Function at 0x100014ef
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
xor ecx, ecx
mov ecx, 0x7e24
xor ecx, 0x82d2
sub ecx, 0x2b84
xor ecx, 0x8812
rol ecx, 0x12
shr ecx, 0xf
or ecx, 0x8dea
cmp ecx, 0xbfeb
jne 0x1000157e
mov ecx, 0
mov ecx, 0x7e24
imul ecx, ecx, 0x6782
add ecx, 0x6d96
imul ecx, ecx, 0xffffb434
add ecx, 0x4b95
and ecx, 0x6b90
sub ecx, 0x80002944
cmp ecx, 0x7fffffd0
jl 0x1000157e
push 0x1000b87c
push 0x1000c15b
push 0x2d14
call dword [sym.imp.ntoskrnl.exe_ZwQuerySymbolicLinkObject]
jmp 0x1000158f
mov ecx, dword [0x1000be1c]
mov edx, dword [ecx]
imul edx, edx, 0x5de2
mov dword [ecx], edx
pop ecx
rol dword [ebp - 0x160], 6
sbb dword [0x1000b84c], 0x1000b878
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
sub dword [0x1000b9f4], 0x1000ba64
ror dword [ebp - 0x44], 7
or dword [0x1000b9f4], 0x1000ba90
mov dword [eax + 0x34], ebx
mov dword [ebp - 0x10], ebx
mov dword [0x10004020], ecx
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x3c]
btr dword [ebp - 0x70], 0x15
or dword [0x1000bb9c], 0x1000b948
shr dword [ebp - 0x70], 0xc
push esi
add edx, ecx
push edi
mov dword [0x10004034], edx
and dword [0x1000ba50], 0x1000b99c
rcl dword [ebp - 0x64], 6
btr dword [ebp - 0x64], 0xd
mov dword [0x1000402c], eax
mov eax, dword [ebp + 0xc]
push 3
mov dword [0x10004030], eax
btr dword [ebp - 0x9c], 0x15
mov edi, dword [0x1000ba54]
and edi, 0x5d7
mov dword [0x1000ba54], edi
mov dword [ebp + 8], ebx
push ecx
xor ecx, ecx
add ecx, 0x66e6
or ecx, 0x75c9
sub ecx, 0x5e80
xor ecx, 0x3251
sub ecx, 0x80002b6f
xor ecx, 0x4ac6
cmp ecx, 0x7fffa509
jge 0x10001683
push 0x2f63
call dword [sym.imp.ntoskrnl.exe_ExDeleteNPagedLookasideList]
push 0x1000c02d
push 0x1000b9c0
call dword [sym.imp.ntoskrnl.exe_RtlInitString]
jmp 0x10001691
mov ecx, dword [0x1000be18]
mov edi, 0x7c57
or dword [ecx], edi
pop ecx
and dword [0x1000b980], 0x1000b89c
sub dword [0x1000b980], 0x1000b93c
or esi, 0xffffffff
pop edi
jmp 0x100016bc
xor ebx, ebx
mov eax, dword [ebp + 8]
push 5
xor edx, edx
adc dword [0x1000ba48], 0x1000bb28
bts dword [ebp - 0xb8], 0xe
xor dword [0x1000ba48], 0x1000bb88
add dword [0x1000ba48], 0x1000bae0
pop ecx
div ecx
sub edx, ebx
je 0x100018fa
rcl dword [ebp - 0xbc], 0xb
xor dword [0x1000bb94], 0x1000b8e0
ror dword [ebp - 0xbc], 9
dec edx
je 0x100018c4
dec edx
je 0x1000186d
dec edx
je 0x10001833
mov eax, esi
mov edx, dword [0x1000bd7c]
mov ebx, 0x5ca3
sub dword [edx], ebx
and eax, edi
lea eax, [eax*4 + 0x100040c0]
mov dword [ebp - 8], eax
mov edx, dword [0x1000bfe4]
mov ebx, 0x4020
sbb dword [edx], ebx
lea eax, [esi - 2]
and eax, edi
lea eax, [eax*4 + 0x100040c0]
mov edx, dword [0x1000bfa8]
push eax
xor eax, eax
mov eax, 0x918a
sub eax, 0x753c
or eax, 0x7f8c
rol eax, 7
add eax, 0x6f38
cmp eax, 0x406638
jle 0x10001791
push 0x7bca
call dword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
jmp 0x100017a9
mov eax, dword [0x1000be04]
mov ebx, dword [eax]
imul ebx, ebx, 0x1b42
mov dword [eax], ebx
pop eax
sal dword [ebp - 0x19c], 0xd
mov ebx, dword [0x1000b8bc]
sub ebx, 0x67d0
mov dword [0x1000b8bc], ebx
mov ebx, 0x3c50
sub dword [edx], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
lea ecx, [esi - 1]
and ecx, edi
mov edx, dword [0x1000bd24]
mov ebx, 0x5426
add dword [edx], ebx
and eax, edi
lea ecx, [ecx*4 + 0x100040c0]
lea eax, [eax*4 + 0x100040c0]
mov dword [ebp + 0xc], edi
mov edx, dword [ecx]
mov ebx, dword [0x1000b860]
xor ebx, 0x69f2
mov dword [0x1000b860], ebx
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
add edx, ebx
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx]
sbb dword [0x1000b8d8], 0x1000bb88
or dword [0x1000b8d8], 0x1000b9b0
add edx, ebx
add dword [eax], edx
dec dword [ebp + 0xc]
jne 0x100017ed
jmp 0x1000194b
lea eax, [esi - 1]
add dword [0x1000b85c], 0x1000bae0
shl dword [ebp - 0xb8], 7
shl dword [ebp - 0xb8], 5
bts dword [ebp - 0xb8], 0x16
and eax, edi
lea eax, [eax*4 + 0x100040c0]
or dword [eax], 0x4169
jmp 0x1000194b
mov eax, esi
mov dword [0x1000b9d0], 0x1000ba4c
sal dword [ebp - 0x90], 5
bts dword [ebp - 0x90], 0x18
and eax, edi
lea eax, [eax*4 + 0x100040c0]
mov ecx, edi
btc dword [ebp - 0x88], 2
adc dword [0x1000bb2c], 0x1000ba94
xor dword [0x1000bb2c], 0x1000bb40
add dword [eax], 0x3199
dec ecx
jne 0x100018b2
jmp 0x1000194b
mov eax, dword [ebp + 8]
and eax, edi
lea eax, [eax*4 + 0x100040c0]
mov ecx, dword [eax]
btr dword [ebp - 0x9c], 0xa
rol dword [ebp - 0x9c], 5
and dword [0x1000b8f0], 0x1000b96c
imul ecx, ecx, 0x6149
mov dword [eax], ecx
jmp 0x1000194b
lea eax, [esi - 2]
bts dword [ebp - 0xe4], 7
mov ecx, dword [0x1000b878]
adc ecx, 0x23b1
mov dword [0x1000b878], ecx
and eax, edi
lea eax, [eax*4 + 0x100040c0]
mov ecx, edi
xor dword [eax], 0x5179
xor dword [0x1000b958], 0x1000a000
bts dword [ebp - 0xd0], 0x10
shl dword [ebp - 0xd0], 2
dec ecx
jne 0x10001923
lea eax, [esi - 0x6013]
xor eax, 0x7014
cmp eax, 0xffffcfff
jne 0x10001b95
mov ecx, dword [ebp + 8]
and dword [ebp + 0xc], 0
mov dword [0x1000b8f0], 0x1000b88c
mov edx, dword [0x1000badc]
push ebx
mov ebx, 0x4f9c
and ebx, 0x4744
ror ebx, 0x10
xor ebx, 0x8472
and ebx, 0x33df
cmp ebx, 0x1052
jl 0x100019ac
push 0x6393
call dword [sym.imp.ntoskrnl.exe_RtlNtStatusToDosError]
jmp 0x100019c1
sbb dword [0x1000b8e8], 0x1000b890
and dword [0x1000b8e8], 0x1000bb14
pop ebx
bt dword [ebp - 0x158], 0x19
and dword [0x1000bb60], 0x1000b908
rol dword [ebp - 0x158], 1
add edx, 0x1b29
mov dword [0x1000badc], edx
lea ebx, [esi - 2]
and ecx, edi
and ebx, edi
btr dword [ebp - 0xb4], 2
sal dword [ebp - 0xb4], 9
lea eax, [esi - 1]
and eax, edi
lea ecx, [ecx*4 + 0x100040c0]
mov edx, dword [0x1000b908]
and edx, 0x6b4
mov dword [0x1000b908], edx
lea eax, [eax*4 + 0x100040c0]
mov dword [ebp - 8], ecx
lea ebx, [ebx*4 + 0x100040c0]
btc dword [ebp - 0x60], 0xc
sbb dword [0x1000b8d0], 0x1000ba8c
rol dword [ebp - 0x60], 2
mov dword [ebp - 0xc], eax
add dword [ecx], 0xffffa109
cmp dword [ebp + 0xc], 2
mov edx, dword [ebp - 0x10]
mov edx, dword [edx*4 + 0x100040b4]
mov dword [0x100040bc], edx
jne 0x10001b33
add dword [0x1000b9f4], 0x1000ba5c
mov eax, dword [0x1000ba98]
xor eax, 0x51ab
mov dword [0x1000ba98], eax
mov eax, dword [0x100040bc]
push 0x10004040
call eax
mov ecx, dword [ebp - 8]
rol dword [ebp - 0x8c], 8
bts dword [ebp - 0x8c], 0xd
push ebx
mov ebx, 0
add ebx, 0x5d32
add ebx, 0x85f9
xor ebx, 0x5521
imul ebx, ebx, 0x6333
xor ebx, 0x6a3e
shr ebx, 0xb
add ebx, 0x3a95
cmp ebx, 0x91bde
jl 0x10001aea
push 0x104d
push 0x7b42
call dword [sym.imp.ntoskrnl.exe_KeSetPriorityThread]
jmp 0x10001b01
mov ebx, dword [0x1000be20]
mov edx, 0x360f
add dword [ebx], edx
pop ebx
btc dword [ebp - 0x1bc], 0x19
mov edx, dword [0x1000b9c4]
add edx, 0x49be
mov dword [0x1000b9c4], edx
shl dword [ebp - 0x8c], 9
mov edx, dword [0x1000bba0]
add edx, 0x25f1
mov dword [0x1000bba0], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx]
imul edx, edx, 0xffff9139
mov dword [ebx], edx
sub dword [0x1000b94c], 0x1000a000
rol dword [ebp - 0xd4], 6
bt dword [ebp - 0xd4], 0xe
xor dword [eax], 0xffff8129
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], edi
jb 0x10001a46
add dword [0x1000b920], 0x1000b91c
shl dword [ebp - 0x78], 0xd
bts dword [ebp - 0x78], 0xa
mov eax, esi
and eax, edi
lea eax, [eax*4 + 0x100040c0]
or dword [eax], 0x7159
jmp 0x10001d30
cmp eax, 0xffffcffe
jne 0x10001d30
push 0xfffffffffffffffe
mov ebx, dword [0x1000bc7c]
mov ecx, 0x4ad0
or dword [ebx], ecx
pop ebx
lea eax, [ebx - 2]
and eax, edi
lea eax, [eax*4 + 0x100040c0]
bts dword [ebp - 0xc4], 9
or dword [0x1000ba84], 0x1000b99c
mov ecx, dword [0x1000bb20]
sbb ecx, 0x3ac0
mov dword [0x1000bb20], ecx
add dword [eax], 0xffffa109
lea eax, [ebx - 1]
and eax, edi
mov ecx, dword [0x1000b914]
sbb ecx, 0x96e
mov dword [0x1000b914], ecx
lea eax, [eax*4 + 0x100040c0]
mov ecx, dword [eax]
imul ecx, ecx, 0xffff9139
bts dword [ebp - 0x10c], 0x12
push ebx
mov ebx, 0x6d85
shr ebx, 6
imul ebx, ebx, 0x2f8c
xor ebx, 0x4130
rol ebx, 0xe
cmp ebx, 0x462e1014
jne 0x10001c66
push 0x1000bbe0
push 0x1202
push 0x759b
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceInterfaceAlias]
push 0x5238
push 0x750b
push 0x6032
call dword [sym.imp.ntoskrnl.exe_RtlVerifyVersionInfo]
jmp 0x10001c79
rcr dword [ebp - 0xb4], 6
add dword [0x1000b9b4], 0x1000ba5c
pop ebx
rol dword [ebp - 0x22c], 0xc
and dword [0x1000b9f0], 0x1000b9c0
xor dword [0x1000bb64], 0x1000bbdc
rol dword [ebp - 0x10c], 0xd
mov dword [eax], ecx
mov eax, ebx
and eax, edi
lea eax, [eax*4 + 0x100040c0]
xor dword [eax], 0xffff8129
rol dword [ebp - 0xb4], 9
adc dword [0x1000b988], 0x1000ba2c
lea eax, [ebx - 0x6012]
xor eax, 0x7014
cmp eax, 0xffffd0ff
jne 0x10001cfe
rcr dword [ebp - 0x98], 2
bts dword [ebp - 0x98], 5
shr dword [ebp - 0x98], 7
call fcn.10001f8a
test eax, eax
je 0x10001ec2
inc ebx
mov eax, ebx
rcl dword [ebp - 0x124], 0xd
sub dword [0x1000b850], 0x1000b9c8
and eax, edi
lea eax, [eax*4 + 0x100040c0]
or dword [eax], 0x7159
lea eax, [ebx + 2]
cmp eax, 0x101
jb 0x10001bb0
mov eax, dword [ebp + 8]
and eax, edi
mov ecx, dword [0x1000bb4c]
add ecx, 0x552d
mov dword [0x1000bb4c], ecx
lea eax, [eax*4 + 0x100040c0]
add dword [eax], 0xffffa109
mov eax, esi
and eax, edi
lea eax, [eax*4 + 0x100040c0]
bts dword [ebp - 0x54], 3
rcr dword [ebp - 0x54], 2
bt dword [ebp - 0x54], 0x10
push ecx
xor ecx, ecx
add ecx, 0x94c6
and ecx, 0x2152
or ecx, 0x6d8c
sub ecx, 0x3794
or ecx, 0x35cb
cmp ecx, 0x27cb
jge 0x10001e14
mov ecx, 0
add ecx, 0x94c6
and ecx, 0x6144
shr ecx, 6
xor ecx, 0x4452
imul ecx, ecx, 0x30a1
sub ecx, 0x1f9d
imul ecx, ecx, 0x55db
cmp ecx, 0x3ef15652
jl 0x10001e14
push 0x1000bae4
push 0x61b0
push 0x1000bbcc
push 0x8e66
call dword [sym.imp.ntoskrnl.exe_ObQueryNameString]
push 0x1000bbec
push 0x56b4
push 0x1447
push 0x6d04
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceInterfaces]
jmp 0x10001e27
mov ecx, dword [0x1000bb58]
or ecx, 0x378
mov dword [0x1000bb58], ecx
pop ecx
rcr dword [ebp - 0xd0], 2
and dword [0x1000b9f0], 0x1000b8d0
adc dword [0x1000b9f0], 0x1000b830
xor dword [0x1000b9f0], 0x1000b974
or dword [eax], 0x7159
lea eax, [esi - 1]
and eax, edi
mov ecx, dword [0x1000b964]
sbb ecx, 0x28ce
mov dword [0x1000b964], ecx
lea eax, [eax*4 + 0x100040c0]
xor dword [eax], 0xffff8129
lea eax, [esi - 2]
sal dword [ebp - 0xd0], 8
mov ecx, dword [0x1000b8b8]
xor ecx, 0x11b4
mov dword [0x1000b8b8], ecx
and eax, edi
lea eax, [eax*4 + 0x100040c0]
mov ecx, dword [eax]
imul ecx, ecx, 0xffff9139
inc dword [ebp + 8]
inc esi
cmp dword [ebp + 8], 0x2001
mov dword [eax], ecx
jb 0x100016ba
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0xc0000001
jmp 0x10001ebb