Function at 0x10003150
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
call fcn.1000de40
test eax, eax
js 0x10003405
mov eax, dword [0x1000f068]
test eax, eax
je 0x1000317b
lock inc dword [eax]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
lea ecx, [edx + 0x4c]
call fcn.100025c0
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x1000319a
mov eax, 0xc0000017
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov edi, esi
mov ecx, 0x13
mov edx, 0x6000
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edi, [esi + 0x4c]
xor al, al
rep stosb byte es:[edi], al
mov dword [esi + 0x24], 0x300
lea ecx, [esi + 0x14]
mov dword [esi + 0x28], 0x500
mov dword [ebp - 4], 0
call fcn.100025e0
mov ebx, eax
test ebx, ebx
js 0x100033ee
lea ecx, [esi + 8]
mov edx, 0x1800
call fcn.100025e0
mov ebx, eax
test ebx, ebx
js 0x100033ee
mov eax, dword fs:[0x30]
lea edx, [ebp - 4]
push 1
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0x18]
push eax
mov dword [ebp - 0x18], eax
call fcn.1000cb50
mov ebx, eax
test ebx, ebx
js 0x100033ee
mov ecx, dword [ebp - 4]
mov edx, 0x1ad9d7aa
call fcn.1000b2e0
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 8]
sub ecx, dword [ebp - 4]
add eax, ecx
or ecx, 0xffffffff
mov dword [esi + 0x30], eax
call fcn.1000ccb0
mov cl, byte [esi + 0x48]
xor cl, al
mov ebx, dword [esi + 8]
and cl, 1
mov dword [ebp - 0x28], eax
xor byte [esi + 0x48], cl
mov edx, dword [ebp - 4]
sub dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ebx
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0x78]
add eax, edx
mov ecx, dword [eax + 0x1c]
mov edi, dword [eax + 0x20]
add ecx, edx
mov dword [ebp - 0x20], ecx
add edi, edx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ecx, edx
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000339b
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
mov edi, dword [edi]
add edi, edx
cmp byte [edi], 0x5a
jne 0x1000337d
cmp byte [edi + 1], 0x77
jne 0x1000337d
mov ecx, edi
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100032b0
sub ecx, esi
cmp ecx, 6
jb 0x100032f8
lea eax, [edi - 4]
mov edx, 0x10001cbc
add eax, ecx
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x100032e8
test cl, cl
je 0x100032e4
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x100032e8
add eax, 2
add edx, 2
test cl, cl
jne 0x100032c8
xor eax, eax
jmp 0x100032ed
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 4]
test eax, eax
je 0x10003377
mov ecx, dword [ebp - 8]
movzx eax, word [ecx]
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ecx + eax*4]
add ebx, edx
cmp byte [ebx], 0xb8
jne 0x100033c4
movzx esi, word [ebx + 1]
lea edx, [edi + 2]
mov eax, dword [ebp - 0xc]
shl esi, 5
add esi, dword [ebp - 0x24]
mov dword [eax + 4], esi
mov eax, 0x9c074
mov cl, byte [edx]
test cl, cl
je 0x10003341
lea ecx, [ecx]
rol eax, 0xd
lea edx, [edx + 1]
movzx ecx, cl
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10003330
mov ecx, dword [ebp - 0xc]
mov edx, esi
push eax
push ebx
mov dword [ecx], eax
mov ecx, dword [ebp - 0x14]
call fcn.10002fb0
mov ebx, eax
test ebx, ebx
js 0x100033eb
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0xc]
add dword [esi + 0x18], ecx
add dword [esi + 8], ecx
add ebx, 8
lea eax, [ecx + edi]
mov dword [ebp - 0xc], ebx
mov dword [esi + 0x14], eax
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
add eax, 2
add edi, 4
mov dword [ebp - 8], eax
sub esi, 1
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], esi
jne 0x10003293
mov esi, dword [ebp - 0x14]
mov ecx, edx
call fcn.1000cb30
sub ebx, dword [esi + 8]
lea ecx, [esi + 4]
sar ebx, 3
mov dword [ecx], ebx
mov dword [esi + 0x1c], ebx
call fcn.10002eb0
cmp dword [ebp - 0x28], 0
mov ecx, esi
je 0x100033ce
call fcn.10002ba0
jmp 0x100033d3
mov esi, dword [ebp - 0x14]
mov ebx, 0xe0070102
jmp 0x100033f1
call fcn.100026f0
mov ebx, eax
test ebx, ebx
js 0x100033ee
mov dword [0x1000f068], esi
lock inc dword [esi]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
test edx, edx
je 0x100033fc
mov ecx, edx
call fcn.1000cb30
mov ecx, esi
call fcn.10003440
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret