Function at 0x10008a10
Capabilities:
Encode data using xor
Get process image filename
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8c
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push 0
push 0x410
mov dword [ebp - 0xc44], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0xc34], ebx
test ebx, ebx
je 0x10008cfd
push 0x104
lea eax, [ebp - 0x828]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10008cf6
push ecx
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x828]
call fcn.1000b5b0
add esp, 4
test al, al
je 0x10008cf6
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.10008030
test al, al
jne 0x10008acc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea edx, [ebp - 0xc88]
mov ecx, 1
call fcn.10005900
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c666
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0xc28]
mov byte [ebp - 0xc29], 0
call fcn.100032d0
mov esi, dword [0x10130a84]
mov eax, dword [0x10130a88]
mov dword [ebp - 0xc40], esi
cmp esi, eax
je 0x10008c17
mov ebx, dword [ebp - 0xc38]
mov cl, byte [ebp - 0xc29]
cmp byte [esi], 1
jne 0x10008c00
test cl, cl
jne 0x10008bf7
push 0x10027cac
lea eax, [ebp - 0x210]
mov dword [ebp - 0xc30], 0
push eax
lea eax, [ebp - 0xc30]
or ebx, 0xffffffff
push eax
call fcn.1000fa90
add esp, 0xc
test eax, eax
jne 0x10008c11
push 0x400
call fcn.1001006e
add esp, 4
mov edi, eax
mov dword [ebp - 0xc3c], edi
push dword [ebp - 0xc30]
test edi, edi
je 0x10008d12
push 0x400
push 1
push edi
call fcn.1000fcf7
mov edx, eax
add esp, 0x10
test edx, edx
je 0x10008bcc
mov esi, edi
nop
mov edi, esi
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ebp + ecx*4 - 0xc28]
sub edx, 1
jne 0x10008b82
push dword [ebp - 0xc30]
mov dword [ebp - 0xc38], ebx
push 0x400
push 1
push esi
call fcn.1000fcf7
mov edx, eax
add esp, 0x10
mov eax, ebx
test edx, edx
jne 0x10008b80
mov esi, dword [ebp - 0xc40]
mov edi, dword [ebp - 0xc3c]
push edi
call fcn.10010079
add esp, 4
push dword [ebp - 0xc30]
call fcn.1001003e
mov eax, dword [0x10130a88]
add esp, 4
mov byte [ebp - 0xc29], 1
not ebx
mov cl, byte [ebp - 0xc29]
cmp dword [esi + 4], ebx
je 0x10008d1f
add esi, 0x48
mov dword [ebp - 0xc40], esi
cmp esi, eax
jne 0x10008b03
mov ebx, dword [ebp - 0xc34]
lea eax, [ebp - 0xa30]
mov ecx, 0x82
lea esi, [ebp - 0x210]
lea edi, [ebp - 0xa30]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [0x10130a9c]
mov eax, dword [0x10130aa0]
cmp esi, eax
je 0x10008cf6
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
cmp byte [esi], 1
jne 0x10008ce8
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x620]
push str._s_S
push eax
call edi
lea eax, [ebp - 0x620]
push str.:Windows_
push eax
call fcn.1000d9b0
add esp, 0x18
test eax, eax
jne 0x10008ce3
lea eax, [ebp - 0x620]
push str.:SystemRoot_
push eax
call fcn.1000d9b0
add esp, 8
test eax, eax
jne 0x10008ce3
lea eax, [ebp - 0x620]
push str.System32_
push eax
call fcn.1000d9b0
add esp, 8
test eax, eax
jne 0x10008ce3
push 0x1002c600
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0xc38]
push eax
call fcn.1000fa90
mov eax, dword [ebp - 0xc38]
add esp, 0xc
test eax, eax
jne 0x10008d6f
mov eax, dword [0x10130aa0]
add esi, 0x105
cmp esi, eax
jne 0x10008c50
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c666
mov esp, ebp
pop ebp
ret 8
call fcn.1001003e
add esp, 4
jmp 0x10008c11
movups xmm0, xmmword [esi + 0x28]
push dword [ebp - 0xc34]
movups xmmword [ebp - 0xc88], xmm0
movups xmm0, xmmword [esi + 0x38]
movups xmmword [ebp - 0xc78], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc44]
lea edx, [ebp - 0xc88]
mov ecx, 2
call fcn.10005900
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c666
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.1001003e
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc44]
lea edx, [ebp - 0xc88]
mov ecx, 5
call fcn.10005900
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop edi
pop esi
pop ebx
call fcn.1000c666
mov esp, ebp
pop ebp
ret 8