Function at 0x1001d629
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064946
call fcn.10063950
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], eax
cmp byte [ebp + 0x10], bl
je 0x1001d7ca
mov dword [ebp + 0x10], 0x50af
cmp dword [ebp + 0x10], 0x5267
jle 0x1001d6b7
push ebx
push 0x1663
push 0x1d92
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10080db8
or eax, esi
cdq
push edx
push eax
call fcn.10004c02
inc edi
cmp edi, 0x1b69
jl 0x1001d684
inc esi
cmp esi, 0x39d6
jl 0x1001d682
push 0x15ea
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], 0x4eec
jge 0x1001d6d2
mov edx, str.srgwkn_eju_imkwum_agwf_akofzgq_exrcq_jcysq_djtqprop_hscj_xbiwqkwct_pilv_zan_dtvar_mfookrpi
mov ecx, 0x10080db8
call fcn.10007110
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x24], 0
je 0x1001d7c0
mov esi, ebx
cmp dword [edi], ebx
jbe 0x1001d743
mov ebx, dword [ebp + 8]
call fcn.1001ac82
push 0x34
pop ecx
xor edx, edx
div ecx
push 0x1a
mov eax, edx
pop ecx
cmp eax, ecx
jge 0x1001d728
movsx edx, byte [ebx]
jmp 0x1001d731
cdq
idiv ecx
mov eax, dword [ebp + 0x1c]
movsx eax, byte [eax]
mov ecx, dword [ebp + 0x18]
add edx, eax
push edx
call fcn.10016dec
inc esi
cmp esi, dword [edi]
jb 0x1001d6e9
xor ebx, ebx
mov dword [ebp + 0x10], 0xf0a
cmp dword [ebp + 0x10], 0x11c0
jle 0x1001d7a3
push ebx
push 0x210b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x3c]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d77f
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.100052fb
inc edi
cmp edi, 0x3336
jl 0x1001d766
inc esi
cmp esi, 0x506c
jl 0x1001d764
cmp dword [ebp + 0x10], 0xc5d
jge 0x1001d8a8
push str.wgcqdxq_kczujkunh_qbbbtxp_efxrrgaj_hrrlha_oxbiy_php_ywo_nitoi_urncgevg_gbur
call fcn.1004cf6c
pop ecx
jmp 0x1001d8a8
mov eax, dword [ebp + 0xc]
inc dword [eax]
jmp 0x1001d8a8
cmp byte [ebp + 0x20], 0
je 0x1001d891
mov dword [ebp - 0x24], 0x4166
cmp dword [ebp - 0x24], 0x431f
jle 0x1001d83a
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp + 0x10], ecx
lea eax, [ebx + edi]
and eax, ecx
mov ecx, 0x10080db8
xor eax, esi
cdq
push edx
push eax
call fcn.10004c02
mov ecx, dword [ebp + 0x10]
inc ecx
mov dword [ebp + 0x10], ecx
cmp ecx, 0x13ce
jl 0x1001d7f3
inc ebx
push 0
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x64d7
pop ebx
jl 0x1001d7eb
inc edi
cmp edi, 0x4ce9
jl 0x1001d7e8
inc esi
cmp esi, 0x3dc1
jl 0x1001d7e6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp + 0x14]
mov dword [edx], ebx
jmp 0x1001d851
mov ecx, dword [edx]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x661fbc9f
inc dword [edx]
mov eax, dword [ebp - 0x20]
cmp dword [edx], 1
jl 0x1001d841
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0x40a4
jge 0x1001d875
mov edx, str.jyyehsoaf_twyxm_ksq_sgktt_dbzbuuj_vnux_mxiytl_wwsbk_gsy_owvwg_fpbfu
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x1001d8a8
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], bl
je 0x1001d8a8
push ebx
push 1
push 0x6eb
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret