Function at 0x100fc180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101fdeb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x103b9004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x10c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xf4], ecx
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x108], edx
push ecx
push dword [ebp + 0x24]
mov ecx, eax
mov dword [ebp - 0x100], esi
push edx
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x114], 0
call fcn.100fa450
test eax, eax
je 0x100fc90d
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x100fc231
test esi, esi
je 0x100fc220
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x100fc234
mov esi, dword [ebp - 0xf4]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x100], esi
jmp 0x100fc234
mov edi, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x104]
cmp dword [ecx + 8], 5
jl 0x100fc32d
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf8], eax
call fcn.100f0f70
push 4
lea edx, [ebp - 0xf8]
call fcn.100f34d0
mov edx, dword [ebp - 0x104]
lea ecx, [ebp - 0xf0]
add edx, 0x20
push 0x20
call fcn.100f34d0
push 5
mov edx, str.there
lea ecx, [ebp - 0xf0]
call fcn.100f34d0
mov edx, dword [ebp - 0x104]
lea ecx, [ebp - 0xf0]
add esp, 0x10
lea edx, [edx + 0x20]
call fcn.100f3580
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp + 0x14]
lea eax, [ecx + 0x20]
push eax
push 0
push edx
push dword [ebp - 0xf4]
push dword [ebp - 0x108]
call fcn.100fc930
cmp dword [ebp + 0x20], 0
je 0x100fc90d
mov eax, dword [ebp - 0x104]
add eax, 0x20
push eax
push 1
push edi
mov edi, dword [ebp - 0x108]
push esi
mov esi, dword [ebp - 0x104]
mov ecx, esi
push edi
call fcn.100fc930
lea eax, [esi + 0x20]
mov dword [ebp - 0xfc], str.EncryptMetadata
push eax
push 1
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xf8], 0xf
push eax
mov ecx, edi
call fcn.1008b310
push eax
push dword [esi + 0x18]
push edi
call fcn.100fcf00
jmp 0x100fc90d
mov esi, dword [ebp - 0x114]
test eax, eax
je 0x100fc5f6
mov esi, dword [ebp - 0x100]
lea eax, [ebp - 0x30]
mov edx, 0x102072a8
xor ecx, ecx
sub edx, edi
sub esi, eax
nop
cmp ecx, edi
jae 0x100fc35d
lea eax, [esi + ecx]
mov al, byte [ebp + eax - 0x30]
jmp 0x100fc360
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0x30], al
inc ecx
cmp ecx, 0x20
jb 0x100fc350
lea eax, [ebp - 0x40]
mov edx, 0x20
push eax
lea ecx, [ebp - 0x30]
call fcn.100e5760
mov eax, dword [ebp - 0x104]
add esp, 4
mov esi, dword [ebp - 0x114]
cmp dword [eax + 8], 3
jl 0x100fc3ad
mov edi, 0x32
lea eax, [ebp - 0x40]
mov edx, 0x10
push eax
mov ecx, eax
call fcn.100e5760
add esp, 4
sub edi, 1
jne 0x100fc395
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x70]
test esi, esi
je 0x100fc3fe
mov eax, edx
mov edi, ecx
or eax, edi
test al, 3
jne 0x100fc3ed
mov eax, esi
shr eax, 2
test eax, eax
je 0x100fc3e1
mov esi, edi
mov ecx, eax
mov edi, edx
lea edx, [edx + eax*4]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x114]
lea ecx, [ebp - 0x40]
lea ecx, [ecx + eax*4]
mov eax, esi
and eax, 3
je 0x100fc3fe
push eax
push ecx
push edx
jmp 0x100fc3f6
push esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x14]
lea esi, [ebp - 0x30]
mov edi, dword [ebp - 0xf4]
mov edx, 0x102072a8
xor ecx, ecx
sub edx, eax
sub edi, esi
mov esi, dword [ebp - 0x114]
nop dword [eax + eax]
cmp ecx, eax
jae 0x100fc42d
lea eax, [edi + ecx]
mov al, byte [ebp + eax - 0x30]
jmp 0x100fc430
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0x30], al
inc ecx
mov eax, dword [ebp + 0x14]
cmp ecx, 0x20
jb 0x100fc420
lea eax, [ebp - 0x70]
mov edx, 0x20
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100e4d10
mov eax, dword [ebp - 0x104]
add esp, 8
cmp dword [eax + 8], 3
jl 0x100fc52d
mov edx, 1
mov dword [ebp - 0x100], edx
nop dword [eax]
xor eax, eax
test esi, esi
jle 0x100fc502
cmp esi, 0x40
jb 0x100fc4ef
mov ecx, esi
and ecx, 0x8000003f
jns 0x100fc48e
dec ecx
or ecx, 0xffffffc0
inc ecx
mov edi, esi
sub edi, ecx
movsx ecx, dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x70]
pxor xmm0, xmm1
movups xmmword [ebp + eax - 0x50], xmm0
movups xmm0, xmmword [ebp + eax - 0x60]
pxor xmm0, xmm1
movups xmmword [ebp + eax - 0x40], xmm0
movups xmm0, xmmword [ebp + eax - 0x50]
pxor xmm0, xmm1
movups xmmword [ebp + eax - 0x30], xmm0
movups xmm0, xmmword [ebp + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [ebp + eax - 0x20], xmm0
add eax, 0x40
cmp eax, edi
jl 0x100fc4b0
cmp eax, esi
jge 0x100fc502
mov cl, byte [ebp + eax - 0x70]
xor cl, dl
mov byte [ebp + eax - 0x50], cl
inc eax
cmp eax, esi
jl 0x100fc4f3
lea eax, [ebp - 0x50]
mov edx, 0x20
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100e4d10
mov edx, dword [ebp - 0x100]
add esp, 8
inc edx
mov dword [ebp - 0x100], edx
cmp edx, 0x13
jbe 0x100fc470
push 0x2d
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100fc546
mov dword [ebp - 0x100], edi
jmp 0x100fc574
mov dword [edi + 8], 0x20
lea ecx, [edi + 0xc]
mov dword [edi + 4], 0x20
lea edx, [ebp - 0x30]
mov dword [edi], 1
push 0x20
mov byte [edi + 0x2c], 0
mov dword [ebp - 0x100], edi
call fcn.100a43b0
add esp, 4
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x118], 0x1039a384
mov dword [ebp - 0x114], 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0xf8], eax
test eax, eax
je 0x100fc5c3
push 0
lea ecx, [ebp - 0x100]
xorps xmm0, xmm0
push ecx
movups xmmword [eax], xmm0
mov ecx, eax
mov dword [eax + 0x10], 0
call fcn.10073a50
jmp 0x100fc5c5
xor eax, eax
mov ecx, dword [ebp - 0x108]
push 0
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.1008b4f0
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x100fc5f6
dec dword [edi]
cmp dword [edi], 1
jge 0x100fc5f6
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [ebp - 0x10c]
mov eax, dword [ebp - 0x104]
mov edx, dword [ebp + 0x14]
push 0
push esi
mov ecx, dword [eax + 0x10]
lea edi, [eax + 0x20]
push edi
push edx
mov edx, dword [ebp - 0xf4]
call fcn.100f9170
mov eax, dword [ebp - 0x104]
add esp, 0x14
cmp dword [eax + 8], 3
jge 0x100fc725
mov eax, 0x102072a8
lea ecx, [ebp - 0x30]
or eax, ecx
test al, 3
jne 0x100fc654
movups xmm0, xmmword [0x102072a8]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [0x102072b8]
movups xmmword [ebp - 0x20], xmm0
jmp 0x100fc667
push 0x20
lea eax, [ebp - 0x30]
push 0x102072a8
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push esi
push edi
mov edx, 0x20
lea ecx, [ebp - 0x30]
call fcn.100e4d10
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x2d
call edi
