Function at 0x10003600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100284eb
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x10036008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x160], eax
xor eax, eax
cmp dword [ebx + 0xec], eax
je 0x10003986
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebx + 0xfc], eax
jne 0x100036d4
movaps xmm0, xmmword [0x10033800]
xor ecx, ecx
mov eax, 0x18
mov dword [ebp - 0x140], 0xf7f8e6fc
mov dword [ebp - 0x154], eax
movups xmmword [ebp - 0x150], xmm0
mov dword [ebp - 0x13c], 0xf4f6f1e3
mov byte [ebp - 0x138], 0x9b
mov word [ebp - 0x137], cx
mov byte [ebp - 0x135], cl
nop
lea eax, [ecx - 0x7d]
xor byte [ebp + ecx - 0x150], al
inc ecx
mov eax, dword [ebp - 0x154]
cmp ecx, eax
jb 0x100036a0
mov byte [ebp + eax - 0x150], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebx + 0xec]
call edi
mov dword [ebx + 0xfc], eax
xor eax, eax
cmp dword [ebx + 0xfc], esi
je 0x10003986
cmp dword [ebx + 0xf8], esi
jne 0x1000375b
movaps xmm0, xmmword [0x10033810]
mov eax, 0x19
mov dword [ebp - 0x154], eax
xor ecx, ecx
movups xmmword [ebp - 0x150], xmm0
mov dword [ebp - 0x140], 0xe4c5fafc
mov dword [ebp - 0x13c], 0xe9fcfbf8
mov dword [ebp - 0x138], 0x9ce8
lea eax, [ecx - 0x7d]
xor byte [ebp + ecx - 0x150], al
inc ecx
mov eax, dword [ebp - 0x154]
cmp ecx, eax
jb 0x10003721
mov byte [ebp + eax - 0x150], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebx + 0xec]
call edi
mov dword [ebx + 0xf8], eax
cmp eax, esi
je 0x10003982
xor edi, edi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0xfc]
push edi
push esi
push 5
call eax
cmp eax, 0xc0000023
je 0x1000377e
cmp eax, 0xc0000004
jne 0x1000379f
test esi, esi
je 0x10003789
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x14]
add edi, 0x200
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
jmp 0x10003760
xor edi, edi
test esi, esi
je 0x10003984
push 0x90
lea eax, [ebp - 0x134]
mov dword [ebp - 0x158], edi
push edi
push eax
call fcn.10010ba0
lea eax, [ebp - 0x128]
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x134], eax
xor eax, eax
mov dword [ebp - 0x12c], edi
mov word [ebp - 0x128], ax
push 0x90
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa4]
push eax
call fcn.10010ba0
lea eax, [ebp - 0x98]
mov dword [ebp - 0xa0], edi
add esp, 0x18
mov dword [ebp - 0xa4], eax
xor eax, eax
mov dword [ebp - 0x9c], edi
mov word [ebp - 0x98], ax
mov byte [ebp - 4], 1
mov dword [ebp - 0x15c], 1
nop dword [eax]
cmp dword [edi + esi + 0x44], 4
jbe 0x100038a1
push str.smss.exe
push dword [edi + esi + 0x3c]
call fcn.1001c06b
add esp, 8
test eax, eax
je 0x100038a1
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
cmp ecx, edx
je 0x1000387a
mov edi, dword [edi + esi + 0x44]
nop
cmp edi, dword [ecx]
cmove eax, dword [ebp - 0x15c]
add ecx, 4
cmp ecx, edx
jne 0x10003860
mov edi, dword [ebp - 0x158]
test eax, eax
jne 0x100038a1
push dword [ebp - 0x160]
lea eax, [ebp - 0xa4]
mov ecx, ebx
push eax
lea eax, [ebp - 0x134]
push eax
push dword [edi + esi + 0x44]
call fcn.100039b0
test eax, eax
jne 0x10003979
mov eax, dword [edi + esi]
add edi, eax
mov dword [ebp - 0x158], edi
test eax, eax
jne 0x10003830
xor edi, edi
mov eax, dword [ebp - 0xa4]
lea ecx, [ebp - 0x98]
cmp eax, ecx
je 0x100038d7
push eax
call fcn.10016113
lea eax, [ebp - 0x98]
add esp, 4
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x100038f4
push eax
call fcn.10016113
add esp, 4
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x10003911
push eax
call fcn.10016113
add esp, 4
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x10003936
push eax
call fcn.10016113
lea eax, [ebp - 0x128]
add esp, 4
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x10003953
push eax
call fcn.10016113
add esp, 4
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
je 0x10003970
push ecx
call fcn.10016113
add esp, 4
mov dword [ebp - 0x12c], 0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10003984
mov edi, dword [edi + esi + 0x44]
jmp 0x100038b2
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f18c
mov esp, ebp
pop ebp
ret 8