Function at 0x1002b0ee
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Get thread local storage value

Disassembly:
mov eax, 0x10058717
call fcn.10057898
sub esp, 0xcc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x64], edx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 8], bl
je 0x1002b1aa
mov dword [ebp - 0x18], 0x49c7
cmp dword [ebp - 0x18], 0x4b63
jle 0x1002b183
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor esi, esi
mov edi, ebx
inc esi
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0xc0]
cdq
push edx
push eax
call fcn.10001a21
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002b150
mov eax, dword [eax]
push eax
call fcn.1003f696
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xc0]
call fcn.1000200c
mov ecx, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x47f7
jl 0x1002b134
inc edi
cmp edi, 0x3d36
jl 0x1002b12f
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp - 0x18], 0x4923
jge 0x1002b870
push str.yqv_ozgjtr_ozecjuq_qrsmkb_niy
call fcn.1003f696
pop ecx
jmp 0x1002b870
mov dword [ebp - 0x60], 0x17ca0029
xor esi, esi
mov dword [ebp - 0x6c], 0x8ee4
inc esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x4c], 0x6c65
mov dword [ebp - 0x1c], ebx
jmp 0x1002b1de
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002b1d1
push ebx
lea eax, [ebp - 0x58]
mov edx, 0x3f50
push eax
lea eax, [ebp - 0x60]
mov ecx, 0x3bb7
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.1002bb2a
pop ecx
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.1002c29f
mov eax, dword [0x100720fc]
pop ecx
pop ecx
test al, 1
jne 0x1002b25d
or eax, esi
mov ecx, 0x1571
or edi, 0xffffffff
mov dword [0x100720fc], eax
mov dword [0x100720f4], edi
mov edx, esi
mov dword [0x10070d74], ecx
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x10070d74], ecx
inc edx
cmp edx, 0x270
jl 0x1002b232
mov dword [0x10070d70], 0x270
jmp 0x1002b260
or edi, 0xffffffff
mov dword [ebp - 0x14], 0xf665683c
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], 0xfcf419c2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0x51fd9ab8
mov dword [ebp - 0x18], 0xdf7d
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
jmp 0x1002b29c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x28], 0x38d679bd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002b28e
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp dword [ebp - 0x14], ecx
je 0x1002b2ce
mov eax, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1002b2d0
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jl 0x1002b2dc
mov edx, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1002b2de
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 8
jl 0x1002b2f0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x14]
jg 0x1002b308
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1002b30a
mov eax, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x14]
add eax, ecx
cmp eax, edi
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp eax, esi
setg dl
add edx, 8
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x14]
cmp ecx, 0x593c
setne al
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp edi, eax
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1002b3b0
mov dword [ebp - 0x18], 0xff90
xor edx, edx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], 0xfffffffb
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
cmp edx, dword [ebp - 0x14]
jg 0x1002b3a9
mov eax, ebx
cmp dword [ebp - 0x28], ebx
je 0x1002b3ab
mov eax, esi
mov dword [ebp - 0x14], eax
jmp 0x1002b3c3
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002b3c3
push 0xbc1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ecx
mov edx, 0x5ff1
mov ecx, 0x4d3e
call fcn.1002c18a
mov dword [ebp - 0x20], 0x1eb9
cmp dword [ebp - 0x20], 0x20c2
pop ecx
jle 0x1002b453
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
xor eax, edi
lea ecx, [ebp - 0xd8]
cdq
push edx
push eax
call fcn.10001a21
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002b405
mov eax, dword [eax]
push eax
call fcn.1003f696
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xd8]
call fcn.1000200c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x3a0c
jl 0x1002b3eb
inc edi
cmp edi, 0x2aaa
jl 0x1002b3e6
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x24b4
push 0x5cc
push 0x1853
push 0x8d1
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1002b46c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0x648
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002b45b
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1002b4a9
push 0x7ab8
push ebx
push esi
push ebx
mov edx, 0x273
mov ecx, 0x4e85
call fcn.1002c19f
mov eax, dword [ebp - 0x14]
add esp, 0x10
cmp dword [ebp + eax*4 - 0x8c], ebx
jne 0x1002b4a9
dec dword [ebp - 0x14]
jns 0x1002b47e
mov dword [ebp - 0x2c], 0x21af
cmp dword [ebp - 0x2c], 0x22fb
jle 0x1002b525
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xd2c
mov esi, ebx
mov edi, ebx
mov ebx, dword [ebp - 0x18]
mov eax, edi
mov ecx, 0x1006f978
and eax, esi
or eax, ebx
cdq
push edx
push eax
call fcn.10001ca8
inc edi
cmp edi, 0x5c7b
jl 0x1002b4cd
inc esi
push 0
pop ebx
cmp esi, 0x7b73
jl 0x1002b4c8
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x18], edi
dec dword [ebp - 0x1c]
jne 0x1002b4c6
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1b90
jl 0x1002b4bc
push 0xf35
push ebx
push 0x2151
push 0x12cc
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor esi, esi
inc esi
mov dword [ebp - 0x14], 2
or edi, 0xffffffff
cmp dword [ebp - 0x14], ebx
jl 0x1002b551
push ecx
mov dword [ebp - 0x68], edi
lea ecx, [ebp - 0x68]
push 0x213b
mov edx, 0x3857
call fcn.1002b932
dec dword [ebp - 0x14]
pop ecx
pop ecx
jns 0x1002b534
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x1e48
jge 0x1002b594
mov edx, str.habzkezca_cfhah_apquzgr_ftsox_fsekw
mov ecx, 0x1006f978
call fcn.1000365f
jmp 0x1002b594
cmp dword [ebp - 0x20], 0x1b2b
jge 0x1002b5a8
push str.hburfim_xmdoxdt_smlkp_ulmxrk_pthvgdcl_cnosajf
call fcn.1003f696
pop ecx
mov dword [ebp - 4], edi
cmp byte [0x10070ad9], 0
jne 0x1002b7b7
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], 0x6ce125d1
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x54], 0xe6b6
mov dword [ebp - 0x38], 0xa2d34caa
mov dword [ebp - 0x20], 0xb171
mov dword [ebp - 0x50], 0x2630
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1002b603
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x70], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002b5f9
push 0x61f7
push ebx
lea ecx, [ebp - 0x38]
call fcn.1002a9c5
add esp, 8
lea eax, [ebp - 0x50]
push eax
push ecx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x5c]
push eax
push ecx
push ebx
push ecx
mov eax, ecx
push eax
call fcn.1002a7f1
push 0x1520
push ebx
push esi
push esi
mov edx, 0x4d29
mov ecx, 0x10070d70
call fcn.1002c19f
mov dword [ebp - 0x14], 0xfffffffb
add esp, 0x30
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
jmp 0x1002b664
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002b65a
mov dword [ebp - 0x14], ebx
jmp 0x1002b67b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002b66e
mov dword [ebp - 0x14], ebx
jmp 0x1002b694
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002b686
mov dword [ebp - 0x14], 0xffffffef
jmp 0x1002b774
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0xeb4e5227
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0x4be495ee
mov dword [ebp - 0x20], 0xcc0f90b8
mov dword [ebp - 0x18], ebx
jmp 0x1002b6e9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa8], 0xab8ac29b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002b6d8
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
sbb eax, eax
inc eax
cmp eax, esi
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setl cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x14]
test edx, edx
je 0x1002b733
cmp dword [ebp - 0x48], ebx
jne 0x1002b736
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x34]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x1002b6a5
push ebx
push 0x551a
push 0x6368
push 0x6b5b
push esi
push 0x10070ad9
push 0x41e3
push 0x2073
push 0x3a28
push 0x2978
mov edx, 0x5650
xor cl, cl
call fcn.1002c4ce
add esp, 0x28
sub esp, 0xc
mov dword [ebp - 0x20], esi
call fcn.1002c492
mov byte [ebp - 0x21], bl
add esp, 0xc
cmp byte [ebp - 0x21], 0
je 0x1002b7d5
xor cl, cl
call fcn.1002b8d6
mov eax, dword [0x10070d70]
cmp eax, 0x270
jne 0x1002b821
mov edx, 0x10070d78
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, dword [edx - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
add edx, 4
cmp edx, 0x10071738
jl 0x1002b7e6
jmp 0x1002b82d
cmp eax, 0x4e0
jb 0x1002b832
call fcn.1002c66b
mov eax, dword [0x10070d70]
mov ecx, dword [eax*4 + 0x10070d74]
inc eax
mov dword [0x10070d70], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [0x100720f4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret