Function at 0x10003e90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov cx, ax
push esi
lea esp, [esp]
movsx esi, byte [eax + 0x1012a58d]
movsx dx, byte [eax + 0x1012a58c]
add dx, si
movsx esi, byte [eax + 0x1012a58f]
add dx, si
movsx esi, byte [eax + 0x1012a58e]
add dx, si
add eax, 4
add cx, dx
cmp eax, 0x20
jb 0x10003eb0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov al, cl
add al, byte [0x112827d0]
mov word [ebp - 0xc], cx
mov ecx, dword [ebp - 0xc]
push ebx
shr ecx, 8
add cl, byte [0x112827d4]
sub al, 0xf
push edi
lea edx, [ebp - 0xc]
mov byte [0x1012fe12], al
push edx
lea eax, [ebp - 0x1c]
add cl, 0xf
push eax
mov byte [0x1012fe11], cl
mov dword [ebp - 0xc], 0x76636572
mov byte [ebp - 8], 0
mov dword [ebp - 0x1c], 0x5f327357
mov dword [ebp - 0x18], 0x642e3233
mov word [ebp - 0x14], 0x6c6c
mov byte [ebp - 0x12], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov dword [0x1012fe44], eax
mov dword [ebp - 0xc], 0x646e6573
mov byte [ebp - 8], 0
mov dword [ebp - 0x1c], 0x5f327357
mov dword [ebp - 0x18], 0x642e3233
mov word [ebp - 0x14], 0x6c6c
mov byte [ebp - 0x12], 0
call esi
push eax
call edi
mov dword [0x1012fe40], eax
mov ecx, 0xd4
xor eax, eax
jmp 0x10003f90
mov dl, byte [eax + 0x1001f94c]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x2c], dl
inc eax
and ecx, 0xff
cmp eax, 0xc
jb 0x10003f90
mov byte [ebp - 0x20], 0
mov ecx, 0x8c
xor eax, eax
mov dl, byte [eax + 0x1001f95c]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x1c], dl
inc eax
and ecx, 0xff
cmp eax, 0xc
jb 0x10003fb4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov byte [ebp - 0x10], 0
call esi
push eax
call edi
mov edx, dword [0x1012fe40]
xor ecx, ecx
cmp dword [0x112827d0], 0
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x10], cl
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x20], cl
mov ecx, dword [0x1012fe44]
mov dword [0x1012fe68], ecx
mov dword [0x1012fe64], edx
mov esi, dword [ecx]
mov dword [0x1012fe58], esi
mov cl, byte [ecx + 4]
mov byte [0x1012fe5c], cl
mov ecx, dword [edx]
mov dword [0x1012fe50], ecx
movzx edx, byte [edx + 4]
mov byte [0x1012fe54], dl
mov ecx, dword [eax]
mov dword [0x1012fe48], ecx
movzx edx, byte [eax + 4]
pop edi
mov dword [0x1012fe3c], eax
mov dword [0x1012fe60], eax
mov byte [0x1012fe4c], dl
pop ebx
jne 0x10004063
cmp dword [0x112827d4], 0
je 0x100040d9
call fcn.10017a90
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10017f70
push 0x10003dc0
push 0x1012fe68
call fcn.10017540
call fcn.10017b00
call fcn.10017a90
call esi
push eax
call fcn.10017f70
push 0x10003e30
push 0x1012fe64
call fcn.10017540
call fcn.10017b00
mov eax, dword [0x1012fe44]
mov ecx, dword [eax]
mov dword [0x1012fe58], ecx
movzx edx, byte [eax + 4]
mov eax, dword [0x1012fe40]
mov byte [0x1012fe5c], dl
mov ecx, dword [eax]
mov dword [0x1012fe50], ecx
movzx edx, byte [eax + 4]
mov byte [0x1012fe54], dl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100189a8
mov esp, ebp
pop ebp
ret