Function at 0x10006d8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030603
mov eax, dword fs:[0]
push eax
mov eax, 0x1064
call fcn.1002e640
push ebx
push esi
push edi
mov eax, dword [0x10039030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0x4f90
mov dword [ebp - 0x18], 0x6640
mov dword [ebp - 0x18], 0x4990
mov dword [ebp - 0x18], 0x7851
mov dword [ebp - 0x10], 0x4879
mov dword [ebp - 0x20], 0x684d
mov dword [ebp - 0x18], 0x1593
mov dword [ebp - 0x1c], 0x7f2b
mov dword [ebp - 0x14], 0x6718
mov dword [ebp - 0x24], 0x1667
mov dword [ebp - 0x10], 0x13a9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
and eax, edx
or ecx, eax
mov eax, dword [ebp - 0x10]
add eax, 0x680c
or ecx, eax
mov dword [ebp - 0x10], ecx
push str.EnumProcesses
lea ecx, [ebp - 0x54]
call fcn.10022d10
xor edi, edi
mov eax, 0x10033e44
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], edi
call fcn.10015c70
mov byte [ebp - 4], 1
cmp dword [ebp - 0x58], 8
mov eax, dword [ebp - 0x6c]
jae 0x10006e5a
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x38], esi
jne 0x10006e7c
or dword [ebp - 0x28], 0xffffffff
push 0x10036050
lea eax, [ebp - 0x28]
push eax
call fcn.1000e891
cmp dword [ebp - 0x3c], 0x10
mov eax, dword [ebp - 0x50]
jae 0x10006e88
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
mov dword [ebp - 0x34], eax
jne 0x10006ea8
mov dword [ebp - 0x2c], 0xfffffffe
push 0x10036050
lea eax, [ebp - 0x2c]
jmp 0x10006e76
lea ecx, [ebp - 0x30]
push ecx
push 0x1000
lea ecx, [ebp - 0x1070]
push ecx
mov byte [ebp - 4], 2
call eax
mov ebx, eax
neg ebx
sbb bl, bl
push esi
inc bl
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
push 1
lea esi, [ebp - 0x70]
call fcn.100161cc
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x54]
call fcn.10007145
test bl, bl
je 0x10006f07
mov dword [ebp - 0x10], 0x53d4
mov dword [ebp - 0x10], 0x2dce
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x64ca
jmp 0x1000700b
mov dword [ebp - 0x10], 0x4d33
mov dword [ebp - 0x14], 0x27cb
mov dword [ebp - 0x10], 0x3561
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
imul eax, ecx
xor eax, 0x512c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 0x621f
mov dword [ebp - 0x14], 0xdc8
mov dword [ebp - 0x10], 0x7b31
mov dword [ebp - 0x24], 0x436
mov dword [ebp - 0x20], 0x4e1c
mov dword [ebp - 0x1c], 0x777b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
imul eax, ecx
mov ecx, dword [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
imul ecx, ecx, 0x2e7f
xor ecx, edx
shr esi, 2
or eax, ecx
cmp esi, edi
mov dword [ebp - 0x10], eax
jbe 0x10006fe9
mov dword [ebp - 0x10], 0x311d
mov dword [ebp - 0x14], 0x7b99
mov dword [ebp - 0x10], 0x568c
mov dword [ebp - 0x24], 0x242c
mov dword [ebp - 0x20], 0x36d1
mov dword [ebp - 0x1c], 0x784
mov dword [ebp - 0x18], 0x49f8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
and eax, edx
xor ecx, eax
mov eax, dword [ebp - 0x18]
push dword [ebp + edi*4 - 0x1070]
add eax, 0x4b62
xor ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.10016865
inc edi
cmp edi, esi
pop ecx
jb 0x10006f82
mov dword [ebp - 0x10], 0x6aba
mov dword [ebp - 0x14], 0x1987
mov dword [ebp - 0x10], 0x6603
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
xor eax, ecx
xor eax, 0xb78
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret