Function at 0x1003faef
Capabilities:
Encode data using xor
Get file attributes
Set thread local storage value

Disassembly:
mov eax, 0x10062c3f
call fcn.10060e94
sub esp, 0x34
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ebx
je 0x1003fbef
cmp byte [ebp + 0x1c], 0
je 0x1003fbe8
mov dword [ebp - 0x14], 0x5257
cmp dword [ebp - 0x14], 0x5466
jle 0x1003fb74
xor edi, edi
xor esi, esi
mov dword [ebp + 0x14], esi
mov ebx, esi
mov esi, 0x37ed
mov eax, ebx
mov ecx, 0x1007cfd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000703f
dec ebx
dec esi
jne 0x1003fb3c
mov esi, dword [ebp + 0x14]
inc esi
mov dword [ebp + 0x14], esi
cmp esi, 0x1119
jl 0x1003fb35
inc edi
cmp edi, 0x68ce
jl 0x1003fb30
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x4f64
jge 0x1003fbaf
mov edx, str.fzqhnjw_xfcklzkdp_zliq_zejijyxfa_kfbc_hxdxhelbx
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x1003fbaf
mov eax, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
cmp eax, dword [ebx]
je 0x1003fbd7
push dword [ebp - 0x1c]
mov edx, 0x649
mov ecx, 0x3869
push 1
push 0
push 1
call fcn.1003f9cc
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
inc dword [eax]
jmp 0x1003fbd7
cmp byte [ebp + 0x10], 0
je 0x1003fcc5
mov esi, dword [ebp + 0x20]
mov dword [esi], 0
cmp dword [esi], 0xfffffffc
je 0x1003fbd7
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x14], 0x91b
cmp dword [ebp - 0x14], 0x985
jle 0x1003fc8d
xor edi, edi
mov dword [ebp + 0x14], edi
xor ebx, ebx
mov ecx, ebx
mov dword [ebp - 0x20], edi
xor esi, esi
shl edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003fc49
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000162e
inc esi
cmp esi, 0x55d5
jl 0x1003fc2e
mov edi, dword [ebp + 0x14]
inc ebx
cmp ebx, 0x5fd1
jl 0x1003fc25
inc edi
mov dword [ebp + 0x14], edi
cmp edi, 0x60f3
jl 0x1003fc23
push 0
push 0x1ae6
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [ebp + 0x20]
push ecx
lea eax, [ebp - 0x24]
xor cl, cl
push eax
push 0x5615
push 0x6d12
call fcn.1003f0ea
add esp, 0x10
cmp dword [ebp - 0x14], 0x8f3
jge 0x1003fcba
push str.crk_vwetksqjv_gwckbuesh_shz_vqxg_gfscbj_xxpxehib_oov_ivoiwh
call fcn.10048570
pop ecx
or dword [ebp - 4], 0xffffffff
dec dword [esi]
jmp 0x1003fc02
mov dword [ebp + 0x14], 0x35bb
cmp dword [ebp + 0x14], 0x3721
jle 0x1003fcfa
xor esi, esi
mov edi, esi
mov ebx, 0x6acd
mov eax, edi
mov ecx, 0x1007cfd8
cdq
push edx
push eax
call fcn.1000703f
dec edi
dec ebx
jne 0x1003fcde
inc esi
cmp esi, 0x4ced
jl 0x1003fcd7
mov dword [ebp - 4], 4
cmp dword [ebp + 0x14], 0x3514
jge 0x1003fd19
mov edx, str.szbn_igfn_jdcsbkmb_lcolx_dwqxyq_dow
mov ecx, 0x1007cfd8
call fcn.1000b30d
or dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x14], 0x338f
cmp dword [ebp + 0x14], 0x33e2
jle 0x1003fd52
xor esi, esi
mov edi, esi
mov ebx, 0x2047
mov eax, edi
mov ecx, 0x1007cfd8
cdq
push edx
push eax
call fcn.1000703f
dec edi
dec ebx
jne 0x1003fd36
inc esi
cmp esi, 0x5bbe
jl 0x1003fd2f
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003fd6b
push 0
push 0x352
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 4], 6
cmp dword [ebp + 0x14], 0x324d
jge 0x1003fbd7
mov edx, str.tbvpt_qhtfsp_nczt_lnrcni_dbo_nxvhdf_dqablwqup_ijhlv_iapqgbp_gkkapy
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x1003fbd7