Function at 0x100bfd30
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x101835f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1018232c]
sub eax, dword [0x10182330]
and eax, 0x5ca17aa7
sub eax, 0x6c76efa5
add eax, 0x5f9f4431
sub eax, 0x2f1dd7ba
mov ecx, 0x6a13c2f9
xor edx, edx
div ecx
sub eax, 0x96881c7d
xor eax, 0xa41b61cd
and eax, 0x586705f4
sub eax, 0x5e156a5b
and eax, 0xe35acdac
mov ecx, 0x32f26e20
xor edx, edx
div ecx
sub eax, 0xca9a0c78
imul eax, eax, 0x70cd722c
mov ecx, 0x75ca4e84
xor edx, edx
div ecx
or eax, 0x637024ca
and eax, 0x451fe199
sub eax, 0x14fef674
add eax, 0x3eac953a
or eax, 0xcac8ac11
and eax, 0xb3235d04
or eax, 0x95315ba1
mov ecx, 0xb7d69377
xor edx, edx
div ecx
add eax, 0x24ceeeaa
add eax, 0xe1029bf9
imul eax, eax, 0x32f02e49
sub eax, 0x893e0ec5
or eax, 0x97c62a82
or eax, 0x8d53a1d4
mov ecx, 0x9fac4c77
xor edx, edx
div ecx
imul eax, eax, 0x8ec4effb
or eax, 0xb8fef5c4
or eax, 0xf8a8a6ed
sub eax, 0x7c1c5130
or eax, 0xcc60fd8c
or eax, 0x9f3faab2
imul eax, eax, 0x4336691f
and eax, 0x15842552
or eax, 0xc8c75f48
cmp eax, 0x889e63b3
je 0x100c0365
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
mov eax, 0x7e8a64ef
mov dword [ebp - 0x1c], eax
push eax
mov esi, esp
mov dword [ebp - 0x20], esi
push eax
mov ecx, esp
mov dword [ebp - 0x2c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x24], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10129600
mov eax, dword [ebp - 0x28]
add esp, 0xc
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
mov word [eax + 0x30], 0
sub esp, 0xc
mov dword [esp], 0xc
mov dword [esp + 4], 8
mov dword [esp + 8], 6
call fcn.100434e0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [ebp - 0x16], cl
cmp eax, 0xf736515c
ja 0x100c0365
mov al, byte [ebp - 0x16]
test al, 1
jne 0x100bff43
jmp 0x100c0137
mov eax, dword [0x1018233c]
and eax, dword [0x10182340]
sub eax, 0x5da854a0
or eax, 0x451640ed
sub eax, 0xacc2e7a8
add eax, 0xdc8b122f
xor eax, 0xb016260
and eax, 0x38cf51da
sub eax, 0x6b09ac5
sub eax, 0xc0a5965d
or eax, 0x1c0c13f2
or eax, 0x685d56da
mov ecx, 0xc8d77bef
xor edx, edx
div ecx
and eax, 0xf9324f6b
or eax, 0xd8200855
or eax, 0xdab7d380
and eax, 0xd1f4ce3e
imul eax, eax, 0x24418530
sub eax, 0x15fc8872
mov ecx, 0x32de65a0
xor edx, edx
div ecx
imul eax, eax, 0x62a8b071
imul eax, eax, 0x513d934
and eax, 0x5aa3c471
and eax, 0x3f10a58
xor eax, 0xca9df49c
or eax, 0x2c21ab02
and eax, 0x98bde78
imul eax, eax, 0x2b3667d9
add eax, 0x4f82014e
xor eax, 0xe66df29b
imul eax, eax, 0x148296b0
imul eax, eax, 0x9da0b21e
sub eax, 0x910d2f5f
add eax, 0x9243d16
or eax, 0x49f69732
xor eax, 0xb9d3b5b0
imul eax, eax, 0xe6a3cfe5
sub eax, 0x8cdd9dd7
or eax, 0xe510c763
imul eax, eax, 0x91a77b35
cmp eax, 0xb3a038d8
jae 0x100c0441
mov eax, dword [0x10182344]
and eax, dword [0x10182348]
sub eax, 0x85a72a49
xor eax, 0x87025ef2
xor eax, 0x186a9c11
and eax, 0xb1aa2825
add eax, 0xf26aeee8
and eax, 0x6435a75a
or eax, 0x1f3b9e11
sub eax, 0xb23df570
xor eax, 0x16043b96
mov ecx, 0xf1e0b0e4
xor edx, edx
div ecx
or eax, 0x9b4a414c
and eax, 0x5987f9d3
mov ecx, 0xe244c570
xor edx, edx
div ecx
and eax, 0x5f21e640
sub eax, 0xc2598dc1
or eax, 0x7f904947
add eax, 0xa0a91c30
sub eax, 0xab2fe739
xor eax, 0xb827d9ea
mov ecx, 0x40af8eca
xor edx, edx
div ecx
add eax, 0x8d0b7e2f
add eax, 0xa6f8b874
add eax, 0xb7006b7
or eax, 0x853e0823
