Function at 0x100623e0
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10196ffc
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x101f6e00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xdc], esi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x1bc]
mov dword [0x1027e740], eax
test edi, edi
je 0x10062d3e
cmp dword [ebp + 0xc], 1
jne 0x10062d3e
mov ecx, dword [esi + 0xf8]
test ecx, ecx
je 0x10062467
cmp byte [ecx + 0x10d], 0
je 0x10062467
cmp edi, dword [esi + 4]
jne 0x10062467
push 0
call dword [0x101d64b8]
mov ecx, dword [esi + 0x1bc]
test ecx, ecx
je 0x10062467
push 0
call dword [0x101d64b8]
mov eax, dword [esi + 0x104]
test eax, eax
je 0x10062d3a
mov al, byte [eax + 0x10d]
test al, al
je 0x10062d3a
cmp edi, dword [esi + 0x174]
jne 0x10062499
mov ecx, esi
call fcn.10063e80
mov al, 1
jmp 0x10062d40
mov eax, dword [esi + 0x198]
cmp edi, eax
jne 0x100624ba
cmp dword [eax + 0xe0], 3
sete al
mov byte [esi + 0x1a2], al
mov al, 1
jmp 0x10062d40
cmp edi, dword [esi + 0x178]
jne 0x10062a39
mov edi, dword [0x10297f7c]
mov edx, dword [edi + 0x324]
lea ecx, [edi + 0x324]
test edx, edx
je 0x100624f0
mov eax, dword [0xf3e860]
mov al, byte [eax + 0xce8]
mov byte [edx + 0x45], al
mov edi, dword [0x10297f7c]
mov eax, dword [ecx]
cmp byte [eax + 0x45], 0x15
je 0x1006264a
movaps xmm0, xmmword [0x101ded00]
xor ecx, ecx
movups xmmword [ebp - 0x5c], xmm0
mov word [ebp - 0x3c], 0x67
movaps xmm0, xmmword [0x101de1a0]
movups xmmword [ebp - 0x4c], xmm0
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x5b]
xor al, byte [ebp - 0x5c]
mov byte [ebp + ecx - 0x5b], al
inc ecx
cmp ecx, 0x20
jb 0x10062520
sub esp, 0x1c
mov byte [ebp - 0x3b], 0
mov edx, esp
lea ecx, [ebp - 0x5b]
xorps xmm0, xmm0
lea esi, [ecx + 1]
mov dword [edx], 0
movups xmmword [edx + 4], xmm0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10062560
sub ecx, esi
lea eax, [ebp - 0x5b]
push ecx
push eax
mov ecx, edx
call fcn.100484d0
lea eax, [ebp - 0x9c]
push eax
call fcn.10049410
add esp, 0x20
mov dword [ebp - 4], 0
lea ecx, [eax + 4]
cmp dword [eax + 0x18], 0xf
mov dword [ebp - 0xe4], ecx
jbe 0x100625a2
mov ecx, dword [ecx]
mov dword [ebp - 0xe4], ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100625a5
sub ecx, edx
mov dword [ebp - 0xdc], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.1013d380
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0xe0], edi
call fcn.1013f8f0
push dword [ebp - 0xdc]
lea esi, [edi + 0x20]
push dword [ebp - 0xe4]
push esi
call fcn.1013f190
mov eax, dword [ebp - 0xdc]
add esp, 0x1c
mov dword [edi + 0x14], eax
mov dword [edi + 4], esi
mov dword [edi + 0x18], 0x1f
mov ecx, dword ds:[0xf3690c]
push 0
push 0xba0f30
push dword [ebp - 0xe0]
mov eax, dword [0x101d63dc]
call eax
push edi
call fcn.1013c8d0
add esp, 4
lea ecx, [ebp - 0x9c]
call fcn.100477d0
mov eax, dword [ebp - 0x9c]
push 8
push eax
mov dword [ebp - 0x9c], 0
call fcn.1013c8d0
add esp, 8
mov al, 1
jmp 0x10062d40
cmp byte [esi + 0x1a9], 0
jne 0x1006279a
movaps xmm0, xmmword [0x101de100]
xor ecx, ecx
movups xmmword [ebp - 0x80], xmm0
mov word [ebp - 0x60], 0x7e
movaps xmm0, xmmword [0x101de3c0]
movups xmmword [ebp - 0x70], xmm0
mov al, byte [ebp + ecx - 0x7f]
xor al, byte [ebp - 0x80]
mov byte [ebp + ecx - 0x7f], al
inc ecx
cmp ecx, 0x20
jb 0x10062675
sub esp, 0x1c
mov byte [ebp - 0x5f], 0
mov edx, esp
lea ecx, [ebp - 0x7f]
xorps xmm0, xmm0
lea esi, [ecx + 1]
mov dword [edx], 0
movups xmmword [edx + 4], xmm0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100626b0
sub ecx, esi
lea eax, [ebp - 0x7f]
push ecx
push eax
mov ecx, edx
call fcn.100484d0
lea eax, [ebp - 0xb8]
push eax
call fcn.10049410
add esp, 0x20
mov dword [ebp - 4], 1
lea ecx, [eax + 4]
cmp dword [eax + 0x18], 0xf
mov dword [ebp - 0xdc], ecx
jbe 0x100626f2
mov ecx, dword [ecx]
mov dword [ebp - 0xdc], ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100626f5
sub ecx, edx
mov dword [ebp - 0xe4], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.1013d380
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0xe0], edi
call fcn.1013f8f0
push dword [ebp - 0xe4]
lea esi, [edi + 0x20]
push dword [ebp - 0xdc]
push esi
call fcn.1013f190
mov eax, dword [ebp - 0xe4]
add esp, 0x1c
mov dword [edi + 0x14], eax
mov dword [edi + 4], esi
mov dword [edi + 0x18], 0x1f
mov ecx, dword ds:[0xf3690c]
push 0
push 0xba0f30
push dword [ebp - 0xe0]
mov eax, dword [0x101d63dc]
call eax
push edi
call fcn.1013c8d0
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.100477d0
mov eax, dword [ebp - 0xb8]
push 8
push eax
mov dword [ebp - 0xb8], 0
call fcn.1013c8d0
add esp, 8
mov al, 1
jmp 0x10062d40
cmp dword [edi + 0x174], 0
jne 0x100627be
push 0
push 0
push 0
push 0x100b2150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x174], eax
lea ecx, [ebp - 0x108]
mov byte [ebp - 0xd5], 0xf1
call fcn.100508a0
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0xf0]
mov eax, ecx
mov edx, dword [ebp - 0xf4]
sub eax, edx
mov dword [ebp - method.Packet.virtual_0], vtable.Packet.0
mov byte [ebp - 0xe8], 0xe9
cmp eax, 0x989680
jb 0x10062822
push 0x97
push 0x101d5be8
push str.size_____10000000
call fcn.101598d0
mov ecx, dword [ebp - 0xf0]
add esp, 0xc
mov edx, dword [ebp - 0xf4]
mov eax, dword [ebp - 0xfc]
sub ecx, edx
lea edi, [eax + 1]
cmp ecx, edi
jae 0x10062843
push edi
lea ecx, [ebp - 0xf8]
call fcn.10052c60
mov eax, dword [ebp - 0xfc]
push eax
lea ecx, [ebp - 0xf8]
call fcn.10052c00
mov cl, byte [ebp - 0xd5]
mov byte [eax], cl
mov ecx, dword [ebp - 0xfc]
inc ecx
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 4], 3
mov edx, dword [ebp - 0xf0]
mov eax, edx
mov edi, dword [ebp - 0xf4]
sub eax, edi
mov byte [ebp - 0xd5], 1
cmp eax, 0x989680
jb 0x100628b2
push 0x97
push 0x101d5be8
push str.size_____10000000
call fcn.101598d0
mov edx, dword [ebp - 0xf0]
add esp, 0xc
mov edi, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xfc]
lea eax, [ecx + 1]
sub edx, edi
cmp edx, eax
jae 0x100628cd
push eax
lea ecx, [ebp - 0xf8]
call fcn.10052c60
mov ecx, dword [ebp - 0xfc]
push ecx
lea ecx, [ebp - 0xf8]
call fcn.10052c00
mov cl, byte [ebp - 0xd5]
mov byte [eax], cl
mov al, byte [esi + 0x1a9]
mov edx, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xfc]
mov edi, dword [ebp - 0xf4]
inc ecx
mov byte [ebp - 0xd5], al
mov eax, edx
sub eax, edi
mov dword [ebp - 0xfc], ecx
cmp eax, 0x989680
jb 0x1006293a
push 0x97
push 0x101d5be8
push str.size_____10000000
call fcn.101598d0
mov edx, dword [ebp - 0xf0]
add esp, 0xc
mov edi, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xfc]
lea eax, [ecx + 1]
sub edx, edi
cmp edx, eax
jae 0x10062955
push eax
lea ecx, [ebp - 0xf8]
call fcn.10052c60
mov ecx, dword [ebp - 0xfc]
push ecx
lea ecx, [ebp - 0xf8]
call fcn.10052c00
mov cl, byte [ebp - 0xd5]
mov byte [eax], cl
mov al, byte [esi + 0x1a2]
mov edx, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xfc]
mov esi, dword [ebp - 0xf4]
inc ecx
mov byte [ebp - 0xd5], al
mov eax, edx
sub eax, esi
mov dword [ebp - 0xfc], ecx
cmp eax, 0x989680
jb 0x100629c2
push 0x97
push 0x101d5be8
push str.size_____10000000
call fcn.101598d0
mov edx, dword [ebp - 0xf0]
add esp, 0xc
mov esi, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xfc]
lea eax, [ecx + 1]
sub edx, esi
cmp edx, eax
jae 0x100629dd
push eax
lea ecx, [ebp - 0xf8]
call fcn.10052c60
mov ecx, dword [ebp - 0xfc]
push ecx
lea ecx, [ebp - 0xf8]
call fcn.10052c00
mov cl, byte [ebp - 0xd5]
mov byte [eax], cl
lea ecx, [ebp - 0x108]
inc dword [ebp - 0xfc]
call fcn.100c62b0
lea ecx, [ebp - 0xf8]
mov dword [ebp - method.ByteBuffer.virtual_0], vtable.ByteBuffer.0
call fcn.10052cf0
mov eax, dword [ebp - 0xf8]
push 8
push eax
mov dword [ebp - 0xf8], 0
call fcn.1013c8d0
add esp, 8
mov al, 1
jmp 0x10062d40
cmp edi, dword [esi + 0x17c]
jne 0x10062c86
mov ecx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov edi, 0x10c
mov byte [esi + 0x1a9], 0
mov byte [esi + 0x1a2], 0
nop
mov eax, dword [0x10297f7c]
mov eax, dword [eax + 0x478]
mov eax, dword [edi + eax]
mov dword [ebp - 0xe0], eax
test eax, eax
je 0x10062aa1
push 4
push eax
call ecx
test eax, eax
jne 0x10062a9b
mov eax, dword [ebp - 0xe0]
mov dword [0x1027ede8], eax
mov dword [0x10297efc], 2
call fcn.100e5070
mov ecx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add edi, 4
cmp edi, 0x11c
jl 0x10062a60
mov edi, dword [esi + 0x174]
test edi, edi
je 0x10062ad4
push 4
push edi
call ecx
test eax, eax
jne 0x10062ad4
mov dword [0x1027ede8], edi
mov dword [0x10297efc], 2
call fcn.100e5070
mov esi, dword [esi + 0x198]
test esi, esi
je 0x10062b00
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10062b00
mov dword [0x1027ede8], esi
mov dword [0x10297efc], 2
call fcn.100e5070
movaps xmm0, xmmword [0x101ddd00]
xor ecx, ecx
mov eax, dword [0x10297f7c]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x18], 0xc191906
movaps xmm0, xmmword [0x101ddfb0]
mov word [eax + 0x448], 0x100
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x14], 0x470d
mov byte [ebp - 0x12], 0
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x37]
xor al, byte [ebp - 0x38]
mov byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x25
jb 0x10062b40
sub esp, 0x1c
mov byte [ebp - 0x12], 0
mov edx, esp
lea ecx, [ebp - 0x37]
xorps xmm0, xmm0
lea esi, [ecx + 1]
mov dword [edx], 0
movups xmmword [edx + 4], xmm0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10062b80
sub ecx, esi
lea eax, [ebp - 0x37]
push ecx
push eax
mov ecx, edx
call fcn.100484d0
lea eax, [ebp - 0xd4]
push eax
call fcn.10049410
add esp, 0x20
mov dword [ebp - 4], 4
lea ecx, [eax + 4]
cmp dword [eax + 0x18], 0xf
mov dword [ebp - 0xdc], ecx
jbe 0x10062bc2
mov ecx, dword [ecx]
mov dword [ebp - 0xdc], ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10062bc5
sub ecx, edx
mov dword [ebp - 0xe4], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.1013d380
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0xe0], edi
call fcn.1013f8f0
push dword [ebp - 0xe4]
lea esi, [edi + 0x20]
push dword [ebp - 0xdc]
push esi
call fcn.1013f190
mov eax, dword [ebp - 0xe4]
add esp, 0x1c
mov dword [edi + 0x14], eax
mov dword [edi + 4], esi
mov dword [edi + 0x18], 0x1f
mov ecx, dword ds:[0xf3690c]
push 0
push 0xba0f30
push dword [ebp - 0xe0]
mov eax, dword [0x101d63dc]
call eax
push edi
call fcn.1013c8d0
add esp, 4
lea ecx, [ebp - 0xd4]
call fcn.100477d0
mov eax, dword [ebp - 0xd4]
push 8
push eax
mov dword [ebp - 0xd4], 0
call fcn.1013c8d0
mov eax, dword [0x10297f7c]
add esp, 8
cmp dword [eax + 0x174], 0
je 0x10062d3a
mov dword [eax + 0x174], 0
mov al, 1
jmp 0x10062d40
xor dl, dl
mov byte [ebp - 0xd5], dl
nop
movzx eax, dl
cmp edi, dword [esi + eax*4 + 0x10c]
jne 0x10062d29
xor cl, cl
lea edi, [esi + 0x10c]
mov byte [ebp - 0xd6], cl
nop
cmp dl, cl
jne 0x10062cdc
lea eax, [edx + 1]
mov byte [esi + 0x1a9], al
mov esi, dword [edi]
test esi, esi
je 0x10062d10
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10062d04
mov dword [0x10297efc], 3
jmp 0x10062cf9
mov esi, dword [edi]
test esi, esi
je 0x10062d10
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10062d04
mov dword [0x10297efc], 2
mov dword [0x1027ede8], esi
call fcn.100e5070
mov dl, byte [ebp - 0xd5]
mov cl, byte [ebp - 0xd6]
mov esi, dword [ebp - 0xdc]
inc cl
add edi, 4
mov byte [ebp - 0xd6], cl
cmp cl, 4
jb 0x10062cb0
mov edi, dword [ebp + 8]
inc dl
mov byte [ebp - 0xd5], dl
cmp dl, 4
jb 0x10062c90
mov al, 1
jmp 0x10062d40
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1013c8c0
mov esp, ebp
pop ebp
ret 8