Function at 0x1000bbcf
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1005a694]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax + 0x14], 0x10
lea esi, [eax + 4]
jb 0x1000bbf1
mov esi, dword [eax + 4]
push esi
call fcn.10001edd
pop ecx
push eax
push esi
mov esi, 0x1005b13c
mov ecx, esi
call fcn.10001dbf
cmp dword [0x1005b14c], 0
mov ebx, 0x1005b154
je 0x1000be20
push ebx
mov ecx, esi
call fcn.1000b2a1
test eax, eax
je 0x1000be20
mov cl, 0x71
mov dword [ebp - 0x18], 0x2155f71
mov word [ebp - 0x14], 5
xor eax, eax
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 4
jae 0x1000bc48
mov cl, byte [ebp - 0x18]
jmp 0x1000bc39
lea eax, [ebp - 0x17]
mov byte [ebp - 0x13], 0
push eax
call fcn.10001edd
pop ecx
push eax
push 0
lea eax, [ebp - 0x17]
mov ecx, esi
push eax
call fcn.1000b2d1
cmp eax, 0xffffffff
je 0x1000be20
movaps xmm0, xmmword [0x1004a930]
xor ecx, ecx
push dword [0x1005b120]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x4d4e4e1f
mov dword [ebp - 0x24], 0x501a5b21
mov dword [ebp - 0x20], 0xa0a19
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x1a
jb 0x1000bc95
sub esp, 0x18
mov byte [ebp - 0x1d], 0
lea eax, [ebp - 0x37]
mov ecx, esp
push eax
call fcn.100012e0
lea eax, [ebp - 0x50]
push eax
call fcn.1001b71b
add esp, 0x20
mov ecx, ebx
push eax
call fcn.10006163
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.10001cd4
cmp dword [0x1005b150], 0x10
push 0
cmovae esi, dword [0x1005b13c]
push 0x80
push 3
push 0
push 3
push connect
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
call esi
cmp dword [0x1005b168], 0x10
mov edi, eax
push 0
cmovae ebx, dword [0x1005b154]
push 0x80
push 2
push 0
push 2
push 0x40000000
push ebx
mov dword [ebp - 0x1c], edi
call esi
mov ebx, eax
cmp edi, 0xffffffff
je 0x1000be0a
cmp ebx, 0xffffffff
je 0x1000be0a
lea eax, [ebp - 0x10]
mov byte [ebp - 0x18], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
or ecx, dword [ebp - 0x10]
and cl, 1
cdq
movzx esi, cl
neg esi
sbb esi, esi
add esi, 0x20
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000be07
push 0
lea eax, [ebp - 8]
push eax
push 4
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000bd97
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
and dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000bdf9
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 8], esi
push 1
pop ecx
movzx eax, al
cmovb eax, ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push ecx
push 0
push dword [0x1005b11c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1000bdf9
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [ebp - 0x18], 0
je 0x1000bda7
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1000be17
push edi
call esi
test ebx, ebx
je 0x1000be2c
push ebx
call esi
jmp 0x1000be2c
push 0xffffffffffffffff
push 0
push esi
mov ecx, ebx
call fcn.10001d29
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.10044a5e
mov esp, ebp
pop ebp
ret