Function at 0x1003afff
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d50f
call fcn.1005c388
sub esp, 0x164
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x64], esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1003b133
cmp byte [ebp + 0x1c], 0
je 0x1003b05e
push ecx
mov edx, 0x1b8a
lea ecx, [ebp - 0x124]
call fcn.10008047
push ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10027487
push ebx
push 1
lea ecx, [ebp - 0x124]
call fcn.100056dd
jmp 0x1003b964
mov dword [ebp - 0x24], 0x4026
xor ebx, ebx
cmp dword [ebp - 0x24], 0x42e4
jle 0x1003b0ec
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x14], ebx
mov edx, esi
mov ecx, edi
sar edx, cl
mov esi, ebx
mov dword [ebp - 0x18], edx
mov edi, ebx
lea eax, [edi + esi]
and eax, edx
lea ecx, [ebp - 0xf4]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b0a4
mov eax, dword [eax]
push eax
call fcn.100443ac
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xf4]
call fcn.10005611
mov edx, dword [ebp - 0x18]
inc edi
cmp edi, 0x5d90
jl 0x1003b087
inc esi
cmp esi, 0x36ee
jl 0x1003b085
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x52ff
jl 0x1003b07a
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3864
jl 0x1003b075
mov esi, dword [ebp + 0x10]
mov dword [esi], ebx
jmp 0x1003b111
push 0x853
push 1
push ebx
push 1
mov edx, 0x5272
mov ecx, 0x4b15
call fcn.10039801
add esp, 0x10
inc dword [esi]
cmp dword [esi], 0xb
jge 0x1003b0f3
cmp dword [ebp - 0x24], 0x3fb8
jge 0x1003b964
push str.gtce_cnywxtdx_kciamwa_hhmk_sfbxkq_aphte_zplapuokc_beyy_wvfyngcgg_ambbib_loaa_mqe_yhrm
call fcn.100443ac
pop ecx
jmp 0x1003b964
mov dword [ebp - 0x1c], 0x4625
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x492d
jle 0x1003b196
push ebx
push ebx
call dword [sym.imp.GDI32.dll_RectInRegion]
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov ecx, edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x34], ebx
sar esi, cl
mov eax, esi
mov ecx, 0x10075fb8
xor eax, ebx
cdq
push edx
push eax
call fcn.10004fa9
inc ebx
cmp ebx, 0x5b82
jl 0x1003b15e
mov esi, dword [ebp - 0x14]
inc edi
push 0
pop ebx
cmp edi, 0x66f7
jl 0x1003b154
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x5093
jl 0x1003b152
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], 3
cmp dword [ebp - 0x1c], 0x4520
jge 0x1003b1b5
mov edx, str.gvpkllqog_tsflz_gbvqpg_zwvnxyq_noi_ongl_dta_oboblp_rna_kgbnwk
mov ecx, 0x10075fb8
call fcn.1000736a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x1003b335
mov dword [ebp - 0x18], 0x3787
cmp dword [ebp - 0x18], 0x3a7e
jle 0x1003b21d
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x154]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b1f6
mov eax, dword [eax]
push eax
call fcn.100443ac
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x154]
call fcn.10005611
inc edi
cmp edi, 0x1a4b
jl 0x1003b1d7
inc esi
cmp esi, 0x1c2c
jl 0x1003b1d5
cmp dword [ebp - 0x18], 0x35a5
mov edi, dword [ebp + 0x20]
jge 0x1003b234
push str.xmw_hvajaee_imstg_mwlwyxjs_cmxm_oluxh_sqgtuo_yktmd_gyyqnm_zyuwnd_hhgk_thrluoue_jjdzvpus
call fcn.100443ac
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [edi], ebx
cmp dword [edi], 0xffffffef
jg 0x1003b964
mov dword [ebp - 0x20], 0xe35
mov dword [ebp - 0x14], 0x7af5af8b
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], 0x77e7
cmp dword [ebp - 0x18], 0x7b7f
jle 0x1003b2b9
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0xc4]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b289
mov eax, dword [eax]
push eax
call fcn.100443ac
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xc4]
call fcn.10005611
inc edi
cmp edi, 0x71d3
jl 0x1003b26b
inc esi
cmp esi, 0x3173
jl 0x1003b269
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0x20]
cmp dword [ebp - 0x18], 0x771d
jge 0x1003b2cd
push str.tdwao_qmqqvr_scf_olapxaun_jghgpwo_akf_bdpd_zznno_oapp_agh_cxtsbnw_shfnjdqp_eslbnowmw_csjkodhe
call fcn.100443ac
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1003b312
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1003b304
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x18]
mov dword [ebp - 0x74], 0x4c20f746
dec dword [edi]
jmp 0x1003b23a
mov ecx, dword [ebp + 0xc]
mov eax, 0xb4ffb871
mov edi, dword [ebp + 0x18]
mov edx, 0x28ae
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x70], 0x443250e6
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x6c], 0xf29c8dda
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x6c]
push eax
push ecx
lea eax, [ebp - 0x70]
mov dword [ebp - 0x30], ecx
push eax
push 0x2c63
mov ecx, 0x5fb5
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x3c], esi
call fcn.1003ae0d
add esp, 0x10
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 4], 9
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x24], 0x7e2799ac
mov dword [ebp - 0x14], 0x211e9a9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], ebx
jmp 0x1003b3cf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9c], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003b3be
xor dl, dl
mov ecx, 0x622f
call fcn.1003baf7
mov dword [ebp - 0x24], 0x16
cmp dword [ebp - 0x24], 0x17
jge 0x1003b605
mov dword [ebp - 0x2c], 0xe8b72fd4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0x9265
mov dword [ebp - 0x2c], ebx
jmp 0x1003b4f3
mov dword [ebp - 0x28], 0x467b
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x14], ebx
jmp 0x1003b42c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44], 0x19570a50
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003b41e
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, 0x6efe0cd1
setg dl
sub eax, edx
jne 0x1003b462
cmp dword [ebp - 0x28], ebx
je 0x1003b462
xor ecx, ecx
inc ecx
jmp 0x1003b464
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xf8b8
setne cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
sub edx, eax
mov eax, dword [ebp - 0x28]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x3ae5
setne al
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
jmp 0x1003b4ea
mov dword [ebp - 0x1c], ebx
jmp 0x1003b4d8
mov dword [ebp - 0x28], ebx
jmp 0x1003b4cf
push ecx
push ecx
call fcn.1003d66d
mov eax, dword [ebp - 0x28]
pop ecx
pop ecx
cmp dword [ebp + eax*4 - 0x44], ebx
jne 0x1003b4d5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jle 0x1003b4ba
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jle 0x1003b4b5
push ecx
xor dl, dl
call fcn.10039648
inc dword [ebp - 0x14]
pop ecx
cmp dword [ebp - 0x14], 1
jle 0x1003b4b0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jg 0x1003b40b
mov dword [ebp - 0x28], 0x7841
cmp dword [ebp - 0x28], 0x7c15
jle 0x1003b5a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, esi
mov ecx, ebx
cdq
idiv edi
mov dword [ebp - 0x14], ecx
mov edi, edx
mov eax, edi
mov esi, ebx
cdq
idiv ecx
mov ebx, edx
mov eax, esi
mov ecx, 0x10075fb8
or eax, ebx
cdq
push edx
push eax
call fcn.10004fa9
inc esi
cmp esi, 0xccc
jl 0x1003b544
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
push 0
pop ebx
cmp ecx, 0x7f3e
jl 0x1003b53b
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x7982
jl 0x1003b52f
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x1935
jl 0x1003b52a
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp + 0x18]
cmp dword [ebp - 0x94], ebx
jne 0x1003b5fd
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x28], 0x7784
jge 0x1003b5f6
mov edx, str.hdzfslo_iam_hpavd_umjkt_qlsaqf_mkcceey_wrc_idth_wai_nhyy_acplh
mov ecx, 0x10075fb8
call fcn.1000736a
jmp 0x1003b5f6
mov dword [ebp - 4], 9
inc dword [ebp - 0x24]
jmp 0x1003b3e8
cmp dword [esi + 0x14], 8
jb 0x1003b60f
mov eax, dword [esi]
jmp 0x1003b611
mov eax, esi
push dword [esi + 0x10]
mov ecx, edi
push ebx
push eax
call fcn.10027352
mov ecx, ebx
mov edi, eax
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x34]
jae 0x1003b89b
mov dword [ebp - 0x14], 0x17571177
mov dword [ebp - 0x1c], 0xbeccce1e
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xffffffe6
jne 0x1003b66a
mov byte [ebp - 0x35], bl
lea edx, [ebp - 0x35]
push 1
mov cl, 1
call fcn.1003953e
dec dword [ebp - 0x1c]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
pop ecx
je 0x1003b64b
mov ecx, dword [ebp - 0x18]
cmp edi, 0xffffffff
je 0x1003b6db
cmp edi, ecx
je 0x1003b6a7
mov eax, edi
sub eax, ecx
push eax
push ecx
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0xdc]
push eax
call fcn.1003dadb
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xf
call fcn.1003db89
push ebx
push 1
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 9
call fcn.100056dd
mov eax, dword [ebp - 0x20]
add eax, edi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x18], eax
jb 0x1003b6b9
mov ecx, dword [esi]
jmp 0x1003b6bb
mov ecx, esi
push dword [esi + 0x10]
push eax
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.10027352
mov ecx, dword [ebp - 0x18]
mov edi, eax
cmp ecx, 0xffffffff
jne 0x1003b624
jmp 0x1003b89b
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], 0xa35c
mov dword [ebp - 0x20], 0x12a30a4c
mov dword [ebp - 0x14], 0xf1448112
mov dword [ebp - 0x30], 0x5c526587
mov dword [ebp - 0x14], ebx
jmp 0x1003b719
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], 0xb3bfa32a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003b708
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
cmp dword [ebp - 0x54], ebx
jne 0x1003b742
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x54]
test eax, eax
jne 0x1003b742
mov edx, ebx
jmp 0x1003b745
xor edx, edx
inc edx
mov eax, dword [ebp - 0x54]
imul edx, ecx
xor ecx, ecx
add eax, edx
cmp eax, 0x31f145ba
mov dword [ebp - 0xa0], eax
sete cl
xor edx, edx
sub ecx, 0x288586fd
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
setle dl
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ebx
jmp 0x1003b7e1
mov dword [ebp - 0x3c], 0x4f8d
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], ebx
jmp 0x1003b79b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1003b78e
mov dword [ebp - 0x14], 0xffffffe4
jmp 0x1003b7c0
mov dword [ebp - 0x3c], 9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x88], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jge 0x1003b7aa
mov eax, dword [ebp - 0x88]
dec eax
neg eax
sbb eax, eax
add eax, 0xffffb0d5
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
jg 0x1003b77b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x18]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.1003dadb
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xc
call fcn.1003db89
push ebx
push 1
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 9
call fcn.100056dd
mov dword [ebp - 0x30], 0x4ad2
cmp dword [ebp - 0x30], 0x4d78
jle 0x1003b89b
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x20], ebx
and eax, edi
xor eax, ecx
lea ecx, [ebp - 0x13c]
or eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b857
mov eax, dword [eax]
push eax
call fcn.100443ac
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x13c]
call fcn.10005611
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x4525
jl 0x1003b839
inc edi
cmp edi, 0x3420
jl 0x1003b834
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x5781
jl 0x1003b832
inc esi
cmp esi, 0x1ba6
jl 0x1003b82d
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x60]
push eax
call fcn.1003dbf9
mov dword [ebp - 0x30], 0x32ff
cmp dword [ebp - 0x30], 0x3419
jle 0x1003b95c
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov eax, esi
mov dword [ebp - 0x34], 0x25e9
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
xor eax, esi
lea ecx, [ebp - 0x16c]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b8ee
mov eax, dword [eax]
push eax
call fcn.100443ac
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x16c]
call fcn.10005611
mov eax, dword [ebp - 0x20]
add eax, edi
dec dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
jne 0x1003b8d4
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x7654
jl 0x1003b8c5
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x4516
jl 0x1003b8c3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x3599
jl 0x1003b8be
push 0x160f
push ebx
push ebx
push 0x3b0
push 0x203e
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
lea ecx, [ebp - 0x60]
call fcn.1003dfb0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret