Function at 0x1003873c
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov eax, 0x1005c5b9
call fcn.1005abe8
sub esp, 0x28
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x24], 0x1227
cmp dword [ebp - 0x24], 0x1281
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], str.cfjygfg_xuhjgebp_cluy_cfzmh
jle 0x100387c3
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x7b38
xor edi, edi
xor esi, esi
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10076fd8
and eax, ebx
cdq
push edx
push eax
call fcn.100045e5
inc esi
cmp esi, 0x4687
jl 0x1003877b
inc edi
cmp edi, 0xdc9
jl 0x10038779
mov esi, dword [ebp - 0x18]
add ebx, esi
dec dword [ebp - 0x1c]
jne 0x10038777
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x611a
jl 0x1003876e
push 0xae8
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [ebp - 0x14], 0
je 0x1003896b
mov dword [ebp - 0x20], 0x3efc
cmp dword [ebp - 0x20], 0x419a
jle 0x10038843
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
and dword [ebp - 0x28], 0
mov eax, edi
cdq
idiv ebx
lea edi, [edx + esi]
mov esi, dword [ebp - 0x28]
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10076fd8
cdq
push edx
push eax
call fcn.100045e5
inc esi
cmp esi, 0x749
jl 0x10038800
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x1c]
cmp ebx, 0x592
jl 0x100387f1
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x4f90
jl 0x100387ef
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x226f
jl 0x100387ea
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x3ea2
mov dword [ebp - 0x1c], esi
jge 0x1003888b
mov edx, str.oeop_zmncxvqnv_msxr_zfdx_gxcbuys_bqhyf_jfit_cmg_kmz
mov ecx, 0x10076fd8
call fcn.10006ac3
jmp 0x1003888b
or dword [ebp - 4], 0xffffffff
mov dword [edi], 0xd
cmp dword [esi], 0xfffffff9
jle 0x100389ec
mov dword [ebp - 0x18], 0xb457102d
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 6
cmp dword [ebp - 0x18], 0xb
jg 0x1003895a
mov dword [ebp - 0x28], 0x843046b6
xor cl, cl
push 0x5e78
call fcn.10037fb5
mov dword [ebp - 0x20], 0xa75
cmp dword [ebp - 0x20], 0xb2f
pop ecx
jle 0x1003890a
xor edi, edi
xor ebx, ebx
mov esi, 0x726a
mov eax, ebx
mov ecx, 0x10076fd8
cdq
push edx
push eax
call fcn.100045e5
add ebx, edi
dec esi
jne 0x100388ea
inc edi
cmp edi, 0x7b79
jl 0x100388e3
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 0x28], 0
jne 0x10038952
mov dword [ebp - 4], 4
cmp dword [ebp - 0x20], 0x71b
jge 0x1003894e
mov edx, str.nmwlktc_agssh_cix_mwbais_lgzhovoq
mov ecx, 0x10076fd8
call fcn.10006ac3
jmp 0x1003894e
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x18]
jmp 0x100388b3
cmp dword [ebp - 0x2c], 0
jne 0x100389ec
dec dword [esi]
jmp 0x10038895
mov dword [ebp - 0x20], 0x6da2
cmp dword [ebp - 0x20], 0x7103
jle 0x100389bd
push 0
push 0x1044
push 0xf33
push 0x2471
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10076fd8
xor eax, esi
cdq
push edx
push eax
call fcn.100045e5
inc edi
cmp edi, 0xfe1
jl 0x1003899a
inc esi
cmp esi, 0x553c
jl 0x10038998
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100389cd
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 4], 6
cmp dword [ebp - 0x20], 0x6cea
jge 0x100389ec
mov edx, str.odbqdqvp_diq_qskk_yulscbbq
mov ecx, 0x10076fd8
call fcn.10006ac3
mov dword [ebp - 4], 8
cmp dword [ebp - 0x24], 0x1157
jge 0x10038a09
mov edx, dword [ebp - 0x30]
mov ecx, 0x10076fd8
call fcn.10006ac3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret