Function at 0x100c2071
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
pushfd
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x150], edx
lea eax, [ebp + 4]
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x140], edi
mov edi, 0xfffffff
mov ebx, dword [0x1007b9bc]
mov esi, dword [eax + 4]
sub eax, 4
mov dword [ebp - 0xe8], eax
mov eax, dword [esi]
shr eax, 1
and eax, edi
lea ecx, [ebx + eax - 1]
mov eax, ecx
xor edx, edx
div ebx
mov eax, dword [0x1007b9bc]
sub ecx, edx
mov dword [ebp - 0x80], ecx
mov eax, dword [0x10012044]
mov dword [ebp - 0x7c], eax
mov eax, dword [0x1007b9bc]
mov eax, dword [0x10012044]
test eax, eax
je 0x100c2170
and dword [ebp - 0x70], 0
mov eax, dword [0x10012044]
dec eax
lea ecx, [eax + 1]
xor eax, eax
mov edx, ecx
test ecx, ecx
je 0x100c2128
mov ebx, dword [0x1012ee38]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x1012ee38], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x100c2101
xor edx, edx
div ecx
cmp dword [ebp - 0x7c], 0
jbe 0x100c216a
mov ecx, 0xffffc390
mov eax, 0x3c6f
lea ebx, [edx*4 + 0x1012ee90]
inc dword [ebp - 0x70]
lock cmpxchg dword [ebx], ecx
cmp eax, 0x3c6f
je 0x100c234a
lea eax, [edx + 1]
mov ecx, dword [0x10012044]
xor edx, edx
div ecx
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x7c]
jb 0x100c2132
xor ebx, ebx
test ebx, ebx
jne 0x100c21e9
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x74], eax
xor ebx, ebx
push 0x40
inc ebx
push 0x1000
push dword [ebp - 0x80]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x100c235e
push eax
call dword [sym.imp.kernel32.dll_Sleep]
cmp ebx, 0x11
jb 0x100c217b
xor ebx, ebx
cmp dword [0x1011fbc8], ebx
ja 0x100c21b4
test ebx, 3
je 0x100c21c8
test ebx, ebx
je 0x100c21c6
push 0x8000
push 0
push ebx
call dword [sym.imp.kernel32.dll_VirtualFree]
xor ebx, ebx
push dword [ebp - 0x74]
call dword [sym.imp.kernel32.dll_SetLastError]
test ebx, ebx
je 0x100c20d2
mov ecx, dword [ebp - 0x80]
mov eax, ebx
test ecx, ecx
je 0x100c21e9
mov byte [eax], 0
inc eax
dec ecx
jne 0x100c21e2
mov eax, 0xf6140860
mov eax, dword [esi + 4]
and eax, 7
lea eax, [eax + esi + 8]
mov esi, dword [esi]
shr esi, 1
and esi, edi
lea ecx, [esi + eax]
mov edi, 0x10000000
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x70], eax
mov eax, dword [0x1007b9bc]
sub eax, esi
mov dword [ebp - 0x74], ecx
lea ecx, [eax + 1]
sub dword [ebp - 0x84], edi
xor eax, eax
test ecx, ecx
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0x64], ecx
je 0x100c225b
mov edx, dword [0x1012ee38]
shr dword [ebp - 0x64], 0x10
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x1012ee38], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x64], 0
jne 0x100c2231
xor edx, edx
div ecx
add ebx, edx
push ebx
push esi
push dword [ebp - 0x84]
mov dword [ebp - 0xc8], ebx
mov eax, 0xd8089628
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x70]
add esp, 0xc
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0xf0], ecx
test esi, esi
mov ebx, 0xfffff000
mov byte [ebp - 0x55], 0
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0x80], eax
je 0x100c29a2
lea eax, [ebp - 0xf0]
push eax
mov eax, 0x4b8e3fb3
mov esi, dword [0x1001256c]
mov eax, 0xfffffff
mov edx, dword [ebp - 0xec]
and dword [ebp - 0x60], 0
and dword [ebp - 0x5c], 0
pop ecx
mov ecx, dword [ebp - 0xf0]
and edx, eax
mov dword [ebp - 0x68], edx
and ecx, eax
add ecx, edi
mov dword [ebp - 0x64], ecx
mov eax, edi
sub eax, esi
mov dword [ebp - 0xf8], eax
jne 0x100c2365
xor edi, edi
test edx, edx
jbe 0x100c25ad
mov esi, 0x7fffffff
mov ecx, 0x69bf6243
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax + edi]
mov edx, ecx
add eax, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc edi
mov dword [ebp - 0x5c], eax
cmp edi, dword [ebp - 0x68]
jb 0x100c2303
jmp 0x100c25ad
mov ebx, dword [0x1007b9bc]
imul ebx, edx
lea ebx, [ebx + section..data]
jmp 0x100c216c
mov ebx, eax
jmp 0x100c21a4
lea eax, [ecx + edx]
mov edx, dword [0x1000003c]
lea edx, [edx + 0x100000a0]
sub ecx, edi
mov esi, dword [edx + 4]
mov dword [ebp - 0x6c], eax
mov eax, dword [edx]
add eax, edi
mov edx, ecx
mov edi, ecx
and edx, ebx
sub edi, edx
mov dword [ebp - 0x78], edi
mov edi, dword [ebp - 0x68]
add ecx, edi
mov edi, ecx
and edi, ebx
add esi, eax
mov ebx, eax
sub ecx, edi
mov dword [ebp - 0xe4], edi
cmp eax, esi
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], esi
je 0x100c23bf
cmp dword [ebx], edx
jae 0x100c23bf
add ebx, dword [ebx + 4]
cmp ebx, dword [ebp - 0xdc]
jne 0x100c23b0
and dword [ebp - 0xd4], 0
cmp ebx, dword [ebp - 0xdc]
je 0x100c23fd
cmp dword [ebx], edx
jne 0x100c23fd
mov ecx, dword [ebx + 4]
sub ecx, 8
shr ecx, 1
je 0x100c23fd
lea eax, [ebx + 8]
movzx edx, word [eax]
and edx, 0xfff
cmp edx, dword [ebp - 0x78]
jae 0x100c23fd
inc dword [ebp - 0xd4]
inc eax
inc eax
cmp dword [ebp - 0xd4], ecx
jne 0x100c23df
mov esi, 0x7fffffff
mov ecx, 0x69bf6243
mov edi, dword [ebp - 0x64]
cmp ebx, dword [ebp - 0xdc]
je 0x100c2562
mov eax, dword [ebp - 0xe4]
cmp dword [ebx], eax
ja 0x100c2562
mov eax, dword [ebx + 4]
lea edx, [eax - 8]
shr edx, 1
mov eax, dword [ebp - 0xd4]
cmp eax, edx
jne 0x100c245c
add ebx, dword [ebx + 4]
cmp ebx, dword [ebp - 0xdc]
je 0x100c2562
mov eax, dword [ebp - 0xe4]
cmp dword [ebx], eax
ja 0x100c2562
and dword [ebp - 0xd4], 0
jmp 0x100c2424
mov edx, dword [ebp - 0xe4]
cmp dword [ebx], edx
jne 0x100c247c
movzx eax, word [ebx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xe0]
jae 0x100c2562
mov edx, 0xf000
mov eax, dword [ebp - 0xd4]
inc dword [ebp - 0xd4]
test word [ebx + eax*2 + 8], dx
je 0x100c240a
mov edx, dword [ebx]
movzx eax, word [ebx + eax*2 + 8]
and dword [ebp - 0x64], 0
and eax, 0xfff
lea eax, [eax + edx + 0x10000000]
mov dword [ebp - 0x68], eax
sub dword [ebp - 0x68], edi
mov dword [ebp - 0x78], eax
je 0x100c2501
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax + edi]
add eax, ecx
add dword [ebp - 0x60], eax
mov edx, ecx
add eax, dword [ebp - 0x5c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc dword [ebp - 0x64]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x68]
jb 0x100c24ba
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf4], eax
xor edi, edi
mov edx, ecx
movzx eax, byte [ebp + edi - 0xf4]
add eax, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc edi
cmp edi, 4
mov dword [ebp - 0x5c], eax
jb 0x100c2514
mov edi, dword [ebp - 0x78]
add edi, 4
jmp 0x100c240a
mov eax, dword [ebp - 0x6c]
xor ebx, ebx
sub eax, edi
mov dword [ebp - 0x6c], eax
je 0x100c25ad
mov edx, ecx
movzx eax, byte [edi + ebx]
add eax, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
inc ebx
cmp ebx, dword [ebp - 0x6c]
jb 0x100c256e
xor edi, edi
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x60]
mov byte [ebp + eax - 0x54], cl
inc eax
cmp eax, 0x10
jb 0x100c25b1
mov eax, 0x21de154a
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [0x10120760]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x108], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x138], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x124], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x110], ecx
lea ecx, [ebp - 0x44]
sub eax, ecx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0xc8]
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x6c], eax
lea edi, [ebp - 0xc4]
lea esi, [ebp - 0x138]
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x78], 2
lea edi, [edx + esi]
mov ebx, dword [ebp - 0xc0]
rol edi, 7
xor eax, edi
lea edi, [esi + eax]
rol edi, 9
xor ecx, edi
lea edi, [ecx + eax]
rol edi, 0xd
xor edx, edi
lea edi, [ecx + edx]
ror edi, 0xe
xor esi, edi
mov edi, dword [ebp - 0xb0]
add ebx, edi
rol ebx, 7
xor dword [ebp - 0xa0], ebx
mov ebx, dword [ebp - 0xa0]
add edi, ebx
rol edi, 9
xor dword [ebp - 0x90], edi
mov edi, ebx
mov ebx, dword [ebp - 0x90]
add ebx, edi
mov edi, dword [ebp - 0x90]
rol ebx, 0xd
xor dword [ebp - 0xc0], ebx
mov ebx, dword [ebp - 0xc0]
add edi, ebx
ror edi, 0xe
mov ebx, dword [ebp - 0x9c]
xor dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0xac]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x8c], edi
mov edi, ebx
mov ebx, dword [ebp - 0x8c]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xbc], edi
mov edi, ebx
mov ebx, dword [ebp - 0xbc]
add ebx, edi
mov edi, dword [ebp - 0xbc]
rol ebx, 0xd
xor dword [ebp - 0xac], ebx
mov ebx, dword [ebp - 0xac]
add edi, ebx
mov ebx, dword [ebp - 0x88]
ror edi, 0xe
xor dword [ebp - 0x9c], edi
mov edi, dword [ebp - 0x98]
add edi, ebx
rol edi, 7
xor dword [ebp - 0xb8], edi
mov edi, ebx
mov ebx, dword [ebp - 0xb8]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xa8], edi
mov edi, ebx
mov ebx, dword [ebp - 0xa8]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xa8]
xor dword [ebp - 0x98], ebx
mov ebx, dword [ebp - 0x98]
add edi, ebx
ror edi, 0xe
xor dword [ebp - 0x88], edi
mov edi, dword [ebp - 0xb8]
add edi, esi
rol edi, 7
xor dword [ebp - 0xc0], edi
mov edi, dword [ebp - 0xc0]
add edi, esi
rol edi, 9
xor dword [ebp - 0xbc], edi
mov ebx, dword [ebp - 0xbc]
mov edi, dword [ebp - 0xc0]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xbc]
xor dword [ebp - 0xb8], ebx
mov ebx, dword [ebp - 0xb8]
add ebx, edi
mov edi, dword [ebp - 0xb0]
add edi, eax
ror ebx, 0xe
xor esi, ebx
rol edi, 7
xor dword [ebp - 0xac], edi
mov edi, dword [ebp - 0xb0]
mov ebx, dword [ebp - 0xac]
add ebx, edi
mov edi, dword [ebp - 0xac]
rol ebx, 9
xor dword [ebp - 0xa8], ebx
mov ebx, dword [ebp - 0xa8]
add ebx, edi
rol ebx, 0xd
xor eax, ebx
mov ebx, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xa8]
add edi, eax
ror edi, 0xe
xor dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0x9c]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x98], edi
mov ebx, dword [ebp - 0x98]
mov edi, dword [ebp - 0x9c]
add ebx, edi
rol ebx, 9
xor ecx, ebx
mov edi, dword [ebp - 0x98]
add edi, ecx
rol edi, 0xd
mov ebx, dword [ebp - 0x8c]
xor dword [ebp - 0xa0], edi
mov edi, dword [ebp - 0xa0]
add edi, ecx
ror edi, 0xe
xor dword [ebp - 0x9c], edi
mov edi, dword [ebp - 0x88]
add edi, ebx
rol edi, 7
xor edx, edi
mov edi, dword [ebp - 0x88]
add edi, edx
rol edi, 9
xor dword [ebp - 0x90], edi
mov edi, dword [ebp - 0x90]
add edi, edx
rol edi, 0xd
xor dword [ebp - 0x8c], edi
mov edi, dword [ebp - 0x90]
mov ebx, dword [ebp - 0x8c]
add ebx, edi
ror ebx, 0xe
xor dword [ebp - 0x88], ebx
dec dword [ebp - 0x78]
jne 0x100c268f
mov dword [ebp - 0x94], edx
push 0x40
xor edx, edx
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xc4], esi
xor eax, eax
pop ebx
mov ecx, dword [ebp + eax - 0x138]
add dword [ebp + eax - 0xc4], ecx
add eax, 4
cmp eax, ebx
jl 0x100c2901
inc dword [ebp - 0x118]
lea esi, [ebp - 0xc4]
push 0x10
lea edi, [ebp - 0x44]
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xcc], ebx
jbe 0x100c2965
mov esi, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
lea edi, [esi + eax]
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + edi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
mov byte [ecx + esi], al
inc edx
cmp edx, ebx
jb 0x100c293b
sub dword [ebp - 0xcc], ebx
add dword [ebp - 0x7c], ebx
add esi, ebx
add dword [ebp - 0x80], ebx
mov dword [ebp - 0x68], esi
jmp 0x100c265f
cmp dword [ebp - 0xcc], edx
jbe 0x100c2992
lea eax, [ebp - 0x44]
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x80]
sub esi, eax
sub edi, eax
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + esi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
mov byte [ecx + edi], al
inc edx
cmp edx, dword [ebp - 0xcc]
jb 0x100c297a
mov ebx, 0xfffff000
mov esi, dword [ebp - 0xd0]
mov edi, 0x10000000
mov eax, dword [ebp - 0x74]
mov al, byte [eax + 8]
xor al, byte [ebp - 0x55]
je 0x100c2a3a
call fcn.10023238
mov edi, eax
mov edx, 0xffff
mov eax, dword [ebp - 0xe8]
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0x100f1b6e
and ecx, 0xfffffffc
lea esi, [ecx + 0xfff]
and edi, ebx
and esi, ebx
xor eax, eax
mov ebx, dword [0x1012ee38]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x1012ee38], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x100c29dc
mov ebx, 0xffff
div ebx
inc edx
mov dword [ebp - 0x150], edi
cmp ecx, esi
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x6c], 0
mov eax, ecx
jae 0x100c2a30
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
add eax, 4
cmp eax, esi
jb 0x100c2a24
mov eax, 0x100f1b6e
jmp 0x100c2b1c
mov eax, dword [ebp - 0x70]
mov ecx, dword [0x1001256c]
sub eax, dword [ebp - 0xc8]
sub edi, ecx
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x74], edi
jne 0x100c2a5e
test eax, eax
je 0x100c2b0c
mov eax, dword [ebp - 0x84]
mov edi, dword [ebp - 0xc8]
mov ecx, dword [0x10103928]
sub edi, dword [ebp - 0x70]
add eax, esi
mov dword [ebp - 0x6c], eax
xor esi, esi
dec ecx
js 0x100c2aa8
lea eax, [esi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x1010392c]
and edx, 0xfffffff
cmp dword [ebp - 0x84], edx
jae 0x100c2a9f
lea ecx, [eax - 1]
jmp 0x100c2aa4
jbe 0x100c2aac
lea esi, [eax + 1]
cmp ecx, esi
jge 0x100c2a7d
mov ebx, esi
jmp 0x100c2b04
mov ebx, eax
jmp 0x100c2b04
mov eax, dword [ebx*4 + 0x1010392c]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x6c]
jae 0x100c2b0c
lea esi, [ecx + edi + 0x10000000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x100c2af4
dec ecx
je 0x100c2aec
dec ecx
jne 0x100c2afd
mov edx, dword [ebp - 0x74]
jmp 0x100c2afd
mov edx, dword [ebp - 0xd0]
jmp 0x100c2afd
mov edx, dword [ebp - 0x74]
sub edx, dword [ebp - 0xd0]
dec eax
dec eax
jne 0x100c2b03
add dword [esi], edx
inc ebx
cmp ebx, dword [0x10103928]
jb 0x100c2ab0
mov eax, dword [0x1007b9bc]
mov eax, 0xc6072ca2
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx + 8], eax
mov ebx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x144]
mov edi, dword [ebp - 0x140]
mov esi, dword [ebp - 0x13c]
mov esp, ebp
pop ebp
popfd
ret