or eax, 0x2a6ba498
or eax, 0xfce4a88
or eax, 0xf6a5f23e
or eax, 0x813f4618
imul eax, eax, 0x42b5f953
xor eax, 0x498011bc
add eax, 0x5797c4bb
or eax, 0x397054ee
imul eax, eax, 0x48d03dc6
mov ecx, 0xcfa90c19
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor ecx, 0xb7161360
and ecx, 0x4d53b191
xor ecx, 0xb047658d
imul ecx, ecx, 0xd851ce32
mov dword [ebp - 0x30], ecx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x30]
cmp eax, 0x852d171a
jae 0x100c0441
jmp 0x100c0137
mov eax, dword [0x1018234c]
sub eax, dword [0x10182350]
or eax, 0xe91dba8a
add eax, 0x20a15807
xor eax, 0x192534fb
imul eax, eax, 0xb0745d3d
sub eax, 0x9b7bac11
imul eax, eax, 0x8e4e2ea0
or eax, 0x51d54dd7
imul eax, eax, 0xb9fa18da
xor eax, 0x36a9d361
sub eax, 0x20b7ff0f
sub eax, 0x19b3989
xor eax, 0xa6399e0
mov ecx, 0x105dcf3
xor edx, edx
div ecx
or eax, 0x10290e16
sub eax, 0xfad4a00b
imul eax, eax, 0x9f3bd725
add eax, 0xc737ff0a
and eax, 0x87f28689
or eax, 0x4f0fa861
sub eax, 0x8a82ef0
mov ecx, 0xff65db82
xor edx, edx
div ecx
and eax, 0x418cc451
sub eax, 0xff2c4412
mov ecx, 0xbe37c9e3
xor edx, edx
div ecx
add eax, 0xe1ecdaac
sub eax, 0x7e01d656
sub eax, 0x1be0161d
mov ecx, 0x750e5d8
xor edx, edx
div ecx
mov ecx, 0x76ae3d1d
xor edx, edx
div ecx
imul eax, eax, 0x45104e7b
add eax, 0x808bbd1d
xor eax, 0x529ac727
xor eax, 0x85c3efeb
imul eax, eax, 0x79f6c80
add eax, 0x94b37c5c
or eax, 0xafffa87d
sub eax, 0xd1ab80f2
or eax, 0xd839e6e6
cmp eax, 0x6ec29dfa
je 0x100c045f
mov eax, dword [0x10182354]
and eax, dword [0x10182358]
or eax, 0xabd476fb
mov ecx, 0x94a6ab49
xor edx, edx
div ecx
add eax, 0x84ec2e19
xor eax, 0x41cef6e0
mov ecx, 0x5a6e86a7
xor edx, edx
div ecx
mov ecx, 0x1b979ecf
xor edx, edx
div ecx
add eax, 0x3efa13e3
and eax, 0xf55634fd
xor eax, 0x41bcc1dd
and eax, 0x88ee86c8
or eax, 0x3ebbc514
or eax, 0x5ac1294f
imul eax, eax, 0x83b53048
imul eax, eax, 0xfd6ce76
mov ecx, 0x7978132b
xor edx, edx
div ecx
and eax, 0xbf7913e1
add eax, 0x3db9cd87
xor eax, 0xe39c4520
or eax, 0x33226325
add eax, 0x4251e01a
sub eax, 0xad3b8210
add eax, 0x2657ed70
xor eax, 0xe862c999
sub eax, 0xbb1a4017
or eax, 0x3cceb00f
mov ecx, 0xd19be556
xor edx, edx
div ecx
and eax, 0x18225ae7
and eax, 0xcbb4de33
xor eax, 0x987f27b1
add eax, 0x5df1abd6
xor eax, 0xc8c504d7
imul eax, eax, 0xdbebb930
mov ecx, 0xa6b951cb
xor edx, edx
div ecx
mov ecx, 0xf6d9eeec
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
imul ecx, ecx, 0x4cb4dc8b
xor ecx, 0x2660cc67
add ecx, 0x76329112
xor ecx, 0xc4255011
mov dword [ebp - 0x38], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x34], ecx
cmp eax, 0x2efcca7a
je 0x100c0225
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10126c4a
mov eax, dword [ebp - 0x34]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [ebp - 0x44], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x40], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x3c], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.10129600
mov eax, dword [ebp - 0x40]
add esp, 0xc
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
mov word [eax + 0x30], 0
sub esp, 0xc
mov dword [esp], 0xc
mov dword [esp + 4], 8
mov dword [esp + 8], 6
call fcn.100434e0
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100bfe3b
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x100c0027
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100c0225