Function at 0x1003a86c
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100579b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [esp + 0x28], ebx
je 0x1003b086
cmp byte [ebp + 8], 0
je 0x1003b072
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x1c]
call fcn.1000c42d
lea ecx, [esp + 0xb0]
call fcn.1003834b
add esp, 0x18
xor ebx, ebx
mov dword [esp + 0x15c], ebx
mov eax, dword [esp + 0x98]
cmp eax, dword [esp + 0x9c]
je 0x1003ac73
lea eax, [esp + 0x50]
mov dword [esp + 0x50], ebx
push eax
push 0x1000
lea ecx, [esp + 0x5c]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
call fcn.1001de2d
mov byte [esp + 0x15c], 1
mov esi, 0x7b94
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x54]
push dword [esp + 0x54]
sar eax, 1
push eax
push esi
push 0x640c
call fcn.10034400
pop ecx
pop ecx
call eax
push dword [esp + 0x54]
lea ecx, [esp + 0x6c]
call fcn.1000c468
push 0xc22c
mov byte [esp + 0x160], 2
call fcn.1001d84f
cmp dword [esp + 0x80], 8
pop ecx
movzx edx, ax
lea ecx, [esp + 0x68]
cmovae ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x78]
mov dword [esp + 0x60], edx
cmp word [ecx + eax*2 - 2], dx
je 0x1003a997
push 1
push 0x79cf
lea eax, [esp + 0x70]
mov ecx, 0x5cc7
push eax
lea eax, [esp + 0x6c]
push eax
push 0xe89
call fcn.10039297
add esp, 0x14
push ecx
mov edx, 0xf31
lea ecx, [esp + 0x124]
call fcn.1000f178
push ecx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x168], 3
call fcn.10036cb4
push ebx
push 1
lea ecx, [esp + 0x128]
mov byte [esp + 0x164], 2
call fcn.1000cafd
cmp dword [esp + 0x7c], 8
lea eax, [esp + 0x68]
push ebx
cmovae eax, dword [esp + 0x6c]
push eax
push esi
push 0xe578
call fcn.10034400
pop ecx
pop ecx
call eax
push 0x57d8
push 0x244b
lea eax, [esp + 0x70]
mov cl, 1
push eax
push 0x708c
push 1
push 0x168f
push ebx
lea edx, [esp + 0x7c]
call fcn.100398e1
add esp, 0xc
mov dword [esp + 0x74], ebx
lea edx, [esp + 0x74]
push 1
push 0x666d
push ecx
lea ecx, [esp + 0xb4]
call fcn.1003a467
add esp, 0x1c
mov byte [esp + 0x23], bl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x44], 0x4a027a00
mov dword [esp + 0x48], 0x35602db
mov word [esp + 0x4c], 0x11d
mov byte [esp + 0x4e], bl
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0xa8]
call fcn.1000c42d
push 0x10
pop edx
lea ecx, [esp + 0x108]
mov byte [esp + 0x15c], 4
call fcn.1000f65a
lea eax, [esp + 0x108]
mov byte [esp + 0x15c], 5
push eax
push ecx
push ecx
lea ecx, [esp + 0xb0]
call fcn.10039574
add esp, 0xc
mov ecx, ebx
mov dword [esp + 0x24], ecx
push 0x2e
pop eax
push 2
mov word [esp + 0x84], ax
pop esi
cmp esi, 2
jne 0x1003aacb
push 3
pop ecx
push ecx
mov dword [esp + 0x28], ecx
pop esi
jmp 0x1003ab20
movzx edx, byte [esp + esi + 0x45]
mov eax, esi
sub eax, ecx
push 0x50aa
push 1
push 1
movzx eax, byte [esp + eax + 0x4e]
push 0x5ea6
push 0x56ec
movzx ecx, word [esp + eax*2 + 0x94]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [esp + esi + 0x58]
add ecx, edx
lea edx, [esp + 0x38]
mov word [esp + eax*2 + 0x94], cx
mov ecx, 0x2b48
call fcn.10039765
mov ecx, dword [esp + 0x38]
add esp, 0x14
add esi, 2
cmp esi, 0xb
jb 0x1003aabb
xor eax, eax
mov dword [esp + 0xe8], 7
mov word [esp + 0x88], ax
lea ecx, [esp + 0xd4]
mov word [esp + 0xd4], ax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0xe8], ebx
call fcn.1000c9db
push ecx
push ecx
lea eax, [esp + 0xdc]
mov byte [esp + 0x164], 6
push eax
lea ecx, [esp + 0xb0]
call fcn.10036cb4
push ebx
push 1
lea ecx, [esp + 0xdc]
mov byte [esp + 0x164], 5
call fcn.1000cafd
xor eax, eax
lea edi, [esp + 0x80]
cmp dword [esp + 0xb8], 8
stosd dword es:[edi], eax
push ebx
push 0x80
push 2
stosd dword es:[edi], eax
push ebx
push ebx
push 0x40000000
stosw word es:[edi], ax
