Function at 0x1000a660
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
mov esi, ecx
lea eax, [edx - 0xec]
mov ecx, dword [esp + 0x20]
add edx, 0xfffffd17
mov dword [esp + 0xc], eax
add ebx, 0xffffeab0
push edi
mov edi, dword [esp + 0x18]
lea eax, [ecx - 0x160]
add edi, 0xfffff888
mov dword [esp + 0x24], eax
lea ebp, [ecx - 0x157]
mov eax, dword [esp + 0x38]
add eax, 0xffffea70
mov dword [esp + 0x38], edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffe43
cmp edx, eax
je 0x1000a75f
mov ecx, dword [esp + 0x1c]
lea eax, [edx - 0x3b6]
add ecx, 0xffffe5ba
cmp ecx, eax
je 0x1000a75f
mov eax, dword [esi + 0x12c]
mov ecx, dword [eax + 0x64]
mov eax, dword [esi + 0xf0]
add ecx, 0x655bbf
mov dword [eax + 8], ecx
lea eax, [esi + 0x9c]
push eax
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x178], eax
mov eax, dword [esi]
mov eax, dword [eax + 0xd8]
or eax, 0x190f
sub dword [esi + 0xfc], eax
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xc0]
add eax, dword [esi + 0x3c]
mov dword [esi + 0x164], eax
cmp dword [esi + 0x58], 0x11d7
je 0x1000a74b
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x24]
add ecx, 0x1a46
mov dword [eax + 0x10], ecx
imul eax, dword [esi + 0x94], 0x1550
mov edx, dword [esp + 0x38]
or dword [esi + 0x15c], eax
lea eax, [edx - 0x221]
cmp dword [esp + 0x28], eax
je 0x1000a9ce
mov eax, dword [esi + 0x164]
cmp eax, dword [esi + 0x3c]
je 0x1000a9b4
mov ecx, dword [esi + 0x19c]
mov eax, 0xffffffa8
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub eax, esi
push 4
push 0x1000
add dword [ecx + 0x30], eax
mov eax, dword [esi + 0xf8]
mov ecx, dword [esi + 0xfc]
xor ecx, 0x132f
mov dword [eax + 0xd0], ecx
mov ecx, dword [esi + 0x164]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
push eax
push 0
call edi
imul ecx, dword [esi + 0x198], 0x14e4
mov ebx, eax
mov dword [esi + 0x194], ecx
mov ecx, dword [esi + 0x19c]
mov edx, dword [ecx + 0x64]
mov ecx, dword [esi + 0xf8]
xor edx, 0xa51
cmp edx, dword [ecx + 0x64]
jb 0x1000a802
mov eax, dword [esi + 0xc8]
sub dword [esi + 0xfc], eax
inc eax
mov dword [esi + 0xc8], eax
test ebx, ebx
je 0x1000a983
mov eax, dword [esi + 0x164]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
push eax
push ecx
push ebx
call fcn.10007016
mov eax, dword [esi + 0x19c]
add esp, 0xc
cmp dword [eax + 0x64], 0x1baa
je 0x1000a84f
mov ecx, dword [esi + 0xd8]
mov eax, dword [esi + 0x150]
imul eax, ecx
mov dword [esi + 0x150], eax
lea eax, [ecx + 1]
mov dword [esi + 0xd8], eax
cmp dword [esi + 0x50], 0x139b
jbe 0x1000a862
imul ecx, dword [esi + 0x30], 0x14fb
or dword [esi + 0x30], ecx
mov eax, dword [esi + 0x168]
call eax
mov dword [esi + 0x174], eax
mov ecx, dword [esi + 0x58]
mov ecx, dword [ecx + 0x14]
sub ecx, 0x1a4e
cmp eax, ecx
jne 0x1000a8cb
mov eax, dword [esi]
imul eax, dword [eax + 0x14c], 0xa28bb6b4
cmp eax, 0x1784
jge 0x1000a8ba
mov edi, dword [esi + 0x194]
mov ecx, 0x1784
mov edx, dword [esi + 0xd8]
sub ecx, eax
mov eax, 0x14e4
sub eax, edi
add edx, eax
sub ecx, 1
jne 0x1000a8a6
mov dword [esi + 0xd8], edx
imul eax, dword [esi + 0x1c4], 0xc61ec93
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push eax
mov eax, dword [esi + 0x178]
call eax
test eax, eax
jne 0x1000a8e8
mov eax, dword [esi + 0x64]
sub eax, 0x19ac
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0xd0]
xor dword [esi + 0x1b8], eax
dec eax
mov dword [esi + 0xd0], eax
mov eax, dword [esi + 0x19c]
mov ecx, dword [eax + 0x64]
imul eax, ecx, 0x3baac894
xor ecx, 0x1ded
shl ecx, 2
push eax
push 0x1000
push ecx
push 0
call edi
mov edi, eax
mov dword [esp + 0x28], edi
test edi, edi
je 0x1000a983
mov ecx, dword [esi + 0x164]
mov ecx, dword [ecx + 8]
cmp dword [ecx], 0xffffffff
jne 0x1000a942
mov ecx, dword [esi]
mov eax, dword [ecx + 0x1c]
xor eax, 0x11d7
jmp 0x1000a979
mov edx, dword [esi + 0x64]
xor edx, 0xa36
cmp edx, 0x139b
jge 0x1000a96e
mov ecx, dword [esi + 0x7c]
lea edi, [esi + 0x10]
mov eax, 0x139b
sub eax, edx
or ecx, edi
sub eax, 1
jne 0x1000a960
mov edi, dword [esp + 0x28]
mov dword [esi + 0x7c], ecx
mov eax, dword [esi + 0x164]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [edi + eax*4], ebx
mov dword fs:[0x2c], edi
mov edx, dword [esi + 0x12c]
mov ecx, 0x19ad
mov dword [esi + 0x13c], 0x7df
cmp dword [edx + 0x64], ecx
jbe 0x1000a9b4
mov eax, dword [esi + 0x194]
or eax, 0x1fff
inc ecx
mov dword [esi + 0x194], eax
cmp ecx, dword [edx + 0x64]
jb 0x1000a9a3
mov eax, dword [esi + 0xd0]
sub eax, 0x139b
xor dword [esi + 0x2c], eax
lea eax, [ebp + 0x56b]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esi + 0x50]
mov eax, edi
imul eax, dword [esp + 0x24]
cmp ecx, eax
jne 0x1000aa0c
mov edx, dword [esi + 0x64]
mov esi, dword [esi + 0xf8]
or edx, 0x156f
nop dword [eax + eax]
mov eax, dword [esp + 0x28]
inc ecx
sub eax, esi
add ebp, edx
add ebx, eax
xor edi, ebx
xor edi, dword [esp + 0x10]
mov eax, edi
imul eax, dword [esp + 0x24]
cmp ecx, eax
je 0x1000a9f0
pop edi
pop esi
lea eax, [ebp + 0x56b]
pop ebp
pop ebx
pop ecx
ret