Function at 0x100174df
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov eax, 0x1005e825
call fcn.1005dc80
sub esp, 0x58
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
cmp byte [ebp + 0x14], bl
je 0x10017725
mov dword [ebp - 0x1c], 0x4cf1
cmp dword [ebp - 0x1c], 0x4d38
jle 0x10017560
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x48]
and eax, esi
cdq
push edx
push eax
call fcn.10001b3f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10017530
mov eax, dword [eax]
push eax
call fcn.10047293
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.1001084f
inc edi
cmp edi, 0x262a
jl 0x10017517
inc esi
cmp esi, 0x7b44
jl 0x10017515
push 0x1d1b
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp - 0x1c], 0x4c46
jge 0x10017574
push str.vuhlzfhf_uflsgs_ptcbarvt_pxyfq_yybvmrgy_mpdtz_bhattwyxr_adzcbqfs_lrmk_dikxqkheu_fddzd_dhwv_ekjtgqemd
call fcn.10047293
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x2c], 0
je 0x100176fd
mov dword [ebp - 0x28], 0x54dc
cmp dword [ebp - 0x28], 0x55f3
jle 0x100175e7
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov dword [ebp - 0x20], 0xe9b
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov esi, 0x20d2
mov eax, ebx
mov ecx, 0x10079ad8
xor eax, edi
cdq
push edx
push eax
call fcn.1000fde8
inc ebx
dec esi
jne 0x100175aa
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add eax, esi
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jne 0x100175a3
inc esi
mov dword [ebp - 0x24], esi
push 0
pop ebx
cmp esi, 0x28cd
jl 0x10017597
inc edi
cmp edi, 0x3bc2
jl 0x10017594
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x5465
jge 0x10017624
mov edx, str.kuboylv_icrtxo_qqhq_okgvxnota_afvjuuxq_ouqonyvr_ctsn
mov ecx, 0x10079ad8
call fcn.10012b8c
jmp 0x10017624
mov esi, dword [ebp + 0x28]
xor edx, edx
mov edi, dword [ebp + 0x18]
mov eax, dword [esi]
mov ecx, dword [esi]
imul ecx, dword [esi]
mov eax, dword [esi]
inc ecx
cmp ecx, eax
sete dl
cmp edx, 0x14d2
jne 0x1001764e
mov eax, dword [edi]
cmp dword [eax], ebx
je 0x1001764e
xor edx, edx
inc edx
jmp 0x10017650
mov edx, ebx
mov eax, dword [edi]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x34]
setne cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
mov eax, dword [ebp - 0x30]
setne cl
mov dword [eax], 0xfc36fe5a
mov eax, dword [ebp + 0x24]
mov dword [eax], ecx
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx]
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 0x775
sete cl
sub ecx, 0xce9b
neg ecx
sbb ecx, ecx
inc ecx
mov dword [edx], ecx
mov eax, dword [edx]
mov eax, dword [esi]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edi]
mov ecx, dword [edx]
sub ecx, dword [eax + 4]
mov eax, dword [edx]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
cmp eax, dword [edx]
jle 0x100176b8
cmp dword [esi], ebx
je 0x100176bb
xor ebx, ebx
inc ebx
mov ecx, dword [edi]
mov eax, dword [ecx + 8]
imul eax, ebx
sub eax, 0x4ad744d0
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, dword [ecx]
mov eax, dword [esi]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp + 0x20]
cmp edx, 0xfffffffd
setne cl
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100177c6
push 1
push ebx
lea eax, [ebp + 0x17]
mov byte [ebp + 0x17], bl
push eax
push 0x5607
push 0x49ea
xor dl, dl
mov ecx, 0x2072
call fcn.10013e8f
add esp, 0x14
jmp 0x100177c6
mov dword [ebp - 0x28], 0xa7a
cmp dword [ebp - 0x28], 0xbdf
jle 0x10017781
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x60]
cdq
push edx
push eax
call fcn.10001b3f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001775d
mov eax, dword [eax]
push eax
call fcn.10047293
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.1001084f
inc edi
cmp edi, 0x22ba
jl 0x10017742
inc esi
cmp esi, 0x7283
jl 0x10017740
cmp byte [ebp + 0x30], 0
je 0x100177a0
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x100177b2
push ecx
push ecx
xor dl, dl
mov ecx, 0x39e3
call fcn.100151af
pop ecx
jmp 0x100177b1
push ebx
mov edx, 0x2a78
mov byte [ebp - 0x15], bl
lea ecx, [ebp - 0x15]
call fcn.10017bf6
pop ecx
cmp dword [ebp - 0x28], 0x9a8
jge 0x100177c6
push str.kcrf_gcukwux_wyek_ataucd_ial_pwlullwc_amipwjqi_vgfajd_mtw_lnnch_kjfisomt_bji_wavxq_aiknwpl
call fcn.10047293
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret