Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
lea ecx, [eax - 0x41f]
push edi
mov edi, dword [esp + 0x38]
lea ebx, [eax - 0xb71]
mov ebp, 0x1a86
mov dword [esp + 0x40], ecx
lea edx, [eax - 0x24b5]
mov dword [esp + 0x18], ebx
xor edi, ebp
mov dword [esp + 0x44], edx
add esi, 0xb4
mov dword [esp + 0x38], edi
add eax, 0xfffff816
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
cmp ecx, ebx
jl 0x10001077
mov ebx, dword [0x10247e84]
xor edi, ebp
mov ebp, dword [esp + 0x3c]
mov eax, dword [ebp + 0x1c]
add eax, dword [0x10280b14]
xor eax, 0x1719dfb8
mov dword [0x10280ac8], eax
jmp 0x10001210
mov ebp, dword [esp + 0x3c]
imul eax, dword [ebp + 0xc8], 0x1bd4
xor eax, 0x2096
cmp dword [0x10280b28], eax
jae 0x10001176
mov edx, ebx
mov dword [esp + 0x10], edi
mov ebx, dword [0x10247e84]
imul edx, esi
mov eax, dword [ebx + 0x38]
xor eax, edx
mov dword [esp + 0x2c], edx
cmp edi, eax
jb 0x10001210
mov ecx, dword [esp + 0x44]
mov edi, esi
mov eax, edi
and eax, 0x1805
mov dword [esp + 0x20], eax
imul eax, ecx, 0x21e2
mov dword [esp + 0x24], eax
lea eax, [ecx + 0x1ee7]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x50]
sub eax, edi
add eax, ecx
add dword [0x10280b74], eax
mov eax, dword [ebx + 0xc4]
mov ecx, dword [ebp + 0xc0]
xor eax, dword [ebp + 0x128]
or ecx, dword [esp + 0x44]
mov edx, dword [ebx + 0x80]
sub edx, dword [ebx + 0xd4]
mov esi, dword [ebp + 0x64]
xor esi, dword [esp + 0x18]
push ebp
push eax
push ecx
push dword [esp + 0x2c]
sub esi, edi
push edx
push dword [esp + 0x38]
push esi
call fcn.10004a52
mov dword [esp + 0x38], eax
add esp, 0x1c
mov eax, edi
sub eax, dword [0x10280b5c]
or eax, 0x23d7
push eax
mov eax, dword [ebp + 4]
imul eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, dword [0x10247e84]
mov ecx, dword [esp + 0x10]
add ecx, 4
mov dword [esp + 0x10], ecx
mov eax, dword [ebx + 0x38]
xor eax, dword [esp + 0x2c]
cmp ecx, eax
mov ecx, dword [esp + 0x44]
jae 0x100010db
mov esi, dword [esp + 0x14]
jmp 0x10001208
mov ebx, dword [0x10247e84]
mov dword [esp + 0x14], edi
mov eax, dword [ebx + 0xc4]
and eax, esi
cmp edi, eax
je 0x10001210
xor ecx, 0x1d71
lea eax, [edx + edi]
mov edi, dword [esp + 0x40]
add ecx, 0x2096
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [0x10280ba0]
and eax, edx
push eax
mov eax, dword [0x10280b78]
xor eax, dword [0x10280b4c]
xor eax, dword [esp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
imul eax, edi
push eax
mov eax, dword [0x10280adc]
xor eax, esi
xor eax, dword [ebp + 0x84]
push ecx
push eax
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [0x10247e84]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x44]
add ecx, 2
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0xc4]
and eax, esi
cmp ecx, eax
mov ecx, dword [esp + 0x28]
jne 0x100011ab
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov eax, edi
xor eax, 0xdbd
cmp esi, eax
jl 0x10001260
mov eax, dword [ebp + 0x4c]
xor edi, 0x393
mov edx, dword [esp + 0x1c]
add eax, 0xd9947
xor dword [ebx + 0x7c], eax
lea eax, [esi + 0x68e]
push ebp
push edi
push eax
lea eax, [edx - 0x2f9]
push eax
lea eax, [edx + 0x2de]
push eax
mov eax, ecx
xor eax, 0x3983
push eax
lea eax, [ecx - 0x325]
push eax
call fcn.10004a52
add esp, 0x1c
mov edi, eax
lea eax, [edi - 0xaa7]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret