Function at 0x10004105
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [eax - 0x1e6]
lea esi, [eax - 0x8e]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add edi, 0xffffe6eb
mov dword [esp + 0xc], esi
lea edx, [eax - 0x17c5]
lea ebp, [eax + 0x1d8]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x24]
add eax, 0xfffff8a4
mov dword [esp + 0x18], eax
mov eax, edi
xor eax, 0x1915
cmp edx, eax
je 0x1000467b
lea eax, [esi + 0xb71]
push ebx
cmp ebp, eax
jg 0x10004520
mov esi, dword [esp + 0x30]
xor ebp, ebp
mov ebx, ebp
mov eax, dword [0x110102a4]
mov ecx, dword [esi + 0xfc]
push 0x3c
mov eax, dword [eax + 0x90]
mov edx, dword [ebx + eax]
add ebx, 4
mov eax, dword [esi + 0x88]
sub eax, ecx
add ecx, 0xffebdbfc
add eax, 0x5b6bb
xor dword [esi + 4], eax
mov eax, dword [esi + 0xa0]
add eax, ecx
or dword [0x11010348], eax
mov eax, dword [esi + 0xa0]
sub eax, 0x11174
xor dword [0x110102ac], eax
mov eax, dword [0x110102a4]
mov ecx, dword [esi + 0x48]
mov eax, dword [eax + 0x2c]
sub eax, 0xb5ec2
imul eax, dword [esi + 0xdc]
mov dword [esi + 0xdc], eax
movzx eax, dl
movzx edx, byte [esi + 0x44]
imul edx, eax
mov eax, dword [esi + 0x9c]
mov byte [ecx + eax], dl
inc dword [esi + 0x48]
mov eax, dword [esi + 0xa0]
sub eax, 0x11174
add dword [esi + 0x88], eax
mov ecx, dword [0x110102a4]
mov eax, dword [esi + 0x110]
add eax, dword [0x110103b0]
xor eax, 8
add dword [ecx + 0x4c], eax
mov eax, dword [esi + 0x108]
sub eax, 7
imul eax, dword [esi + 0xbc]
mov dword [esi + 0xbc], eax
mov ecx, dword [0x110102a4]
mov eax, dword [0x11010384]
add eax, 0xfff94111
imul eax, dword [ecx + 0x38]
mov dword [ecx + 0x38], eax
mov edx, dword [0x110102a4]
mov eax, dword [esi + 0xf4]
add eax, 0xffefb1e2
add eax, dword [edx + 0xb0]
imul eax, dword [edx + 0xec]
mov dword [edx + 0xec], eax
pop eax
sub eax, dword [esi + 0x98]
add dword [esi + 0x110], eax
cmp ebx, 0x16cb00
jl 0x10004173
mov eax, dword [esi + 0xb0]
xor eax, dword [0x1101038c]
xor eax, 0x2eb38f44
cmp dword [esi + 0x1c], 0x17904
mov dword [esi + 0x44], eax
je 0x100042ae
mov dword [esi + 0x90], 0x10005050
mov ebx, ebp
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0xfc]
add ecx, dword [esi + 0x38]
mov edx, dword [ebx + eax]
add ebx, 4
mov eax, dword [0x11010318]
add eax, 0xffeced6f
add eax, ecx
mov dword [0x11010318], eax
mov eax, dword [esi + 0x7c]
sub eax, 0x138b43
imul eax, dword [0x11010340]
mov dword [0x11010340], eax
movzx eax, dl
movzx edx, byte [esi + 0x44]
imul edx, eax
mov eax, dword [0x110102a4]
mov ecx, dword [eax + 0x9c]
mov eax, dword [eax + 0x48]
mov byte [ecx + eax], dl
mov eax, dword [0x110102a4]
inc dword [eax + 0x48]
mov eax, dword [0x11010324]
mov edx, dword [esi + 0xc8]
add eax, 0xffec74bc
mov ecx, dword [esi + 0x38]
add eax, edx
add dword [esi + 0x110], eax
xor ecx, edx
mov eax, 0x104df6
sub eax, dword [esi + 0xb0]
add dword [esi + 0x2c], eax
mov eax, dword [0x11010318]
dec eax
add eax, ecx
mov dword [0x11010318], eax
mov eax, dword [0x110102a4]
mov eax, dword [eax + 0xe4]
xor eax, 0x12d9ed
or dword [esi + 0x124], eax
mov eax, dword [0x110102a4]
mov eax, dword [eax + 0xec]
imul eax, dword [esi + 0xfc]
mov dword [esi + 0xfc], eax
mov eax, dword [0x110102d4]
xor eax, 0xb5ec3
add dword [esi + 0xe4], eax
mov eax, dword [0x1101038c]
mov ecx, dword [0x110102a4]
add eax, 0xe8ef4398
add eax, dword [0x110102c4]
mov dword [0x1101038c], eax
mov eax, 0x1710bc68
sub eax, dword [ecx + 0x1c]
add dword [0x11010394], eax
mov eax, dword [ecx + 0xa0]
add eax, dword [0x110102c4]
xor eax, dword [ecx + 0xfc]
xor eax, 0x1711cddc
mov dword [ecx + 0xfc], eax
mov eax, 0x6bef0
sub eax, dword [esi + 0xdc]
add dword [0x11010324], eax
cmp ebx, 0x1047f0
jl 0x100042b0
mov eax, dword [0x110102a4]
mov ecx, dword [esi + 0xc8]
add ecx, 0xcad
mov dword [eax + 0x44], ecx
mov eax, 0x12cd41
mov ecx, dword [0x110102a4]
sub eax, dword [0x11010318]
sub eax, dword [esi + 0xe4]
add dword [ecx + 0x44], eax
mov dword [esi + 0x90], 0x10adebf8
mov eax, dword [0x11010348]
mov ecx, dword [0x110102a4]
add eax, 0xfff4a13d
add eax, dword [esi + 0x2c]
mov dword [0x11010348], eax
mov eax, dword [0x11010338]
mov edx, dword [eax + ebp]
add ebp, 4
mov eax, dword [esi + 0x108]
add eax, dword [0x110102f4]
xor eax, dword [ecx + 0x10]
xor eax, 0x374f9
mov dword [ecx + 0x10], eax
mov eax, dword [0x110102a4]
mov ebx, dword [esi + 0x44]
imul ebx, edx
mov eax, dword [eax + 0xfc]
sub eax, 0x131290
add dword [esi + 0x10], eax
mov eax, dword [0x110102a4]
mov edx, ebx
shr edx, 0x18
mov ecx, dword [eax + 0x9c]
mov eax, dword [esi + 0x48]
mov byte [ecx + eax], dl
mov edx, ebx
inc dword [esi + 0x48]
mov ecx, dword [0x110102a4]
mov eax, dword [esi + 0x38]
dec eax
shr edx, 0x10
add dword [ecx + 0x2c], eax
mov ecx, dword [0x110102a4]
mov eax, dword [esi + 0x108]
sub eax, dword [esi + 0xbc]
sub eax, 8
or dword [ecx + 0xb0], eax
mov eax, dword [0x110102a4]
mov ecx, dword [eax + 0x9c]
mov eax, dword [esi + 0x48]
mov byte [ecx + eax], dl
mov ecx, ebx
inc dword [esi + 0x48]
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x9c]
shr ecx, 8
mov byte [edx + eax], cl
mov eax, dword [esi + 0xc8]
inc dword [esi + 0x48]
xor eax, 1
imul eax, dword [esi + 0xbc]
mov ecx, dword [esi + 0x48]
mov dword [esi + 0xbc], eax
mov eax, dword [0x110102a4]
mov eax, dword [eax + 0x9c]
mov byte [ecx + eax], bl
inc dword [esi + 0x48]
cmp ebp, 0x25170
jl 0x1000441e
xor edi, 0x17ec
jmp 0x1000467a
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0x28]
and eax, dword [esp + 0x1c]
add eax, edi
cmp ecx, eax
jbe 0x1000467a
mov eax, esi
or eax, 0x1784
cmp ecx, eax
jge 0x1000467a
mov ecx, dword [ebx + 0x54]
lea eax, [ecx + ebp]
or ecx, edx
push eax
mov eax, dword [esp + 0x20]
sub eax, ebp
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ecx
push eax
mov eax, dword [ebx + 0xa0]
xor eax, dword [esp + 0x20]
sub eax, dword [esp + 0x28]
push eax
mov eax, dword [0x110103b8]
or eax, edi
push eax
mov eax, dword [ebx + 0x110]
imul eax, ebp
xor eax, 0x1fa9
push eax
call esi
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
and eax, ebp
add edx, eax
mov eax, dword [ebx + 0xb0]
sub eax, dword [ebx + 0xe4]
add ebp, eax
mov dword [esp + 0x10], edx
mov eax, dword [0x110102a4]
mov ecx, dword [eax + 0x38]
imul ecx, dword [0x11010340]
xor ecx, dword [eax + 0x80]
add dword [0x11010348], ecx
mov eax, dword [ebx + 4]
xor eax, 0x3f61
push eax
mov eax, dword [ebx + 0x98]
xor eax, dword [ebx + 4]
push eax
mov eax, ebp
and eax, 0x2162
push eax
mov eax, dword [ebx + 0x10]
add eax, dword [esp + 0x28]
push eax
mov eax, dword [ebx + 0xb0]
xor eax, edi
add eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0xc8]
add eax, edx
push eax
mov eax, dword [ebx + 0xb4]
or eax, dword [ebx + 0x38]
xor eax, dword [ebx + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x110102a4]
mov ecx, dword [ebx + 0x60]
xor ecx, dword [esp + 0x2c]
or ecx, dword [eax + 0xb0]
mov eax, dword [ebx + 0x7c]
sub eax, dword [esp + 0x2c]
or eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
push eax
mov eax, edi
add ecx, 0x1a86
sub eax, ebp
push eax
mov eax, dword [0x110102c8]
add eax, ecx
push eax
mov eax, dword [ebx + 0xd8]
add eax, edi
push eax
mov eax, dword [0x110102c0]
add eax, dword [0x11010360]
push eax
call esi
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x110102a4]
or eax, 0x24b5
imul eax, dword [esp + 0x14]
mov ecx, dword [ecx + 0x7c]
and ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebx
xor edi, 0x36f8
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
pop ecx
ret