Function at 0x1000b80f
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add dword [esp + 0x18], 0x5ed
add edx, 0x3f8
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebx, 0x5e9
push edi
mov edi, ecx
mov dword [esp + 0x20], edx
xor ecx, 0x77
xor edi, 0xe8
lea ebp, [esi - 0x2c3]
mov dword [esp + 0x24], ecx
xor esi, 0x43b1
mov dword [esp + 0x10], ebp
lea eax, [esi + 0x4227]
cmp ebp, eax
je 0x1000bb79
mov ecx, dword [0x1004b8b4]
mov esi, dword [esp + 0x1c]
mov eax, dword [ecx + 0xd8]
cmp eax, dword [ecx + 0x84]
jae 0x1000b895
mov eax, 0x4aae6
sub eax, dword [esi + 0xf4]
add dword [esi + 0x3c], eax
mov ecx, dword [0x1004b8b4]
cmp dword [esi + 0xc0], 0xa893
jb 0x1000b8b6
mov ecx, dword [ecx + 0x28]
mov eax, 0x1907e5
xor ecx, dword [0x1006148c]
sub eax, ecx
add dword [esi + 0x3c], eax
jmp 0x1000b8ce
mov eax, dword [esi + 0x7c]
sub eax, dword [ecx + 0x6c]
add eax, 0xa6bc
imul eax, dword [ecx + 0xa8]
mov dword [ecx + 0xa8], eax
mov ecx, dword [0x1004b8b4]
mov eax, 0xbe059122
sub eax, dword [0x10061534]
add dword [ecx + 0x3c], eax
mov ecx, dword [0x1004b8b4]
cmp dword [ecx + 0x50], 0x113a7
je 0x1000b904
mov eax, dword [0x10061534]
sub eax, dword [esi + 0xa4]
sub eax, 0x1621ca
add dword [ecx + 0x3c], eax
xor edi, edi
mov dword [0x100614e0], 0x10041000
mov ebp, edi
mov eax, dword [esi + 0x88]
mov edx, dword [eax + ebp]
add ebp, 4
mov eax, dword [0x100614d4]
xor eax, 0xd79d24
add dword [esi + 0xdc], eax
mov eax, 0xebe3f8
sub eax, dword [esi + 0x7c]
sub eax, dword [esi + 0xa8]
add dword [0x100614fc], eax
mov eax, 0x313ef
sub eax, dword [0x1006148c]
mov ecx, dword [0x1004b8b4]
add dword [ecx + 0xe0], eax
mov eax, dword [0x100614a0]
add eax, 0xffe57c0e
xor dword [esi + 0x7c], eax
mov eax, 0x163ac8
sub eax, dword [esi + 0xb0]
sub eax, dword [0x10061534]
add dword [0x100614d4], eax
mov eax, dword [esi + 0xd8]
imul eax, dword [0x100614f4]
mov ebx, dword [esi + 0x3c]
imul ebx, edx
mov dword [esi + 0xd8], eax
mov eax, dword [esi]
xor eax, dword [esi + 0x60]
mov edx, ebx
sub eax, 0x16b65b
shr edx, 8
or dword [esi + 0x7c], eax
mov eax, dword [0x1004b8b4]
mov ecx, dword [eax + 0x58]
mov eax, dword [esi + 0x8c]
mov byte [ecx + eax], dl
mov eax, dword [0x1004b8b4]
inc dword [eax + 0x58]
mov ecx, dword [0x1004b8b4]
mov eax, dword [esi + 0x48]
sub eax, 0x1a83f2
add dword [ecx + 0x50], eax
mov ecx, dword [esi + 0x58]
mov eax, dword [esi + 0x8c]
mov byte [ecx + eax], bl
inc dword [esi + 0x58]
mov ecx, dword [0x1004b8b4]
mov eax, dword [esi + 0xdc]
sub eax, 0x163ac6
imul eax, dword [ecx + 0x28]
mov dword [ecx + 0x28], eax
mov ecx, dword [esi + 0x34]
mov edx, dword [0x1004b8b4]
add ecx, 0xffe77010
mov eax, dword [esi + 0x50]
add eax, ecx
imul eax, dword [edx + 0xc0]
mov dword [edx + 0xc0], eax
mov eax, 0x1fb115
mov ecx, dword [0x1004b8b4]
sub eax, dword [ecx + 0x84]
add dword [0x1006154c], eax
mov eax, dword [esi]
sub eax, 0x2edea
or dword [ecx + 0x84], eax
cmp ebp, 0xa3c8
jl 0x1000b912
mov eax, dword [esi + 0xe0]
mov ebp, dword [esp + 0x10]
cmp eax, dword [esi + 0xf4]
je 0x1000ba6b
mov eax, dword [0x10061534]
xor eax, 0x7086c2ec
mov dword [0x10061494], eax
cmp dword [0x1006148c], 0x111
jbe 0x1000ba81
mov dword [esi + 0x88], 0x10010298
mov eax, dword [esi + 0x88]
mov ecx, dword [edi + eax]
add edi, 4
mov eax, dword [esi + 0xa4]
xor eax, 1
add dword [esi + 0xc0], eax
mov eax, dword [0x1004b8b4]
mov ebx, dword [eax + 0x3c]
imul ebx, ecx
mov ecx, dword [eax + 0x58]
mov eax, dword [esi + 0x8c]
mov edx, ebx
shr edx, 8
mov byte [ecx + eax], dl
mov eax, dword [0x1004b8b4]
inc dword [eax + 0x58]
mov ecx, dword [esi + 0x58]
mov eax, dword [esi + 0x8c]
mov byte [ecx + eax], bl
inc dword [esi + 0x58]
mov eax, dword [0x1004b8b4]
mov eax, dword [eax + 0x48]
sub eax, dword [0x10061458]
sub eax, 0x179607
imul eax, dword [esi + 0xcc]
mov dword [esi + 0xcc], eax
mov ecx, dword [0x1004b8b4]
mov eax, dword [ecx + 0x28]
xor eax, 0x1a1769
sub dword [0x100614fc], eax
mov eax, dword [esi + 0xdc]
add eax, dword [esi + 0x60]
xor eax, 0x2a9678
or dword [ecx + 0x34], eax
mov eax, dword [0x1004b8b4]
mov eax, dword [eax + 0x6c]
xor eax, dword [0x1006154c]
sub eax, 0x4b303
imul eax, dword [esi + 0x6c]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x9c]
dec eax
or dword [0x100614d4], eax
mov eax, dword [0x1006154c]
mov ecx, dword [esi + 0xb0]
add eax, 0xfffb4cfc
add eax, ecx
sub ecx, dword [esi + 0xe0]
imul eax, dword [esi + 0x7c]
add ecx, 0x12
mov dword [esi + 0x7c], eax
mov eax, dword [0x1004b8b4]
xor dword [eax + 0xa8], ecx
cmp edi, 0xee8
jl 0x1000ba81
jmp 0x1000bd61
mov eax, edi
or eax, 0x45a6
cmp dword [0x100614bc], eax
ja 0x1000bd61
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0xd0]
sub eax, ebx
cmp ebp, eax
jae 0x1000bd61
mov eax, dword [ecx + 0x4c]
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov eax, dword [esp + 0x20]
xor eax, ebp
mov ecx, dword [esp + 0x30]
imul eax, eax, 0x4282
add ecx, 0xffffbf75
add ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x60]
or eax, dword [esp + 0x24]
imul eax, eax, 0x47f8
add ebp, eax
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0xa8]
xor ecx, dword [eax + 0x84]
mov eax, dword [0x1004b8b4]
xor edx, dword [0x10061514]
mov eax, dword [eax + 0xd8]
or eax, edi
mov edi, dword [esp + 0x1c]
xor eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
or eax, dword [esp + 0x34]
push edi
push eax
push ecx
push edx
call fcn.1000e052
mov ecx, eax
add esp, 0x14
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x30]
sub eax, 0x43bc
push eax
mov eax, dword [0x100614fc]
and eax, esi
push eax
mov eax, dword [0x1004b8b4]
mov eax, dword [eax + 0xd0]
add eax, ecx
imul eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [0x1004b8b4]
or esi, ebp
push edi
mov eax, dword [ecx + 0xb8]
and eax, dword [esp + 0x2c]
or eax, 0x3fb9
imul eax, dword [esp + 0x2c]
add eax, eax
and eax, dword [edi + 0xa4]
push eax
mov eax, dword [edi + 0xd0]
imul eax, ebp
sub eax, 0x426d
push eax
mov eax, dword [ecx + 0xcc]
add eax, dword [ecx + 8]
xor eax, dword [esp + 0x30]
push eax
mov eax, dword [edi + 0xd8]
sub eax, dword [ecx + 0xdc]
push esi
push eax
call fcn.100095dd
mov eax, dword [0x10061500]
and eax, 0x4227
or dword [edi + 0xdc], eax
mov eax, dword [edi + 0xd0]
or eax, dword [esp + 0x48]
imul edi, dword [0x10061528], 0x47f8
or eax, 0x3fb9
sub ebp, eax
mov eax, dword [esp + 0x34]
mov esi, dword [eax + 0xec]
add edi, ebx
sub esi, dword [eax + 0xcc]
mov eax, dword [0x1004b8b4]
or esi, 0x408b
mov edx, dword [0x10061524]
sub edx, dword [esp + 0x48]
xor edx, ebp
mov ecx, dword [eax]
mov eax, dword [0x1006149c]
imul eax, dword [0x100614ac]
imul ecx, dword [esp + 0x38]
or eax, 0x47f8
push eax
mov eax, dword [esp + 0x38]
sub ecx, 0x4767
push ecx
push eax
push edx
push esi
push edi
call fcn.10009f5f
mov edx, dword [esp + 0x4c]
mov ecx, eax
mov eax, dword [0x1004b8b4]
push edx
mov eax, dword [eax + 4]
xor eax, ecx
mov ecx, dword [edx + 0xb8]
or ecx, dword [edx + 0x28]
sub eax, 0x4767
push eax
mov eax, dword [edx + 0xd8]
imul eax, ebx
push eax
mov eax, dword [0x10061540]
and eax, ebp
push eax
mov eax, dword [edx + 0x48]
or eax, dword [esp + 0x64]
push eax
push ecx
call fcn.1000dfef
add esp, 0x48
pop edi
xor ebp, 0xa1
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret