Function at 0x10001a89
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100568bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x28], edx
mov byte [esp + 0x30], cl
push edi
test cl, cl
je 0x10002042
push dword [esp + 0x2c]
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x64]
movdqa xmm0, xmmword [0x10066990]
mov dword [esp + 0x34], eax
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x94]
mov dword [esp + 0x68], ebx
push eax
push ebx
movdqu xmmword [esp + 0x9c], xmm0
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call fcn.1000eb10
xor ecx, ecx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0xc], ebx
inc ecx
jmp 0x10001b1d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x5c], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x10001b11
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], eax
mov dword [eax + 8], 0x1c
mov dword [esp + 0xc], 0x53af
cmp dword [esp + 0xc], 0x563b
jle 0x10001b85
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x1c], ebx
mov ebx, esi
mov esi, 0x6495
mov eax, ebx
mov ecx, 0x1006cbb8
or eax, edi
cdq
push edx
push eax
call fcn.1000c318
dec ebx
dec esi
jne 0x10001b53
mov esi, dword [esp + 0x1c]
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x1bf5
jl 0x10001b4c
inc edi
push 0
pop ebx
cmp edi, 0x12b4
jl 0x10001b46
mov dword [esp + 0x14], 0xd811f07b
cmp dword [esp + 0xc], 0x51b0
jge 0x10001ba6
mov edx, str.soup_mqg_epqpqoc_roc_cnijyaw_atp_nhio_cqp_sfutpcvwd_rrdmr_nqidbkbl
mov ecx, 0x1006cbb8
call fcn.1000e58f
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x10001d03
mov dword [esp + 0x18], 0x7e60
cmp dword [esp + 0x18], 0x7f62
jle 0x10001c41
mov eax, ebx
mov dword [esp + 0xc], ebx
mov esi, ebx
mov edi, ebx
mov ecx, esi
mov dword [esp + 0x20], 0x6d11
mov dword [esp + 0x1c], ecx
sar eax, cl
lea ecx, [esp + 0xf0]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001bf9
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push ebx
push 1
lea ecx, [esp + 0xf8]
call fcn.1000c8ef
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
add ecx, edi
dec dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
jne 0x10001bde
dec edi
cmp edi, 0xffffe27b
jg 0x10001bd0
inc esi
cmp esi, 0x679d
jl 0x10001bce
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x6e09
jl 0x10001bcc
mov dword [esp + 0xc], 0xc3938dd4
cmp dword [esp + 0x18], 0x7b0d
jge 0x10001c5e
push str.xmqlalbc_mawmwj_jssnjebfx
call fcn.1004139c
pop ecx
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x5c], ebx
jne 0x10001d03
mov dword [esp + 0xc], ebx
jmp 0x10001cef
push 3
lea ecx, [esp + 0x40]
call fcn.1000c530
lea eax, [esp + 0x3c]
mov byte [esp + 0x12c], 1
push eax
lea eax, [esp + 0x88]
mov dword [esp + 0x50], 0x7921e124
push eax
push 0x3814
push 0xd99
mov edx, 0x7d3e
xor cl, cl
call fcn.10002270
mov eax, dword [esp + 0x4c]
add esp, 0x10
mov dword [eax], ebx
jmp 0x10001cd3
lea eax, [esp + 0x4c]
mov edx, 0x5820
push eax
xor cl, cl
call fcn.10006ce8
mov eax, dword [esp + 0x40]
pop ecx
dec dword [eax]
mov eax, dword [esp + 0x3c]
cmp dword [eax], ebx
jge 0x10001cbb
lea ecx, [esp + 0x3c]
mov byte [esp + 0x12c], bl
call fcn.1000c5b3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10001c72
dec dword [esp + 0x14]
jns 0x10001bb4
mov eax, dword [esp + 0x10]
dec dword [eax + 8]
cmp dword [eax + 8], 7
jne 0x10001b32
or dword [esp + 0x12c], 0xffffffff
lea ecx, [esp + 0x60]
call fcn.1000c5b3
mov eax, dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x34]
mov al, byte [eax]
mov byte [esp + 0x2a], al
lea eax, [esp + 0x2a]
push eax
call fcn.10002240
pop ecx
pop ecx
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x78]
mov dword [esp + 0x1c], 0xbc58
mov dword [esp + 0x10], ebx
push 4
call fcn.1000c530
mov dword [esp + 0x12c], 2
mov dword [esp + 0x10], 0x71b5
cmp dword [esp + 0x10], 0x7453
jle 0x10001de7
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], 0x3f6a
mov esi, dword [esp + 0xc]
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0xa8]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001dad
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push ebx
push 1
lea ecx, [esp + 0xb0]
call fcn.1000c8ef
inc edi
cmp edi, 0xd8b
jl 0x10001d8e
mov esi, dword [esp + 0x20]
add dword [esp + 0xc], esi
dec dword [esp + 0x18]
jne 0x10001d88
inc esi
mov dword [esp + 0x20], esi
cmp esi, 0x16ab
jl 0x10001d7c
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x10], 0x6fb0
jge 0x10001e00
push str.cwaxc_pmom_phj
call fcn.1004139c
pop ecx
push ecx
lea eax, [esp + 0x7c]
push eax
push ecx
lea edx, [esp + 0x34]
call fcn.10001a43
add esp, 0xc
mov dword [esp + 0x28], ebx
jmp 0x10001e2c
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x9c], 0x351a938
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jl 0x10001e19
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
cmp dword [esp + 0x1c], eax
jl 0x10001e6e
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, 0xaa43b2b
setg cl
xor edx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x78]
setne dl
mov dword [eax + 8], edx
mov eax, dword [esp + 0x14]
mov ecx, 0xa421
mov eax, dword [esp + 0x14]
mov dword [esp + 0x9c], ecx
mov eax, dword [esp + 0x14]
sub eax, ecx
lea ecx, [esp + 0x78]
mov dword [esp + 0x18], eax
or dword [esp + 0x12c], 0xffffffff
call fcn.1000c5b3
mov dword [esp + 0x10], 0x2964
cmp dword [esp + 0x10], 0x2d17
jle 0x10001ef7
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [esp + 0xc0]
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001ecf
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push ebx
push 1
lea ecx, [esp + 0xc8]
call fcn.1000c8ef
inc edi
cmp edi, 0x1168
jl 0x10001eb3
inc esi
cmp esi, 0x1b58
jl 0x10001eb1
push 0x13f4
mov dword [esp + 0x58], 0xffffffff
mov edx, 0x3483
push 0x7e5d
mov dword [esp + 0x50], 0xffffffff
xor cl, cl
mov dword [esp + 0x58], ebx
push 0x7875
mov dword [esp + 0x64], 0xd77cccae
mov dword [esp + 0x44], 0x9034e105
push 0x70a9
call fcn.100023ab
lea eax, [esp + 0x60]
mov cl, 1
push eax
push 1
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x64]
push eax
push 0xb90
lea eax, [esp + 0x78]
push eax
push 0x3eb8
push ebx
push 0xd33
lea edx, [esp + 0x6c]
call fcn.10004749
mov esi, dword [esp + 0x64]
add esp, 0x34
mov dl, 0x12
mov cl, byte [esi]
call fcn.1000e766
cmp dword [esp + 0x10], 0x2767
mov byte [esi], al
jge 0x10001f93
push str.nhadsogp_invgt_udolcbsc_hndx_nlcvwftf_iyyytl
call fcn.1004139c
pop ecx
mov dword [esp + 0x1c], 0x7f6d
cmp dword [esp + 0x1c], 0x80a2
jle 0x10002016
mov esi, ebx
mov dword [esp + 0x20], ebx
mov edi, ebx
mov dword [esp + 0x18], ebx
mov eax, esi
mov ecx, ebx
cdq
idiv edi
mov dword [esp + 0x10], ecx
mov edi, edx
mov esi, edi
mov dword [esp + 0x38], ebx
sar esi, cl
mov eax, esi
mov ecx, 0x1006cbb8
xor eax, ebx
cdq
push edx
push eax
call fcn.1000c318
inc ebx
cmp ebx, 0x2203
jl 0x10001fc6
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
push 0
pop ebx
cmp ecx, 0x2bba
jl 0x10001fbe
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x1e1e
jl 0x10001fb1
inc esi
mov dword [esp + 0x20], esi
cmp esi, 0x70d7
jl 0x10001fab
cmp dword [esp + 0x1c], 0x7e14
mov edx, dword [esp + 0x2c]
mov al, byte [esp + 0x26]
mov byte [edx], al
jge 0x1000222b
mov edx, str.jeujxkhov_aqavkiil_vmurl_lqdvvs_rpvbv_cuqnubyrj_lffutnxq_qwxfjlbi_nyqqlai_tvyrnr_kqe
mov ecx, 0x1006cbb8
call fcn.1000e58f
jmp 0x1000222b
mov esi, dword [ebp + 8]
cmp dword [esi], ebx
je 0x1000205f
lea eax, [esp + 0x27]
mov byte [esp + 0x27], bl
push eax
push ecx
call fcn.1000238e
pop ecx
pop ecx
jmp 0x1000222b
mov dword [esp + 0x14], 0xffff
mov dword [esp + 0x20], 0x1e07
cmp dword [esp + 0x20], 0x1f88
jle 0x100020f1
mov edi, ebx
mov dword [esp + 0x18], ebx
mov eax, ebx
mov dword [esp + 0x10], ebx
mov ecx, eax
mov dword [esp + 0x2c], edi
mov esi, ebx
sar edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [esp + 0xd8]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100020ae
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push ebx
push 1
lea ecx, [esp + 0xe0]
call fcn.1000c8ef
inc esi
cmp esi, 0x413f
jl 0x1000208f
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x281e
jl 0x10002085
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0xb44
jl 0x1000207f
mov esi, dword [ebp + 8]
push 3
pop edi
push edi
lea ecx, [esp + 0x70]
call fcn.1000c530
mov dword [esp + 0x12c], edi
cmp dword [esp + 0x20], 0x1a37
jge 0x1000211a
push str.owbj_ogsgnlmpc_tnmh_runrbnhu_hehkavru_awlixxxex_hypi_yaroe_rxponkm_utm_uobpxivex_mjrjkyp
call fcn.1004139c
pop ecx
lea eax, [esp + 0x6c]
mov ecx, 0x147e
push eax
push ebx
lea edx, [esp + 0x90]
call fcn.10004c3a
mov dword [esp + 0x20], 0xd36
cmp dword [esp + 0x20], 0xe7d
pop ecx
pop ecx
jle 0x100021b6
mov edi, ebx
mov esi, ebx
mov ecx, ebx
mov dword [esp + 0x10], ebx
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x108]
or eax, edi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000216e
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push ebx
push 1
lea ecx, [esp + 0x110]
call fcn.1000c8ef
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x3982
jl 0x1000214f
inc esi
cmp esi, 0x7bf1
jl 0x10002149
inc edi
cmp edi, 0x3540
jl 0x10002147
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esi]
mov eax, dword [esi]
sub eax, 0x3773672
jne 0x100021d5
cmp dword [esp + 0x14], ebx
je 0x100021d8
xor ebx, ebx
inc ebx
mov eax, dword [esi]
xor edx, edx
sub eax, ebx
cmp eax, 0x2fd2d1a4
mov eax, dword [esp + 0x6c]
setl dl
xor ecx, ecx
mov dword [eax + 4], edx
mov eax, dword [esi]
cmp edx, eax
mov eax, dword [ebp + 0x10]
setge cl
mov dword [eax], ecx
cmp dword [esp + 0x18], 0xac6
jge 0x10002210
push str.qjucdsm_trq_rremcjpl_chaupcog_swnjg_ywsbwxk_cnqiyx_sxah_xaq_hofhhe_jqk
call fcn.1004139c
pop ecx
lea eax, [esp + 0x6c]
mov edx, 0x603d
push eax
push esi
call fcn.1000722d
pop ecx
pop ecx
lea ecx, [esp + 0x6c]
call fcn.1000c5b3
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret