Function at 0x10011e80
Capabilities:
Create thread
Encode data using xor
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003a008]
xor eax, ebp
mov dword [ebp - 4], eax
movsd xmm0, qword [0x10037db8]
mov eax, 0x5a4d
movsd qword [0x1003a920], xmm0
movsd xmm0, qword [0x10037dd8]
movsd qword [0x1003a910], xmm0
movsd xmm0, qword [0x10037dc0]
movsd qword [0x1003a928], xmm0
movsd xmm0, qword [0x10037db0]
mov dword [ebp - 0x10], 0
movsd qword [0x1003a918], xmm0
cmp word [ecx], ax
je 0x10011ef2
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e319
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [0x10037de8]
mov eax, dword [ecx + 0x3c]
movsd qword [0x1003a918], xmm0
movsd xmm0, qword [0x10037dc8]
movsd qword [0x1003a920], xmm0
cmp dword [ecx + eax], 0x4550
movsd xmm0, qword [0x10037df0]
movsd qword [0x1003a910], xmm0
movsd xmm0, qword [0x10037dd0]
movsd qword [0x1003a928], xmm0
je 0x10011f51
mov eax, 0xfffffffe
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e319
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [0x10037e28]
movsd qword [0x1003a928], xmm0
movsd xmm0, qword [0x10037e18]
movsd qword [0x1003a918], xmm0
movsd xmm0, qword [0x10037de0]
push esi
movsd qword [0x1003a920], xmm0
sub esp, 0x14
movsd xmm0, qword [0x10037e40]
movsd qword [0x1003a910], xmm0
call fcn.1001c720
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x10011fb7
mov eax, 0xfffffffd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e319
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 0
movsd xmm4, qword [0x1003a918]
movsd xmm5, qword [0x10037da8]
movaps xmm1, xmm4
movsd xmm6, qword [0x1003a928]
addsd xmm1, xmm5
movaps xmm0, xmm6
movsd xmm3, qword [0x1003a910]
movsd xmm2, qword [0x1003a920]
push edi
divsd xmm0, xmm1
movaps xmm1, xmm4
subsd xmm3, xmm0
movaps xmm0, xmm2
addsd xmm0, xmm5
movsd qword [0x1003a910], xmm3
divsd xmm1, xmm0
movaps xmm0, xmm3
subsd xmm6, xmm1
movaps xmm1, xmm2
addsd xmm0, xmm5
movsd qword [0x1003a928], xmm6
addsd xmm6, xmm5
divsd xmm1, xmm0
divsd xmm3, xmm6
subsd xmm4, xmm1
subsd xmm2, xmm3
movsd qword [0x1003a918], xmm4
movsd qword [0x1003a920], xmm2
je 0x100120a6
mov dword [ebp - 0xc], 0xf7e5f7d1
xor ecx, ecx
mov word [ebp - 8], 0xd0f2
mov byte [ebp - 6], 0
nop dword [eax + eax]
lea eax, [ecx - 0x7e]
xor byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 6
jb 0x10012060
lea edx, [ebp - 0xc]
mov byte [ebp - 6], 0
mov ecx, esi
call fcn.1001ccf0
test eax, eax
jne 0x1001209b
mov ecx, esi
call fcn.1001cdd0
pop edi
mov eax, 0xfffffffc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e319
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push eax
jmp 0x100120b2
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x1001ce50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movsd xmm3, qword [0x1003a928]
mov ecx, esi
movsd xmm1, qword [0x1003a918]
movaps xmm4, xmm3
mulsd xmm4, qword [0x1003a910]
movaps xmm2, xmm1
mulsd xmm2, xmm3
addsd xmm4, qword [0x1003a920]
addsd xmm2, qword [0x1003a910]
movaps xmm0, xmm4
movsd qword [0x1003a920], xmm4
mulsd xmm0, xmm1
movsd qword [0x1003a910], xmm2
mulsd xmm2, xmm4
addsd xmm0, xmm3
addsd xmm2, xmm1
movsd qword [0x1003a928], xmm0
movsd qword [0x1003a918], xmm2
call fcn.1001cdd0
test edi, edi
je 0x1001213e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1001e319
mov esp, ebp
pop ebp
ret