Function at 0x1002f480
Capabilities:
Create thread
Encode data using xor
Generate random numbers using a mersenne twister
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004468c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1584
call fcn.1003f530
mov eax, dword [0x1005b034]
xor eax, esp
mov dword [esp + 0x1580], eax
push ebx
push esi
push edi
mov eax, dword [0x1005b034]
xor eax, esp
push eax
lea eax, [esp + 0x1598]
mov dword fs:[0], eax
xor ebx, ebx
xor edi, edi
mov eax, 0x1004df8f
lea esi, [esp + 0x5c]
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
call fcn.10002d20
mov dword [esp + 0x15a0], ebx
mov esi, dword [sym.imp.MSVCP100.dll_unsigned_int___cdecl_std::tr1::_Random_device_void_]
call esi
mov dword [esp + 0x15a0], 0xffffffff
cmp dword [esp + 0x70], 0x10
jb 0x1002f516
mov eax, dword [esp + 0x5c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
call esi
mov ecx, 1
lea ecx, [ecx]
mov edx, eax
shr edx, 0x1e
xor eax, edx
imul eax, eax, 0x6c078965
add eax, ecx
inc ecx
cmp ecx, 0x270
jl 0x1002f520
push ebx
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
push str..Xor_PlusSplashXor_Welc.bmp
lea eax, [esp + 0xc8]
mov dword [0x101750dc], ebx
call fcn.10030170
mov dword [esp + 0x15a0], 1
mov eax, dword [esp + 0x1c8]
mov esi, dword [esp + 0x1cc]
cmp eax, ebx
je 0x1002f59a
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
mov dword [esp + 0x1cc], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov eax, dword [esp + 0x1e0]
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
lea eax, [esp + 0xc4]
call fcn.10030260
mov eax, dword [esp + 0x1c8]
cmp eax, ebx
je 0x1002f5d7
add esi, 0xb4
shr esi, 1
push esi
mov edx, 0xf
mov ecx, 0x1004ffb8
lea ebx, [esp + 0xc8]
call fcn.1002ff10
mov eax, dword [esp + 0x1c8]
lea ecx, [esp + 0xa4]
push ecx
mov ebx, eax
push eax
mov dword [esp + 0x3c], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0xac]
sub eax, dword [esp + 0xa4]
mov esi, dword [esp + 0xb0]
sub esi, dword [esp + 0xa8]
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x10
push 0
push 0
push 0
push str..Xor_PlusSplashProgress_Bar.bmp
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov edi, eax
mov dword [esp + 0x30], edi
test edi, edi
je 0x1002fa21
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea edx, [esp + 0x5c]
push edx
push 0x18
push edi
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x64]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x3c], eax
xor eax, eax
sub esi, edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], 0xffffff
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov byte [esp + 0x15a0], 2
mov dword [esp + 0x98], eax
mov byte [esp + 0x88], al
lea edi, [eax + 0x1c]
mov eax, str.XOR
lea esi, [esp + 0x88]
mov dword [esp + 0x9c], 0xf
call fcn.10002d20
mov ecx, esi
lea edi, [esp + 0x4c]
mov byte [esp + 0x15a0], 3
call fcn.10008e30
cmp dword [esp + 0x9c], 0x10
jb 0x1002f6f9
mov eax, dword [esp + 0x88]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor esi, esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], esi
jmp 0x1002f707
xor esi, esi
mov eax, 0x51eb851f
imul dword [esp + 0x18]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push str._d__
lea edx, [esp + 0x1578]
call fcn.10030460
add esp, 8
push 0x400
lea edx, [esp + 0x7c]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x157c]
push eax
push ebx
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x84]
sub edi, dword [esp + 0x7c]
sub eax, ecx
sub ecx, dword [esp + 0x78]
cdq
sub eax, edx
mov esi, eax
mov eax, edi
cdq
sub eax, edx
mov edx, dword [esp + 0x24]
sar eax, 1
push 0xffffff
lea eax, [eax + edx - 0x1c]
push ebx
sar esi, 1
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x2dbfd
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
push 0
push 0
push 0
lea edx, [esp + 0xc0]
push edx
push 2
add eax, 0x5c
push 0
mov dword [esp + 0xd0], eax
push 0
add ecx, 0xa
add eax, edi
push ebx
mov dword [esp + 0xd4], 0xa
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe0], eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0x13100a
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esp + 0x1c]
mov eax, 0x51eb851f
imul dword [esp + 0x28]
mov eax, dword [esp + 0x30]
sar edx, 5
mov edi, edx
push eax
shr edi, 0x1f
push ecx
add edi, edx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x40]
push eax
push edi
push 0
push 0
push edx
push eax
mov eax, dword [esp + 0x40]
push edi
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0xffffff
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea eax, [esp + 0x1570]
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002f870
sub eax, edi
mov edi, dword [esp + 0x48]
push eax
lea edx, [esp + 0x1574]
push edx
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_TextOutA]
mov esi, dword [esp + 0x4c]
xor eax, eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
cmp dword [esi + 0x14], 0x10
jb 0x1002f8bb
mov eax, dword [esi]
jmp 0x1002f8bd
mov eax, esi
push 0x400
lea ecx, [esp + 0x8c]
push ecx
push 0xffffffffffffffff
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push edi
push 5
push ebx
call dword [sym.imp.GDI32.dll_GetPixel]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov edx, dword [esp + 0x14]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x1002f8ff
mov ecx, dword [esi]
jmp 0x1002f901
mov ecx, esi
push eax
push ecx
push edi
push 5
push ebx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
add dword [esp + 0x18], 0x64
add dword [esp + 0x28], ecx
inc eax
mov dword [esp + 0x2c], eax
cmp eax, 0xa
jg 0x1002f935
mov dword [esp + 0x14], 0xffffff
jmp 0x1002f9b7
cmp eax, 0x14
jg 0x1002f944
mov dword [esp + 0x14], 0x8dfe39
jmp 0x1002f9b7
cmp eax, 0x1e
jg 0x1002f953
mov dword [esp + 0x14], 0xffffff
jmp 0x1002f9b7
cmp eax, 0x28
jg 0x1002f962
mov dword [esp + 0x14], 0x8dfe39
jmp 0x1002f9b7
cmp eax, 0x32
jg 0x1002f971
mov dword [esp + 0x14], 0xffffff
jmp 0x1002f9b7
cmp eax, 0x3c
jg 0x1002f980
mov dword [esp + 0x14], 0x8dfe39
jmp 0x1002f9b7
cmp eax, 0x46
jg 0x1002f98f
mov dword [esp + 0x14], 0xffffff
jmp 0x1002f9b7
cmp eax, 0x50
jg 0x1002f99e
mov dword [esp + 0x14], 0x8dfe39
jmp 0x1002f9b7
xor edx, edx
cmp eax, 0x5a
setg dl
dec edx
and edx, 0x7201c6
add edx, 0x8dfe39
mov dword [esp + 0x14], edx
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [0x101774cd], 1
je 0x1002f9e5
cmp dword [esp + 0x18], 0x2710
jle 0x1002f705
mov esi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [esp + 0x34]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [esp + 0x50]
mov eax, esi
call fcn.10009080
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x1002fa9d
cmp dword [0x10172f38], 1
jne 0x1002fa9d
mov eax, dword [0x101775ac]
test eax, eax
je 0x1002fa76
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1002fa71
xor eax, eax
cmp dword [esp + 0x20], 0x103
sete al
test eax, eax
je 0x1002fa71
mov edx, dword [0x101775ac]
push edx
mov byte [0x1005e299], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x101775ac], eax
jmp 0x1002fa76
mov eax, dword [0x101775ac]
cmp byte [0x1005e299], 0
je 0x1002fa9d
test eax, eax
jne 0x1002fa9d
push eax
push eax
push eax
push 0x10024f60
push eax
push eax
mov byte [0x101774df], al
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x101775ac], eax
mov eax, dword [esp + 0x1c8]
test eax, eax
je 0x1002fad1
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [esp + 0x1cc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov eax, dword [esp + 0x1e0]
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [esp + 0x1d8]
mov dword [esp + 0xc4], vtable.CSplash.0
test eax, eax
je 0x1002faee
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1598]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1580]
xor ecx, esp
call fcn.1003e6b0
mov esp, ebp
pop ebp
ret