Function at 0x10003630
Capabilities:
Encode data using xor
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x17fc
call fcn.1000d760
mov eax, dword [0x10136864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10137794], 1
je 0x100036ea
mov eax, dword [0x10136424]
mov dword [0x10136428], eax
mov eax, dword [0x10136430]
mov dword [0x10136434], eax
mov eax, dword [0x1013643c]
mov dword [0x10136440], eax
mov eax, dword [0x10136448]
mov dword [0x10137764], 0
mov dword [0x10137768], 0
mov dword [0x1013776c], 0
mov dword [0x10137770], 0
mov dword [0x10137774], 0
mov dword [0x10137778], 0
mov dword [0x1013777c], 0
mov dword [0x10137780], 0
mov dword [0x10137784], 0
mov dword [0x10137788], 0
mov dword [0x1013778c], 0
mov dword [0x1013644c], eax
mov word [ebp - 0x17d4], 0x74c1
call fcn.10012cb9
and eax, 0x800000ff
jns 0x10003706
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x17d2], al
mov eax, dword [0x10137794]
mov dword [ebp - 0x17d0], eax
mov eax, dword [0x10036064]
mov dword [ebp - 0x17cc], eax
mov eax, dword [str.PREMIUM]
mov dword [ebp - 0x17c8], eax
mov eax, dword [0x1002aaf8]
mov byte [ebp - 0x17d1], 0
mov dword [ebp - 0x17c4], eax
call fcn.100041c0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x17c0], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0x17b0], xmm0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x17a0], eax
lea eax, [ebp - 0x17f8]
push eax
push 0x1000
lea eax, [ebp - 0x1760]
mov dword [ebp - 0x17f8], 0
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10003aaa
push esi
mov esi, dword [ebp - 0x17f8]
shr esi, 2
push edi
xor edi, edi
mov dword [ebp - 0x17fc], esi
test esi, esi
jle 0x1000398b
push ebx
nop dword [eax + eax]
mov eax, dword [ebp + edi*4 - 0x1760]
test eax, eax
je 0x1000396b
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10003964
push 0x104
lea eax, [ebp - 0x558]
push eax
push ebx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10003964
mov eax, 0x1002aafd
mov byte [ebp - 0x17f0], 0x25
mov byte [ebp - 0x17ee], 0
mov al, byte [eax]
xor al, 0x7d
mov byte [ebp - 0x17ef], al
lea eax, [ebp - 0x558]
push eax
call fcn.10003cc0
push eax
lea eax, [ebp - 0x17f0]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov word [ebp - 0x17f0], ax
mov byte [ebp - 0x17ee], al
lea eax, [ebp - 0x760]
push 0x104
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.10003d20
add esp, 0x1c
test al, al
je 0x10003964
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10010280
mov eax, 0x1002aafd
mov byte [ebp - 0x17f4], 0x25
mov byte [ebp - 0x17f2], 0
mov al, byte [eax]
xor al, 0x7d
mov byte [ebp - 0x17f3], al
lea eax, [ebp - 0x760]
push eax
lea eax, [ebp - 0x17f4]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
add esp, 0x18
mov word [ebp - 0x17f4], ax
xor edx, edx
mov byte [ebp - 0x17f2], al
mov al, byte [ebp + edx - 0x108]
cmp al, 0x41
jl 0x100038d8
cmp al, 0x5a
jg 0x100038d8
add al, 0x20
mov byte [ebp + edx - 0x108], al
lea eax, [ebp - 0x108]
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100038e2
sub eax, esi
cmp edx, eax
jbe 0x100038c0
mov edx, 0xb4
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x1002ab00]
xor al, dl
mov byte [ebp + ecx - 0x17ec], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x17
jb 0x10003900
mov byte [ebp - 0x17d5], 0
lea ecx, [ebp - 0x17ec]
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003950
test dl, dl
je 0x1000394c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003950
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003930
xor eax, eax
jmp 0x10003955
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x10003976
mov esi, dword [ebp - 0x17fc]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jl 0x100037b0
jmp 0x1000398a
mov eax, dword [ebp + edi*4 - 0x1760]
push ebx
mov dword [ebp - 0x1764], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
push 0x104
lea eax, [ebp - 0x350]
push 0
push eax
call fcn.10010280
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10010280
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x350]
add esp, 0x18
push 0x104
push eax
push 0
call esi
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call esi
push 0x1002a5f8
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10005ee0
push 0x35
lea eax, [ebp - 0x179c]
push 0
push eax
call fcn.10010280
movups xmm0, xmmword [ebp - 0x20c]
mov eax, dword [ebp - 0x1ec]
add esp, 0x18
mov dword [ebp - 0x177c], eax
mov eax, dword [0x101377ac]
movups xmmword [ebp - 0x179c], xmm0
pop edi
movups xmm0, xmmword [ebp - 0x1fc]
pop esi
movups xmmword [ebp - 0x178c], xmm0
test eax, eax
je 0x10003a58
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1778], xmm0
mov al, byte [eax + 0x10]
mov byte [ebp - 0x1768], al
cmp byte [0x10137a70], 0
jne 0x10003a8a
lea eax, [ebp - 0x17c0]
push eax
lea eax, [ebp - 0x17c8]
push eax
push dword [ebp - 0x17cc]
push dword [ebp - 0x17d0]
push str._CHClientInfoSend__IsReconnect:__d__ClientFileCRC:__X__HackVersion:__s__HardwareId:__s
push 0
call fcn.10005720
add esp, 0x18
movzx eax, byte [ebp - 0x17d3]
mov ecx, 0x100363e0
push eax
lea eax, [ebp - 0x17d4]
push eax
call fcn.10003f40
mov byte [0x10137a70], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d74a
mov esp, ebp
pop ebp
ret