Function at 0x100034b0
Capabilities:
Encode data using xor
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1814
call fcn.10028f40
mov eax, dword [0x100571c4]
xor eax, esp
mov dword [esp + 0x1810], eax
cmp dword [0x1019fb34], 1
push ebx
push esi
push edi
je 0x10003574
mov eax, dword [0x1019dbd4]
mov dword [0x1019dbd8], eax
mov eax, dword [0x1019dbe0]
mov dword [0x1019dbe4], eax
mov eax, dword [0x1019dbec]
mov dword [0x1019dbf0], eax
mov eax, dword [0x1019dbf8]
mov dword [0x1019fb74], 0
mov dword [0x1019fbac], 0
mov dword [0x1019fa00], 0
mov dword [0x1019fb68], 0
mov dword [0x1019fa08], 0
mov dword [0x1019fb6c], 0
mov dword [0x1019fb48], 0
mov dword [0x1019fa2c], 0
mov dword [0x1019fb3c], 0
mov dword [0x1019fb70], 0
mov dword [0x1019fb44], 0
mov dword [0x1019dbfc], eax
mov word [esp + 0x20], 0x74c1
call fcn.1002df64
and eax, 0x800000ff
jns 0x1000358e
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x22], al
mov eax, dword [0x1019fb34]
mov dword [esp + 0x24], eax
mov eax, dword [0x1019e234]
mov dword [esp + 0x28], eax
mov eax, dword [str.PREMIUM]
mov dword [esp + 0x2c], eax
mov eax, dword [0x1004fe70]
mov byte [esp + 0x23], 0
mov dword [esp + 0x30], eax
call fcn.1001cb80
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x34], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0x44], xmm0
mov eax, dword [eax + 0x20]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x18]
push eax
push 0x1000
lea eax, [esp + 0xb8]
mov dword [esp + 0x20], 0
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x10003902
mov esi, dword [esp + 0x18]
xor edi, edi
shr esi, 2
mov dword [esp + 0x1c], esi
test esi, esi
jle 0x100037ea
nop word [eax + eax]
mov eax, dword [esp + edi*4 + 0xb0]
test eax, eax
je 0x100037ca
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x100037c3
push 0x104
lea eax, [esp + 0x140c]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100037c3
mov eax, 0x1004fe75
mov byte [esp + 0x10], 0x25
lea ecx, [esp + 0x1408]
mov byte [esp + 0x12], 0
mov al, byte [eax]
xor al, 0x7d
mov byte [esp + 0x11], al
call fcn.1001c5d0
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x12c8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
lea edx, [esp + 0x161c]
add esp, 8
mov word [esp + 0x14], ax
lea ecx, [esp + 0x140c]
mov byte [esp + 0x16], al
call fcn.1001c3b0
add esp, 4
test al, al
je 0x100037c3
push 0x104
lea eax, [esp + 0x10b4]
push 0
push eax
call fcn.1002aef0
mov eax, 0x1004fe75
mov byte [esp + 0x20], 0x25
add esp, 0xc
mov byte [esp + 0x16], 0
mov al, byte [eax]
xor al, 0x7d
mov byte [esp + 0x15], al
lea eax, [esp + 0x1610]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10b8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
add esp, 0xc
mov word [esp + 0x14], ax
xor edx, edx
mov byte [esp + 0x16], al
nop
mov al, byte [esp + edx + 0x10b0]
cmp al, 0x41
jl 0x10003738
cmp al, 0x5a
jg 0x10003738
add al, 0x20
mov byte [esp + edx + 0x10b0], al
lea eax, [esp + 0x10b0]
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003743
sub eax, esi
cmp edx, eax
jbe 0x10003720
mov edx, 0xb4
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x1004fe78]
xor al, dl
mov byte [esp + ecx + 0x98], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x17
jb 0x10003760
mov byte [esp + 0xaf], 0
lea ecx, [esp + 0x98]
lea eax, [esp + 0x10b0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100037b1
test dl, dl
je 0x100037ad
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100037b1
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003791
xor eax, eax
jmp 0x100037b6
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x100037d5
mov esi, dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jl 0x10003620
jmp 0x100037ea
mov eax, dword [esp + edi*4 + 0xb0]
push ebx
mov dword [esp + 0x94], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [esp + 0x1304]
push 0
push eax
call fcn.1002aef0
add esp, 0xc
lea eax, [esp + 0x11b8]
push 0x104
push 0
push eax
call fcn.1002aef0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x130c]
add esp, 0xc
push 0x104
push eax
push 0
call esi
lea eax, [esp + 0x1300]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x104
lea eax, [esp + 0x11bc]
push eax
push 0
call esi
push ecx
lea edx, [esp + 0x1304]
lea ecx, [esp + 0x11bc]
call fcn.1001df40
add esp, 4
lea eax, [esp + 0x58]
push 0x35
push 0
push eax
call fcn.1002aef0
movups xmm0, xmmword [esp + 0x11c4]
mov eax, dword [esp + 0x11e4]
add esp, 0xc
mov dword [esp + 0x78], eax
mov eax, dword [0x1019fbb0]
movups xmmword [esp + 0x58], xmm0
movups xmm0, xmmword [esp + 0x11c8]
movups xmmword [esp + 0x68], xmm0
test eax, eax
je 0x100038b6
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x7c], xmm0
mov al, byte [eax + 0x10]
mov byte [esp + 0x8c], al
cmp byte [0x101a0618], 0
jne 0x100038eb
lea eax, [esp + 0x34]
mov ecx, str.rj_j
push eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
call fcn.1001c970
push eax
push 0
push 0x1019dc18
call fcn.100153a0
add esp, 0x1c
movzx eax, byte [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.100020b0
mov byte [0x101a0618], 1
mov ecx, dword [esp + 0x181c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret