Function at 0x1002eb40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x68]
mov ebp, dword [edi + 0x64]
sub ecx, dword [edi + 0x7c]
add ebp, dword [edi + 0x7c]
mov dword [esp + 0x18], ecx
cmp ecx, 2
jb 0x1002ee62
mov al, byte [ebp]
movzx esi, al
and esi, 0xf
mov byte [esp + 0x13], al
cmp esi, 8
jae 0x1002eb8a
xor ecx, ecx
cmp dword [edi + 0x84], ecx
sete cl
xor eax, eax
test esi, esi
setne al
xor ecx, eax
jmp 0x1002eb92
not al
movzx ecx, al
shr ecx, 7
test ecx, ecx
jne 0x1002ee83
mov al, byte [ebp + 1]
test al, al
jns 0x1002ee83
movzx eax, al
xor edx, edx
mov ebx, eax
mov dword [esp + 0x1c], edx
and ebx, 0x7f
cmp ebx, 0x7e
jae 0x1002ebca
mov edx, dword [ebp + 2]
lea eax, [ecx + 5]
lea ecx, [ebp + 6]
mov dword [esp + 0x14], ecx
jmp 0x1002ecb5
add eax, 0xffffff82
cmp eax, 0x81
ja case.0x1002ebdf.128
movzx eax, byte [eax + 0x1002eea8]
jmp dword [eax*4 + 0x1002ee94]
movzx eax, word [ebp + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [esp + 0x1c]
lea ecx, [ebp + 4]
movzx ebx, ax
mov eax, 3
mov dword [esp + 0x14], ecx
jmp 0x1002ecb5
mov edx, dword [ebp + 6]
mov eax, edx
mov ecx, dword [ebp + 2]
mov ebx, ecx
shrd ebx, eax, 0x18
mov eax, edx
shr eax, 8
and ebx, 0xff0000
and eax, 0xff00
or ebx, eax
mov eax, edx
shrd ecx, eax, 8
shr edx, 0x18
mov eax, 9
and ecx, 0xff000000
or ebx, ecx
lea ecx, [ebp + 0xa]
or ebx, edx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x1c]
jmp 0x1002ecb5
movzx eax, word [ebp + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [ebp + 4]
lea ecx, [ebp + 8]
movzx ebx, ax
mov eax, 7
mov dword [esp + 0x14], ecx
jmp 0x1002ecb5
mov edx, dword [ebp + 6]
mov eax, edx
mov ecx, dword [ebp + 2]
mov ebx, ecx
shrd ebx, eax, 0x18
mov eax, edx
shr eax, 8
and ebx, 0xff0000
and eax, 0xff00
or ebx, eax
mov eax, edx
shrd ecx, eax, 8
shr edx, 0x18
mov eax, 0xd
and ecx, 0xff000000
or ebx, ecx
lea ecx, [ebp + 0xe]
or ebx, edx
mov dword [esp + 0x14], ecx
mov edx, dword [ebp + 0xa]
jmp 0x1002ecb5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
inc eax
add eax, ebx
mov dword [esp + 0x20], eax
cmp ecx, eax
jb 0x1002ee62
sub ecx, eax
add ebp, eax
mov al, byte [esp + 0x13]
mov dword [esp + 0x18], ecx
test esi, esi
je 0x1002ece3
test al, al
jns 0x1002ece3
mov byte [esp + 0x12], 0
jmp 0x1002ed08
mov byte [esp + 0x12], 1
test esi, esi
jne 0x1002ecf4
mov esi, dword [edi + 0x84]
jmp 0x1002ecfa
mov dword [edi + 0x84], esi
test al, al
jns 0x1002ed08
mov dword [edi + 0x84], 0
lea eax, [esi - 1]
cmp eax, 8
ja case.0x1002ed1b.3
movzx eax, byte [eax + 0x1002ef38]
jmp dword [eax*4 + 0x1002ef2c]
test edx, edx
je 0x1002ed6e
mov ecx, dword [esp + 0x14]
mov eax, ebx
and eax, 3
sub ecx, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
add ecx, ebx
cmp eax, ecx
jae 0x1002ed49
nop
xor dword [eax], edx
add eax, 4
cmp eax, ecx
jb 0x1002ed40
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x1002ed6c
sub eax, 1
je 0x1002ed64
sub eax, 1
jne 0x1002ed6e
mov eax, edx
shr eax, 0x10
xor byte [ecx + 2], al
mov eax, edx
shr eax, 8
xor byte [ecx + 1], al
xor byte [ecx], dl
mov al, byte [esp + 0x12]
test al, al
je 0x1002edc4
mov eax, dword [esp + 0x14]
lea ecx, [edi + 0x88]
test eax, eax
je 0x1002edc0
mov edx, dword [ecx + 4]
add edx, ebx
mov dword [esp + 0x1c], edx
cmp edx, dword [ecx + 8]
jbe 0x1002eda6
push ebx
call fcn.100029a0
test eax, eax
je 0x1002edc0
mov eax, dword [esp + 0x14]
lea ecx, [edi + 0x88]
push ebx
push eax
mov eax, dword [ecx]
add eax, dword [ecx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [edi + 0x8c], eax
mov al, byte [esp + 0x12]
cmp byte [esp + 0x13], 0
jge 0x1002ee55
test al, al
je 0x1002edfd
mov ecx, dword [edi + 0x88]
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x1002edf5
mov eax, dword [edi + 0x8c]
mov byte [ecx + eax], 0
mov ecx, dword [edi + 0x88]
mov dword [esp + 0x14], ecx
mov ebx, dword [edi + 0x8c]
jmp 0x1002ee01
mov ecx, dword [esp + 0x14]
cmp esi, 9
jne 0x1002ee11
push ebx
push ecx
mov ecx, edi
call fcn.10034fd0
jmp 0x1002ee1c
push 0
push ebx
push ecx
mov ecx, edi
call fcn.1002f390
cmp byte [esp + 0x12], 0
je 0x1002ee55
mov eax, dword [edi + 0x88]
test eax, eax
je 0x1002ee37
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov dword [edi + 0x88], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x8c], 0
mov ecx, dword [esp + 0x18]
cmp ecx, 2
jae 0x1002eb62
mov eax, dword [edi + 0x68]
sub eax, ecx
mov dword [edi + 0x7c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 1
mov ecx, edi
call fcn.1002ddc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.1002d770