Function at 0x1000b470
Capabilities:
Encode data using xor
Encrypt or decrypt data via bcrypt

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [edx]
push esi
mov esi, dword [ebx + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x7c], edi
movups xmmword [esi], xmm0
movups xmm0, xmmword [edx + 0x10]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [edx + 0x20]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [edx + 0x30]
movups xmmword [esi + 0x30], xmm0
movups xmm0, xmmword [edx + 0x40]
movups xmmword [esi + 0x40], xmm0
mov cl, byte [0x1005858c]
cmp cl, 0xc
jb 0x1000b51c
mov eax, dword [edi + 0x14]
movq xmm0, qword [eax]
movq qword [ebp - 0x34], xmm0
mov eax, dword [eax + 8]
mov dword [ebp - 0x2c], eax
jbe 0x1000b53e
sub cl, 0xc
mov esi, 0xc
movzx edi, cl
mov ecx, esi
mov dword [ebp - 0x80], ecx
xor edx, edx
mov eax, esi
div ecx
lea ecx, [ebp - 0x34]
add ecx, edx
mov edx, dword [ebp - 0x7c]
mov eax, dword [edx + 0x14]
mov al, byte [esi + eax]
inc esi
xor byte [ecx], al
mov ecx, dword [ebp - 0x80]
sub edi, 1
jne 0x1000b4f8
mov esi, dword [ebp - 0x38]
jmp 0x1000b53e
movzx eax, cl
xorps xmm0, xmm0
push eax
push dword [edi + 0x14]
lea eax, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
push eax
mov dword [ebp - 0x2c], 0
call fcn.10049810
add esp, 0xc
push 0x100585cc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi]
xor edx, edx
mov ecx, dword [esi + 4]
shrd edi, ecx, 1
shr ecx, 1
cmp byte [0x100584b3], dl
sete dl
mov eax, dword [edx*8 + 0x100585f0]
sub eax, 0x7530
mov dword [ebp - 0x38], eax
mov eax, dword [edx*8 + 0x100585f4]
sbb eax, 0
cmp ecx, eax
jl 0x1000b673
jg 0x1000b58b
cmp edi, dword [ebp - 0x38]
jb 0x1000b673
cmp ecx, dword [edx*8 + 0x100585f4]
jg 0x1000b59f
jl 0x1000b5c3
cmp edi, dword [edx*8 + 0x100585f0]
jb 0x1000b5c3
mov al, byte [0x100584b3]
movzx edx, al
cmp ecx, dword [edx*8 + 0x100585f4]
jg 0x1000b673
jl 0x1000b5c3
cmp edi, dword [edx*8 + 0x100585f0]
jae 0x1000b673
mov edx, dword [edx*4 + 0x100585e4]
test edx, edx
je 0x1000b673
lea ecx, [esi + 8]
mov dword [ebp - 0x78], 0x40
push 0
lea eax, [ecx + 0x34]
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x60], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x34]
movlpd qword [ebp - 0x58], xmm0
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x38]
push eax
push 0x34
push ecx
push 0
push 0
lea eax, [ebp - 0x78]
movlpd qword [ebp - 0x50], xmm0
push eax
push 0x34
push ecx
push edx
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x5c], 0x10
mov dword [ebp - 0x6c], 0xc
call dword [sym.imp.bcrypt.dll_BCryptDecrypt]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
mov ecx, 0x80070000
push 0x100585cc
cmovle ecx, eax
mov dword [ebp - 0x38], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x38]
shr eax, 0x1f
xor al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x100585cc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.100483f7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret