [esp + 0x2c]
call fcn.10013f80
mov ecx, 0x40
lea edx, [esp + 0x8d4]
mov dword [esp + 0x8c4], 0x10211a41
call fcn.10013c20
mov dword [esp + 0x8c8], eax
push 0x3f
lea ecx, [esp + 0x829]
push ebx
push ecx
mov byte [esp + 0x830], bl
call fcn.10064e10
add esp, 0xc
cmp dword [ebp + 0x60], ebx
je 0x100116e5
mov ecx, 0x10
lea esi, [esp + 0x8d4]
lea edi, [esp + 0x824]
rep movsd dword es:[edi], dword [esi]
push 0x150
lea edi, [esp + 0x918]
lea esi, [esp + 0x30]
call fcn.10013cc0
test eax, eax
jne 0x1001167f
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x280
mov eax, esi
push ebx
push eax
call fcn.10064e10
add esp, 0xc
cmp dword [esp + 0x53c], ebx
je 0x10011590
mov ecx, dword [esp + 0x538]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 0x80004005
jmp 0x10011920
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x884]
push edx
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, esi
lea ecx, [esp + 0x54c]
call fcn.10013730
test eax, eax
je 0x100115b9
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [esp + 0x54c]
push ecx
mov ecx, 0x10
lea edx, [esp + 0x880]
call fcn.10013860
push 0xffffffffffffffff
push 0xffffffffffffffff
lea edx, [esp + 0x54c]
push edx
mov ecx, 0x1a0
lea edx, [esp + 0x8d0]
call fcn.10013860
mov ecx, 0x200
lea edx, [esp + 0x864]
or eax, 0xffffffff
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x100e1aa8]
dec ecx
inc edx
cmp ecx, ebx
jne 0x100116f4
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push ebx
not eax
push ebx
mov dword [esp + 0x878], eax
xor eax, eax
push ebx
push eax
mov eax, dword [ebp + 0x4c]
push eax
call esi
test eax, eax
jne 0x10011772
call fcn.10002d30
mov ecx, dword [esp + 0x18]
push ecx
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x280
lea edx, [esp + 0x30]
push ebx
push edx
call fcn.10064e10
add esp, 0xc
cmp dword [esp + 0x53c], ebx
je 0x1001176b
mov eax, dword [esp + 0x538]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x10011920
mov eax, dword [ebp + 0x4c]
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0x200
lea edx, [esp + 0x870]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001172e
mov eax, dword [ebp + 0x350]
push ebx
push ebx
xor ecx, ecx
push ecx
mov ecx, dword [ebp + 0x4c]
push eax
push ecx
call esi
test eax, eax
jne 0x100117cb
call fcn.10002d30
mov edx, dword [esp + 0x18]
push edx
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea esi, [esp + 0x2c]
call fcn.10013c90
mov eax, edi
jmp 0x10011920
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x34c]
shrd ecx, edx, 9
push ebx
push eax
shr edx, 9
push edx
push ecx
call fcn.100669b0
lea esi, [eax*4 + 0x1ff]
mov eax, dword [ebp + 0x354]
shr esi, 9
shl esi, 9
shr esi, 2
cmp eax, ebx
je 0x1001180a
push eax
call fcn.100628c6
add esp, 4
xor ecx, ecx
mov eax, esi
mov edx, 4
mul edx
seto cl
push 0x100e33b4
neg ecx
or ecx, eax
push ecx
call fcn.100628bb
add esp, 8
mov dword [ebp + 0x354], eax
cmp eax, ebx
jne 0x1001183e
mov eax, dword [esp + 0x18]
push eax
jmp 0x1001153c
add esi, esi
add esi, esi
push esi
push 0xff
push eax
mov dword [esp + 0x2c], esi
call fcn.10064e10
add esp, 0xc
cmp dword [ebp + 0x60], ebx
je 0x100118b0
lea edi, [ebp + 0x64]
lea esi, [esp + 0x824]
call fcn.10013810
test eax, eax
jne 0x10011877
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x10011581
mov ecx, dword [esp + 0x20]
mov edx, ecx
shr edx, 9
xor eax, eax
or esi, 0xffffffff
sub esi, edx
mov edx, 0xffffffff
sbb edx, eax
mov eax, edx
mov dword [ebp + 0x344], edx
push eax
mov edx, esi
push edx
mov edx, dword [ebp + 0x354]
push edi
mov dword [ebp + 0x340], esi
call fcn.10013860
mov esi, dword [esp + 0x20]
mov ecx, dword [ebp + 0x354]
mov edx, dword [ebp + 0x4c]
push ebx
lea eax, [esp + 0x28]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100118f0
mov eax, dword [ebp + 0x354]
push eax
call fcn.100628c6
add esp, 4
mov dword [ebp + 0x354], ebx
call fcn.10002d30
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x100117b3
cmp dword [ebp + 0x60], ebx
je 0x1001190a
mov edx, dword [ebp + 0x354]
push esi
push 0xff
push edx
call fcn.10064e10
add esp, 0xc
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea esi, [esp + 0x2c]
call fcn.10013c90
xor eax, eax
mov ecx, dword [esp + 0xa6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa50]
xor ecx, esp
call fcn.10062448
add esp, 0xa64
ret 4