Function at 0x100ad1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, dword [0x101f420c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
test ecx, ecx
jne 0x100ad220
cmp byte [0x101f4208], cl
jne 0x100ad220
call fcn.1010cc30
mov dword [0x101f4204], eax
test eax, eax
je 0x100ad20c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptProtectMemory
push eax
call esi
push str.CryptUnprotectMemory
push dword [0x101f4204]
mov dword [0x101f420c], eax
call esi
mov ecx, dword [0x101f420c]
mov dword [0x101f4210], eax
mov byte [0x101f4208], 1
jmp 0x100ad225
mov eax, dword [0x101f4210]
mov ecx, dword [0x101f420c]
mov byte [0x101f4208], 1
jmp 0x100ad225
mov eax, dword [0x101f4210]
mov esi, ebx
and esi, 0xfffffff0
cmp byte [ebp + 8], 0
je 0x100ad247
test ecx, ecx
je 0x100ad25e
push 0
push esi
push edi
call ecx
test eax, eax
je 0x100ad3f9
jmp 0x100ad3f2
test eax, eax
je 0x100ad25e
push 0
push esi
push edi
call eax
test eax, eax
je 0x100ad400
jmp 0x100ad3f2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [esp + 0x10], eax
movd xmm0, eax
pshufd xmm0, xmm0, 0
test ebx, ebx
je 0x100ad3d7
cmp ebx, 0x10
jb 0x100ad3e0
movups xmm2, xmmword [0x101d3570]
lea edx, [edi + 8]
mov ebx, 0xfffffffc
movaps xmm3, xmmword [0x101d34e0]
sub ebx, edi
andps xmm0, xmm2
mov eax, 4
packuswb xmm0, xmm0
sub eax, edi
packuswb xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [0x101d3640]
mov dword [esp + 0x14], eax
mov edi, eax
movaps xmmword [esp + 0x30], xmm0
mov eax, dword [esp + 0x30]
nop dword [eax]
movd xmm0, ecx
pshufd xmm1, xmm0, 0
paddd xmm1, xmm3
movd xmm0, dword [esp + 0x20]
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, eax
paddb xmm1, xmm0
lea eax, [ebx + edx]
movd xmm0, dword [edx - 8]
xorps xmm1, xmm0
movd xmm0, eax
movd dword [edx - 8], xmm1
lea eax, [ecx + 8]
pshufd xmm1, xmm0, 0
add ecx, 0x10
movd xmm0, dword [esp + 0x20]
paddd xmm1, xmm3
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [esp + 0x30]
paddb xmm1, xmm0
movd xmm0, dword [edx - 4]
xorps xmm1, xmm0
movd xmm0, eax
movd dword [edx - 4], xmm1
lea eax, [edi + edx]
pshufd xmm1, xmm0, 0
lea edx, [edx + 0x10]
movd xmm0, dword [esp + 0x20]
paddd xmm1, xmm3
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [esp + 0x30]
paddb xmm1, xmm0
movd xmm0, dword [edx - 0x10]
xorps xmm1, xmm0
movd xmm0, eax
mov eax, dword [esp + 0x30]
movd dword [edx - 0x10], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [esp + 0x20]
paddd xmm1, xmm3
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [edx - 0xc]
xorps xmm1, xmm0
movd dword [edx - 0xc], xmm1
cmp ecx, esi
jb 0x100ad2d0
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
cmp ecx, ebx
jae 0x100ad3f2
nop dword [eax + eax]
add al, 0x4b
lea edx, [edi + ecx]
add al, cl
inc ecx
xor byte [edx], al
mov eax, dword [esp + 0x10]
cmp ecx, ebx
jb 0x100ad3e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
call fcn.100ace80
push 2
call fcn.100ace80
int3