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100fc691
mov dword [ebp - 0x100], esi
jmp 0x100fc6bf
mov dword [esi + 8], 0x20
lea ecx, [esi + 0xc]
mov dword [esi + 4], 0x20
lea edx, [ebp - 0x30]
mov dword [esi], 1
push 0x20
mov byte [esi + 0x2c], 0
mov dword [ebp - 0x100], esi
call fcn.100a43b0
add esp, 4
mov dword [ebp - 4], 1
push 0x14
mov dword [ebp - 0x110], 0x1039a478
mov dword [ebp - 0x10c], 1
call edi
add esp, 4
mov dword [ebp - 0xf8], eax
test eax, eax
je 0x100fc716
push 0
lea ecx, [ebp - 0x100]
xorps xmm0, xmm0
push ecx
movups xmmword [eax], xmm0
mov ecx, eax
mov dword [eax + 0x10], 0
call fcn.10073a50
push 0
push eax
lea eax, [ebp - 0x110]
jmp 0x100fc8ec
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x110]
jmp 0x100fc8ec
movaps xmm0, xmmword [0x103a6b80]
lea ecx, [ebp - 0xd4]
push 0x20
mov edx, 0x102072a8
mov dword [ebp - 0xd4], 0
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xc0], 0x10325476
call fcn.100e5580
mov ecx, dword [ebp - 0x10c]
add esp, 4
test ecx, ecx
je 0x100fc7d7
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0xf4], 0
test eax, eax
je 0x100fc7a0
jg 0x100fc77d
xor ecx, ecx
jmp 0x100fc780
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx]
lea eax, [ebp - 0xf4]
push eax
call fcn.10089600
mov eax, dword [ebp - 0xf4]
test eax, eax
je 0x100fc7a0
mov ecx, dword [eax + 4]
lea edx, [eax + 0xc]
jmp 0x100fc7a7
xor ecx, ecx
mov edx, 0x10202374
push ecx
lea ecx, [ebp - 0xd4]
call fcn.100e5580
mov eax, dword [ebp - 0xf4]
add esp, 4
test eax, eax
je 0x100fc7d7
dec dword [eax]
mov eax, dword [ebp - 0xf4]
cmp dword [eax], 1
jge 0x100fc7d7
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0xd4]
call fcn.100e5650
push esi
push edi
mov edx, 0x10
lea ecx, [ebp - 0x30]
call fcn.100e4d10
mov edx, 1
add esp, 8
mov dword [ebp - 0x10c], edx
xor ecx, ecx
test esi, esi
jle 0x100fc81e
nop dword [eax + eax]
mov al, byte [edi + ecx]
xor al, dl
mov byte [ebp + ecx - 0x70], al
inc ecx
cmp ecx, esi
jl 0x100fc810
lea eax, [ebp - 0x70]
mov edx, 0x10
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100e4d10
mov edx, dword [ebp - 0x10c]
add esp, 8
inc edx
mov dword [ebp - 0x10c], edx
cmp edx, 0x13
jle 0x100fc802
lea eax, [ebp - 0x20]
mov edx, 0x10
push eax
lea ecx, [ebp - 0x30]
call fcn.100e5760
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x2d
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x100fc871
mov dword [ebp - 0x10c], esi
jmp 0x100fc89f
mov dword [esi + 8], 0x20
lea ecx, [esi + 0xc]
mov dword [esi + 4], 0x20
lea edx, [ebp - 0x30]
mov dword [esi], 1
push 0x20
mov byte [esi + 0x2c], 0
mov dword [ebp - 0x10c], esi
call fcn.100a43b0
add esp, 4
mov dword [ebp - 4], 2
push 0x14
mov dword [ebp - 0x38], 0x1039a478
mov dword [ebp - 0x34], 1
call edi
add esp, 4
mov dword [ebp - 0xf8], eax
test eax, eax
je 0x100fc8e4
push 0
lea ecx, [ebp - 0x10c]
xorps xmm0, xmm0
push ecx
movups xmmword [eax], xmm0
mov ecx, eax
mov dword [eax + 0x10], 0
call fcn.10073a50
jmp 0x100fc8e6
xor eax, eax
push 0
push eax
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x108]
push eax
call fcn.1008b4f0
test esi, esi
je 0x100fc90d
dec dword [esi]
cmp dword [esi], 1
jge 0x100fc90d
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101f3fd0
mov esp, ebp
pop ebp
ret 0x20