Function at 0x1000fd50
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100653c6
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x10078014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x14], 0x10
lea edx, [ecx + 4]
jb 0x1000fd8a
mov edx, dword [ecx + 4]
cmp byte [edx], 0
jne 0x1000fd93
xor ecx, ecx
jmp 0x1000fda1
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fd98
sub ecx, esi
push ecx
push edx
mov ecx, 0x1007a770
call fcn.100028c0
mov esi, dword [0x1007a780]
test esi, esi
je 0x100100a8
cmp dword [0x1007a7a4], 0x10
mov edx, 0x1007a790
mov edi, dword [0x1007a7a0]
mov ecx, 0x1007a770
cmovae edx, dword [0x1007a790]
mov eax, edi
cmp dword [0x1007a784], 0x10
cmovae ecx, dword [0x1007a770]
cmp esi, edi
cmovb eax, esi
push eax
call fcn.10003140
add esp, 4
test eax, eax
jne 0x1000fe05
cmp esi, edi
jb 0x1000fe05
jbe 0x100100a8
mov ah, 0x3a
mov byte [ebp - 0x183], 0
mov bl, 0x14
mov byte [ebp - 0x188], ah
mov al, 0x5e
mov byte [ebp - 0x183], 0
mov cl, 0x49
mov dl, 0x4e
xor bl, ah
xor al, ah
xor cl, ah
mov byte [ebp - 0x187], bl
xor dl, ah
mov byte [ebp - 0x186], al
mov byte [ebp - 0x185], cl
mov byte [ebp - 0x184], dl
test bl, bl
jne 0x1000fe4b
xor ecx, ecx
jmp 0x1000fe5d
lea ecx, [ebp - 0x187]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fe54
sub ecx, edx
push ecx
push ecx
lea eax, [ebp - 0x187]
mov ecx, 0x1007a770
push eax
call fcn.1000f170
cmp eax, 0xffffffff
je 0x100100a8
movaps xmm0, xmmword [0x10070230]
xor ecx, ecx
push dword [0x1007a28c]
movups xmmword [ebp - 0x1a4], xmm0
mov dword [ebp - 0x194], 0x10131342
mov dword [ebp - 0x190], 0xd47067c
mov dword [ebp - 0x18c], 0x575744
nop dword [eax]
mov al, byte [ebp - 0x1a4]
xor byte [ebp + ecx - 0x1a3], al
inc ecx
cmp ecx, 0x1a
jb 0x1000feb0
sub esp, 0x18
mov byte [ebp - 0x189], 0
lea eax, [ebp - 0x1a3]
mov ecx, esp
push eax
call fcn.100029c0
lea eax, [ebp - 0x1c0]
push eax
call fcn.100061b0
add esp, 0x20
mov ecx, 0x1007a790
push eax
call fcn.1000b810
lea ecx, [ebp - 0x1c0]
call fcn.10002380
push 0xb8
lea eax, [ebp - 0xd0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ecx
lea ecx, [ebp - 0xd0]
call fcn.100108f0
push 0xb0
lea eax, [ebp - 0x180]
mov dword [ebp - 4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ecx
lea ecx, [ebp - 0x180]
call fcn.100106b0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x74], 0
je 0x1001007e
cmp dword [ebp - 0x130], 0
je 0x1001007e
push 2
push 0
push 0
lea ecx, [ebp - 0xd0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
lea eax, [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0xd0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
push 0
push 0
push 0
mov ebx, dword [eax + 8]
lea ecx, [ebp - 0xd0]
add ebx, dword [eax]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
add edi, 0x20
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10010068
push 0
push 4
push esi
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x14], 0
xor bl, bl
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000fff4
push 0
push eax
push esi
lea ecx, [ebp - 0x180]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x14], 0
push 0
push edi
push esi
lea ecx, [ebp - 0xd0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
mov eax, dword [ebp - 0xc8]
cmp eax, edi
mov dword [ebp - 0x14], eax
mov eax, 1
movzx ebx, bl
cmovb ebx, eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 1
push 0
push dword [0x1007a290]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1001005a
push 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x180]
push esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
test bl, bl
je 0x10010007
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea ecx, [ebp - 0xd0]
call fcn.100107c0
lea ecx, [ebp - 0x180]
call fcn.10010580
lea ecx, [ebp - 0x118]
call fcn.10010600
lea ecx, [ebp - 0x118]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x60]
call fcn.10010840
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x100100bb
push 0xffffffffffffffff
push 0
push 0x1007a770
mov ecx, 0x1007a790
call fcn.10002480
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10063065
mov esp, ebp
pop ebp
ret