Function at 0x1002ba68
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100636d3
call fcn.10061fc8
sub esp, 0x154
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1002c229
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x54], edx
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
je 0x1002c221
lea eax, [ebp - 0x58]
xor ebx, ebx
push eax
push 0x1000
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.1001e68b
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x64]
push dword [ebp - 0x64]
sar eax, 1
push eax
push 0x117db
push 0x717b
call fcn.1003ff84
pop ecx
pop ecx
call eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0x84]
call fcn.1000ba9d
push 0xf20b
mov byte [ebp - 4], 1
call fcn.1001db0a
cmp dword [ebp - 0x70], 8
pop ecx
movzx edi, ax
lea ecx, [ebp - 0x84]
cmovae ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x68], edi
cmp word [ecx + eax*2 - 2], di
je 0x1002bb46
push 0x31be
push 1
lea eax, [ebp - 0x84]
mov dl, 1
push eax
push 1
lea eax, [ebp - 0x68]
mov ecx, 0x3bc
push 0x7ed7
push eax
call fcn.1002b3f7
mov edi, dword [ebp - 0x68]
add esp, 0x18
push ecx
xor esi, esi
lea eax, [ebp - 0x84]
inc esi
push esi
push eax
call fcn.1002b5a2
add esp, 0xc
lea eax, [ebp - 0x84]
cmp dword [ebp - 0x70], 8
cmovae eax, dword [ebp - 0x84]
push ebx
push eax
push 0x117db
push 0x13dab
call fcn.1003ff84
pop ecx
pop ecx
call eax
push edi
push ecx
lea ecx, [ebp - 0x84]
call fcn.1002cc93
mov dword [ebp - 0x14], 0x3d0a
cmp dword [ebp - 0x14], 0x3dff
jle 0x1002bc02
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov eax, edi
mov dword [ebp - 0x24], 0x7f37
mov dword [ebp - 0x1c], eax
mov edi, ebx
add eax, edi
lea ecx, [ebp - 0x148]
cdq
push edx
push eax
call fcn.10001381
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002bbca
mov eax, dword [eax]
push eax
call fcn.10049bf0
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x148]
call fcn.10001612
mov eax, dword [ebp - 0x1c]
inc edi
cmp edi, 0x1316
jl 0x1002bbb0
dec eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
jne 0x1002bbae
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0xb8a
jl 0x1002bba2
cmp dword [ebp - 0x14], 0x3b26
mov dword [ebp - 0x6c], ebx
jge 0x1002bc19
push str.mdjot_hbtefbm_rwb_xsnzpcdf_uicxicp_hhbpjakf_wechzqzh_okref_pybuny_lowc_rksu_fvcv_eluysbk
call fcn.10049bf0
pop ecx
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], esi
push eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov edx, dword [eax]
call fcn.100431cb
pop ecx
mov byte [ebp - 0x1d], bl
mov eax, ebx
mov dword [ebp - 0x28], ebx
cmp eax, 0x12c
jae 0x1002c216
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0xb4]
call fcn.1000ba62
push 0x10
pop edx
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 4
call fcn.10025082
push ecx
push ecx
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0xb4]
call fcn.1002cf37
push 0x2e
pop eax
push 2
mov ecx, ebx
mov dword [ebp - 0x50], 0xad04df00
mov dword [ebp - 0x4c], 0x19c7970
mov dword [ebp - 0x48], 0x31d024b
mov byte [ebp - 0x44], 0x1d
mov word [ebp - 0x90], ax
pop esi
mov dword [ebp - 0x1c], ecx
cmp esi, 2
jne 0x1002bcb9
push 5
pop ecx
push ecx
mov dword [ebp - 0x1c], ecx
pop esi
jmp 0x1002bcff
movzx edx, byte [ebp + esi - 0x4f]
mov eax, esi
sub eax, ecx
push 1
push 1
push 0x27fc
movzx eax, byte [ebp + eax - 0x52]
movzx ecx, word [ebp + eax*2 - 0x90]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x50]
add ecx, edx
lea edx, [ebp - 0x1c]
mov word [ebp + eax*2 - 0x90], cx
mov cl, 1
call fcn.1002b645
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
add esi, 2
cmp esi, 0xd
jb 0x1002bcaa
xor eax, eax
mov dword [ebp - 0xd0], 7
mov word [ebp - 0x88], ax
lea ecx, [ebp - 0xe4]
mov word [ebp - 0xe4], ax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0xd4], ebx
call fcn.1000bfc1
push ecx
push ecx
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0xb4]
call fcn.1002cf37
push ebx
push 1
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 5
call fcn.1000c0e3
xor eax, eax
lea edi, [ebp - 0x90]
cmp dword [ebp - 0xa0], 8
stosd dword es:[edi], eax
push ebx
push 0x80
push 2
stosd dword es:[edi], eax
push ebx
push ebx
push 0x40000000
stosw word es:[edi], ax
lea eax, [ebp - 0xb4]
cmovae eax, dword [ebp - 0xb4]
mov edi, 0x117db
push eax
push edi
push 0x625b
call fcn.1003ff84
pop ecx
pop ecx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x1002c1ea
push ebx
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x6c]
mov eax, dword [ebp + 0x20]
push dword [eax]
push esi
push edi
push 0x1104b
call fcn.1003ff84
pop ecx
pop ecx
call eax
push esi
test eax, eax
push edi
push 0xe2eb
setne bl
call fcn.1003ff84
pop ecx
pop ecx
call eax
test bl, bl
je 0x1002c1e8
push 0x22
pop eax
xor ebx, ebx
mov dword [ebp - 0x34], 0xf4033e00
push 2
mov ecx, ebx
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x2c], ax
pop esi
mov dword [ebp - 0x24], ecx
cmp esi, 2
jne 0x1002be1c
push 4
pop ecx
push ecx
mov dword [ebp - 0x24], ecx
pop esi
jmp 0x1002be61
movzx edx, byte [ebp + esi - 0x33]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x36]
movzx ecx, word [ebp + eax*2 - 0x2c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x34]
add ecx, edx
push ecx
push 1
push ecx
mov word [ebp + eax*2 - 0x2c], cx
lea eax, [ebp - 0x24]
push eax
push ecx
push 0x61a3
push 0xcb2
call fcn.1002b98e
mov ecx, dword [ebp - 0x24]
add esp, 0x1c
add esi, 2
cmp esi, 6
jb 0x1002be0d
xor eax, eax
mov dword [ebp - 0xb8], 7
mov word [ebp - 0x2a], ax
lea ecx, [ebp - 0xcc]
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0xbc], ebx
call fcn.1000bfc1
push ecx
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 7
push eax
push 1
push ecx
push 0x26b6
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x2c], ebx
call fcn.1002b31d
mov dword [ebp - 0x18], 0x57f8
add esp, 0x14
cmp dword [ebp - 0x18], 0x5a07
jle 0x1002bf17
mov edi, ebx
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x14], ebx
and eax, esi
mov ecx, 0x10080098
xor eax, edi
cdq
push edx
push eax
call fcn.1000b94d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x4eb9
jl 0x1002bed3
inc esi
cmp esi, 0x271f
jl 0x1002bece
inc edi
cmp edi, 0xce9
jl 0x1002becc
push ebx
push ebx
push 0x724
push 0xf10
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0x2e
pop eax
mov byte [ebp - 4], 8
cmp dword [ebp - 0x18], 0x567c
mov dword [ebp - 0x40], 0x7c039702
mov word [ebp - 0x3c], 0x7100
mov byte [ebp - 0x3a], 1
mov byte [ebp - 0x39], al
mov word [ebp - 0x38], 0x201
jge 0x1002bf74
mov edx, str.gwnpu_bgxnn_fib
mov ecx, 0x10080098
call fcn.1000f355
jmp 0x1002bf74
push 0x2f
pop eax
push 2
mov dword [ebp - 4], 7
mov ecx, ebx
mov word [ebp - 0x98], ax
pop esi
cmp esi, 6
jne 0x1002bf9b
movzx eax, byte [ebp - 0x3a]
lea ecx, [eax + 1]
lea esi, [eax + 5]
jmp 0x1002bfc8
movzx edx, byte [ebp + esi - 0x3f]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x42]
movzx eax, word [ebp + eax*2 - 0x9c]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x40]
mov word [ebp + eax*2 - 0x9c], cx
mov ecx, ebx
add esi, 2
cmp esi, 0xa
jb 0x1002bf8a
xor eax, eax
mov word [ebp - 0x94], ax
mov dword [ebp - 0x14], 0x490c
cmp dword [ebp - 0x14], 0x4cf1
jle 0x1002c032
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x130]
cdq
push edx
push eax
call fcn.10001381
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002c00b
mov eax, dword [eax]
push eax
call fcn.10049bf0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x130]
call fcn.10001612
inc edi
cmp edi, 0x6f91
jl 0x1002bfed
inc esi
cmp esi, 0x325b
jl 0x1002bfeb
xor eax, eax
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
lea ecx, [ebp - 0x100]
lea eax, [ebp - 0x9c]
mov dword [ebp - 0xf0], ebx
push eax
call fcn.1000bfc1
push ecx
push ecx
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0xcc]
call fcn.1002cf37
push ebx
push 1
lea ecx, [ebp - 0x100]
call fcn.1000c0e3
cmp dword [ebp - 0x14], 0x4836
jge 0x1002c097
push str.ywztaf_qtwqh_bmpagg_mxsxur_uwiqiwmb
call fcn.10049bf0
pop ecx
xor eax, eax
mov dword [ebp - 4], 7
lea edi, [ebp - 0x9c]
mov edx, 0x5687
stosd dword es:[edi], eax
push 0x1c4f
push 0x52ec
push 0x5f6a
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1d]
push eax
push 1
call fcn.1002b2cd
mov dword [ebp - 0x28], 0x171a
add esp, 0x14
cmp dword [ebp - 0x28], 0x198c
jle 0x1002c17c
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
mov dword [ebp - 0x54], ebx
mov ecx, edi
mov esi, ebx
shl eax, cl
mov dword [ebp - 0x58], eax
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x160]
cdq
idiv edi
xor edx, dword [ebp - 0x58]
mov eax, edx
cdq
push edx
push eax
call fcn.10001381
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002c11c
mov eax, dword [eax]
push eax
call fcn.10049bf0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x160]
call fcn.10001612
inc edi
cmp edi, 0x1798
jl 0x1002c0fa
inc esi
cmp esi, 0x7f12
jl 0x1002c0f8
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x31a
jl 0x1002c0ea
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x58c1
jl 0x1002c0e5
push 0xbe8
push 0x3c8
push 0x957
push 0x591
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0xcc]
call fcn.100294a7
cmp dword [ebp - 0x28], 0x16a1
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
jge 0x1002c1a6
push str.grldntjz_alscryxlc_fcukigzl_noj_frzuuap_hzkiaupxw_qzjfiizyo_yekz_ulkjcvw_cdi_sxjofqo
call fcn.10049bf0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xcc]
call fcn.1000c0e3
push ebx
push 1
lea ecx, [ebp - 0x118]
call fcn.1000c0e3
push ebx
push 1
lea ecx, [ebp - 0xb4]
call fcn.1000c0e3
push ebx
push 1
lea ecx, [ebp - 0x84]
call fcn.1000c0e3
lea ecx, [ebp - 0x64]
call fcn.1001e712
jmp 0x1002c239
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x118]
call fcn.1000c0e3
push ebx
push 1
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.1000c0e3
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
jmp 0x1002bc38
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 2
jmp 0x1002c1d0
mov dword [edx], 1
jmp 0x1002c239
cmp byte [ecx], 0
je 0x1002c239
push 0x25e2
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret