Function at 0x100016c0
Capabilities:
Check for peb beingdebugged flag
Encode data using xor

Disassembly:
mov eax, 0x4134
call fcn.10017510
mov dword [esp + 0xc], 0x227d1eba
mov eax, dword [esp + 0xc]
mov dword [esp + 8], eax
push ebx
mov ebx, edx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
add eax, 0x8fe66e27
shl edx, 0xc
add eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xd872d34d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
and eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
not ecx
and eax, ecx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
shr ecx, 0x13
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
and eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
not ecx
and eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add eax, 0x276778c2
shl ecx, 5
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub eax, 0x3d6eaca5
shl ecx, 9
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
and eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
push esi
push edi
not ecx
mov eax, dword [esp + 0x18]
and eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0xec6f35b4
shl ecx, 3
add eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0xa4493ef8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
shr ecx, 0x10
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], 0x78e49ad
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0x8fe66e27
shl ecx, 0xc
add eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0xd872d34d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
shr ecx, 0x13
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0x276778c2
shl ecx, 5
add eax, ecx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub eax, 0x3d6eaca5
shl ecx, 9
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0xec6f35b4
shl ecx, 3
add eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0xa4493ef8
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
shr ecx, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], 0x296810de
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0x8fe66e27
shl ecx, 0xc
add eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0xd872d34d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
shr ecx, 0x13
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0x276778c2
shl ecx, 5
add eax, ecx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
shl ecx, 9
sub eax, 0x3d6eaca5
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0xec6f35b4
shl ecx, 3
add eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0xa4493ef8
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
shr ecx, 0x10
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], 0x73d905f4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0x8fe66e27
shl ecx, 0xc
add eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0xd872d34d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
shr ecx, 0x13
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0x276778c2
shl ecx, 5
add eax, ecx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub eax, 0x3d6eaca5
shl ecx, 9
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add eax, 0xec6f35b4
shl ecx, 3
add eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0xa4493ef8
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
shr ecx, 0x10
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x1144]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1140]
push str.Hashed_Keys:_0x_08X__0x_08X__0x_08X__0x_08X
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x2140]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x1140]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push eax
push 0x800
lea eax, [esp + 0x2158]
push eax
push esi
call fcn.10001680
add esp, 0x20
lea eax, [esp + 0x2140]
push eax
push dword [esi]
call fcn.10001660
mov ecx, 0x40
lea edi, [esp + 0x40]
mov esi, 0x100275c0
xor edx, edx
rep movsd dword es:[edi], dword [esi]
nop word [eax + eax]
movzx eax, byte [esp + edx + 0x40]
mov byte [esp + 0x29], al
movzx eax, byte [esp + 0x29]
mov byte [esp + 0x29], al
mov eax, edx
and eax, 3
movzx eax, byte [esp + eax*4 + 0x2c]
mov byte [esp + 0x2a], al
movzx eax, byte [esp + 0x2a]
mov byte [esp + 0x2a], al
movzx eax, byte [esp + 0x2a]
movzx ecx, byte [esp + 0x29]
or cl, al
mov byte [esp + 0x2b], cl
movzx eax, byte [esp + 0x2a]
movzx ecx, byte [esp + 0x29]
and cl, al
mov byte [esp + 0x29], cl
movzx eax, byte [esp + 0x29]
not al
and al, byte [esp + 0x2b]
mov byte [esp + 0x2b], al
movzx eax, byte [esp + 0x2b]
mov byte [esp + edx + 0x40], al
inc edx
cmp edx, 0x100
jb 0x10001f20
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x3144]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x3140]
push str.Decode_Buffer:
push str.____ls_n
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x14
lea eax, [esp + 0x140]
push 0x1000
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x3140]
push eax
push 0x800
lea eax, [esp + 0x148]
push eax
push esi
call fcn.10001680
add esp, 0x10
lea eax, [esp + 0x140]
push eax
push dword [esi]
call fcn.10001660
lea eax, [esp + 0x40]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], eax
call fcn.100020f0
call fcn.100015b0
push 0x1000
mov esi, eax
lea eax, [esp + 0x144]
push 0
push eax
call fcn.10004ba0
add esp, 0xc
lea eax, [esp + 0x140]
push 0x10021960
push 0x800
push eax
push esi
call fcn.10001680
add esp, 0x10
lea eax, [esp + 0x140]
push eax
push dword [esi]
call fcn.10001660
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x10002073
jmp 0x10002071
mov esi, dword [esp + 0x4154]
mov eax, dword [esp + 0x414c]
mov ecx, dword [esp + 0x4148]
cmp esi, eax
ja 0x10002099
mov edx, dword [esp + 0x4150]
jb 0x1000209d
cmp edx, ecx
jb 0x1000209d
mov edx, ecx
mov esi, eax
xor ecx, ecx
test esi, esi
jb 0x100020d5
ja 0x100020a9
test edx, edx
je 0x100020d5
mov edi, dword [esp + 0x4158]
sub edi, ebx
sub ebp, ebx
lea eax, [edi + ebx]
inc ecx
movzx eax, al
lea ebx, [ebx + 1]
mov al, byte [esp + eax + 0x40]
xor al, byte [ebx - 1]
mov byte [ebx + ebp - 1], al
xor eax, eax
cmp eax, esi
jb 0x100020b4
ja 0x100020d5
cmp ecx, edx
jb 0x100020b4
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x100020e3
jmp 0x100020e1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4134
ret