Function at 0x10030130
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0x100
mov eax, dword [esp + 0x110]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x10c]
mov dword [esp + 0xf4], eax
mov eax, dword [0x1005fd38]
mov dword [esp + 0xf8], eax
mov eax, dword [0x1005fd34]
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0xf8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl al
mov byte [esp + 0xe9], al
mov ah, cl
xor ah, 0xff
mov byte [esp + 0xea], ah
xor al, 0xff
mov byte [esp + 0xeb], al
mov dl, 1
xor dl, 0
mov byte [esp + 0xec], dl
and ah, 0
mov byte [esp + 0xed], ah
and cl, dl
mov byte [esp + 0xee], cl
and al, 0
mov byte [esp + 0xef], al
mov cl, byte [esp + 0xee]
mov al, byte [esp + 0xed]
mov ah, byte [esp + 0xec]
mov dl, byte [esp + 0xe9]
and dl, ah
mov byte [esp + 0xe7], dl
or al, cl
mov byte [esp + 0xe8], al
mov al, byte [esp + 0xe8]
mov dl, byte [esp + 0xe7]
mov cl, byte [esp + 0xef]
or cl, dl
xor al, cl
mov byte [esp + 0xe6], al
mov cl, byte [esp + 0xeb]
mov al, byte [esp + 0xea]
or al, cl
mov byte [esp + 0xe5], al
mov al, byte [esp + 0xe6]
mov dl, byte [esp + 0xec]
mov cl, byte [esp + 0xe5]
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x1003026a
jmp 0x1003095a
mov eax, dword [esp + 0xf0]
add eax, 0x1d
mov dword [esp + 0xdc], eax
mov eax, dword [0x1005e2fc]
cmp dword [eax - 0x2b4f3af2], 1
sete al
mov byte [esp + 0xe1], al
mov eax, dword [0x1005fd38]
mov ecx, dword [0x1005fd34]
mov edx, eax
sub edx, 0x84791187
sub edx, 1
add edx, 0x84791187
imul eax, edx
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0xe2], al
cmp ecx, 0xa
setl cl
mov byte [esp + 0xe3], cl
xor al, 0xff
mov byte [esp + 0xe4], al
mov al, byte [esp + 0xe2]
mov dl, byte [esp + 0xe4]
mov cl, byte [esp + 0xe3]
xor cl, 0xff
mov byte [esp + 0xd8], cl
mov cl, 1
xor cl, 0
mov byte [esp + 0xd9], cl
and dl, 0
mov byte [esp + 0xda], dl
and al, cl
mov byte [esp + 0xdb], al
mov al, byte [esp + 0xd8]
and al, 0
mov byte [esp + 0xd7], al
mov cl, byte [esp + 0xd9]
mov al, byte [esp + 0xe3]
and al, cl
mov byte [esp + 0xd6], al
mov dl, byte [esp + 0xd9]
mov ah, byte [esp + 0xd8]
mov cl, byte [esp + 0xe4]
mov dh, byte [esp + 0xd6]
mov ch, byte [esp + 0xd7]
mov bl, byte [esp + 0xdb]
mov al, byte [esp + 0xda]
or al, bl
or ch, dh
xor al, ch
or cl, ah
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
mov byte [esp + 0xd5], al
mov al, byte [esp + 0xd5]
test al, 1
jne 0x10030399
jmp 0x1003095a
mov eax, dword [0x1005fd38]
mov dword [esp + 0xc8], eax
mov eax, dword [0x1005fd34]
mov dword [esp + 0xcc], eax
xor eax, eax
sub eax, 1
mov dword [esp + 0xd0], eax
mov ecx, dword [esp + 0xd0]
mov eax, dword [esp + 0xc8]
add eax, ecx
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0xcc]
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc8]
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
mov byte [esp + 0xc0], cl
cmp eax, 0xa
setl al
mov byte [esp + 0xc1], al
xor cl, 0xff
mov byte [esp + 0xc2], cl
xor al, 0xff
mov byte [esp + 0xc3], al
mov al, byte [esp + 0xc0]
mov dl, byte [esp + 0xc2]
mov cl, 1
xor cl, 0
mov byte [esp + 0xbd], cl
and dl, 0
mov byte [esp + 0xbe], dl
and al, cl
mov byte [esp + 0xbf], al
mov cl, byte [esp + 0xc3]
mov al, byte [esp + 0xc2]
mov dh, byte [esp + 0xbf]
mov dl, byte [esp + 0xbe]
mov bl, byte [esp + 0xbd]
mov ch, byte [esp + 0xc1]
mov ah, cl
and ah, 0
and ch, bl
or dl, dh
or ah, ch
xor dl, ah
mov byte [esp + 0xbb], dl
or al, cl
mov byte [esp + 0xbc], al
mov al, byte [esp + 0xbb]
mov dl, byte [esp + 0xbd]
mov cl, byte [esp + 0xbc]
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x100304bc
jmp 0x10030a7f
mov eax, dword [0x1005fd38]
mov dword [esp + 0xac], eax
mov ecx, dword [0x1005fd34]
mov dword [esp + 0xb0], ecx
add eax, 0x1b64acc7
sub eax, 1
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0xb4]
sub eax, 0x1b64acc7
mov dword [esp + 0xa8], eax
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0xac]
imul eax, ecx
and eax, 1
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa4]
cmp ecx, 0
sete cl
cmp eax, 0xa
setl al
mov byte [esp + 0x9d], al
mov ah, cl
xor ah, 0xff
mov byte [esp + 0x9e], ah
xor al, 0xff
mov byte [esp + 0x9f], al
mov dl, 1
xor dl, 0
mov byte [esp + 0xa0], dl
and ah, 0
mov byte [esp + 0xa1], ah
and cl, dl
mov byte [esp + 0xa2], cl
and al, 0
mov byte [esp + 0xa3], al
mov cl, byte [esp + 0xa3]
mov ah, byte [esp + 0xa2]
mov al, byte [esp + 0xa1]
mov ch, byte [esp + 0xa0]
mov dl, byte [esp + 0x9d]
and dl, ch
or al, ah
or cl, dl
xor al, cl
mov byte [esp + 0x9c], al
mov al, byte [esp + 0x9c]
mov dl, byte [esp + 0xa0]
mov ah, byte [esp + 0x9f]
mov cl, byte [esp + 0x9e]
or cl, ah
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x100305d7
jmp 0x10030a7f
mov eax, dword [0x1005fd38]
mov dword [esp + 0x90], eax
mov ecx, dword [0x1005fd34]
mov dword [esp + 0x94], ecx
sub eax, 0xe3b19c6f
sub eax, 1
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x98]
add eax, 0xe3b19c6f
mov dword [esp + 0x8c], eax
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
imul eax, ecx
mov dword [esp + 0x88], eax
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x88]
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x85], al
cmp ecx, 0xa
setl cl
mov byte [esp + 0x86], cl
and al, cl
mov byte [esp + 0x87], al
mov al, byte [esp + 0x87]
mov dl, byte [esp + 0x86]
mov cl, byte [esp + 0x85]
xor cl, dl
or al, cl
test al, 1
jne 0x10030684
jmp 0x1003097b
mov eax, dword [0x1005fd38]
mov dword [esp + 0x78], eax
mov ecx, dword [0x1005fd34]
mov dword [esp + 0x7c], ecx
sub eax, 0xc58ebd17
sub eax, 1
add eax, 0xc58ebd17
mov dword [esp + 0x80], eax
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
imul eax, ecx
and eax, 1
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x74]
cmp ecx, 0
sete cl
mov byte [esp + 0x72], cl
cmp eax, 0xa
setl al
mov byte [esp + 0x73], al
mov cl, byte [esp + 0x73]
mov al, byte [esp + 0x72]
and al, cl
mov byte [esp + 0x71], al
mov cl, byte [esp + 0x73]
mov al, byte [esp + 0x72]
xor al, cl
mov byte [esp + 0x70], al
mov cl, byte [esp + 0x70]
mov al, byte [esp + 0x71]
or al, cl
test al, 1
jne 0x1003070f
jmp 0x1003097b
mov cl, byte [esp + 0xe1]
xor eax, eax
test cl, 1
mov dword [esp + 0x6c], eax
jne 0x100307bd
jmp 0x1003072a
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xdc]
mov dword [esp + 0x68], eax
mov bh, byte [edx + eax]
mov esi, 0x1d
xor edx, edx
div esi
mov eax, dword [esp + 0x68]
mov bl, byte [ecx + edx]
mov dl, bh
xor dl, 0xff
and dl, 0xbb
mov cl, 0xff
xor cl, 0xbb
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0xbb
and bl, cl
mov ecx, dword [esp + 0xf4]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0x41
mov dword [esp + 0x6c], eax
jne 0x1003072a
mov eax, dword [0x1005e2fc]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x64]
add eax, 0xd4b0c50e
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
mov dword [eax], 1
jmp 0x100307bd
mov eax, dword [0x1005fd38]
mov dword [esp + 0x54], eax
mov ecx, dword [0x1005fd34]
mov dword [esp + 0x58], ecx
sub eax, 0x16547f88
sub eax, 1
add eax, 0x16547f88
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x54]
imul eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
and eax, 1
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x4c]
cmp eax, 0
sete ah
cmp ecx, 0xa
setl cl
mov dl, ah
xor dl, 0xff
mov byte [esp + 0x47], dl
mov al, cl
xor al, 0xff
mov byte [esp + 0x48], al
mov ch, 1
xor ch, 0
mov byte [esp + 0x49], ch
and dl, 0
and ah, ch
and al, 0
and cl, ch
or dl, ah
mov byte [esp + 0x4a], dl
or al, cl
mov byte [esp + 0x4b], al
mov dl, byte [esp + 0x49]
mov ah, byte [esp + 0x48]
mov cl, byte [esp + 0x47]
mov ch, byte [esp + 0x4b]
mov al, byte [esp + 0x4a]
xor al, ch
or cl, ah
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
mov byte [esp + 0x46], al
mov al, byte [esp + 0x46]
test al, 1
jne 0x10030875
jmp 0x10030980
mov eax, dword [0x1005fd38]
mov dword [esp + 0x38], eax
mov ecx, dword [0x1005fd34]
mov dword [esp + 0x3c], ecx
add eax, 0x41005884
sub eax, 1
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
sub edx, 0x41005884
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
mov byte [esp + 0x36], cl
cmp eax, 0xa
setl al
mov byte [esp + 0x37], al
mov al, byte [esp + 0x36]
mov cl, byte [esp + 0x37]
mov dl, al
xor dl, 0xff
mov byte [esp + 0x31], dl
xor cl, 0xff
mov byte [esp + 0x32], cl
mov cl, 1
xor cl, 1
mov byte [esp + 0x33], cl
and dl, 0xff
mov byte [esp + 0x34], dl
and al, cl
mov byte [esp + 0x35], al
mov cl, byte [esp + 0x33]
mov al, byte [esp + 0x37]
mov dl, byte [esp + 0x32]
and dl, 0xff
mov byte [esp + 0x2f], dl
and al, cl
mov byte [esp + 0x30], al
mov cl, byte [esp + 0x32]
mov al, byte [esp + 0x31]
mov ch, byte [esp + 0x30]
mov ah, byte [esp + 0x2f]
mov dh, byte [esp + 0x35]
mov dl, byte [esp + 0x34]
or dl, dh
or ah, ch
xor dl, ah
mov byte [esp + 0x2d], dl
or al, cl
xor al, 0xff
mov byte [esp + 0x2e], al
mov al, byte [esp + 0x2d]
mov cl, byte [esp + 0x2e]
mov dl, byte [esp + 0x33]
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x10030951
jmp 0x10030980
add esp, 0x100
pop esi
pop ebx
ret
mov eax, dword [0x1005e2fc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
add eax, 0xd4b0c50e
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
jmp 0x1003026a
jmp 0x10030684
mov eax, dword [0x1005fd38]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [0x1005fd34]
mov dword [esp + 0x18], ecx
mov ecx, eax
sub ecx, 0x9e99b68
sub ecx, 1
add ecx, 0x9e99b68
imul eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x17], al
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x18]
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
mov byte [esp + 0x15], dl
xor al, cl
mov byte [esp + 0x16], al
mov cl, byte [esp + 0x16]
mov al, byte [esp + 0x15]
or al, cl
mov byte [esp + 0x14], al
mov al, byte [esp + 0x14]
test al, 1
jne 0x100309fb
jmp 0x10030a84
mov eax, dword [0x1005fd38]
mov dword [esp + 8], eax
mov ecx, dword [0x1005fd34]
mov dword [esp + 0xc], ecx
sub eax, 0xefdce26d
sub eax, 1
add eax, 0xefdce26d
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
imul eax, ecx
and eax, 1
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp eax, 0
sete al
mov byte [esp + 3], al
mov al, byte [esp + 3]
mov ecx, dword [esp + 0xc]
cmp ecx, 0xa
setl cl
mov byte [esp + 1], cl
and al, cl
mov byte [esp + 2], al
mov al, byte [esp + 2]
mov dl, byte [esp + 1]
mov cl, byte [esp + 3]
xor cl, dl
or al, cl
mov byte [esp], al
mov al, byte [esp]
test al, 1
jne 0x10030a7a
jmp 0x10030a84
jmp 0x10030875
jmp 0x100304bc
jmp 0x100309fb