Function at 0x100bc14
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using chaskey

Disassembly:
pushfd
push ebp
mov ebp, esp
sub esp, 0x8c
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x78], edx
lea eax, [ebp + 4]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x84], edi
mov esi, dword [0x100aa54]
mov edi, dword [eax + 4]
sub eax, 4
mov dword [ebp - 0x68], eax
mov eax, dword [edi]
shr eax, 1
and eax, 0xfffffff
xor edx, edx
lea ecx, [esi + eax - 1]
mov eax, ecx
div esi
mov eax, dword [0x100aa54]
sub ecx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [0x10055a0]
mov dword [ebp - 0x38], eax
mov eax, dword [0x100aa54]
mov eax, dword [0x10055a0]
test eax, eax
je 0x100bcfa
xor esi, esi
mov eax, dword [0x10055a0]
dec eax
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x100bcb7
mov ebx, dword [0x104d00c]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x104d00c], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x100bc90
xor edx, edx
div ecx
cmp dword [ebp - 0x38], 0
jbe 0x100bcf4
mov eax, 0xc4a6
inc esi
lea ebx, [edx*4 + 0x104d078]
mov ecx, 0xffff3b59
lock cmpxchg dword [ebx], ecx
cmp eax, 0xc4a6
je 0x100be70
lea eax, [edx + 1]
xor edx, edx
mov ecx, dword [0x10055a0]
div ecx
cmp esi, dword [ebp - 0x38]
jb 0x100bcc1
xor esi, esi
test esi, esi
jne 0x100bd70
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov ebx, eax
inc esi
push 0x40
push 0x1000
push dword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x100be84
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x11
jb 0x100bd04
xor esi, esi
cmp esi, 0x10000
jb 0x100bd3d
test esi, 3
je 0x100bd51
test esi, esi
je 0x100bd4f
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x100bc67
mov eax, esi
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x100bd70
mov byte [eax], 0
inc eax
dec ecx
jne 0x100bd69
mov eax, 0x63fb243c
mov eax, dword [edi]
mov ecx, eax
shr eax, 1
and eax, 0xfffffff
shr ecx, 0x1d
lea edi, [ecx + edi + 8]
mov ecx, eax
lea eax, [ecx + edi]
mov dword [ebp - 0x44], eax
mov eax, dword [0x100aa54]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], edi
mov edi, 0x1000000
sub eax, ecx
mov dword [ebp - 0x4c], ecx
sub dword [ebp - 0x2c], edi
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x100bdd9
mov ebx, dword [0x104d00c]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x104d00c], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x100bdb2
xor edx, edx
div ecx
add edx, esi
mov eax, edx
push dword [ebp - 0x4c]
push dword [ebp - 0x2c]
mov dword [ebp - 0x48], edx
mov eax, 0x6c4babed
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [eax]
lea esi, [ebp - 0x70]
mov eax, dword [eax + 4]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0xd], 0
mov eax, 0x175e4fee
mov eax, dword [ebp - 0x70]
mov edx, 0xfffffff
mov ecx, dword [ebp - 0x6c]
mov esi, dword [0x1034d40]
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
and eax, edx
and ecx, edx
mov edx, edi
add eax, edi
sub edx, esi
mov dword [ebp - 0x50], edx
jne 0x100be8b
xor esi, esi
test ecx, ecx
jbe 0x100c048
mov edi, 0x6e0a9da6
movzx edx, byte [esi + eax]
add edx, edi
add dword [ebp - 0x20], edx
add edx, dword [ebp - 0x1c]
imul edx, edx, 0x6e0a9da6
ror edx, 9
imul edx, edx, 0x6e0a9da6
ror edx, 9
add dword [ebp - 0x20], edx
inc esi
mov dword [ebp - 0x1c], edx
cmp esi, ecx
jb 0x100be42
jmp 0x100c048
mov esi, dword [0x100aa54]
imul esi, edx
lea esi, [esi + 0x1044008]
jmp 0x100bcf6
mov esi, eax
jmp 0x100bd2d
mov edi, dword [0x100003c]
lea edx, [eax + ecx]
mov esi, eax
lea edi, [edi + 0x10000a0]
mov ebx, 0x1000000
sub esi, ebx
mov dword [ebp - 0x28], edx
mov edx, dword [edi]
add edx, ebx
mov ebx, dword [edi + 4]
mov edi, esi
and edi, 0xfffff000
mov dword [ebp - 0x14], edi
add ecx, esi
mov edi, esi
mov esi, ecx
sub edi, dword [ebp - 0x14]
and esi, 0xfffff000
mov dword [ebp - 0x64], esi
sub ecx, esi
mov dword [ebp - 0x60], ecx
add ebx, edx
mov dword [ebp - 0x5c], ebx
jmp 0x100bee0
mov ecx, dword [ebp - 0x14]
cmp dword [edx], ecx
jae 0x100bee4
add edx, dword [edx + 4]
cmp edx, ebx
jne 0x100bed6
and dword [ebp - 0x54], 0
cmp edx, ebx
je 0x100bf1f
mov ecx, dword [ebp - 0x14]
cmp dword [edx], ecx
jne 0x100bf1f
mov ecx, dword [edx + 4]
sub ecx, 8
shr ecx, 1
je 0x100bf1f
lea ebx, [edx + 8]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
movzx ebx, word [ebx]
and ebx, 0xfff
cmp ebx, edi
jae 0x100bf1f
inc dword [ebp - 0x54]
add dword [ebp - 0x14], 2
cmp dword [ebp - 0x54], ecx
jne 0x100bf03
mov edi, 0x6e0a9da6
cmp edx, dword [ebp - 0x5c]
je 0x100c016
cmp dword [edx], esi
ja 0x100c016
mov ecx, dword [edx + 4]
lea ebx, [ecx - 8]
shr ebx, 1
mov ecx, dword [ebp - 0x54]
cmp ecx, ebx
jne 0x100bf5e
add edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
je 0x100c016
cmp dword [edx], esi
ja 0x100c016
and dword [ebp - 0x54], 0
jmp 0x100bf35
cmp dword [edx], esi
jne 0x100bf76
movzx ecx, word [edx + ecx*2 + 8]
and ecx, 0xfff
cmp ecx, dword [ebp - 0x60]
jae 0x100c016
mov ecx, dword [ebp - 0x54]
inc dword [ebp - 0x54]
mov ebx, 0xf000
test word [edx + ecx*2 + 8], bx
je 0x100bf24
movzx esi, word [edx + ecx*2 + 8]
and esi, 0xfff
mov ecx, dword [edx]
lea esi, [esi + ecx + 0x1000000]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x34], esi
je 0x100bfd6
movzx esi, byte [ecx + eax]
add esi, edi
add dword [ebp - 0x20], esi
add esi, dword [ebp - 0x1c]
imul esi, esi, 0x6e0a9da6
ror esi, 9
imul esi, esi, 0x6e0a9da6
ror esi, 9
add dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
inc ecx
cmp ecx, dword [ebp - 0x14]
jb 0x100bfa9
mov esi, dword [ebp - 0x34]
mov eax, dword [esi]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x74], eax
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x74]
add eax, edi
add dword [ebp - 0x20], eax
add eax, dword [ebp - 0x1c]
imul eax, eax, 0x6e0a9da6
ror eax, 9
imul eax, eax, 0x6e0a9da6
ror eax, 9
add dword [ebp - 0x20], eax
inc ecx
cmp ecx, 4
mov dword [ebp - 0x1c], eax
jb 0x100bfe0
lea eax, [esi + 4]
mov esi, dword [ebp - 0x64]
jmp 0x100bf24
xor edx, edx
mov esi, dword [ebp - 0x28]
sub esi, eax
je 0x100c048
movzx ecx, byte [eax + edx]
add ecx, edi
add dword [ebp - 0x20], ecx
add ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0x6e0a9da6
ror ecx, 9
imul ecx, ecx, 0x6e0a9da6
ror ecx, 9
add dword [ebp - 0x20], ecx
inc edx
mov dword [ebp - 0x1c], ecx
cmp edx, esi
jb 0x100c01f
xor ebx, ebx
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x20]
mov byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 8
jb 0x100c04c
mov eax, 0x2be2f4b8
mov eax, dword [ebp - 0x48]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x4c]
and eax, 7
mov dword [ebp - 0x28], eax
je 0x100c21f
mov edi, dword [ebp - 0x2c]
cmp eax, ebx
not edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], ebx
jle 0x100c0b7
push 0x38
pop edx
movzx ebx, byte [esi]
cmp dword [ebp - 0x18], 4
jge 0x100c0a4
lea ecx, [edx - 0x20]
shl ebx, cl
or dword [ebp - 0x3c], ebx
jmp 0x100c0ab
mov ecx, edx
shl ebx, cl
or dword [ebp - 0x14], ebx
inc esi
inc dword [ebp - 0x18]
sub edx, 8
cmp dword [ebp - 0x18], eax
jl 0x100c091
movzx ebx, word [ebp - 8]
mov eax, edi
movzx edx, word [ebp - 0xa]
mov ecx, edx
xor ecx, edi
rol ecx, 6
imul ebx, ecx
mov ecx, dword [ebp - 8]
rol eax, 0xd
xor eax, ebx
xor eax, dword [ebp - 0x2c]
xor ecx, eax
mov ebx, dword [ebp - 0xc]
sub ebx, ecx
xor edi, ebx
mov ecx, edi
sub ecx, edx
movzx ebx, word [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov edx, edi
imul ecx, ebx
shr edx, 0xe
sub ecx, edx
xor eax, ecx
mov ecx, dword [ebp - 0xc]
add ecx, eax
rol ecx, 4
movzx edx, word [ebp - 6]
imul ecx, edx
movzx edx, word [ebp - 8]
mov dword [ebp - 0x24], ebx
mov ebx, eax
ror ebx, 2
add ebx, ecx
xor edi, ebx
mov ebx, edi
mov ecx, edi
xor ecx, dword [ebp - 0x24]
rol ecx, 3
imul edx, ecx
rol ebx, 7
add ebx, edx
movzx edx, word [ebp - 8]
xor eax, ebx
mov ecx, eax
sub ecx, edx
mov edx, dword [ebp - 0x18]
rol ecx, 5
imul edx, ecx
mov ecx, eax
shr ecx, 1
xor edx, ecx
mov ecx, dword [ebp - 8]
xor edi, edx
xor ecx, edi
mov edx, edi
rol ecx, 3
imul ecx, dword [ebp - 0x24]
ror edx, 0xc
add edx, ecx
xor eax, edx
mov ecx, eax
movzx edx, word [ebp - 6]
sub ecx, dword [ebp - 0xc]
rol ecx, 7
imul ecx, edx
mov ebx, eax
ror ebx, 0xc
sub ecx, ebx
mov ebx, dword [ebp - 0x18]
xor edi, ecx
mov edx, edi
movzx ecx, word [ebp - 8]
ror edx, 3
sub edx, ecx
imul edx, dword [ebp - 0x24]
xor eax, edx
mov edx, eax
mov ecx, eax
sub ecx, dword [ebp - 8]
ror ecx, 6
rol edx, 0xc
imul ebx, ecx
mov ecx, dword [ebp - 0x18]
and dword [ebp - 0x18], 0
xor edx, ebx
mov ebx, dword [ebp - 0x28]
xor edi, edx
xor ecx, edi
mov edx, edi
rol ecx, 7
imul ecx, dword [ebp - 0x24]
xor edi, dword [ebp - 0x14]
ror edx, 2
sub ecx, edx
xor ecx, dword [ebp - 0x3c]
xor eax, ecx
mov ecx, edi
mov dword [ebp - 0x24], eax
test ebx, ebx
jle 0x100c1f5
cmp dword [ebp - 0x18], 4
jge 0x100c1dc
rol dword [ebp - 0x24], 8
mov ebx, dword [ebp - 0x30]
mov dl, byte [ebp - 0x24]
inc dword [ebp - 0x30]
xor byte [ebp - 0xd], dl
mov byte [ebx], dl
jmp 0x100c1ea
mov edx, dword [ebp - 0x30]
inc dword [ebp - 0x30]
rol ecx, 8
xor byte [ebp - 0xd], cl
mov byte [edx], cl
inc dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x18], ebx
jl 0x100c1c2
add ebx, 0xfffffffc
test ebx, ebx
jle 0x100c20c
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edi, cl
shl edi, cl
mov edx, edi
jmp 0x100c22e
xor edx, edx
test ebx, ebx
jge 0x100c22e
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x100c22e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
xor edx, edx
not eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov edi, dword [ebp - 0x4c]
shr edi, 3
test edi, edi
jbe 0x100c3fa
movzx ecx, word [ebp - 8]
mov dword [ebp - 0x28], ecx
movzx ecx, word [ebp - 6]
neg dword [ebp - 0x28]
mov dword [ebp - 0x50], ecx
movzx ecx, word [ebp - 0xa]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x34], edi
movzx ecx, byte [esi]
movzx edi, byte [esi + 1]
shl ecx, 8
or ecx, edi
movzx edi, byte [esi + 2]
shl ecx, 8
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 3]
or ecx, edi
movzx edi, byte [esi + 5]
mov dword [ebp - 0x24], ecx
movzx ecx, byte [esi + 4]
shl ecx, 8
or ecx, edi
movzx edi, byte [esi + 6]
shl ecx, 8
or ecx, edi
movzx edi, byte [esi + 7]
shl ecx, 8
or ecx, edi
movzx edi, word [ebp - 8]
mov dword [ebp - 0x40], ecx
xor edx, ecx
mov ecx, dword [ebp - 0x18]
xor ecx, edx
mov ebx, edx
add esi, 8
rol ecx, 6
imul edi, ecx
mov ecx, dword [ebp - 0xc]
rol ebx, 0xd
xor ebx, edi
xor ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 8]
xor eax, ebx
mov ebx, ecx
xor edi, eax
sub ebx, edi
xor edx, ebx
mov ebx, edx
sub ebx, dword [ebp - 0x18]
movzx edi, cx
imul ebx, edi
mov edi, edx
shr edi, 0xe
sub ebx, edi
xor eax, ebx
add ecx, eax
mov edi, eax
rol ecx, 4
imul ecx, dword [ebp - 0x50]
ror edi, 2
add edi, ecx
xor edx, edi
mov ebx, edx
mov ecx, edx
movzx edi, word [ebp - 0xc]
xor ecx, edi
rol ecx, 3
movzx edi, word [ebp - 8]
imul edi, ecx
mov ecx, dword [ebp - 0x28]
rol ebx, 7
add ebx, edi
mov edi, dword [ebp - 0x18]
xor eax, ebx
add ecx, eax
rol ecx, 5
imul edi, ecx
mov ecx, eax
shr ecx, 1
xor edi, ecx
mov ecx, dword [ebp - 8]
xor edx, edi
mov ebx, edx
movzx edi, word [ebp - 0xc]
xor ecx, edx
rol ecx, 3
ror ebx, 0xc
imul ecx, edi
add ebx, ecx
xor eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, eax
sub ecx, dword [ebp - 0xc]
mov edi, eax
rol ecx, 7
imul ecx, dword [ebp - 0x50]
ror edi, 0xc
sub ecx, edi
xor edx, ecx
mov edi, edx
movzx ecx, word [ebp - 8]
ror edi, 3
sub edi, ecx
movzx ecx, word [ebp - 0xc]
imul edi, ecx
xor eax, edi
mov edi, eax
mov ecx, eax
sub ecx, dword [ebp - 8]
ror ecx, 6
imul ebx, ecx
mov ecx, dword [ebp - 0x18]
rol edi, 0xc
xor edi, ebx
xor edx, edi
xor ecx, edx
mov ebx, edx
rol ecx, 7
movzx edi, word [ebp - 0xc]
imul ecx, edi
xor edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x30]
ror ebx, 2
sub ecx, ebx
xor ecx, dword [ebp - 0x3c]
mov byte [edi + 7], dl
xor eax, ecx
mov cl, byte [ebp - 0xd]
mov byte [edi + 3], al
xor cl, al
xor cl, dl
ror eax, 8
mov byte [edi + 2], al
xor cl, al
ror edx, 8
mov byte [edi + 6], dl
xor cl, dl
ror eax, 8
xor cl, al
ror edx, 8
xor cl, dl
mov byte [edi + 1], al
mov byte [edi + 5], dl
ror eax, 8
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0x24]
mov byte [edi], al
mov byte [edi + 4], dl
mov dword [ebp - 0x3c], ecx
add edi, 8
mov ecx, dword [ebp - 0x40]
dec dword [ebp - 0x34]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x30], edi
ror eax, 8
ror edx, 8
jne 0x100c257
mov ecx, dword [ebp - 0x44]
mov al, byte [ebp - 0xd]
cmp al, byte [ecx + 8]
je 0x100c48e
call fcn.010259c0
mov edx, 0xfffff000
mov edi, eax
mov eax, dword [ebp - 0x68]
lea ecx, [eax + 0xc]
and ecx, 0xfffffffc
mov dword [eax + 8], 0x103e45c
lea esi, [ecx + 0xfff]
and edi, edx
and esi, edx
xor eax, eax
mov edx, 0xffff
mov ebx, dword [0x104d00c]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x104d00c], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x100c436
mov ebx, 0xffff
div ebx
inc edx
mov eax, ecx
mov dword [ebp - 0x78], edi
cmp ecx, esi
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x40], 0
jae 0x100c484
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
add eax, 4
cmp eax, esi
jb 0x100c478
mov eax, 0x103e45c
jmp 0x100c56e
mov ecx, dword [0x1034d40]
mov eax, 0x1000000
mov ebx, dword [ebp - 0x38]
sub ebx, dword [ebp - 0x48]
sub eax, ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], eax
jne 0x100c4b1
test ebx, ebx
je 0x100c561
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x48]
sub esi, dword [ebp - 0x38]
add eax, ecx
xor edi, edi
mov ecx, dword [0x1006098]
dec ecx
mov dword [ebp - 0x40], eax
js 0x100c4f8
lea eax, [ecx + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x100609c]
and edx, 0xfffffff
cmp dword [ebp - 0x2c], edx
jae 0x100c4ec
lea ecx, [eax - 1]
jmp 0x100c4f1
jbe 0x100c4fd
lea edi, [eax + 1]
cmp ecx, edi
jge 0x100c4cd
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x14], edi
jmp 0x100c556
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
jmp 0x100c556
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x100609c]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x40]
jae 0x100c561
lea edi, [ecx + esi + 0x1000000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x100c548
dec ecx
je 0x100c544
dec ecx
jne 0x100c54d
mov edx, dword [ebp - 0x34]
jmp 0x100c54d
mov edx, ebx
jmp 0x100c54d
mov edx, dword [ebp - 0x34]
sub edx, ebx
dec eax
dec eax
jne 0x100c553
add dword [edi], edx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x1006098]
jb 0x100c505
mov eax, dword [0x100aa54]
mov eax, 0xe2d2f733
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x68]
mov dword [ecx + 8], eax
mov ebx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x88]
mov esi, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x78]
mov edi, dword [ebp - 0x84]
mov esp, ebp
pop ebp
popfd
ret