Function at 0x10002b80
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x1001f9ab
mov eax, dword fs:[0]
push eax
push ebp
push esi
mov eax, dword [0x1002a258]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x20]
sub eax, 0
je 0x10002e4a
sub eax, 1
jne 0x10002efe
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebp
push 0x18
call fcn.100053d0
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x10002be3
mov ecx, eax
call fcn.10001970
jmp 0x10002be5
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
mov dword [esp + 0x18], 0xffffffff
mov dword [0x1002b28c], eax
call esi
push str.kernel32.dll
mov dword [0x1002b280], eax
call esi
mov dword [0x1002b284], eax
xor ecx, ecx
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + str.G4_], al
add ecx, 1
cmp ecx, 0x18
jb 0x10002c12
xor ecx, ecx
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + 0x1002a020], al
add ecx, 1
cmp ecx, 0xb
jb 0x10002c28
xor ecx, ecx
mov edi, edi
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + str.S4_], al
add ecx, 1
cmp ecx, 0x11
jb 0x10002c40
xor ecx, ecx
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + str.U_], al
add ecx, 1
cmp ecx, 0x13
jb 0x10002c56
xor ecx, ecx
lea esp, [esp]
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + str.C0_n], al
add ecx, 1
cmp ecx, 0xe
jb 0x10002c70
xor ecx, ecx
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + 0x1002a064], al
add ecx, 1
cmp ecx, 0xb
jb 0x10002c86
xor ecx, ecx
lea esp, [esp]
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + str.C_Y], al
add ecx, 1
cmp ecx, 0xb
jb 0x10002ca0
xor ecx, ecx
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + str.W_X], al
add ecx, 1
cmp ecx, 0x12
jb 0x10002cb6
xor ecx, ecx
lea esp, [esp]
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + str.C0], al
add ecx, 1
cmp ecx, 0x12
jb 0x10002cd0
xor ecx, ecx
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + str.G], al
add ecx, 1
cmp ecx, 0x1c
jb 0x10002ce6
xor ecx, ecx
lea esp, [esp]
mov al, cl
mov dl, 0x51
imul dl
xor byte [ecx + 0x1002a0c4], al
add ecx, 1
cmp ecx, 0x10
jb 0x10002d00
mov eax, dword [0x1002b280]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.G4_
push eax
call esi
mov ecx, dword [0x1002b280]
push 0x1002a020
push ecx
mov dword [0x1002b290], eax
call esi
mov edx, dword [0x1002b280]
push str.S4_
push edx
mov dword [0x1002b294], eax
call esi
mov dword [0x1002b298], eax
mov eax, dword [0x1002b280]
push str.C0_n
push eax
call esi
mov ecx, dword [0x1002b280]
push str.U_
push ecx
mov dword [0x1002b29c], eax
call esi
push 0x10002b20
push 0x1002a064
push str.kernel32.dll
mov dword [0x1002b2a0], eax
call fcn.10003820
push eax
call fcn.10003180
push 0x10002690
push str.C_Y
push str.kernel32.dll
mov dword [0x1002b2a4], eax
call fcn.10003820
push eax
call fcn.10003180
push 0x100027c0
push str.W_X
push str.kernel32.dll
mov dword [0x1002b2a8], eax
call fcn.10003820
push eax
call fcn.10003180
push 0x10002930
push str.C0
push str.kernel32.dll
mov dword [0x1002b2ac], eax
call fcn.10003820
push eax
call fcn.10003180
cmp dword [0x1002e004], 0
mov dword [0x1002b2b0], eax
jne 0x10002e26
mov dword [0x1002b288], 1
call ebp
mov edx, dword [esp + 0x1c]
push 0
push edx
push 0x10001120
push 3
mov dword [0x1002e004], eax
call dword [0x1002b298]
mov dword [section..shared], eax
push 0x100010e0
push str.S4_
push str.user32.dll
call fcn.10003820
push eax
call fcn.10003180
mov dword [0x1002b298], eax
jmp 0x10002efe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, dword [0x1002b298]
push 0x100010e0
push eax
call fcn.10002f20
mov ecx, dword [0x1002b2b0]
push 0x10002930
push ecx
call fcn.10002f20
mov edx, dword [0x1002b2ac]
push 0x100027c0
push edx
call fcn.10002f20
mov eax, dword [0x1002b2a8]
push 0x10002690
push eax
call fcn.10002f20
mov ecx, dword [0x1002b2a4]
push 0x10002b20
push ecx
call fcn.10002f20
cmp dword [0x1002b288], 0
je 0x10002ec3
mov edx, dword [section..shared]
push edx
call dword [0x1002b2a0]
mov dword [0x1002b288], 0
mov eax, dword [0x1002b284]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
call esi
mov ecx, dword [0x1002b280]
push ecx
call esi
mov ecx, dword [0x1002b28c]
test ecx, ecx
mov esi, ecx
je 0x10002ef4
call fcn.100019d0
push esi
call fcn.10004930
add esp, 4
mov dword [0x1002b28c], 0
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0xc
ret 0xc