Function at 0x1000b640
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x10074e73
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x1008c54c]
xor eax, esp
mov dword [esp + 0x4c4], eax
push ebx
push ebp
push esi
mov eax, dword [0x1008c54c]
xor eax, esp
push eax
lea eax, [esp + 0x4d8]
mov dword fs:[0], eax
xor edx, edx
mov dword [esp + 0x1c], edx
mov cl, byte [0x1008d8e5]
dec cl
mov al, cl
add al, 0x5f
imul cl
mov byte [0x1008d8e4], cl
mov cl, 0xfe
sub cl, al
mov al, cl
mov cl, 0x12
imul cl
mov bl, al
mov eax, 0x2b
mov word [esp + 0x64], ax
mov ecx, 0xda
mov word [esp + 0x66], cx
mov eax, 0xe3
mov word [esp + 0x68], ax
mov ecx, 0x8e
mov word [esp + 0x6a], cx
mov eax, 0xe6
mov word [esp + 0x6c], ax
mov ecx, 0x65
mov word [esp + 0x6e], cx
mov eax, 0x74
mov word [esp + 0x70], ax
mov ecx, 6
mov word [esp + 0x72], cx
mov eax, 0x5a
mov word [esp + 0x74], ax
mov ecx, 0xe
mov word [esp + 0x76], cx
mov eax, 0xf6
mov word [esp + 0x78], ax
mov ecx, 0x18
mov word [esp + 0x7a], cx
mov eax, 0x43
mov word [esp + 0x7c], ax
mov ecx, 0x4c
mov word [esp + 0x7e], cx
mov eax, 0xcc
mov word [esp + 0x80], ax
mov ecx, 0xed
mov word [esp + 0x82], cx
mov eax, 0x14
mov word [esp + 0x84], ax
mov ecx, 0x34
mov word [esp + 0x86], cx
mov eax, 0xf0
mov word [esp + 0x88], ax
mov ecx, 0x64
mov word [esp + 0x8a], cx
mov eax, 0x22
mov word [esp + 0x8c], ax
mov ecx, 0xe6
mov word [esp + 0x8e], cx
mov eax, 0x3d
mov word [esp + 0x90], ax
mov ecx, 0xb9
mov word [esp + 0x92], cx
mov eax, 0x62
mov word [esp + 0x94], ax
mov ecx, 0x9f
mov eax, 0xa4
mov word [esp + 0x96], cx
mov word [esp + 0x98], ax
mov ecx, 0xeb
mov eax, 0x92
mov word [esp + 0x9a], cx
mov word [esp + 0x9c], ax
mov ecx, 0x32
mov eax, 6
mov word [esp + 0x9e], cx
mov word [esp + 0xa0], ax
mov ecx, 0x6f
mov eax, 0x2e
mov byte [esp + 0x2c], 0x5a
mov word [esp + 0xa2], cx
mov word [esp + 0xa4], ax
test byte [0x10091100], 1
mov ecx, 0x6b
mov word [esp + 0xa6], cx
mov eax, 0x97
mov word [esp + 0xa8], ax
mov ecx, 0x7a
mov word [esp + 0xaa], cx
mov eax, 0x2f
mov word [esp + 0xac], ax
mov ecx, 0x29
mov word [esp + 0xae], cx
mov eax, 0x8a
mov word [esp + 0xb0], ax
mov ecx, 0x82
mov word [esp + 0xb2], cx
mov eax, 0x78
mov ecx, 0x50
mov word [esp + 0xb4], ax
mov word [esp + 0xb6], cx
mov eax, 0x95
mov ecx, 0x16
mov word [esp + 0xb8], ax
mov word [esp + 0xba], cx
mov eax, 0x72
mov ecx, 0x87
mov word [esp + 0xbc], ax
mov word [esp + 0xbe], cx
mov eax, 0x49
mov ecx, 0xd1
mov word [esp + 0xc0], ax
mov word [esp + 0xc2], cx
jne 0x1000b91f
or dword [0x10091100], 1
lea eax, [esp + 0x94]
lea ecx, [esp + 0x64]
mov dword [esp + 0x4e0], edx
call fcn.1003a5f0
push 0x10076fc0
call fcn.1005f1f6
add esp, 4
test byte [0x10091108], 1
mov ebp, dword [0x10090cf8]
mov edx, 0x8a
mov word [esp + 0x34], dx
mov eax, 0x5f
mov word [esp + 0x36], ax
mov ecx, 0xb9
mov word [esp + 0x38], cx
mov edx, 0x65
mov word [esp + 0x3a], dx
mov eax, 0xfd
mov word [esp + 0x3c], ax
mov ecx, 0x6b
mov word [esp + 0x3e], cx
mov edx, 0x85
mov word [esp + 0x40], dx
mov eax, 3
mov word [esp + 0x42], ax
mov ecx, 0x7d
mov word [esp + 0x44], cx
mov edx, 0x48
mov word [esp + 0x46], dx
mov eax, 0x62
mov ecx, 0xe3
mov edx, 0x3a
mov word [esp + 0x48], ax
mov word [esp + 0x4c], cx
mov word [esp + 0x4e], dx
mov eax, 0xdf
mov ecx, 0x17
mov edx, 0x9c
mov word [esp + 0x50], ax
mov word [esp + 0x52], cx
mov word [esp + 0x54], dx
mov eax, 6
mov ecx, 0xe0
mov edx, 0x2d
mov word [esp + 0x56], ax
mov word [esp + 0x58], cx
mov word [esp + 0x5a], dx
mov eax, 0x19
mov ecx, 0x24
mov edx, 0xe
mov word [esp + 0x5c], ax
mov word [esp + 0x5e], cx
mov word [esp + 0x60], dx
jne 0x1000ba3c
mov eax, 1
or dword [0x10091108], eax
mov dword [esp + 0x4e0], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x50]
mov esi, 0x10091104
call fcn.10043400
push 0x10076fb0
call fcn.1005f1f6
add esp, 4
mov ecx, dword [0x10091104]
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000ba63
push ebp
lea esi, [esp + 0x18]
call fcn.1000e630
mov dword [esp + 0x4e0], 2
mov al, byte [0x1008d8e4]
mov dl, 0x51
imul dl
sub al, 0x23
mov byte [0x1008d8e4], al
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000bb01
lea ecx, [esp + 0x1c]
push ecx
push 0x1007dee4
mov byte [0x1008d8e4], 0x2e
call eax
mov cl, byte [0x1008d8e5]
mov esi, eax
mov al, cl
imul cl
mov dl, al
mov al, byte [0x1008d8e4]
imul bl
sub dl, al
sub dl, 0x29
mov al, dl
imul bl
mov cl, 0xe3
imul cl
mov byte [0x1008d8e5], al
test esi, esi
jl 0x1000bb01
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1000bb01
lea edx, [esp + 0xc4]
mov byte [esp + 0x2c], 0xb1
call fcn.100328e0
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, byte [0x1008d8e5]
mov cl, 0x31
imul cl
mov bl, 0x69
sub bl, al
mov byte [0x1008d8e4], 0x57
jmp 0x1000bbcf
test byte [0x100910ec], 1
mov edx, 0x50
mov eax, 0x16
mov word [esp + 0x1c], dx
mov word [esp + 0x1e], ax
mov ecx, 0xf0
mov edx, 0xe3
mov eax, 4
mov word [esp + 0x20], cx
mov word [esp + 0x22], dx
mov word [esp + 0x24], ax
mov ecx, 0x53
mov edx, 0xbd
mov eax, 0xb3
mov word [esp + 0x26], cx
mov word [esp + 0x28], dx
mov word [esp + 0x2a], ax
jne 0x1000bbb7
or dword [0x100910ec], 1
push 0xa
mov byte [esp + 0x4e4], 3
call fcn.1004407f
add esp, 4
mov dword [0x100910e8], eax
xor eax, eax
mov cx, word [esp + eax + 0x24]
xor cx, word [esp + eax + 0x1c]
mov edx, dword [0x100910e8]
mov word [eax + edx], cx
add eax, 2
cmp eax, 8
jb 0x1000bb7a
mov ecx, dword [0x100910e8]
xor eax, eax
push 0x10076ff0
mov word [ecx + 8], ax
call fcn.1005f1f6
add esp, 4
mov byte [esp + 0x4e0], 2
mov edx, dword [0x100910e8]
push edx
lea ecx, [esp + 0xc8]
call fcn.10032940
add esp, 4
mov bl, 0x68
test byte [0x100910d4], 1
mov eax, 0xf
mov ecx, 0x42
mov edx, 0x81
mov word [esp + 0x24], ax
mov word [esp + 0x26], cx
mov word [esp + 0x28], dx
mov eax, 0x7b
mov ecx, 0x2f
mov edx, 0xf1
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], cx
mov word [esp + 0x20], dx
jne 0x1000bc71
or dword [0x100910d4], 1
push 8
mov byte [esp + 0x4e4], 4
call fcn.1004407f
add esp, 4
mov dword [0x100910d0], eax
xor eax, eax
mov cx, word [esp + eax + 0x1c]
xor cx, word [esp + eax + 0x24]
mov edx, dword [0x100910d0]
mov word [eax + edx], cx
add eax, 2
cmp eax, 6
jb 0x1000bc34
mov ecx, dword [0x100910d0]
xor eax, eax
push 0x10077020
mov word [ecx + 6], ax
call fcn.1005f1f6
add esp, 4
mov byte [esp + 0x4e0], 2
mov esi, dword [0x100910d0]
call fcn.10032e60
push eax
lea edx, [esp + 0xc8]
push edx
lea edx, [esp + 0x2d4]
mov ecx, esi
call fcn.10032bf0
add esp, 8
test eax, eax
je 0x1000bce9
mov al, byte [0x1008d8e5]
add al, 0xf
imul byte [esp + 0x2c]
sub al, byte [0x1008d8e4]
add al, bl
mov byte [0x1008d8e5], al
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
mov word [edi + 4], ax
lea eax, [esp + 0x2cc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000bcd0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x2d0]
jmp 0x1000bd03
xor ecx, ecx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
mov word [edi + 4], cx
push ecx
mov eax, 0x1007efe4
mov esi, edi
call fcn.1000aed0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000bd19
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov ecx, dword [esp + 0x4d8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c4]
xor ecx, esp
call fcn.1005f0c0
add esp, 0x4d4
ret