Function at 0x1003682b
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], 0x3020e6d
push esi
mov cl, 0x6d
mov dword [ebp - 8], 0xa040b
mov eax, ebx
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 6
jae 0x10036856
mov cl, byte [ebp - 0xc]
jmp 0x10036847
push 0xffffffffffffffff
push 5
push 0x100df4f4
lea eax, [ebp - 0xb]
mov byte [ebp - 5], bl
push 0x100e0d90
push eax
call fcn.100672cb
and dword [ebp - 0x18], ebx
add esp, 0x14
and dword [ebp - 0x14], ebx
mov cl, 0x14
mov dword [ebp - 8], 0x757b7814
mov eax, ebx
mov word [ebp - 4], 0x70
xor byte [ebp + eax - 7], cl
inc eax
cmp eax, 4
jae 0x10036899
mov cl, byte [ebp - 8]
jmp 0x1003688a
lea eax, [ebp - 0x18]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 7]
push eax
call fcn.10062a2c
mov esi, 0x100e0d94
pop ecx
pop ecx
test al, al
je 0x1003692a
call fcn.1002a012
mov eax, dword [0x100e0d90]
sub esp, 0x18
mov ecx, esp
push dword [eax*4 + 0x100df4f4]
call fcn.100098a9
call fcn.1002920d
mov eax, dword [0x100e0a3c]
add esp, 0x18
movaps xmm0, xmmword [str._DGILML_bKGFNAO_b]
movups xmmword [ebp - 0x20], xmm0
or dword [eax + 0x174], 0xffffffff
movzx eax, byte [0x100e0828]
mov cl, byte [0x100e0827]
push eax
push ecx
mov ecx, ebx
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xe
jb 0x100368ff
sub esp, 0x18
mov byte [ebp - 0x11], bl
mov eax, esp
lea ecx, [ebp - 0x1f]
push esi
push ecx
push eax
call fcn.1001a213
add esp, 0xc
call fcn.1007b260
add esp, 0x20
push ecx
push ecx
mov dword [esp + 4], 0xbf800000
and dword [esp], ebx
call fcn.10049b54
and dword [ebp - 0x18], ebx
mov eax, ebx
and dword [ebp - 0x14], ebx
pop ecx
pop ecx
mov cl, 0x1a
mov dword [ebp - 8], 0x6c7b691a
mov word [ebp - 4], 0x7f
xor byte [ebp + eax - 7], cl
inc eax
cmp eax, 4
jae 0x10036964
mov cl, byte [ebp - 8]
jmp 0x10036955
lea eax, [ebp - 0x18]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 7]
push eax
call fcn.10062a2c
pop ecx
pop ecx
test al, al
je 0x100369b1
mov cl, 0x2c
mov dword [ebp - 0x1c], 0x5a4d5f2c
mov dword [ebp - 0x18], 0x435c0c49
mov eax, ebx
mov dword [ebp - 0x14], 0x5c595c
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x100369a2
mov cl, byte [ebp - 0x1c]
jmp 0x10036993
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push ebx
push eax
call fcn.10047bd2
pop ecx
pop ecx
push ecx
push ecx
mov dword [esp + 4], 0xbf800000
and dword [esp], ebx
call fcn.10049b54
and dword [ebp - 0x18], ebx
mov eax, ebx
and dword [ebp - 0x14], ebx
pop ecx
pop ecx
mov cl, 0x12
mov dword [ebp - 8], 0x61776012
mov word [ebp - 4], 0x6677
mov byte [ebp - 2], bl
xor byte [ebp + eax - 7], cl
inc eax
cmp eax, 5
jae 0x100369ee
mov cl, byte [ebp - 8]
jmp 0x100369df
lea eax, [ebp - 0x18]
mov byte [ebp - 2], bl
push eax
lea eax, [ebp - 7]
push eax
call fcn.10062a2c
pop ecx
pop ecx
push 0x26
pop ebx
test al, al
je 0x10036a6d
call fcn.1002a012
movzx eax, byte [0x100e0828]
mov cl, byte [0x100e0827]
push eax
push ecx
mov cl, 0x48
mov dword [ebp - 0x20], 0x3b2d3a48
mov dword [ebp - 0x1c], 0x2b683c2d
xor eax, eax
mov byte [ebp - 0x18], 0x27
mov byte [ebp - 0x17], bl
mov dword [ebp - 0x16], 0x682f212e
mov byte [ebp - 0x12], 0
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xd
jae 0x10036a4e
mov cl, byte [ebp - 0x20]
jmp 0x10036a3f
sub esp, 0x18
mov byte [ebp - 0x12], 0
mov eax, esp
lea ecx, [ebp - 0x1f]
push esi
push ecx
push eax
call fcn.1001a213
add esp, 0xc
call fcn.1007b260
add esp, 0x20
and dword [ebp - 0x18], 0
mov cl, 0x29
and dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0xc], 0x59444029
mov dword [ebp - 8], 0x5d5b46
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 6
jae 0x10036a96
mov cl, byte [ebp - 0xc]
jmp 0x10036a87
lea eax, [ebp - 0x18]
mov byte [ebp - 5], 0
push eax
lea eax, [ebp - 0xb]
push eax
call fcn.10062a2c
pop ecx
pop ecx
test al, al
je 0x10036ab2
call fcn.10029057
push ecx
push ecx
mov dword [esp + 4], 0xbf800000
and dword [esp], 0
call fcn.10049b54
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor eax, eax
pop ecx
pop ecx
mov cl, 0x16
mov dword [ebp - 0xc], 0x666e7316
mov dword [ebp - 8], 0x626479
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 6
jae 0x10036af0
mov cl, byte [ebp - 0xc]
jmp 0x10036ae1
lea eax, [ebp - 0x18]
mov byte [ebp - 5], 0
push eax
lea eax, [ebp - 0xb]
push eax
call fcn.10062a2c
pop ecx
pop ecx
test al, al
je 0x10036b0c
call fcn.100284a2
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor eax, eax
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], 0x40484945
mov dword [ebp - 0xb], 0x4006414f
mov dword [ebp - 7], 0x43424a49
mov word [ebp - 3], 0x54
xor byte [ebp + eax - 0xf], bl
inc eax
cmp eax, 0xd
jae 0x10036b43
mov bl, byte [ebp - 0x10]
jmp 0x10036b34
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
lea eax, [ebp - 0xf]
mov byte [ebp - 2], bl
push eax
call fcn.10062a2c
pop ecx
pop ecx
test al, al
je 0x10036bc5
movaps xmm0, xmmword [str.x_B___v]
mov ecx, ebx
push 0x19
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x1b173c24
mov dword [ebp - 0x28], 0x161d150d
mov word [ebp - 0x24], 0xb0c
mov byte [ebp - 0x22], bl
pop edx
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, edx
jb 0x10036b82
mov byte [ebp - 0x22], bl
mov eax, ebx
mov byte [ebp - 8], dl
mov dword [ebp - 7], 0x777c6976
mov byte [ebp - 3], bl
xor byte [ebp + eax - 7], dl
inc eax
cmp eax, 4
jae 0x10036baf
mov dl, byte [ebp - 8]
jmp 0x10036ba0
push 1
push ebx
push ebx
lea eax, [ebp - 0x3b]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 7]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov cl, 0x7e
mov dword [ebp - 0x1c], 0x81f0d7e
mov dword [ebp - 0x18], 0x110e5e1b
mov eax, ebx
mov dword [ebp - 0x14], 0xe0b0e
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xa
jae 0x10036bed
mov cl, byte [ebp - 0x1c]
jmp 0x10036bde
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], bl
push ebx
push eax
call fcn.1003f3b0
pop ecx
pop ecx
test al, al
je 0x10036d3e
and dword [ebp - 0x18], ebx
mov cl, 0x73
and dword [ebp - 0x14], ebx
xor eax, eax
push 0x10
pop ebx
mov dword [ebp - 0x10], 0x5120073
mov word [ebp - 0xc], 0x5316
mov byte [ebp - 0xa], bl
mov dword [ebp - 9], 0x1a151d1c
mov word [ebp - 5], 0x14
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x10036c3d
mov cl, byte [ebp - 0x10]
jmp 0x10036c2e
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0
push eax
lea eax, [ebp - 0xf]
push eax
call fcn.10062a2c
pop ecx
pop ecx
test al, al
je 0x10036cd8
call fcn.100402a6
mov eax, dword [0x100e0d90]
sub esp, 0x18
mov ecx, esp
push dword [eax*4 + 0x100df4f4]
call fcn.100098a9
call fcn.1002a952
movzx eax, byte [0x100e0828]
add esp, 0x18
mov cl, byte [0x100e0827]
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x1f], 0x75667163
push eax
push ecx
mov dword [ebp - 0x1b], 0x7f733074
xor eax, eax
mov dword [ebp - 0x17], 0x7779767e
mov word [ebp - 0x13], 0x30
xor byte [ebp + eax - 0x1f], bl
inc eax
cmp eax, 0xd
jae 0x10036cb9
mov bl, byte [ebp - 0x20]
jmp 0x10036caa
sub esp, 0x18
mov byte [ebp - 0x12], 0
mov eax, esp
lea ecx, [ebp - 0x1f]
push esi
push ecx
push eax
call fcn.1001a213
add esp, 0xc
call fcn.1007b260
add esp, 0x20
push ecx
push ecx
mov dword [esp + 4], 0xbf800000
and dword [esp], 0
call fcn.10049b54
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0xb], 0x626f6062
inc ecx
mov word [ebp - 7], 0x6d64
mov byte [ebp - 0xc], cl
xor eax, eax
mov byte [ebp - 5], 0
xor byte [ebp + eax - 0xb], cl
inc eax
cmp eax, 6
jae 0x10036d1d
mov cl, byte [ebp - 0xc]
jmp 0x10036d0e
lea eax, [ebp - 0x18]
mov byte [ebp - 5], 0
push eax
lea eax, [ebp - 0xb]
push eax
call fcn.10062a2c
pop ecx
pop ecx
test al, al
je 0x10036d39
call fcn.100402a6
call fcn.10041192
pop esi
pop ebx
leave
ret