lea eax, [esp + 0xbc]
cmovae eax, dword [esp + 0xbc]
mov edi, 0x7b94
push eax
push edi
push 0x6fd0
call fcn.10034400
pop ecx
pop ecx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x1003ac23
push ebx
lea eax, [esp + 0xf0]
push eax
push dword [esp + 0x6c]
push dword [esp + 0xa4]
push esi
push edi
push 0x10ea6
call fcn.10034400
pop ecx
pop ecx
call eax
push esi
test eax, eax
push edi
push 0x8176
setne bl
call fcn.10034400
pop ecx
pop ecx
call eax
test bl, bl
jne 0x1003ac89
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0x110]
call fcn.1000cafd
push ebx
push 1
lea ecx, [esp + 0xac]
mov byte [esp + 0x164], 2
call fcn.1000cafd
mov edi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x12c
jb 0x1003aa5e
push ebx
push 1
lea ecx, [esp + 0x70]
call fcn.1000cafd
lea ecx, [esp + 0x54]
call fcn.1001deb4
mov eax, dword [ebp + 0x14]
mov byte [eax], bl
lea ecx, [esp + 0x98]
call fcn.10021c40
jmp 0x1003b16e
push 0x22
pop eax
mov dword [esp + 0x2c], 0xb025600
xor ebx, ebx
mov byte [esp + 0x30], 0xc
mov edi, 0x1006cbb8
mov word [esp + 0x38], ax
mov dword [esp + 0x18], 0x5792
cmp dword [esp + 0x18], 0x5a84
jle 0x1003ad23
mov esi, ebx
mov dword [esp + 0x1c], ebx
mov ecx, esi
mov dword [esp + 0x28], 0x4de9
mov dword [esp + 0x14], ecx
mov esi, ebx
mov eax, ebx
mov dword [esp + 0x10], ebx
add eax, esi
xor eax, ecx
mov ecx, edi
cdq
push edx
push eax
call fcn.1000c318
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x777c
jl 0x1003acd3
inc esi
cmp esi, 0x141c
jl 0x1003accd
dec ecx
dec dword [esp + 0x28]
mov dword [esp + 0x14], ecx
jne 0x1003accb
mov esi, dword [esp + 0x1c]
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x5658
jl 0x1003acbd
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
push 2
mov ecx, ebx
pop esi
mov dword [esp + 0x10], ecx
cmp esi, 2
jne 0x1003ad3c
push 3
pop ecx
push ecx
mov dword [esp + 0x14], ecx
pop esi
jmp 0x1003ad93
movzx edx, byte [esp + esi + 0x2d]
mov eax, esi
sub eax, ecx
push 0x28e6
push 0x780f
push 0x4d13
movzx eax, byte [esp + eax + 0x36]
push 0x4212
push 1
movzx ecx, word [esp + eax*2 + 0x4c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [esp + esi + 0x40]
add ecx, edx
mov edx, 0x5ff0
mov word [esp + eax*2 + 0x4c], cx
lea eax, [esp + 0x24]
push eax
push 1
mov cl, 1
call fcn.100398e1
mov ecx, dword [esp + 0x2c]
add esp, 0x1c
add esi, 2
cmp esi, 5
jb 0x1003ad2c
cmp dword [esp + 0x18], 0x550a
jge 0x1003adb1
mov edx, str.jyhmq_bgdyr_pgnxarh_xfvmr_acfhiqaly_facaqbp_gdjjxcc_tpdfs
mov ecx, edi
call fcn.1000e58f
xor eax, eax
mov dword [esp + 0xd0], 7
mov word [esp + 0x3a], ax
lea ecx, [esp + 0xbc]
mov word [esp + 0xbc], ax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0xd0], ebx
call fcn.1000c9db
push ecx
lea eax, [esp + 0xc0]
mov byte [esp + 0x160], 7
push eax
lea ecx, [esp + 0xac]
mov dword [esp + 0x40], ebx
call fcn.1003b347
mov dword [esp + 0x3c], 0x5ad4
cmp dword [esp + 0x3c], 0x5bf1
pop ecx
pop ecx
jle 0x1003ae6b
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov edx, ebx
mov dword [esp + 0x14], ebx
mov esi, ebx
mov ecx, ebx
mov dword [esp + 0x18], ebx
mov eax, esi
sar eax, cl
mov ecx, edi
or eax, edx
cdq
push edx
push eax
call fcn.1000c318
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 0x6d5
jl 0x1003ae30
inc esi
cmp esi, 0x5d9b
jl 0x1003ae2a
inc edx
mov dword [esp + 0x14], edx
cmp edx, 0x5e7d
jl 0x1003ae28
push 0x53
pop eax
push 2
mov dword [esp + 0x40], 0x73011703
mov dword [esp + 0x44], 0xd000f02
mov word [esp + 0x96], ax
pop esi
movzx eax, byte [esp + esi + 0x3a]
movzx edx, byte [esp + esi + 0x3d]
mov ecx, edx
movzx eax, word [esp + eax*2 + 0x8c]
or ecx, eax
and edx, eax
movzx eax, byte [esp + esi + 0x3c]
sub ecx, edx
add esi, 2
mov word [esp + eax*2 + 0x8c], cx
cmp esi, 8
jb 0x1003ae89
mov dword [esp + 0x14], 0x1472
cmp dword [esp + 0x14], 0x1845
jle 0x1003af55
mov dword [esp + 0x24], ebx
mov esi, ebx
mov dword [esp + 0x28], ebx
mov eax, ebx
mov dword [esp + 0x1c], ebx
mov ecx, eax
mov dword [esp + 0x10], esi
mov eax, esi
mov edx, ebx
mov esi, dword [esp + 0x24]
sar eax, cl
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov ecx, edx
sar eax, cl
mov ecx, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000c318
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
inc edx
mov dword [esp + 0x18], edx
cmp edx, 0x6246
jl 0x1003aef6
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 0x7a3e
jl 0x1003aede
inc esi
mov dword [esp + 0x28], esi
cmp esi, 0x4de2
jl 0x1003aed8
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, 0x32be
jl 0x1003aed2
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_OffsetRect]
xor eax, eax
cmp dword [esp + 0x14], 0x1327
mov word [esp + 0x94], ax
jge 0x1003af75
mov edx, str.kedknvb_vyb_jdkxktqn_dcdwlhiq_tqcjkn_preoulp
mov ecx, edi
call fcn.1000e58f
cmp dword [esp + 0x34], 0x57f1
jge 0x1003af8b
mov edx, str.gocjkdlla_lky_fcvxmcspd_omcom_toeosbj_tchjktnus_ttsjcby_nnn
mov ecx, edi
call fcn.1000e58f
xor eax, eax
mov dword [esp + 0x104], 7
mov word [esp + 0xf0], ax
lea ecx, [esp + 0xf0]
lea eax, [esp + 0x8c]
mov dword [esp + 0x100], ebx
push eax
call fcn.1000c9db
push ecx
push ecx
lea eax, [esp + 0xf8]
mov byte [esp + 0x164], 8
push eax
lea ecx, [esp + 0xc8]
call fcn.10036cb4
push ebx
push 1
lea ecx, [esp + 0xf8]
mov byte [esp + 0x164], 7
call fcn.1000cafd
xor eax, eax
lea edi, [esp + 0x8c]
stosd dword es:[edi], eax
mov dl, 1
push ecx
push 0x370c
push 0x539f
stosd dword es:[edi], eax
lea ecx, [esp + 0x2f]
stosw word es:[edi], ax
call fcn.1003a5b3
add esp, 0xc
lea edx, [esp + 0x68]
lea ecx, [esp + 0xbc]
call fcn.100383da
mov ecx, dword [ebp + 0x14]
push ebx
push 1
mov byte [ecx], al
lea ecx, [esp + 0xc4]
call fcn.1000cafd
push ebx
push 1
lea ecx, [esp + 0x110]
call fcn.1000cafd
push ebx
push 1
lea ecx, [esp + 0xac]
call fcn.1000cafd
push ebx
push 1
lea ecx, [esp + 0x70]
call fcn.1000cafd
lea ecx, [esp + 0x54]
call fcn.1001deb4
jmp 0x1003ac78
push ecx
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.1003b6d2
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
jmp 0x1003b16e
cmp byte [ebp + 0x28], 0
je 0x1003b0a1
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x24]
sar ecx, 2
mov dword [eax], ecx
jmp 0x1003b16e
mov dword [esp + 0x1c], 0x16c8
mov edi, 0x1006cbb8
cmp dword [esp + 0x1c], 0x1a12
jle 0x1003b111
xor esi, esi
mov dword [esp + 0x18], esi
xor ebx, ebx
mov dword [esp + 0x34], ebx
and dword [esp + 0x50], 0
mov eax, esi
cdq
idiv ebx
mov esi, dword [esp + 0x50]
mov ebx, edx
mov eax, ebx
mov ecx, edi
and eax, esi
cdq
push edx
push eax
call fcn.1000c318
inc esi
cmp esi, 0x7d39
jl 0x1003b0d4
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x34], ebx
cmp ebx, 0x4ac0
jl 0x1003b0c4
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x75fa
jl 0x1003b0be
mov ebx, dword [esp + 0x28]
cmp dword [esp + 0x1c], 0x159b
jge 0x1003b127
mov edx, str.lohugmhn_aesvybkk_qrdcu_dlh_onipxjafw_gkvpsna_dtlqgaf_sgyesf_uiwrry_heik
mov ecx, edi
call fcn.1000e58f
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
push 0x18
cdq
pop ecx
idiv ecx
mov edi, eax
test edi, edi
je 0x1003b16e
xor esi, esi
mov edx, dword [ebx]
lea ecx, [esp + 0x138]
push dword [ebp + 0x2c]
add edx, esi
call fcn.10036dfa
pop ecx
mov ecx, dword [ebx]
push eax
add ecx, esi
call fcn.1000f26a
push 0
push 1
lea ecx, [esp + 0x140]
call fcn.1000cafd
add esi, 0x18
dec edi
jne 0x1003b13a
mov ecx, dword [esp + 0x154]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret