Function at 0x10017488
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x37c], eax
call fcn.10017073
xor esi, esi
test al, al
jne 0x100174c7
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [0x1008f098]
push esi
push esi
call dword [0x1008f09c]
mov edi, dword [0x100c97a0]
mov eax, edi
imul eax, edi
imul eax, edi
push 0xc
cdq
pop ecx
idiv ecx
cmp edx, 2
jne 0x100174f0
mov ebx, esi
mov esi, edi
inc ebx
dec esi
cmp ebx, 0xda
jb 0x100174e4
xor esi, esi
mov eax, dword [ebp - 0x37c]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10017536
push 0xc1
call dword [0x1008f130]
mov ecx, dword [0x100c97a0]
push 0x14
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
cmp edx, 3
jne 0x100177c9
push esi
push esi
push esi
push esi
push esi
call dword [0x1008f094]
jmp 0x100177c9
mov ebx, dword [eax + 0x3c]
add ebx, eax
mov dword [ebp - 0x378], ebx
cmp dword [ebx], 0x4550
je 0x10017594
push 0xc1
call dword [0x1008f130]
call fcn.10017073
test al, al
jne 0x100177c9
mov eax, dword [0x100c97a0]
mov ecx, eax
sub ecx, esi
je 0x10017585
dec ecx
je 0x1001757a
inc eax
mov dword [0x100c97a0], eax
jmp 0x100177c9
mov dword [0x100c97a0], esi
jmp 0x100177c9
mov dword [0x100c97a0], 2
jmp 0x100177c9
push 0x10090f4c
call dword [0x1008f0c8]
push str.VirtualAlloc
push eax
call dword [0x1008f0b4]
mov edi, eax
mov dword [ebp - 0x374], edi
test edi, edi
je 0x100177c9
push 4
push 0x3000
push dword [ebx + 0x50]
push dword [ebx + 0x34]
call edi
mov dword [ebp - 0x370], eax
test eax, eax
jne 0x100175f8
push 4
push 0x3000
push dword [ebx + 0x50]
push esi
call edi
mov dword [ebp - 0x370], eax
test eax, eax
jne 0x100175f8
push 0xe
call dword [0x1008f130]
jmp 0x100177c9
push 0x24
push esi
call dword [0x1008f12c]
push eax
call dword [0x1008f1d0]
mov edi, eax
test edi, edi
jne 0x1001762e
push 0xe
call dword [0x1008f130]
mov ecx, dword [ebp - 0x370]
push 0x8000
push esi
push ecx
call dword [0x1008f11c]
jmp 0x100177c9
mov ecx, dword [ebp - 0x370]
mov dword [edi + 4], ecx
mov dword [edi + 0xc], esi
mov dword [edi + 8], esi
mov edx, dword [0x100c97a0]
push 0xf
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
pop ecx
idiv ecx
xor eax, eax
inc eax
cmp edx, 0xc
jne 0x10017678
push 0xb
mov ebx, eax
pop edx
dec edx
lea ecx, [eax + ebx]
lea ebx, [eax]
mov eax, ecx
jns 0x10017662
mov ebx, dword [ebp - 0x378]
mov dword [0x100c97a0], ecx
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 0x14]
push 4
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
push 0x1000
mov dword [edi + 0x10], esi
mov dword [edi + 0x20], eax
push dword [ebx + 0x54]
push dword [ebp - 0x370]
call dword [ebp - 0x374]
mov ecx, dword [0x100c97a0]
mov edx, ecx
imul edx, ecx
imul edx, ecx
mov dword [ebp - 0x378], eax
and edx, 0x80000007
jns 0x100176ca
dec edx
or edx, 0xfffffff8
inc edx
cmp edx, 6
jne 0x100176df
call fcn.10070af8
mov dword [0x100c97a0], eax
mov eax, dword [ebp - 0x378]
push dword [ebx + 0x54]
push dword [ebp - 0x37c]
push eax
call fcn.1006fdb0
mov ecx, dword [0x100c97a0]
add esp, 0xc
lea eax, [ecx + 2]
inc ecx
imul eax, ecx
mov ecx, dword [0x100c97a0]
imul eax, ecx
cdq
mov dword [ebp - 0x374], 0x16
idiv dword [ebp - 0x374]
cmp edx, 0xb
jne 0x1001772b
push 1
test ecx, ecx
pop eax
cmove ecx, eax
mov dword [0x100c97a0], ecx
mov edx, dword [ebp - 0x37c]
mov ecx, dword [ebp - 0x370]
mov eax, dword [edx + 0x3c]
add eax, dword [ebp - 0x378]
push edi
push ebx
mov dword [edi], eax
push edx
mov dword [eax + 0x34], ecx
call fcn.10016b39
mov eax, dword [ebp - 0x370]
sub eax, dword [ebx + 0x34]
add esp, 0xc
mov dword [ebp - 0x374], eax
call fcn.100170bd
test al, al
jne 0x1001776e
inc dword [0x100c97a0]
mov eax, dword [ebp - 0x374]
test eax, eax
je 0x10017781
push eax
push edi
call fcn.10016d38
pop ecx
pop ecx
push edi
call fcn.1001695f
pop ecx
test eax, eax
je 0x100177c2
push edi
call fcn.10016c4f
push edi
call fcn.10016bef
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
pop ecx
test eax, eax
je 0x1001781a
mov ecx, dword [ebp - 0x370]
push esi
xor ebx, ebx
inc ebx
push ebx
add eax, ecx
push ecx
call eax
test eax, eax
jne 0x100177da
push 0x45a
call dword [0x1008f130]
push edi
call fcn.100170df
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007048b
leave
ret
mov dword [edi + 0x10], ebx
mov ebx, dword [0x100c97a0]
mov eax, ebx
imul eax, ebx
push 0x18
cdq
pop ecx
idiv ecx
cmp edx, 2
jne 0x1001781a
push 8
mov ecx, esi
pop edx
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor ecx, eax
dec edx
jne 0x100177f8
add ebx, ecx
inc esi
cmp esi, 0x100
jl 0x100177f3
mov dword [0x100c97a0], ebx
mov eax, edi
jmp 0x100177cb