Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push ebx
mov ebx, dword [0x10247e84]
add ecx, 0xffffde9e
push ebp
mov ebp, dword [esp + 0x30]
lea edx, [eax - 0x340]
push esi
lea esi, [eax - 0x22e9]
mov dword [esp + 0xc], ecx
add eax, 0xfffff79d
mov dword [esp + 0x10], esi
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x18], eax
xor edi, 0x2096
lea eax, [esi + 0x173b]
mov dword [esp + 0x34], edi
mov dword [esp + 0x40], edx
cmp esi, eax
jg 0x10001076
mov eax, dword [ebp + 0x1c]
xor edi, 0x1ee7
add eax, dword [0x10280b14]
xor eax, 0x1719dfb8
mov dword [0x10280ac8], eax
jmp 0x100011f2
imul eax, dword [ebp + 0xc8], 0x1ccb
mov dword [esp + 0x3c], edi
xor eax, 0x1a86
cmp dword [0x10280b28], eax
jae 0x1000116d
mov eax, dword [ebx + 0x38]
mov edx, esi
imul edx, ecx
xor eax, edx
mov dword [esp + 0x28], edx
cmp edi, eax
jb 0x100011f2
mov edx, dword [esp + 0x40]
mov eax, ecx
and eax, 0x18c0
mov edi, esi
mov dword [esp + 0x1c], eax
imul eax, edx, 0x24b5
mov dword [esp + 0x20], eax
lea eax, [edx + 0x1fa9]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x50]
sub eax, ecx
add eax, edx
add dword [0x10280b74], eax
mov esi, dword [ebp + 0x64]
mov eax, dword [ebx + 0xc4]
xor esi, edi
xor eax, dword [ebp + 0x128]
sub esi, ecx
mov ecx, dword [ebp + 0xc0]
or ecx, dword [esp + 0x40]
mov edx, dword [ebx + 0x80]
sub edx, dword [ebx + 0xd4]
push ebp
push eax
push ecx
push dword [esp + 0x28]
push edx
push dword [esp + 0x34]
push esi
call fcn.10004a1f
mov dword [esp + 0x34], eax
add esp, 0x1c
mov eax, dword [esp + 0x10]
sub eax, dword [0x10280b5c]
or eax, 0x199d
push eax
mov eax, dword [ebp + 4]
imul eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, dword [0x10247e84]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
inc ecx
mov dword [esp + 0x3c], ecx
mov eax, dword [ebx + 0x38]
xor eax, dword [esp + 0x28]
cmp ecx, eax
mov ecx, dword [esp + 0x10]
jae 0x100010d0
mov esi, dword [esp + 0x14]
jmp 0x100011ee
mov eax, dword [ebx + 0xc4]
and eax, ecx
cmp edi, eax
je 0x100011f2
mov eax, esi
xor eax, 0x2114
add eax, 0x173b
add edx, edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edx
mov eax, dword [0x10280ba0]
and eax, edi
push eax
mov eax, dword [0x10280b78]
xor eax, dword [0x10280b4c]
xor eax, esi
push eax
mov eax, dword [ebp + 0x18]
imul eax, esi
push eax
mov eax, dword [0x10280adc]
push dword [esp + 0x34]
xor eax, ecx
xor eax, dword [ebp + 0x84]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [0x10247e84]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
add edx, 3
mov dword [esp + 0x3c], edx
mov eax, dword [ebx + 0xc4]
and eax, ecx
cmp edx, eax
mov edx, dword [esp + 0x24]
jne 0x10001193
mov edi, dword [esp + 0x34]
mov eax, edi
xor eax, 0x7a3
cmp ecx, eax
je 0x10001242
mov eax, dword [ebp + 0x4c]
xor edi, 0x3a52
add eax, 0xd9947
xor dword [ebx + 0x7c], eax
lea eax, [ecx + 0x1ccb]
mov ecx, dword [esp + 0x18]
push ebp
push edi
push eax
lea eax, [ecx + 0x245]
push eax
lea eax, [ecx - 0x171]
push eax
mov eax, esi
xor eax, 0x2096
push eax
lea eax, [esi + 0x2096]
push eax
call fcn.10004a1f
add esp, 0x1c
mov edi, eax
lea eax, [edi + 0x8a]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret