Function at 0x100012b0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
lea ebx, [eax - 0x4d7]
mov dword [esp + 0x18], ebx
lea ecx, [edx - 0x2ad4]
mov ebx, dword [esp + 0x20]
xor ebp, 0x76d
push esi
lea esi, [eax - 0x2e5c]
add ebx, 0xffffd196
push edi
mov edi, edx
mov dword [esp + 0x24], esi
mov eax, ebx
xor edx, 0x4be
xor eax, 0x2b9b
xor edi, 0x14f
cmp edx, eax
jle 0x10001490
mov esi, dword [esp + 0x1c]
lea eax, [ebx + 0x2e55]
cmp edi, eax
je 0x1000133e
mov eax, ecx
xor eax, 0x27f1
push eax
lea eax, [edi + 0x14]
push eax
lea eax, [edx - 0xe]
push eax
lea eax, [ebx + 0x2bc4]
push eax
lea eax, [ecx + 0x2e5c]
push eax
push esi
call fcn.1000b360
add esp, 0x18
mov ebp, eax
mov ecx, dword [0x100f26ac]
mov ecx, dword [ecx + 0xc0]
sub ecx, 0x3333333b
mov dword [esi + 0x60], ecx
mov edx, dword [0x100f26ac]
mov ecx, dword [esi + 0x10c]
cmp ecx, dword [edx + 0x14]
je 0x10001374
mov dword [esi + 0xa8], 0x10126890
mov edx, dword [0x100f26ac]
xor edi, edi
nop word [eax + eax]
mov eax, dword [edx + 0xa8]
mov ebx, dword [eax + edi]
add edi, 4
mov eax, dword [0x10141488]
imul ebx, dword [0x10141478]
add eax, 0xfff22eff
add eax, dword [edx + 0xa0]
imul eax, dword [edx + 0x40]
mov dword [edx + 0x40], eax
mov edx, ebx
mov ecx, dword [0x100f26ac]
mov eax, dword [0x101414d8]
add eax, 0xfffffff8
shr edx, 8
add dword [ecx + 0x6c], eax
mov eax, dword [esi + 0x38]
imul eax, dword [0x101414dc]
mov dword [0x101414dc], eax
mov eax, dword [0x100f26ac]
mov ecx, dword [eax + 0xac]
mov eax, dword [esi + 0x7c]
mov byte [ecx + eax], dl
inc dword [esi + 0x7c]
mov eax, dword [esi + 0x6c]
xor eax, dword [0x10141528]
mov ecx, dword [0x100f26ac]
xor eax, 0x1ab8ee
imul eax, dword [ecx + 0x6c]
mov dword [ecx + 0x6c], eax
mov eax, dword [0x100f26ac]
mov ecx, dword [eax + 0xac]
mov eax, dword [esi + 0x7c]
mov byte [ecx + eax], bl
inc dword [esi + 0x7c]
mov eax, dword [esi + 0xe4]
xor eax, dword [0x101414b4]
xor eax, 0xaf6ef
add dword [esi + 0xc4], eax
mov edx, dword [0x100f26ac]
mov eax, dword [0x10141474]
add eax, 0xffdea989
mov ecx, dword [edx + 0x84]
add ecx, dword [esi + 0x11c]
add eax, ecx
mov dword [0x10141474], eax
mov eax, dword [esi + 0xf0]
add dword [edx + 0xa0], eax
mov eax, dword [0x10141450]
xor eax, 1
sub dword [esi + 0x70], eax
mov edx, dword [0x100f26ac]
mov eax, dword [edx + 4]
sub eax, 0x1d541f
xor dword [0x101414f0], eax
cmp edi, 0x154b0
jl 0x10001380
pop edi
xor ebp, 0x26a
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
imul eax, esi, 0x2baf
add eax, 0x2e6a
cmp ecx, eax
jg 0x10001509
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0xa0]
sub eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp ecx, eax
jbe 0x10001509
mov ecx, dword [0x100f26ac]
mov eax, dword [ecx + 0x74]
and eax, ebx
or eax, edi
push eax
mov eax, dword [ecx + 0x8c]
add eax, dword [0x1014141c]
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esi + 0x68]
add ecx, 0x280
add eax, ecx
push eax
mov eax, dword [esi + 0x78]
imul eax, dword [0x101414d4]
push eax
mov eax, dword [0x10141458]
sub eax, edx
imul eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [edi - 0x194]
xor dword [esi + 0x108], eax
pop edi
xor ebp, 0x26a
pop esi
mov eax, ebp
pop ebp
pop ebx
ret