Function at 0x1000ea72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1003f97c]
sub esp, 0x3c
mov ecx, 0x10035cf0
imul eax, eax, 0x7ae06f84
inc ecx
cmp byte [ecx], 0
jne 0x1000ea82
mov ecx, dword [0x1003f8cc]
mov edx, ecx
push ebx
push esi
or edx, 0x6a4a3960
xor ebx, ebx
push edi
mov esi, ebx
xor ecx, 0xd45b4094
inc esi
cmp word [esi*2 + str.2_202P2X2_2l2], bx
jne 0x1000eaa3
mov ecx, dword [ebp - 4]
jmp 0x1000eacf
cmp ecx, 0xabb
jne 0x1000eac6
sub eax, 0x6e6f796a
mov edx, eax
and edx, 0x189b316
inc ecx
cmp ecx, esi
jb 0x1000eab9
push 7
pop ecx
mov esi, str.4_444_4H4h4t4
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
push 0x30
pop esi
cmp si, word [ebp - 0x24]
jne 0x1000eb2e
xor edi, edi
mov ecx, edi
test si, si
je 0x1000eb0b
cmp word [ebp + ecx - 0x24], di
je 0x1000eb0b
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + str.0_060B0T0f0]
cmp si, word [ebp + ecx - 0x24]
je 0x1000eaed
mov ecx, dword [ebp - 4]
cmp ecx, ebx
jae 0x1000eb2e
imul eax, eax, 0x409b9048
cmp ecx, 0x1ba2
lea edx, [eax + 0x3930410]
cmovne edx, eax
inc ecx
mov eax, edx
cmp ecx, ebx
jb 0x1000eb18
push 5
pop ecx
mov esi, str.__winlogininstall1
lea edi, [ebp - 0x1c]
xor ebx, ebx
or edx, 0x54d072e9
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x1c], 0x37
mov eax, ebx
jne 0x1000eb64
mov cl, 0x37
test cl, cl
je 0x1000eb64
cmp byte [ebp + eax - 0x1c], bl
je 0x1000eb64
mov cl, byte [eax + 0x10036461]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x1000eb4d
movzx ecx, byte [eax + str.7_7_70787D7d7l7t77]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0xd18
jne 0x1000eb82
imul edx, edx, 0x40b1c365
jmp 0x1000eb88
xor edx, 0x8d89f039
xor edx, 0xefb67ff8
mov esi, ebx
and edx, 0x74cbf457
imul eax, edx, 0x229bd64a
mov ebx, eax
mov dword [0x1003f8cc], eax
xor ebx, 0x973ac801
mov dword [0x1003f97c], ebx
inc esi
cmp byte [esi + str.11252G2D3], 0
jne 0x1000ebaf
mov ecx, dword [ebp - 4]
cmp ecx, esi
jae 0x1000ebdd
cmp ecx, 0x2066
jne 0x1000ebce
lea eax, [edx - 0x25b1a83d]
add eax, 0x6fb1268a
inc ecx
cmp ecx, esi
jb 0x1000ebc0
mov dword [0x1003f8cc], eax
xor edi, edi
mov esi, str.Call_stack:
push 6
mov edx, edi
lea edi, [ebp - 0x20]
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x66
pop esi
xor edi, edi
cmp si, word [ebp - 0x20]
jne 0x1000ec44
mov ecx, edi
test si, si
je 0x1000ec19
cmp word [ebp + ecx - 0x20], di
je 0x1000ec19
inc edx
lea ecx, [edx + edx]
movzx esi, word [ecx + str.fribourg]
cmp si, word [ebp + ecx - 0x20]
je 0x1000ebfb
mov ecx, dword [ebp - 4]
cmp ecx, edx
jae 0x1000ec44
cmp ecx, 0x1bbe
jne 0x1000ec34
lea ebx, [eax + 0x6ddea787]
mov dword [0x1003f97c], ebx
imul eax, eax, 0x21274e52
inc ecx
cmp ecx, edx
jb 0x1000ec20
mov dword [0x1003f8cc], eax
push 0xd
mov edx, edi
mov esi, 0x10035794
pop ecx
lea edi, [ebp - 0x3c]
xor eax, 0x571c8a99
rep movsd dword es:[edi], dword [esi]
push 0x32
mov dword [0x1003f888], eax
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x3c]
jne 0x1000ecb5
xor edi, edi
mov ecx, edi
test si, si
je 0x1000ec8a
cmp word [ebp + ecx - 0x3c], di
je 0x1000ec8a
inc edx
lea ecx, [edx + edx]
movzx esi, word [ecx + str.2_202P2X2_2l2]
cmp si, word [ebp + ecx - 0x3c]
je 0x1000ec6c
mov ecx, dword [ebp - 4]
cmp ecx, edx
jae 0x1000ecb5
cmp ecx, 0x2048
jne 0x1000eca5
sub ebx, 0x353028a5
mov dword [0x1003f97c], ebx
imul eax, eax, 0x86ccf68a
inc ecx
cmp ecx, edx
jb 0x1000ec91
mov dword [0x1003f888], eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret