Function at 0x1001d36b
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], edx
push 0x13
xor ebx, ebx
mov dword [ebp - 0x54], edi
pop esi
mov dword [ebp - 0x2c], 0x2e
mov eax, ebx
mov dword [ebp - 0x28], 0xffffffc0
add esi, dword [ebp + eax*4 - 0x2c]
inc eax
cmp eax, 2
jl 0x1001d394
mov eax, dword [0x1002dbe4]
mov ecx, ebx
push 0x10
mov dword [ebp - 0x10], eax
and eax, 0xdcec95ba
pop edx
mov dword [ebp - 0x20], 0x4f
mov dword [ebp - 0x1c], 0x35
mov dword [ebp - 0x18], 0xffffff8a
sub edx, dword [ebp + ecx*4 - 0x20]
inc ecx
cmp ecx, 3
jl 0x1001d3c5
mov dword [ebp - 0x24], 0x26
xorps xmm1, xmm1
mov dword [ebp - 0x20], 0x22
add eax, 0x537f8912
mov dword [ebp - 0x1c], 0x46
mov dword [ebp - 0x18], 0xffffff84
movups xmm0, xmmword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [0x1002dd70], eax
psubd xmm1, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
add ecx, 0x15
cmp edi, esi
jne 0x1001d6b4
mov esi, str.status_request_v2
imul eax, eax, 0x964666ee
lea edi, [ebp - 0x48]
mov dword [ebp - 0x20], 0x576b4605
mov dword [ebp - 0x1c], 0xec0319e6
mov dword [ebp - 0x18], 0x5ac1d707
movsd dword es:[edi], dword [esi]
mov dword [0x1002da74], eax
mov eax, ebx
mov dword [ebp - 8], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x100
mov byte [ebp + eax - 0x154], al
inc eax
cmp eax, edi
jb 0x1001d462
mov esi, dword [0x1002da74]
mov ecx, ebx
mov dword [ebp - 0x10], ecx
mov al, byte [ebp + ecx - 0x154]
xor edx, edx
mov byte [ebp - 1], al
mov eax, ecx
push 0x11
pop ecx
div ecx
movzx ecx, byte [ebp - 1]
movzx eax, byte [ebp + edx - 0x48]
add eax, dword [ebp - 8]
add ecx, eax
movzx eax, cl
mov dword [ebp - 8], eax
mov eax, ebx
inc eax
cmp eax, 0x1fc7
je 0x1001d4c0
cmp byte [eax + str.not_a_writable_directory], bl
jne 0x1001d4a2
cmp eax, 0x201b
jle 0x1001d4c5
call fcn.1001c6ba
jmp 0x1001d4c5
call fcn.1001b7e8
call fcn.1001c6ba
push 0x4d
mov edx, 0x22ec
mov eax, str.MacCleanupTrashCleanedTotal
pop ecx
add edx, ecx
inc eax
cmp edx, 0x10a0
ja 0x1001d4eb
movsx ecx, byte [eax]
test ecx, ecx
jne 0x1001d4d7
jmp 0x1001d501
push esi
call fcn.1001b6d0
pop ecx
mov edx, str._publisher_
mov ecx, str.ciscospark
call fcn.1001c5df
lea ecx, [esi - 0x43d3e7fb]
lea eax, [ecx - 0x6fce3b02]
mov dword [ebp - 0x34], eax
and ecx, 0x7ac9a824
mov dword [ebp - 0x30], ecx
mov dword [0x1002dbe4], ecx
call fcn.1001bde0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 1]
mov al, byte [ebp + eax - 0x154]
mov byte [ebp + ecx - 0x154], al
inc ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov byte [ebp + eax - 0x154], dl
mov edx, dword [ebp - 0x30]
cmp ecx, edi
jb 0x1001d479
movzx eax, byte [str.AvResWsTermEvent]
mov ecx, ebx
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
imul eax, edx, 0x1c2853ca
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
or eax, 0xce19382
mov dword [ebp - 0x28], eax
lea eax, [ecx + 1]
movzx edx, al
mov dword [ebp - 0x10], edx
mov cl, byte [ebp + edx - 0x154]
movzx eax, cl
mov dword [ebp - 0x34], eax
add eax, dword [ebp - 8]
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x154]
mov byte [ebp + edx - 0x154], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x154], cl
mov eax, ebx
inc eax
cmp eax, 0x1516
je 0x1001d5cf
cmp byte [eax + str.MacCleanupTrashCleanedTotal], bl
jne 0x1001d5b0
cmp eax, 0x2456
jle 0x1001d5ea
xor esi, 0x97ff8ca4
jmp 0x1001d5e4
mov edx, str._publisher_
mov ecx, str.not_a_writable_directory
call fcn.1001c5df
lea esi, [edi + 0x72dde231]
mov dword [0x1002da74], esi
mov edi, dword [ebp - 0x14]
mov edx, 0x1f6d
mov eax, str.AvResWsTermEvent
mov ecx, edi
test edi, edi
je 0x1001d620
add edx, ecx
inc eax
cmp edx, 0x1241
ja 0x1001d611
movzx ecx, byte [eax]
test ecx, ecx
jne 0x1001d5fd
jmp 0x1001d620
mov esi, dword [ebp - 0x30]
add esi, 0x38bf4649
mov dword [0x1002da74], esi
mov eax, dword [ebp - 0x10]
mov edx, 0x120b
push 0x63
pop ecx
movzx eax, byte [ebp + eax - 0x154]
add eax, dword [ebp - 0x34]
movzx eax, al
mov al, byte [ebp + eax - 0x154]
mov byte [ebp - 1], al
mov eax, str.ciscospark
add edx, ecx
inc eax
cmp edx, 0x121e
ja 0x1001d662
movsx ecx, byte [eax]
test ecx, ecx
jne 0x1001d648
lea edi, [esi - 0x2793b667]
jmp 0x1001d67a
imul edi, dword [ebp - 0x28], 0xc91fed70
call fcn.1001b9ef
imul esi, esi, 0x419b4ee0
mov dword [0x1002da74], esi
xor edi, 0xdf964a42
call fcn.1001c3ca
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov al, byte [ebp + edx - 0x20]
xor al, byte [ebp - 1]
mov byte [ebp + edx - 0x44], al
inc edx
mov dword [ebp - 0xc], edx
cmp edx, 0xc
jb 0x1001d577
mov dword [0x1002dd70], edi
lea edx, [ebp - 0x44]
mov byte [ebp - 0x38], bl
jmp 0x1001da65
cmp edi, edx
jne 0x1001d8ce
mov edx, dword [0x1002da74]
lea edi, [ebp - 0x24]
mov esi, str.mojo_unknown
mov dword [ebp - 0x40], 0x1e042ad1
mov dword [ebp - 0x3c], 0x8ce72712
mov ecx, str.MacCleanupTrashCleanedTotal
mov word [ebp - 0x38], 0x60e0
mov al, 0x4d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [edx - 0x6e3514c8]
sub al, 0x30
cmp al, 9
ja 0x1001d701
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1001d6ef
mov esi, dword [ebp - 0x10]
jmp 0x1001d707
imul esi, edx, 0x8f036f28
push ecx
or edi, 0xd2230167
call fcn.1001c235
pop ecx
mov eax, ebx
inc eax
cmp eax, 0x6ea
jl 0x1001d746
cmp byte [eax + str.MacCleanupTrashCleanedTotal], bl
jne 0x1001d716
cmp eax, 0x1c35
jle 0x1001d752
mov edx, str.SUVWATAVH
mov ecx, str.not_a_writable_directory
call fcn.1001c5df
mov edi, esi
and edi, 0x67275a0c
jmp 0x1001d758
mov edi, dword [0x1002da74]
and edi, 0xd989538a
xor esi, 0xdffa7303
xor esi, 0x4971bd34
mov dword [ebp - 0x10], esi
or edi, 0x51f08b00
mov dword [ebp - 0x14], edi
call fcn.1001bf0a
mov eax, ebx
mov byte [ebp + eax - 0x154], al
inc eax
cmp eax, 0x100
jb 0x1001d771
push 0xc
mov edi, ebx
mov esi, ebx
pop ecx
xor edx, edx
mov bl, byte [ebp + edi - 0x154]
mov eax, edi
div ecx
movzx ecx, bl
push 0xc
movzx eax, byte [ebp + edx - 0x24]
add eax, esi
add ecx, eax
movzx esi, cl
pop ecx
mov al, byte [ebp + esi - 0x154]
mov byte [ebp + edi - 0x154], al
inc edi
mov byte [ebp + esi - 0x154], bl
cmp edi, 0x100
jb 0x1001d787
mov esi, dword [ebp - 0x10]
xor ebx, ebx
mov edi, dword [ebp - 0x14]
mov edx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
lea eax, [edx + 1]
imul esi, esi, 0x52e62398
movzx ecx, al
mov dword [ebp - 0x28], ecx
mov al, byte [ebp + ecx - 0x154]
movzx edx, al
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
add eax, edx
mov dword [ebp - 0x14], edx
movzx eax, al
xor esi, 0x614adec
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x154]
mov byte [ebp + ecx - 0x154], al
mov ecx, ebx
mov eax, str._publisher_
inc ecx
lea eax, [eax + 2]
cmp ecx, 0x498
jg 0x1001d82c
cmp word [eax], bx
jne 0x1001d819
jmp 0x1001d839
call fcn.1001c53e
mov esi, edi
or esi, 0x47969b77
sub esi, 0x73e4126f
mov ecx, str.not_a_writable_directory
mov dword [0x1002dbe4], esi
mov al, 0x6e
sub al, 0x30
cmp al, 9
ja 0x1001d85b
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1001d84c
jmp 0x1001d869
mov esi, edi
and esi, 0x2a299d7a
mov dword [0x1002dbe4], esi
xor edi, 0x15554033
mov dword [0x1002da74], edi
call fcn.1001c03b
mov eax, dword [ebp - 8]
add edi, 0x953d4b68
mov edx, dword [ebp - 0x28]
mov cl, byte [ebp - 1]
mov byte [ebp + eax - 0x154], cl
movzx eax, byte [ebp + edx - 0x154]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
movzx eax, al
mov al, byte [ebp + eax - 0x154]
xor al, byte [ebp + ecx - 0x40]
mov byte [ebp + ecx - 0x20], al
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, 0xa
jb 0x1001d7d4
mov dword [0x1002dd70], edi
lea edx, [ebp - 0x20]
mov byte [ebp - 0x16], bl
jmp 0x1001da65
cmp edi, ecx
jne 0x1001da9e
mov esi, str.setext_cv
mov dword [ebp - 0x40], 0xa6f8f9e
lea edi, [ebp - 0x20]
mov dword [ebp - 0x3c], 0x21a743af
mov byte [ebp - 0x38], 0xa8
mov eax, ebx
mov dword [ebp - 0xc], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x100
mov byte [ebp + eax - 0x154], al
inc eax
cmp eax, edi
jb 0x1001d8fe
mov esi, dword [ebp - 0x28]
mov ecx, ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], 9
mov bl, byte [ebp + ecx - 0x154]
mov eax, ecx
xor edx, edx
xor esi, 0x2a2dc295
push 9
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x20]
add eax, dword [ebp - 0xc]
add ecx, eax
movzx edx, cl
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0xc], edx
mov al, byte [ebp + edx - 0x154]
mov byte [ebp + ecx - 0x154], al
inc ecx
mov byte [ebp + edx - 0x154], bl
mov dword [ebp - 0x30], ecx
cmp ecx, edi
jb 0x1001d919
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ecx, ebx
mov edi, ebx
lea eax, [ecx + 1]
movzx edx, al
push 0x3c
mov dword [ebp - 0xc], edx
mov al, byte [ebp + edx - 0x154]
movzx ecx, al
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0x34], ecx
movzx eax, al
mov ecx, str._publisher_
mov dword [ebp - 8], eax
pop eax
add eax, 0xffffffd0
cmp ax, word [ebp - 0x14]
ja 0x1001d9b3
mov edx, dword [ebp - 0xc]
add ecx, 2
movzx eax, word [ecx]
mov dword [ebp - 0x28], eax
test ax, ax
jne 0x1001d997
jmp 0x1001d9b9
imul esi, esi, 0x39998403
mov eax, dword [ebp - 8]
mov ecx, str.SUVWATAVH
mov al, byte [ebp + eax - 0x154]
mov byte [ebp + edx - 0x154], al
mov eax, ebx
add ecx, 2
inc eax
cmp eax, 0x1eba
je 0x1001d9ea
cmp word [ecx], bx
jne 0x1001d9d1
cmp eax, 0xb3
jle 0x1001d9fd
jmp 0x1001d9ef
call fcn.1001b9ef
push ecx
mov edx, esi
mov ecx, str.SUVWATAVH
call fcn.1001bab0
pop ecx
and esi, 0xf2745a40
mov dword [0x1002dbe4], esi
imul esi, esi, 0xccb9940f
call fcn.1001b9ef
mov eax, dword [ebp - 8]
mov cl, byte [ebp - 1]
push 9
mov byte [ebp + eax - 0x154], cl
mov eax, esi
mov ecx, dword [ebp - 0xc]
or eax, 0xb019cedd
mov dword [0x1002da74], eax
movzx eax, byte [ebp + ecx - 0x154]
add eax, dword [ebp - 0x34]
movzx eax, al
mov al, byte [ebp + eax - 0x154]
xor al, byte [ebp + edi - 0x40]
mov byte [ebp + edi - 0x20], al
inc edi
pop eax
cmp edi, eax
jb 0x1001d96b
mov dword [0x1002dd70], esi
lea edx, [ebp - 0x20]
mov byte [ebp - 0x17], bl
lea ecx, [ebp - 0x1b8]
call fcn.10014732
mov esi, dword [ebp - 0x54]
mov eax, dword [esi*4 + 0x1002ddd0]
test eax, eax
jne 0x1001da92
lea eax, [ebp - 0x1b8]
push eax
call dword [0x1002ddcc]
mov dword [esi*4 + 0x1002ddd0], eax
push dword [ebp - 0x4c]
push eax
call dword [0x1002ddc4]
jmp 0x1001dab9
push 0xa
pop eax
mov dword [ebp - 0x50], 0x14
mov dword [ebp - 0x4c], 0xffffffe2
add eax, dword [ebp + ebx*4 - 0x50]
inc ebx
cmp ebx, 2
jl 0x1001daaf
pop edi
pop esi
pop ebx
leave
ret