Function at 0x1000b090
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
add eax, 0x327
mov dword [esp + 4], eax
lea eax, [ecx - 0x738]
push ebx
mov dword [esp + 0x38], eax
lea ebx, [edx - 0xbb]
mov eax, dword [esp + 0x20]
add edx, 0x16a
push ebp
push esi
mov dword [esp + 0x28], edx
lea edx, [ecx - 0x190f]
lea ebp, [eax - 0x42b]
mov dword [esp + 0xc], ebx
lea esi, [eax - 0x778]
mov dword [esp + 0x30], ebp
mov eax, dword [esp + 0x24]
add eax, 0xffffec04
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], esi
push edi
cmp eax, ecx
jg 0x1000b3de
mov esi, dword [esp + 0x48]
mov dword [esi + 0x134], 0x18
imul eax, dword [esi], 0x1784
xor dword [esi + 0x2c], eax
mov eax, dword [esi + 0x98]
add eax, 0x139b
or dword [esi + 0xfc], eax
cmp dword [esi + 0x38], 0x156f
jb 0x1000b13e
movzx eax, byte [0x10027cc8]
mov ecx, dword [esi + 0x50]
add eax, 0xffffeeee
add eax, ecx
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0xe0]
xor ebx, ebx
mov ecx, dword [esi + 0x120]
mov dword [esi + 0x138], 3
mov dword [esp + 0x44], ebx
lea ecx, [eax + ecx*4]
mov eax, dword [esi + 0x128]
add dword [ecx], eax
mov eax, dword [esi + 0xe0]
mov ecx, dword [esi + 0x124]
lea ecx, [eax + ecx*4]
mov eax, dword [esi + 0x130]
add dword [ecx], eax
cmp dword [esi + 0x114], ebx
jle 0x1000b3d0
nop dword [eax + eax]
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x1c4]
mov eax, dword [esi + 0xf8]
xor ecx, 0x57f
mov eax, dword [eax + 0x64]
xor eax, 0x3eb
cmp eax, ecx
jae 0x1000b1b8
mov dword [esi + 0x60], 0x1bef
xor ebp, ebp
cmp dword [esi + 0x11c], ebp
jle 0x1000b31b
nop word [eax + eax]
mov eax, dword [esi]
mov eax, dword [eax + 0xfc]
sub eax, 0x11d7
add dword [esi + 0x2c], eax
mov edx, dword [esi + 0xe0]
mov eax, dword [esi + 0x120]
lea ecx, [edx + eax*4]
mov eax, dword [esi + 0x124]
mov eax, dword [edx + eax*4]
xor dword [ecx], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax + 0x64]
sub eax, 0x45d
cmp eax, 0x1552
jge 0x1000b240
mov edx, 0x1552
sub edx, eax
nop word [eax + eax]
movzx ecx, byte [0x10027fc8]
mov eax, dword [esi + 0xc8]
xor ecx, eax
xor ecx, 0x174d
mov dword [esi + 0xc8], ecx
sub edx, 1
jne 0x1000b220
mov eax, dword [esi + 0x58]
xor eax, 0x119a
mov dword [esi + 0xd8], eax
mov ecx, dword [esi + 0x138]
and ecx, 0x8000001f
jns 0x1000b261
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edx, dword [esi + 0xe0]
mov eax, dword [esi + 0x120]
mov edi, dword [edx + eax*4]
je 0x1000b274
ror edi, cl
mov eax, dword [esi + 0x124]
add dword [edx + eax*4], edi
mov eax, dword [esi + 0x38]
mov edi, dword [esi + 0x58]
imul ecx, dword [eax + 0x64], 0xcb260d2b
mov eax, dword [edi + 0x64]
sub eax, 0x9d
cmp ecx, eax
ja 0x1000b2b8
mov ebx, dword [esi + 0x194]
mov edx, dword [esi + 0x10]
nop
add edx, 0xffffe87c
inc ecx
add edx, ebx
mov dword [esi + 0x10], edx
mov eax, dword [edi + 0x64]
sub eax, 0x9d
cmp ecx, eax
jbe 0x1000b2a0
mov eax, dword [esi + 0x120]
inc ebp
inc eax
cdq
idiv dword [esi + 0xe4]
mov dword [esi + 0x120], edx
mov eax, dword [esi + 0x10c]
add dword [esi + 0x50], eax
inc eax
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0x124]
inc eax
cdq
idiv dword [esi + 0xe4]
mov dword [esi + 0x124], edx
mov eax, dword [esi + 0x10]
or eax, 0x13fc
or dword [esi + 0x2c], eax
mov eax, dword [esi + 0x50]
sub eax, 0x1a4d
imul eax, dword [esi + 0x60]
mov dword [esi + 0x60], eax
cmp ebp, dword [esi + 0x11c]
jl 0x1000b1d0
mov ebx, dword [esp + 0x44]
mov ecx, dword [esi + 0x120]
mov eax, dword [esi + 0xdc]
lea edx, [eax + ecx*4]
mov ecx, dword [esi + 0x124]
mov eax, dword [esi + 0xe0]
mov eax, dword [eax + ecx*4]
add dword [edx], eax
mov ecx, dword [esi + 0x134]
and ecx, 0x8000001f
jns 0x1000b34e
dec ecx
or ecx, 0xffffffe0
inc ecx
mov eax, dword [esi + 0xe0]
je 0x1000b363
mov edx, dword [esi + 0x120]
mov edx, dword [eax + edx*4]
ror edx, cl
jmp 0x1000b36c
mov ecx, dword [esi + 0x120]
mov edx, dword [eax + ecx*4]
mov eax, dword [esi + 0xdc]
mov ecx, dword [esi + 0x124]
add dword [eax + ecx*4], edx
mov eax, dword [esi + 0x58]
mov edi, dword [eax + 0x1c4]
xor edi, 0x560
cmp edi, 0x14fc
jge 0x1000b3ae
mov eax, dword [esi + 0x2c]
mov ecx, 0x14fc
mov edx, dword [esi + 0x10]
sub ecx, edi
nop
add edx, eax
inc eax
sub ecx, 1
jne 0x1000b3a0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x10], edx
inc ebx
mov dword [esp + 0x44], ebx
cmp ebx, dword [esi + 0x114]
jl 0x1000b190
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
add eax, 0xfffffec0
pop ebx
add esp, 0x10
ret
pop edi
pop esi
lea eax, [ebp - 0x140]
pop ebp
pop ebx
add esp, 0x10
ret
mov edx, dword [esp + 0x48]
mov eax, dword [edx + 0x19c]
mov edi, dword [edx + 0xc8]
and eax, ebx
mov ecx, dword [edx + 0x12c]
xor edi, esi
mov esi, dword [edx + 0x38]
add ecx, 0x1590
mov ebx, dword [edx + 0x98]
add esi, ecx
mov edx, dword [edx + 0xf8]
xor edi, 0x190f
or edx, dword [esp + 0x18]
sub ebx, 0x1197
imul ebp, eax, 0x14fb
mov eax, dword [esp + 0x48]
imul ecx, dword [eax + 0x50], 0x16cb
mov eax, dword [eax + 0x198]
xor eax, dword [esp + 0x10]
or eax, dword [esp + 0x44]
push eax
add ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
push ecx
push edx
push ecx
mov ecx, dword [esp + 0x4c]
add eax, 0xffffedeb
push esi
sub esp, 0xc
add eax, ecx
push eax
push ecx
push dword [esp + 0x70]
push edi
push ebx
push ebp
call fcn.10002b80
mov ebx, dword [esp + 0x80]
add esp, 0x38
mov edi, dword [esp + 0x34]
mov esi, eax
mov ebp, dword [esp + 0x44]
mov eax, edi
sub eax, ebp
mov ecx, dword [ebx + 0x24]
or ecx, dword [ebx + 0x50]
and ecx, 0x1292
sub dword [ebx + 0x1c4], ecx
mov ecx, dword [ebx + 0xfc]
or ecx, 0x139b
add ecx, dword [ebx + 0xf8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
imul eax, dword [esp + 0x14], 0x190f
sub eax, dword [ebx + 0x38]
push eax
mov ax, word [ebx + 0xd8]
or ax, bp
xor ax, di
sub edi, esi
movzx eax, ax
or edi, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x170]
mov ebp, dword [esp + 0x10]
sub eax, 0x1197
imul eax, eax, 0x11d7
push eax
mov eax, dword [ebx + 0xf8]
sub eax, dword [ebx + 0x50]
push eax
mov eax, ebp
and eax, 0x1849
push eax
mov eax, dword [ebx + 0xc8]
or eax, dword [esp + 0x38]
or eax, 0x1a46
push eax
mov eax, dword [ebx + 0x64]
xor eax, 0x13a4
push eax
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov ecx, dword [ebx + 0xfc]
and ebp, 0x1550
mov eax, dword [ebx + 0xf8]
and eax, dword [esp + 0x14]
add ecx, dword [ebx + 0xd8]
xor ecx, dword [esp + 0x34]
mov edx, dword [ebx + 0x154]
mov esi, dword [ebx + 8]
xor edx, 0x14fb
add edx, dword [ebx + 0x14c]
push eax
mov eax, dword [esp + 0x30]
mov edi, dword [ebx + 0x14]
xor eax, 0x19ad
add esi, dword [esp + 0x48]
sub edi, dword [esp + 0x20]
and esi, dword [esp + 0x48]
or edi, dword [ebx + 0x19c]
push ecx
push ebp
push ecx
push edx
sub esp, 0xc
push eax
imul eax, dword [esp + 0x68], 0x11d7
push ecx
push ebx
push eax
push esi
push edi
call fcn.10002b80
add esp, 0x38
add eax, 0xfffffec0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret