Function at 0x1005f7c0
Capabilities:
Encode data using xor
Generate random numbers via rtlgenrandom
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x1010f16c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebx + 8]
push esi
push edi
mov dword [ebp - 0x40], eax
cmp word [ecx + 0x28], 2
mov dword [ebp - 0x48], ecx
jne 0x1005f801
mov edx, dword [ecx + 0x2c]
xor ecx, ecx
jmp 0x1005f807
mov edx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x34]
push edx
push ecx
push dword [eax + 0x1f4]
mov dword [ebp - 0x44], ecx
push dword [eax + 0x1f0]
mov dword [ebp - 0x34], edx
call fcn.100918b0
push dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov edi, eax
push dword [ebp - 0x34]
mov esi, edx
push dword [ecx + 0x1ec]
push dword [ecx + 0x1e8]
call fcn.100918b0
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x40]
add edi, eax
push dword [ebp - 0x44]
adc esi, edx
imul eax, esi, 0x7a143595
push dword [ecx + 0x204]
push dword [ecx + 0x200]
sub edi, eax
mov eax, edi
shr eax, 0x10
sub edi, eax
mov eax, edi
shr eax, 4
xor eax, edi
and eax, 0xfff
add eax, dword [ecx + 0x1d0]
mov dword [ebp - 0x3c], eax
call fcn.100918b0
push dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov edi, eax
push dword [ebp - 0x34]
mov esi, edx
push dword [ecx + 0x1fc]
push dword [ecx + 0x1f8]
call fcn.100918b0
add edi, eax
adc esi, edx
imul eax, esi, 0x7a143595
mov esi, dword [ebp - 0x40]
mov ecx, dword [esi + 0x1d4]
sub edi, eax
mov eax, edi
shr eax, 0x10
sub edi, eax
mov eax, edi
shr eax, 4
xor eax, edi
and eax, 0xfff
movzx ecx, byte [eax + ecx]
mov eax, dword [ebp - 0x3c]
sub ecx, dword [esi + 0x1e0]
movzx eax, byte [eax]
cmp eax, ecx
cmovge ecx, eax
xor edx, edx
mov dword [ebp - 0x44], ecx
cmp ecx, 0x32
jae 0x1005f8ec
mov edx, 1
jmp 0x1005f93c
cmp ecx, 0x64
jae 0x1005f93c
mov edi, dword [esi + 0x1d8]
mov edx, 0x33
mov eax, edi
mov dword [ebp - 0x34], 0
mul edx
xor eax, eax
add edx, 0x32
adc eax, eax
cmp dword [ebp - 0x34], eax
ja 0x1005f920
jb 0x1005f919
cmp ecx, edx
jae 0x1005f920
mov edx, 1
jmp 0x1005f922
xor edx, edx
mov eax, dword [esi + 0x1dc]
imul ecx, edi, 0x1b873593
add eax, 5
add eax, ecx
mov ecx, dword [ebp - 0x44]
mov dword [esi + 0x1d8], eax
mov al, dl
add al, cl
cmp byte [ebx + 0xc], 0
mov byte [ebp - 0x35], al
je 0x1005f951
test dl, dl
je 0x1005f9ee
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0xc8]
push 0x20
mov edx, 0x10
mov edi, dword [eax + 0x20]
mov esi, dword [eax + 0x1c]
mov eax, dword [ebp - 0x40]
add eax, 0x140
push eax
call fcn.10060570
lea eax, [esi - 0x20]
mov edx, edi
push eax
lea ecx, [ebp - 0xc8]
call fcn.10061d60
add esp, 0xc
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0xc8]
push 0x10
call fcn.10061e10
lea edx, [edi - 0x20]
mov dword [ebp - 0x34], 4
add edx, esi
add esp, 4
mov ecx, 0x10
lea esi, [ebp - 0x20]
xor edi, edi
mov eax, dword [esi]
sub ecx, 4
xor eax, dword [edx]
add esi, 4
or edi, eax
add edx, 4
sub dword [ebp - 0x34], 1
jne 0x1005f9b2
mov dword [ebp - 0x34], ecx
test ecx, ecx
je 0x1005f9e7
nop
movzx ecx, byte [esi]
lea edx, [edx + 1]
movzx eax, byte [edx - 1]
lea esi, [esi + 1]
xor ecx, eax
or edi, ecx
sub dword [ebp - 0x34], 1
jne 0x1005f9d0
test edi, edi
je 0x1005fa19
mov esi, dword [ebp - 0x40]
add dword [esi + 0x2268], 1
mov eax, dword [ebp - 0x48]
adc dword [esi + 0x226c], 0
mov eax, dword [eax + 0x1c]
add dword [esi + 0x2270], eax
mov eax, 3
adc dword [esi + 0x2274], 0
jmp 0x1005fbd4
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
mov al, byte [ebp - 0x35]
mov byte [ecx], al
mov ecx, dword [edx + 0x1e4]
lea eax, [ecx + 1]
mov dword [edx + 0x1e4], eax
cmp ecx, 0x61a8
jne 0x1005fa4a
mov eax, dword [edx + 0x1e0]
inc eax
shr eax, 1
mov dword [edx + 0x1e0], eax
cmp byte [ebx + 0xc], 0
je 0x1005fbd2
cmp byte [ebp - 0x35], 1
je 0x1005fbd2
mov esi, dword [ebp - 0x48]
lea eax, [edx + 0x20]
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x34], eax
push ecx
mov ecx, eax
call fcn.1006ca30
mov edi, dword [esi + 0x1c]
lea eax, [ebp - 0x20]
mov esi, dword [esi + 0x20]
lea ecx, [ebp - 0xc8]
push 0x10
push eax
mov edx, 0x10
sub edi, 0x10
call fcn.10060570
push edi
mov edx, esi
lea ecx, [ebp - 0xc8]
call fcn.10061d60
add esp, 0xc
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0xc8]
push 0x10
call fcn.10061e10
mov eax, dword [ebp - 0x48]
add esp, 4
mov edx, 0x10
mov dword [ebp - 0x3c], 4
mov esi, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
add esi, 0xfffffff0
add esi, ecx
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 0x20]
xor edi, edi
mov ecx, dword [esi]
sub edx, 4
xor ecx, dword [eax]
add esi, 4
or edi, ecx
add eax, 4
sub dword [ebp - 0x3c], 1
jne 0x1005fad8
mov dword [ebp - 0x3c], edx
test edx, edx
je 0x1005fb0a
movzx edx, byte [esi]
lea esi, [esi + 1]
movzx ecx, byte [eax]
lea eax, [eax + 1]
xor edx, ecx
or edi, edx
sub dword [ebp - 0x3c], 1
jne 0x1005faf4
test edi, edi
je 0x1005fbd2
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x34]
push esi
mov eax, dword [edi + 4]
mov dword [edi + 4], eax
lea eax, [edi + 0x20]
push eax
mov dword [edi], 3
mov dword [ebp - 0x3c], eax
call fcn.1006ca30
mov eax, dword [0x101160c8]
test eax, eax
jne 0x1005fb5d
push str.SystemFunction036
push str.ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101160c8], eax
test eax, eax
je 0x1005fb69
push 0x18
add edi, 8
push edi
call eax
test al, al
jne 0x1005fb71
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
add eax, 0x100
mov edx, edi
push eax
call fcn.100635e0
mov ecx, dword [esi + 0x1c]
lea eax, [ebp - 0x30]
add esp, 4
add ecx, 0xffffffe0
push eax
push dword [edi + 0x14]
mov eax, dword [esi + 0x20]
push dword [edi + 0x10]
add eax, ecx
mov ecx, dword [ebp - 0x3c]
push 0x10
push eax
push 0x10
mov edx, ecx
call fcn.10064f80
add esp, 0x18
mov dword [esi + 0x1c], 0x40
xor eax, eax
lea edi, [ebp - 0x30]
mov ecx, 8
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x40]
push esi
push eax
call fcn.1005ecb0
mov eax, 1
jmp 0x1005fbd4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100908e7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8