Function at 0x1000d540
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x1c], 0
mov edx, 0x5a4d
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], ebx
cmp word [esi], dx
jne 0x1000d583
mov ecx, dword [esi + 0x3c]
lea eax, [ecx - 0x40]
cmp eax, 0x3bf
ja 0x1000d583
add ecx, esi
mov dword [ebp - 0x28], ecx
cmp dword [ecx], 0x4550
je 0x1000d586
dec esi
jmp 0x1000d564
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], esi
mov edi, dword [eax + 0xc]
mov dword [ebp - 8], edi
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000d7d7
mov esi, dword [eax + 0x28]
xor ecx, ecx
movzx edx, word [eax + 0x24]
nop dword [eax]
mov al, byte [esi]
ror ecx, 0xd
cmp al, 0x61
movzx eax, al
jb 0x1000d5bf
add ecx, 0xffffffe0
add edx, 0xffff
add ecx, eax
inc esi
test dx, dx
jne 0x1000d5b0
cmp ecx, 0x6a4abc5b
jne 0x1000d693
mov edi, dword [ebp - 0x10]
mov esi, 3
mov edi, dword [edi + 0x10]
mov dword [ebp - 8], edi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov dword [ebp - 0x24], eax
mov ebx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add ebx, edi
add eax, edi
mov dword [ebp - 0x14], eax
mov ecx, dword [ebx]
add ecx, edi
xor edx, edx
mov al, byte [ecx]
nop dword [eax + eax]
ror edx, 0xd
lea ecx, [ecx + 1]
movsx eax, al
add edx, eax
mov al, byte [ecx]
test al, al
jne 0x1000d610
cmp edx, 0xec0e4e8e
je 0x1000d639
cmp edx, 0x7c0dfcaa
je 0x1000d639
cmp edx, 0x91afca54
jne 0x1000d681
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
add eax, edi
cmp edx, 0xec0e4e8e
jne 0x1000d65b
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x1c], eax
jmp 0x1000d67b
cmp edx, 0x7c0dfcaa
jne 0x1000d66c
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x20], eax
jmp 0x1000d67b
cmp edx, 0x91afca54
jne 0x1000d67b
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x18], eax
add esi, 0xffff
add dword [ebp - 0x14], 2
add ebx, 4
test si, si
jne 0x1000d600
jmp 0x1000d6ef
cmp ecx, 0x3cfa685d
jne 0x1000d6f2
mov edi, dword [ebp - 0x10]
mov ebx, 1
mov edi, dword [edi + 0x10]
mov dword [ebp - 8], edi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
mov esi, dword [eax + edi + 0x20]
add esi, edi
mov edx, dword [esi]
add edx, edi
xor eax, eax
mov cl, byte [edx]
nop
ror eax, 0xd
lea edx, [edx + 1]
movsx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x1000d6c0
lea ecx, [ebx - 1]
cmp eax, 0x534c0ab8
movzx edx, cx
movzx ecx, bx
cmovne edx, ecx
add esi, 4
movzx eax, dx
mov ebx, eax
test ax, ax
jne 0x1000d6b6
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0
je 0x1000d702
cmp dword [ebp - 0x20], 0
je 0x1000d702
test ebx, ebx
jne 0x1000d717
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1000d5a3
jmp 0x1000d7d4
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x4f949807
mov dword [ebp - 0x34], 0x7a8a9024
mov dword [ebp - 0x30], 0x58899d3d
mov dword [ebp - 0x2c], 0x3be6f151
mov eax, dword [ebp - 0x38]
cmp byte [ebp - 0x3c], 0
jne 0x1000d755
xor ecx, ecx
mov eax, dword [ebp + ecx*4 - 0x38]
xor eax, 0x3be6f151
mov dword [ebp + ecx*4 - 0x38], eax
inc ecx
cmp ecx, 4
jb 0x1000d742
mov byte [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0x3b558e7b
mov dword [ebp - 0x54], 0x3b5e8e62
mov dword [ebp - 0x50], 0x3b5c8e75
mov dword [ebp - 0x4c], 0x3b228e03
mov dword [ebp - 0x48], 0x3b748e1e
mov dword [ebp - 0x44], 0x3b7c8e5c
mov dword [ebp - 0x40], 0x3b108e30
mov eax, dword [ebp - 0x58]
cmp byte [ebp - 0x5c], 0
jne 0x1000d7b3
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [ebp + ecx*4 - 0x58]
xor eax, 0x3b108e30
mov dword [ebp + ecx*4 - 0x58], eax
inc ecx
cmp ecx, 7
jb 0x1000d7a0
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x58]
call fcn.1000d170
mov ecx, dword [ebp - 0x28]
push 0x40
push 0x3000
push dword [ecx + 0x50]
push 0
call eax
mov edi, eax
mov dword [ebp - 8], edi
mov esi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
mov ecx, esi
add ebx, esi
mov dword [ebp - 0x10], ebx
mov edx, dword [ebx + 0x54]
test edx, edx
je 0x1000d801
mov esi, edi
sub esi, dword [ebp - 0xc]
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
sub edx, 1
jne 0x1000d7f0
mov esi, dword [ebp - 0xc]
movzx eax, word [ebx + 0x14]
mov edx, dword [ebp - 0x10]
add eax, 0x2c
add ebx, eax
movzx eax, word [edx + 6]
test eax, eax
je 0x1000d850
mov edx, dword [ebx]
dec eax
mov ecx, dword [ebx - 8]
add edx, esi
mov esi, dword [ebx - 4]
add ecx, edi
mov dword [ebp - 0x28], eax
test esi, esi
je 0x1000d843
nop dword [eax]
mov al, byte [edx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
lea edx, [edx + 1]
sub esi, 1
jne 0x1000d830
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0xc]
add ebx, 0x28
test eax, eax
jne 0x1000d815
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x80]
lea ebx, [edx + 0x80]
add eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1000d8fe
nop dword [eax]
cmp dword [ebx], 0
je 0x1000d8fb
add eax, edi
push eax
call dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], edx
mov esi, dword [ecx]
add esi, edi
mov edi, dword [ecx + 0x10]
add edi, eax
cmp dword [edi], 0
je 0x1000d8e7
test esi, esi
je 0x1000d8be
mov ecx, dword [esi]
test ecx, ecx
jns 0x1000d8be
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x1000d8cd
mov ebx, dword [edi]
add ebx, eax
lea eax, [ebx + 2]
push eax
push edx
call dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
mov dword [edi], eax
add edi, 4
test esi, esi
lea eax, [esi + 4]
cmove eax, esi
cmp dword [edi], 0
mov esi, eax
mov eax, dword [ebp - 8]
jne 0x1000d898
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x20]
add ecx, 0x14
mov edi, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x1000d870
mov edx, dword [ebp - 0x10]
mov esi, edi
sub esi, dword [edx + 0x34]
cmp dword [edx + 0xa4], 0
je 0x1000d9bc
mov ecx, dword [edx + 0xa0]
add ecx, edi
mov dword [ebp - 0x20], ecx
lea eax, [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
test eax, eax
je 0x1000d9bc
nop dword [eax + eax]
mov edx, dword [ecx]
lea ebx, [ecx + 8]
add edx, edi
lea edi, [eax - 8]
shr edi, 1
je 0x1000d99e
nop
movzx ecx, word [ebx]
dec edi
mov ax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x1000d95c
and ecx, 0xfff
add dword [ecx + edx], esi
jmp 0x1000d994
cmp ax, 3
jne 0x1000d96d
and ecx, 0xfff
add dword [ecx + edx], esi
jmp 0x1000d994
cmp ax, 1
jne 0x1000d984
and ecx, 0xfff
mov eax, esi
shr eax, 0x10
add word [ecx + edx], ax
jmp 0x1000d994
cmp ax, 2
jne 0x1000d994
and ecx, 0xfff
add word [ecx + edx], si
add ebx, 2
test edi, edi
jne 0x1000d940
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 8]
add ecx, dword [eax]
mov dword [ebp - 0x20], ecx
lea eax, [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
test eax, eax
jne 0x1000d930
mov edx, dword [ebp - 0x10]
mov esi, dword [edx + 0x28]
add esi, edi
mov dword [0x10036cd0], edi
cmp byte [ebp + 0xc], 0
jne 0x1000da0d
mov edx, dword [ebp + 0x10]
mov ecx, edi
call fcn.1000d470
mov ebx, eax
test ebx, ebx
je 0x1000da16
cmp byte [ebp + 0x28], 0
je 0x1000d9ed
mov ecx, dword [ebp + 0x2c]
mov edx, edi
call fcn.1000d430
push 0
push 1
push dword [ebp + 0x2c]
call esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x34
push 0
push 1
push dword [ebp + 0x2c]
call esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x34