Function at 0x1000410e
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [eax - 0x6c4]
lea esi, [eax - 0x2096]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add edi, 0xfffff5fb
mov dword [esp + 0xc], esi
lea edx, [eax - 0x7d0]
lea ebp, [eax - 0x2114]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x24]
add eax, 0x7c
mov dword [esp + 0x18], eax
mov eax, edi
xor eax, 0x354
cmp edx, eax
je 0x10004682
lea eax, [esi + 0x1915]
push ebx
cmp ebp, eax
jg 0x10004527
mov esi, dword [esp + 0x30]
xor ebp, ebp
mov ebx, ebp
mov eax, dword [0x10247e84]
mov ecx, dword [esi + 0xfc]
push 0x3c
mov eax, dword [eax + 0x90]
mov edx, dword [ebx + eax]
add ebx, 4
mov eax, dword [esi + 0x88]
sub eax, ecx
add ecx, 0xffebdbfc
add eax, 0x5b6bb
xor dword [esi + 4], eax
mov eax, dword [esi + 0xa0]
add eax, ecx
or dword [0x10280b68], eax
mov eax, dword [esi + 0xa0]
sub eax, 0x11174
xor dword [0x10280acc], eax
mov eax, dword [0x10247e84]
mov ecx, dword [esi + 0x48]
mov eax, dword [eax + 0x2c]
sub eax, 0xb5ec2
imul eax, dword [esi + 0xdc]
mov dword [esi + 0xdc], eax
movzx eax, dl
movzx edx, byte [esi + 0x44]
imul edx, eax
mov eax, dword [esi + 0x9c]
mov byte [ecx + eax], dl
inc dword [esi + 0x48]
mov eax, dword [esi + 0xa0]
sub eax, 0x11174
add dword [esi + 0x88], eax
mov ecx, dword [0x10247e84]
mov eax, dword [esi + 0x110]
add eax, dword [0x10280bd0]
xor eax, 8
add dword [ecx + 0x4c], eax
mov eax, dword [esi + 0x108]
sub eax, 7
imul eax, dword [esi + 0xbc]
mov dword [esi + 0xbc], eax
mov ecx, dword [0x10247e84]
mov eax, dword [0x10280ba4]
add eax, 0xfff94111
imul eax, dword [ecx + 0x38]
mov dword [ecx + 0x38], eax
mov edx, dword [0x10247e84]
mov eax, dword [esi + 0xf4]
add eax, 0xffefb1e2
add eax, dword [edx + 0xb0]
imul eax, dword [edx + 0xec]
mov dword [edx + 0xec], eax
pop eax
sub eax, dword [esi + 0x98]
add dword [esi + 0x110], eax
cmp ebx, 0x38340
jl 0x1000417a
mov eax, dword [esi + 0xb0]
xor eax, dword [0x10280bac]
xor eax, 0x2eb38f44
cmp dword [esi + 0x1c], 0x17904
mov dword [esi + 0x44], eax
je 0x100042b5
mov dword [esi + 0x90], 0x10005050
mov ebx, ebp
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0xfc]
add ecx, dword [esi + 0x38]
mov edx, dword [ebx + eax]
add ebx, 4
mov eax, dword [0x10280b38]
add eax, 0xffeced6f
add eax, ecx
mov dword [0x10280b38], eax
mov eax, dword [esi + 0x7c]
sub eax, 0x138b43
imul eax, dword [0x10280b60]
mov dword [0x10280b60], eax
movzx eax, dl
movzx edx, byte [esi + 0x44]
imul edx, eax
mov eax, dword [0x10247e84]
mov ecx, dword [eax + 0x9c]
mov eax, dword [eax + 0x48]
mov byte [ecx + eax], dl
mov eax, dword [0x10247e84]
inc dword [eax + 0x48]
mov eax, dword [0x10280b44]
mov edx, dword [esi + 0xc8]
add eax, 0xffec74bc
mov ecx, dword [esi + 0x38]
add eax, edx
add dword [esi + 0x110], eax
xor ecx, edx
mov eax, 0x104df6
sub eax, dword [esi + 0xb0]
add dword [esi + 0x2c], eax
mov eax, dword [0x10280b38]
dec eax
add eax, ecx
mov dword [0x10280b38], eax
mov eax, dword [0x10247e84]
mov eax, dword [eax + 0xe4]
xor eax, 0x12d9ed
or dword [esi + 0x124], eax
mov eax, dword [0x10247e84]
mov eax, dword [eax + 0xec]
imul eax, dword [esi + 0xfc]
mov dword [esi + 0xfc], eax
mov eax, dword [0x10280af4]
xor eax, 0xb5ec3
add dword [esi + 0xe4], eax
mov eax, dword [0x10280bac]
mov ecx, dword [0x10247e84]
add eax, 0xe8ef4398
add eax, dword [0x10280ae4]
mov dword [0x10280bac], eax
mov eax, 0x1710bc68
sub eax, dword [ecx + 0x1c]
add dword [0x10280bb4], eax
mov eax, dword [ecx + 0xa0]
add eax, dword [0x10280ae4]
xor eax, dword [ecx + 0xfc]
xor eax, 0x1711cddc
mov dword [ecx + 0xfc], eax
mov eax, 0x6bef0
sub eax, dword [esi + 0xdc]
add dword [0x10280b44], eax
cmp ebx, 0x28260
jl 0x100042b7
mov eax, dword [0x10247e84]
mov ecx, dword [esi + 0xc8]
add ecx, 0xcad
mov dword [eax + 0x44], ecx
mov eax, 0x12cd41
mov ecx, dword [0x10247e84]
sub eax, dword [0x10280b38]
sub eax, dword [esi + 0xe4]
add dword [ecx + 0x44], eax
mov dword [esi + 0x90], 0x101b1d38
mov eax, dword [0x10280b68]
mov ecx, dword [0x10247e84]
add eax, 0xfff4a13d
add eax, dword [esi + 0x2c]
mov dword [0x10280b68], eax
mov eax, dword [0x10280b58]
mov edx, dword [eax + ebp]
add ebp, 4
mov eax, dword [esi + 0x108]
add eax, dword [0x10280b14]
xor eax, dword [ecx + 0x10]
xor eax, 0x374f9
mov dword [ecx + 0x10], eax
mov eax, dword [0x10247e84]
mov ebx, dword [esi + 0x44]
imul ebx, edx
mov eax, dword [eax + 0xfc]
sub eax, 0x131290
add dword [esi + 0x10], eax
mov eax, dword [0x10247e84]
mov edx, ebx
shr edx, 0x18
mov ecx, dword [eax + 0x9c]
mov eax, dword [esi + 0x48]
mov byte [ecx + eax], dl
mov edx, ebx
inc dword [esi + 0x48]
mov ecx, dword [0x10247e84]
mov eax, dword [esi + 0x38]
dec eax
shr edx, 0x10
add dword [ecx + 0x2c], eax
mov ecx, dword [0x10247e84]
mov eax, dword [esi + 0x108]
sub eax, dword [esi + 0xbc]
sub eax, 8
or dword [ecx + 0xb0], eax
mov eax, dword [0x10247e84]
mov ecx, dword [eax + 0x9c]
mov eax, dword [esi + 0x48]
mov byte [ecx + eax], dl
mov ecx, ebx
inc dword [esi + 0x48]
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x9c]
shr ecx, 8
mov byte [edx + eax], cl
mov eax, dword [esi + 0xc8]
inc dword [esi + 0x48]
xor eax, 1
imul eax, dword [esi + 0xbc]
mov ecx, dword [esi + 0x48]
mov dword [esi + 0xbc], eax
mov eax, dword [0x10247e84]
mov eax, dword [eax + 0x9c]
mov byte [ecx + eax], bl
inc dword [esi + 0x48]
cmp ebp, 0x50e8
jl 0x10004425
xor edi, 0x4a3
jmp 0x10004681
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0x28]
and eax, dword [esp + 0x1c]
add eax, edi
cmp ecx, eax
jbe 0x10004681
mov eax, esi
or eax, 0x17c5
cmp ecx, eax
jge 0x10004681
mov ecx, dword [ebx + 0x54]
lea eax, [ecx + ebp]
or ecx, edx
push eax
mov eax, dword [esp + 0x20]
sub eax, ebp
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ecx
push eax
mov eax, dword [ebx + 0xa0]
xor eax, dword [esp + 0x20]
sub eax, dword [esp + 0x28]
push eax
mov eax, dword [0x10280bd8]
or eax, edi
push eax
mov eax, dword [ebx + 0x110]
imul eax, ebp
xor eax, 0x2096
push eax
call esi
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
and eax, ebp
add edx, eax
mov eax, dword [ebx + 0xb0]
sub eax, dword [ebx + 0xe4]
add ebp, eax
mov dword [esp + 0x10], edx
mov eax, dword [0x10247e84]
mov ecx, dword [eax + 0x38]
imul ecx, dword [0x10280b60]
xor ecx, dword [eax + 0x80]
add dword [0x10280b68], ecx
mov eax, dword [ebx + 4]
xor eax, 0x3ff3
push eax
mov eax, dword [ebx + 0x98]
xor eax, dword [ebx + 4]
push eax
mov eax, ebp
and eax, 0x2096
push eax
mov eax, dword [ebx + 0x10]
add eax, dword [esp + 0x28]
push eax
mov eax, dword [ebx + 0xb0]
xor eax, edi
add eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0xc8]
add eax, edx
push eax
mov eax, dword [ebx + 0xb4]
or eax, dword [ebx + 0x38]
xor eax, dword [ebx + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x10247e84]
mov ecx, dword [ebx + 0x60]
xor ecx, dword [esp + 0x2c]
or ecx, dword [eax + 0xb0]
mov eax, dword [ebx + 0x7c]
sub eax, dword [esp + 0x2c]
or eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
push eax
mov eax, edi
add ecx, 0x199d
sub eax, ebp
push eax
mov eax, dword [0x10280ae8]
add eax, ecx
push eax
mov eax, dword [ebx + 0xd8]
add eax, edi
push eax
mov eax, dword [0x10280ae0]
add eax, dword [0x10280b80]
push eax
call esi
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x10247e84]
or eax, 0x173b
imul eax, dword [esp + 0x14]
mov ecx, dword [ecx + 0x7c]
and ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebx
xor edi, 0x77b
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
pop ecx
ret