Function at 0x1002dd50
Capabilities:
Encode data using xor
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10114d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0x36
mov eax, dword [ebp - 0x1c]
xor al, 0x32
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x18]
movzx eax, byte [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
push ebx
xor cl, al
push esi
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x17], 0
movzx eax, byte [ebp - 0x18]
push edi
mov byte [ebp - 0x38], al
lea eax, [ebp - 0x38]
push eax
push str._with_key_0x
push 1
push str.____Select_MetaString4_implementation_
push 0x1012ca98
mov dword [ebp - 0x34], 2
call fcn.10002460
add esp, 8
mov ecx, eax
call fcn.10003830
push eax
call fcn.10002460
add esp, 8
push eax
call fcn.10007300
push eax
call fcn.10002840
lea eax, [ebp - 0x18]
push eax
call fcn.100b12c5
add esp, 0x10
mov byte [ebp - 0x20], 0x41
mov ebx, eax
mov byte [ebp - 0x1f], 0
mov cl, byte [ebp - 0x20]
lea eax, [ebp - 0x40]
movzx ecx, byte [ebp - 0x20]
push eax
push str._with_key_0x
push 2
sub cl, 0xc
mov byte [ebp - 0x40], 0xc
push str.____Select_MetaString4_implementation_
push 0x1012ca98
mov byte [ebp - 0x20], cl
mov dword [ebp - 0x3c], 2
call fcn.10002460
add esp, 8
mov ecx, eax
call fcn.10003830
push eax
call fcn.10002460
add esp, 8
push eax
call fcn.10007300
push eax
call fcn.10002840
lea eax, [ebp - 0x20]
push eax
call fcn.100b12c5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
mov dword [ebp - 0x2c], eax
xor esi, esi
nop
mov ecx, dword [0x1012c80c]
cmp byte [ecx + 0x74], 0
je 0x1002de6f
push 0x64
call edi
inc esi
cmp esi, 0x3e8
jl 0x1002de50
mov ecx, dword [0x1012c80c]
cmp byte [ebp + 8], 0
je 0x1002df6e
mov byte [ecx + 0x74], 1
mov eax, dword [0x1012c80c]
push 0
push 0
mov byte [eax + 0x6c], 0
push dword [0x1012c7dc]
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x7d0
call edi
mov ecx, dword [0x1012c80c]
movzx eax, byte [ecx + 0x6c]
cmp eax, ebx
jle 0x1002df6e
cmp eax, dword [ebp - 0x2c]
mov byte [ecx + 0x74], 0
mov eax, dword [0x1012c80c]
mov byte [eax + 0x6c], 0
jg 0x1002e067
mov dword [ebp - 0x14], 0x52
mov eax, dword [ebp - 0x14]
xor al, 0x63
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x14]
inc al
mov byte [ebp - 0xe], 0
xor al, 0x21
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
xor eax, eax
nop dword [eax]
mov cl, byte [ebp + eax - 0x10]
mov edx, dword [ebp - 0x14]
add dl, al
xor dl, cl
mov byte [ebp + eax - 0x10], dl
inc eax
cmp eax, 2
jb 0x1002def0
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0x10]
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push eax
push str._with_key_0x
push 1
push str.____Select_MetaString4_implementation_
push 0x1012ca98
mov dword [ebp - 8], 2
call fcn.10002460
add esp, 8
mov ecx, eax
call fcn.10003830
push eax
call fcn.10002460
add esp, 8
push eax
call fcn.10007300
push eax
call fcn.10002840
lea eax, [ebp - 0x10]
push eax
call fcn.1000d950
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100858b1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
mov byte [ecx + 0x6c], 0
push eax
push 0x10030810
mov dword [ebp - 0x30], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x1012c80c]
movzx ecx, byte [eax + 0x6c]
cmp ecx, ebx
jle 0x1002e033
mov byte [eax + 0x74], 0
mov eax, dword [0x1012c80c]
mov byte [eax + 0x6c], 0
cmp ecx, dword [ebp - 0x2c]
jg 0x1002e09f
mov byte [ebp - 0x24], 0x66
xor ecx, ecx
mov byte [ebp - 0x23], 0x27
mov byte [ebp - 0x22], 0
mov al, byte [ebp - 0x24]
mov al, byte [ebp + ecx - 0x24]
sub al, 3
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 2
jb 0x1002dfc0
lea eax, [ebp - 0xc]
mov byte [ebp - 0xc], 3
push eax
push str._with_key_0x
push 2
push str.____Select_MetaString4_implementation_
push 0x1012ca98
mov dword [ebp - 8], 2
call fcn.10002460
add esp, 8
mov ecx, eax
call fcn.10003830
push eax
call fcn.10002460
add esp, 8
push eax
call fcn.10007300
push eax
call fcn.10002840
lea eax, [ebp - 0x24]
push eax
call fcn.1000d950
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100858b1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x2c]
jle 0x1002e043
cmp ecx, ebx
jg 0x1002e0c6
mov ecx, dword [ebp - 4]
mov byte [eax + 0x74], 0
mov eax, dword [0x1012c80c]
pop edi
pop esi
mov byte [eax + 0x6c], 0
cmp dword [ebp - 0x30], ebx
pop ebx
setle al
xor ecx, ebp
call fcn.100858b1
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0xc], 0x2b
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor al, 0x65
mov byte [ebp - 8], al
mov eax, dword [ebp - 0xc]
inc al
mov byte [ebp - 6], 0
xor al, 0x21
mov byte [ebp - 7], al
mov al, byte [ebp - 8]
call fcn.1002feb0
push eax
call fcn.1000d950
add esp, 4
push 0
call fcn.100b1860
mov byte [ebp - 0x28], 0x68
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x27], 0x26
mov byte [ebp - 0x26], 0
mov al, byte [ebp - 0x28]
call fcn.1002ff30
push eax
call fcn.1000d950
add esp, 4
push 0
call fcn.100b1860
mov byte [eax + 0x74], 0
mov eax, dword [0x1012c80c]
push 0
mov byte [eax + 0x6c], 0
call fcn.100b1860
int3