Function at 0x10271c94
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x100
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
push ebx
push ebp
push esi
mov esi, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
push edi
xor edi, edi
mov edx, esi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], edi
mov eax, dword [ecx]
add ecx, 4
mov ebp, dword [esp + eax*4 + 0x54]
lea eax, [esp + eax*4 + 0x54]
inc ebp
dec edx
mov dword [eax], ebp
jne 0x10271cff
cmp dword [esp + 0x54], esi
jne 0x10271d37
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
mov dword [ecx], edi
mov dword [edx], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret
mov ebx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 1
lea eax, [esp + 0x58]
mov ebp, dword [ebx]
mov dword [esp + 0x10], ebp
cmp dword [eax], edi
jne 0x10271d5a
inc ecx
add eax, 4
cmp ecx, 0xf
jbe 0x10271d4d
mov eax, ecx
cmp ebp, ecx
mov dword [esp + 0x14], eax
jae 0x10271d6a
mov dword [esp + 0x10], ecx
mov ebp, ecx
mov edx, 0xf
lea esi, [esp + 0x90]
cmp dword [esi], edi
jne 0x10271d82
dec edx
sub esi, 4
cmp edx, edi
jne 0x10271d76
cmp ebp, edx
mov dword [esp + 0x2c], edx
jbe 0x10271d90
mov dword [esp + 0x10], edx
mov ebp, edx
mov esi, 1
mov dword [ebx], ebp
shl esi, cl
cmp ecx, edx
jae 0x10271daf
lea ebx, [esp + ecx*4 + 0x54]
sub esi, dword [ebx]
js 0x10271dca
inc ecx
add ebx, 4
shl esi, 1
cmp ecx, edx
jb 0x10271da1
lea ecx, [edx*4]
mov dword [esp + 0x20], ecx
mov ebx, dword [esp + ecx + 0x54]
lea ecx, [esp + ecx + 0x54]
sub esi, ebx
mov dword [esp + 0x44], esi
jns 0x10271dda
pop edi
pop esi
pop ebp
mov eax, GetMappedFileNameW
pop ebx
add esp, 0x100
ret
add ebx, esi
mov dword [esp + 0x98], edi
mov dword [ecx], ebx
xor ecx, ecx
dec edx
je 0x10271dfd
xor ebx, ebx
add ecx, dword [esp + ebx + 0x58]
add ebx, 4
dec edx
mov dword [esp + ebx + 0x98], ecx
jne 0x10271dec
mov edx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
xor ebx, ebx
mov ecx, dword [edx]
add edx, 4
cmp ecx, edi
mov dword [esp + 0x1c], edx
je 0x10271e36
mov edx, dword [esp + ecx*4 + 0x94]
mov esi, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + ecx*4 + 0x94]
mov dword [esi + edx*4], ebx
mov esi, dword [esp + 0x44]
inc edx
mov dword [ecx], edx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
inc ebx
cmp ebx, ecx
jb 0x10271e06
mov ecx, dword [esp + 0x20]
mov ebx, ebp
neg ebx
mov edx, dword [esp + ecx + 0x94]
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x2c]
cmp eax, ecx
mov dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId], edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x18], reloc.KERNEL32.dll_GetCurrentThreadId
mov dword [esp + 0xd4], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
jg 0x1027212a
mov esi, dword [esp + 0x34]
lea edx, [eax - 1]
lea ecx, [esp + eax*4 + 0x54]
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x28]
mov edx, dword [edx]
mov ecx, edx
dec edx
test ecx, ecx
mov dword [esp + 0x24], edx
je 0x102720ff
jmp 0x10271ebf
mov edx, dword [esp + 0x24]
lea ecx, [ebx + ebp]
cmp eax, ecx
jle 0x10271fdc
inc edx
mov dword [esp + 0x50], edx
jmp 0x10271ed9
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add ebx, ebp
inc edx
add ecx, ebp
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x2c]
sub edx, ebx
mov dword [esp + 0x48], ecx
cmp edx, ebp
jbe 0x10271ef6
mov edx, ebp
mov edi, dword [esp + 0x50]
mov ecx, eax
sub ecx, ebx
mov eax, 1
shl eax, cl
cmp eax, edi
jbe 0x10271f34
mov ebp, dword [esp + 0x24]
or edi, reloc.KERNEL32.dll_GetCurrentThreadId
sub edi, ebp
mov ebp, dword [esp + 0x28]
add eax, edi
cmp ecx, edx
jae 0x10271f34
inc ecx
cmp ecx, edx
jae 0x10271f34
mov edi, dword [ebp + 4]
add ebp, 4
shl eax, 1
cmp eax, edi
jbe 0x10271f34
sub eax, edi
inc ecx
cmp ecx, edx
jb 0x10271f21
mov ebp, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
mov edx, 1
shl edx, cl
mov eax, dword [ebp]
mov dword [esp + 0x3c], edx
add edx, eax
cmp edx, 0x5a0
ja 0x1027214d
mov edi, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp], edx
mov edx, dword [esp + 0x18]
lea eax, [edi + eax*8]
mov edi, dword [esp + 0x18]
test edx, edx
lea edi, [esp + edi*4 + 0xd4]
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], edi
mov dword [edi], eax
je 0x10271fbf
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x40]
mov byte [esp + 0x30], cl
mov ecx, ebx
mov dword [esp + edx*4 + 0x94], edi
mov edx, dword [esp + 0x4c]
mov byte [esp + 0x31], al
sub ecx, eax
mov eax, edi
shr eax, cl
mov ecx, dword [edx - 4]
mov edx, dword [esp + 0x30]
sub esi, ecx
sar esi, 3
sub esi, eax
mov dword [ecx + eax*8], edx
mov dword [ecx + eax*8 + 4], esi
jmp 0x10271fcc
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [esp + 0x38]
mov dword [ecx], eax
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x14]
cmp eax, ecx
jg 0x10271ed1
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
mov dl, al
mov ebp, dword [esp + 0x1c]
sub dl, bl
mov byte [esp + 0x31], dl
mov edx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [ecx + edx*4]
cmp ebp, ecx
jb 0x10272004
mov byte [esp + 0x30], 0xc0
jmp 0x1027204d
mov esi, dword [ebp]
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
cmp esi, ecx
jae 0x10272026
cmp esi, 0x100
sbb dl, dl
and dl, 0xa0
add dl, 0x60
mov byte [esp + 0x30], dl
jmp 0x10272046
sub esi, ecx
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
shl esi, 2
mov dl, byte [esi + ecx]
mov ecx, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
add dl, 0x50
mov esi, dword [esi + ecx]
mov byte [esp + 0x30], dl
add ebp, 4
mov dword [esp + 0x1c], ebp
mov ecx, eax
mov edx, 1
sub ecx, ebx
mov eax, edi
shl edx, cl
mov ecx, ebx
shr eax, cl
cmp eax, dword [esp + 0x3c]
jae 0x10272085
mov ecx, dword [esp + 0x40]
lea ecx, [ecx + eax*8]
mov ebp, dword [esp + 0x30]
add eax, edx
mov dword [ecx], ebp
lea ebp, [edx*8]
mov dword [ecx + 4], esi
add ecx, ebp
cmp eax, dword [esp + 0x3c]
jb 0x1027206b
mov ecx, dword [esp + 0x20]
mov eax, 1
shl eax, cl
test edi, eax
je 0x1027209c
xor edi, eax
shr eax, 1
test edi, eax
jne 0x10272094
mov edx, dword [esp + 0x18]
mov ebp, 1
mov ecx, ebx
xor edi, eax
shl ebp, cl
mov ecx, dword [esp + edx*4 + 0x94]
lea eax, [esp + edx*4 + 0x94]
mov dword [esp + 0x38], edi
dec ebp
and ebp, edi
cmp ebp, ecx
je 0x102720e4
mov ebp, dword [esp + 0x10]
dec edx
sub ebx, ebp
mov ebp, 1
mov ecx, ebx
sub eax, 4
shl ebp, cl
mov ecx, dword [eax]
dec ebp
and ebp, edi
cmp ebp, ecx
jne 0x102720c4
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov edx, eax
dec eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
test edx, edx
jne 0x10271ebb
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
add ecx, 4
inc eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
inc edx
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
jle 0x10271ea4
mov esi, dword [esp + 0x44]
xor edi, edi
cmp esi, edi
je 0x10271d2a
cmp dword [esp + 0x2c], 1
je 0x10271d2a
pop edi
pop esi
pop ebp
mov eax, GetMappedFileNameW
pop ebx
add esp, 0x100
ret
pop edi
pop esi
pop ebp
mov eax, GetMappedFileNameW
pop ebx
add esp, 0x100
ret