Function at 0x1000c100
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jmp 0x1000c121
mov esi, dword [ebp + 0xc]
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x137]
mov byte [ebp - 0x138], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esi + 1]
push eax
mov dword [ebp - 8], eax
call fcn.1002c5d7
mov ebx, eax
mov eax, dword [ebp + 8]
push esi
push eax
push ebx
call fcn.10019400
mov ecx, 0xb
mov esi, str.00210039C00CBFEBFBFF000006FD0000000000000000
lea edi, [ebp - 0x38]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x38]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ebp - 0x540]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push edx
call fcn.1000f920
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x540]
push eax
push ebx
push ecx
call fcn.1000f990
mov al, byte [ebx + 1]
mov dl, byte [ebx]
mov esi, dword [ebp - 4]
add esp, 0x28
cmp al, 1
mov byte [ebp + 0xc], dl
mov edi, 1
jne 0x1000c1b1
mov dword [esi + 0x3c8], edi
cmp byte [ebx + 2], 1
jne 0x1000c1c8
mov ecx, esi
call fcn.100098e0
cmp eax, edi
jne 0x1000c1c8
mov dword [0x10048f34], edi
cmp byte [ebx + 3], 1
jne 0x1000c1d4
mov dword [0x10048f24], edi
cmp byte [ebx + 4], 1
jne 0x1000c1e0
mov dword [0x10048f3c], edi
cmp byte [ebx + 5], 1
jne 0x1000c1fc
push 5
lea ecx, [esi + 0x3dc]
call fcn.1002bfaa
mov ecx, esi
call fcn.1000af30
jmp 0x1000c209
push 0
lea ecx, [esi + 0x3dc]
call fcn.1002bfaa
cmp byte [ebx + 6], 1
jne 0x1000c215
mov dword [0x10048f30], edi
cmp byte [ebx + 7], 1
jne 0x1000c221
mov dword [0x10048f40], edi
cmp byte [ebx + 8], 1
jne 0x1000c22d
mov dword [0x10048f44], edi
cmp byte [ebx + 9], 1
jne 0x1000c239
mov dword [0x10048f48], edi
cmp byte [ebx + 0xa], 1
jne 0x1000c245
mov dword [0x10048f4c], edi
mov al, byte [ebx + 0xb]
test al, al
jne 0x1000c253
mov ecx, esi
call fcn.1000d750
cmp byte [ebx + 0xb], 1
jne 0x1000c260
mov ecx, esi
call fcn.1000d970
cmp byte [ebx + 0xb], 2
jne 0x1000c26d
mov ecx, esi
call fcn.1000d860
cmp byte [ebx + 0xc], 1
jne 0x1000c2b3
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18c], edi
and eax, 0xff
xor ecx, ecx
mov cl, byte [eax + ebx]
lea edi, [eax + ebx]
push ecx
lea edx, [edi + 1]
push edx
push 0x100490a0
call fcn.10019400
mov al, byte [edi]
mov cl, byte [ebp + 0xc]
add esp, 0xc
inc al
add cl, al
mov byte [ebp + 0xc], cl
push 0x100490a0
mov ecx, esi
call fcn.1002bea9
cmp byte [ebx + 0xd], 1
jne 0x1000c304
mov ecx, dword [ebp + 0xc]
xor edx, edx
and ecx, 0xff
mov dl, byte [ecx + ebx]
lea edi, [ecx + ebx]
push edx
lea ecx, [ebp - 0x138]
lea eax, [edi + 1]
push eax
push ecx
call fcn.10019400
mov dl, byte [edi]
mov al, byte [ebp + 0xc]
add esp, 0xc
inc dl
add al, dl
mov byte [ebp + 0xc], al
push 1
push 0
lea eax, [ebp - 0x138]
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, byte [ebx + 0xe]
test al, al
jne 0x1000c387
mov edi, str.NoMove
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.NoMove
push 0x10048f88
call fcn.10019400
mov ecx, dword [ebp + 0xc]
xor edx, edx
and ecx, 0xff
mov dl, byte [ecx + ebx]
lea edi, [ecx + ebx]
push edx
lea eax, [edi + 1]
push eax
push 0x10048f7c
call fcn.10019400
mov cl, byte [edi]
mov al, byte [ebp + 0xc]
inc cl
add al, cl
mov byte [ebp + 0xc], al
xor eax, eax
mov edx, dword [ebp + 0xc]
and edx, 0xff
mov al, byte [edx + ebx]
lea edi, [edx + ebx]
push eax
lea ecx, [edi + 1]
push ecx
push 0x10048f70
call fcn.10019400
mov dl, byte [edi]
mov al, byte [ebp + 0xc]
add esp, 0x24
inc dl
add al, dl
mov byte [ebp + 0xc], al
jmp 0x1000c3d4
mov edi, str.Move
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Move
push 0x10048f88
call fcn.10019400
mov eax, dword [ebp + 0xc]
xor ecx, ecx
and eax, 0xff
mov cl, byte [eax + ebx]
lea edi, [eax + ebx]
push ecx
lea edx, [edi + 1]
push edx
push 0x10049094
call fcn.10019400
mov al, byte [edi]
mov cl, byte [ebp + 0xc]
add esp, 0x18
inc al
add cl, al
mov byte [ebp + 0xc], cl
mov al, byte [ebx + 0xf]
cmp al, 1
mov eax, 1
jne 0x1000c3e5
mov dword [0x10048f50], eax
cmp byte [ebx + 0x10], 1
jne 0x1000c44b
mov ecx, dword [ebp + 0xc]
xor edx, edx
and ecx, 0xff
mov dword [0x10048f54], eax
add esi, 0x64
mov dl, byte [ecx + ebx]
lea edi, [ecx + ebx]
push edx
lea eax, [edi + 1]
push eax
push esi
call fcn.10019400
mov al, byte [edi]
add esp, 0xc
test al, al
jbe 0x1000c437
mov ecx, dword [ebp - 4]
mov eax, esi
mov esi, 0xffffff9c
sub esi, ecx
mov dl, byte [eax]
xor dl, 0xa
mov byte [eax], dl
inc eax
xor edx, edx
mov dl, byte [edi]
lea ecx, [esi + eax]
cmp ecx, edx
jl 0x1000c424
mov al, byte [edi]
mov cl, byte [ebp + 0xc]
mov esi, dword [ebp - 4]
inc al
add cl, al
mov eax, 1
mov byte [ebp + 0xc], cl
cmp byte [ebx + 0x11], 1
jne 0x1000c454
mov dword [esi + 0x5c], eax
cmp byte [ebx + 0x11], 2
jne 0x1000c461
mov dword [esi + 0x5c], 2
cmp byte [ebx + 0x12], 1
jne 0x1000c46c
mov dword [0x10048f58], eax
cmp byte [ebx + 0x13], 1
jne 0x1000c4ab
mov ecx, dword [ebp + 0xc]
xor edx, edx
and ecx, 0xff
mov dword [0x10048f5c], eax
mov dl, byte [ecx + ebx]
lea edi, [ecx + ebx]
push edx
lea eax, [edi + 1]
push eax
push 0x100491a0
call fcn.10019400
mov cl, byte [edi]
mov al, byte [ebp + 0xc]
add esp, 0xc
inc cl
add al, cl
mov byte [ebp + 0xc], al
mov eax, 1
cmp byte [ebx + 0x14], 1
jne 0x1000c4b6
mov dword [0x10048f60], eax
cmp byte [ebx + 0x15], 1
jne 0x1000c4c1
mov dword [0x10048f64], eax
cmp byte [ebx + 0x16], 1
jne 0x1000c4cc
mov dword [0x10048f68], eax
mov edx, dword [ebp + 0xc]
xor ecx, ecx
and edx, 0xff
mov cl, byte [edx + ebx]
lea eax, [edx + ebx]
inc eax
push ecx
push eax
push 0x10048d24
call fcn.10019400
mov edi, 0x10048d24
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000c524
mov dl, 0x87
mov al, byte [esi + 0x10048d24]
mov edi, 0x10048d24
xor al, dl
or ecx, 0xffffffff
mov byte [esi + 0x10048d24], al
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x1000c502
mov ecx, dword [ebp - 8]
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.1002c600
add esp, 4
jmp 0x1000c552
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8