Function at 0x1000c31e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x310
mov eax, dword [esp + 0x318]
mov ecx, dword [esp + 0x314]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push edi
mov edi, str.Hello_World
push edi
xor ebx, ebx
push ebx
mov dword [ecx + 4], eax
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
mov eax, dword [esp + 0x324]
push edi
push ebx
mov dword [eax + 8], ebx
mov dword [eax], 0xc
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push 0x104
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.1000ff40
push str.qGVqGAWPKV_fGQAPKRVMPfCAN
mov dword [esp + 0x20], ebx
call fcn.100100a0
add esp, 0x10
test eax, eax
jbe 0x1000c468
mov eax, dword [esp + 0x10]
mov cl, byte [eax + str.qGVqGAWPKV_fGQAPKRVMPfCAN]
xor cl, 0x22
mov byte [esp + eax + 0x14], cl
inc eax
push str.qGVqGAWPKV_fGQAPKRVMPfCAN
mov dword [esp + 0x14], eax
call fcn.100100a0
cmp dword [esp + 0x14], eax
pop ecx
jb 0x1000c441
lea eax, [esp + 0x118]
push 0x10011694
push eax
call fcn.100105a7
lea eax, [esp + 0x120]
push str.api32.dll
push eax
call fcn.1001057d
add esp, 0x10
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push ebx
mov dword [esp + 0x18], eax
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push edi
push ebx
call esi
push ebx
push ebx
call ebp
push 1
push dword [esp + 0x32c]
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
push dword [esp + 0x334]
call dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x310
ret