Function at 0x1003c964
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061a62
call fcn.10060010
sub esp, 0x13c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x9c], ecx
je 0x1003cbda
mov dword [ebp - 0x1c], 0x1b1d
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x1ce7
jle 0x1003ca49
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x14], ebx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, edi
mov edi, esi
cdq
mov esi, ebx
idiv ecx
mov ecx, edx
shl edi, cl
mov eax, edi
lea ecx, [ebp - 0x12c]
xor eax, esi
cdq
push edx
push eax
call fcn.100025b7
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003c9e3
mov eax, dword [eax]
push eax
call fcn.1004b05d
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x12c]
call fcn.10007cc3
inc esi
cmp esi, 0x3ac9
jl 0x1003c9c7
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
inc ecx
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
cmp ecx, 0x7f0b
jl 0x1003c9ba
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x2dbf
jl 0x1003c9b5
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x2cd0
jl 0x1003c9b0
push ebx
push 0x11df
push 0x1d3f
push 0x82
push 0x267a
call dword [sym.imp.GDI32.dll_CreateBitmap]
cmp dword [ebp - 0x1c], 0x197d
jge 0x1003ca5d
push str.lmfe_ghsgiff_jjxfm_sjv
call fcn.1004b05d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x3eae
cmp dword [ebp - 0x18], 0x41c2
jle 0x1003cb0a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov eax, esi
mov ecx, ebx
cdq
idiv edi
mov dword [ebp - 0x1c], ecx
mov eax, edx
mov dword [ebp - 0x48], eax
mov edi, eax
mov esi, ebx
shl edi, cl
mov eax, edi
lea ecx, [ebp - 0xe4]
xor eax, esi
cdq
push edx
push eax
call fcn.100025b7
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003cab8
mov eax, dword [eax]
push eax
call fcn.1004b05d
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xe4]
call fcn.10007cc3
inc esi
cmp esi, 0x41ec
jl 0x1003ca9c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x3632
jl 0x1003ca96
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x791e
jl 0x1003ca87
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3717
jl 0x1003ca82
cmp dword [ebp - 0x18], 0x3dd9
jge 0x1003cb1e
push str.jqoomvpu_jwdze_atcue_ozzlc_pmxvv
call fcn.1004b05d
pop ecx
mov esi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov dword [esi], ebx
cmp dword [esi], 3
jg 0x1003d318
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0xa8], 4
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], 0x47b5
push 0x5633
mov dword [ebp - 0x98], 0xddd7ad25
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, dword [edi]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
lea eax, [ebp - 0xa8]
push eax
push 1
lea eax, [ebp - 0x94]
mov ecx, dword [ebp - 0x30]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x98]
mov edx, 0x7ce2
push edi
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xa4]
push eax
push 1
push 0x7180
push 1
push dword [ebp + 0x24]
lea eax, [ebp - 0xa0]
push 0x498f
push esi
push 0xa2b
push 0x63f8
push eax
call fcn.10039159
add esp, 0x48
inc dword [esi]
cmp dword [esi], 3
jle 0x1003cb33
jmp 0x1003d318
mov eax, dword [ebp + 8]
xor edi, edi
inc edi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x1c], 0x4979
cmp dword [ebp - 0x1c], 0x4b8e
jle 0x1003cd9b
mov dword [ebp - 0x30], 0x20ac
cmp dword [ebp - 0x30], 0x67f
jge 0x1003cd1b
lea eax, [ebp - 0x50]
push eax
push ecx
lea eax, [ebp - 0x58]
mov ecx, 0x1007c050
push eax
call fcn.100375f1
pop ecx
mov ecx, eax
call fcn.100375f1
xor ebx, ebx
mov ecx, dword [ebp - 0x50]
mov eax, ecx
mov edx, dword [ebp - 0x4c]
or eax, edx
je 0x1003cd0d
add ecx, 0xffffffff
lea eax, [ebp - 0xb0]
push eax
push ecx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x50], ecx
adc edx, 0xffffffff
mov ecx, 0x1007c050
push eax
mov dword [ebp - 0x4c], edx
call fcn.100375f1
pop ecx
mov ecx, eax
call fcn.100375f1
push dword [ebp - 0x54]
mov ecx, dword [ebp - 0x78]
push dword [ebp - 0x58]
mov eax, dword [ebp - 0x74]
sub ecx, edi
sbb eax, ebx
push eax
push ecx
call fcn.1004eb30
mov edi, dword [ebp - 0xb0]
add eax, edi
mov esi, dword [ebp - 0xac]
adc edx, esi
add eax, 1
push ebx
push 2
adc edx, ebx
push edx
push eax
call fcn.10060030
add edi, dword [ebp - 0x78]
push ebx
adc esi, dword [ebp - 0x74]
push 2
push esi
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], edx
call fcn.100600e0
xor edi, edi
inc edi
cmp eax, edi
jne 0x1003ccdd
cmp edx, ebx
jne 0x1003ccdd
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
call fcn.1004eb30
add eax, edi
push ebx
push 2
adc edx, ebx
push edx
push eax
call fcn.10060030
jmp 0x1003cceb
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
add ecx, eax
mov eax, dword [ebp - 0x48]
adc eax, edx
push eax
push ecx
mov ecx, 0x1007bf98
call fcn.10007154
push eax
call fcn.1000a400
pop ecx
jmp 0x1003cc2b
add ecx, 0xffffffff
mov dword [ebp - 0x50], ecx
adc edx, 0xffffffff
mov dword [ebp - 0x4c], edx
jmp 0x1003cd1d
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
cdq
idiv dword [ebp - 0x14]
mov eax, ecx
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0xfc]
xor eax, dword [ebp - 0x18]
cdq
push edx
push eax
call fcn.100025b7
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003cd51
mov eax, dword [eax]
push eax
call fcn.1004b05d
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xfc]
call fcn.10007cc3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x75a1
jl 0x1003cd2a
inc esi
cmp esi, 0x1dc6
jl 0x1003cd27
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x2254
jl 0x1003cd25
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x6bcf
jl 0x1003cd20
jmp 0x1003cd9d
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x4656
jge 0x1003cdb1
push str.qmhg_wiou_feexykks_tghg_oasxpszs_pqb_pbpco_uge
call fcn.1004b05d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1003cdc8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], 0xf054a20a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1003cdba
mov dword [ebp - 0x40], 0xb
jmp 0x1003cf49
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1003cf3c
push 4
lea ecx, [ebp - 0x90]
call fcn.1000199f
mov dword [ebp - 4], 6
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1003ce18
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1003ce05
mov esi, dword [ebp - 0x90]
or dword [esi + 0xc], 0xffffffff
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], 0xffffffff
push eax
push ebx
push 0x117f
push edi
lea eax, [ebp - 0x38]
xor dl, dl
push eax
push 0x4bda
mov ecx, 0x43c8
call fcn.100387c1
add esp, 0x18
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], ebx
jl 0x1003cf0a
mov dword [ebp - 0x18], 0xb00868bb
mov dword [ebp - 0x18], ebx
jmp 0x1003ce98
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x1003ce87
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x70], ebx
jne 0x1003ce87
dec dword [ebp - 0x14]
jns 0x1003ce79
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x70], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1003ce6a
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1003cf01
mov dword [ebp - 0x14], 0xd13d8c53
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], ebx
jmp 0x1003ced3
push edi
push 0x828
push 0x1d67
push 0x75a7
xor dl, dl
xor cl, cl
call fcn.1003d4d8
add esp, 0x10
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1003ceb4
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x1003cefc
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x70]
test eax, eax
setne cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x14]
jns 0x1003cee0
dec dword [ebp - 0x18]
jns 0x1003cea5
dec dword [ebp - 0x38]
jns 0x1003ce5e
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 7
jl 0x1003ce28
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x90]
call fcn.10048a74
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
inc dword [ebp - 0x24]
pop ecx
cmp dword [ebp - 0x24], 0x18
jle 0x1003cde5
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x1b
jl 0x1003cdda
push 2
lea ecx, [ebp - 0x84]
call fcn.1000199f
lea eax, [ebp - 0xcc]
mov dword [ebp - 4], 7
push eax
push ecx
mov dword [ebp - 0x30], ebx
lea edx, [ebp - 0x84]
xor cl, cl
call fcn.10039d3f
mov dword [ebp - 0x18], 0x14f5
cmp dword [ebp - 0x18], 0x17e4
pop ecx
pop ecx
jle 0x1003d005
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
cdq
idiv esi
mov dword [ebp - 0x1c], 0x1ccc
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0x114]
cdq
push edx
push eax
call fcn.100025b7
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003cfc1
mov eax, dword [eax]
push eax
call fcn.1004b05d
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x114]
call fcn.10007cc3
dec esi
dec dword [ebp - 0x1c]
jne 0x1003cfa7
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x481f
jl 0x1003cf9b
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x726e
jl 0x1003cf96
push ebx
push edi
push 0x1001
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp dword [ebp - 0x18], 0x1443
mov eax, dword [ebp - 0x84]
mov dword [eax + 4], 0xffffffe6
jge 0x1003d026
push str.tiemxb_jhl_bzdis_vqkmehf_vjsupr
call fcn.1004b05d
pop ecx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x84]
call fcn.10048a74
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov al, byte [eax]
mov byte [ebp - 0x29], al
mov dword [ebp - 0x1c], 0x3e25
cmp dword [ebp - 0x1c], 0x4082
pop ecx
jle 0x1003d085
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov ecx, 0x1007bf98
xor eax, esi
cdq
push edx
push eax
call fcn.10007154
inc ebx
cmp ebx, 0x7efa
jl 0x1003d05f
inc esi
push 0
pop ebx
cmp esi, 0x5735
jl 0x1003d05c
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x1c], 0x3a76
jge 0x1003d0a4
mov edx, str.hwopu_ekkjmh_lbicj_buabsduet_vnzy_bxvg_kju_vsdic_yondp_gwmtlrhsv_jmnbvylje_ybylp
mov ecx, 0x1007bf98
call fcn.1000a079
or dword [ebp - 4], 0xffffffff
push 2
lea ecx, [ebp - 0x68]
call fcn.1000199f
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0xc
push eax
push 0x3592
push ebx
push 0x488f
lea ecx, [ebp - 0x68]
call fcn.1003b5d3
add esp, 0x10
mov dword [ebp - 0x44], ebx
jmp 0x1003d10a
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xc0], ebx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1003d0fd
mov dword [ebp - 0xb8], edi
cmp dword [ebp - 0xb8], ebx
jl 0x1003d1e0
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], ebx
jmp 0x1003d1ac
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], ebx
jmp 0x1003d19c
push 0x7edf
push ebx
push 0x12f
push 0x7e4a
push 0x1ae5
push 0x4ef8
lea eax, [ebp - 0x68]
mov edx, 0xe39
push eax
push 0x2c04
push 0x78d1
push 0x554
push 0x47b9
push edi
push 0x63dc
lea eax, [ebp - 0x3c]
mov ecx, 0x767e
push eax
push 0x6d47
push 0x35f6
push 0x888
push 0x1491
push ebx
call fcn.1003c08c
add esp, 0x4c
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x1003d136
push ebx
call fcn.10038fb0
inc dword [ebp - 0x24]
pop ecx
cmp dword [ebp - 0x24], edi
jle 0x1003d12e
push ebx
push 0x263d
push 0x2e62
push 0xb12
push ecx
mov byte [ebp - 0x31], bl
lea ecx, [ebp - 0x31]
call fcn.1003873b
add esp, 0x14
dec dword [ebp - 0xb8]
jns 0x1003d122
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x68], 0
je 0x1003d1fc
push dword [ebp - 0x68]
call fcn.10048a74
pop ecx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x24], 0x2ae1
cmp dword [ebp - 0x24], 0x2e4f
jle 0x1003d258
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
xor eax, esi
lea ecx, [ebp - 0x144]
cdq
push edx
push eax
call fcn.100025b7
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d22d
mov eax, dword [eax]
push eax
call fcn.1004b05d
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x144]
call fcn.10007cc3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x3990
jl 0x1003d213
inc esi
cmp esi, 0x7486
jl 0x1003d20e
lea eax, [ebp - 0x5c]
xor cl, cl
push eax
lea edx, [ebp - 0x29]
call fcn.1003dfe1
cmp dword [ebp - 0x24], 0x29da
pop ecx
jge 0x1003d27b
push str.gfxkpjh_jgdgu_zkvne_wjgkif_rdpqn_keotlxr_zaso_wvlbbyfw_onwnloig_fuqjil
call fcn.1004b05d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x24], ebx
jmp 0x1003d29c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc8], 0xf0ea
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1003d28b
push ecx
push ecx
push 0x1536
xor dl, dl
call fcn.10039ece
add esp, 0xc
mov dword [ebp - 0x14], ebx
jmp 0x1003d2c7
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xc8], ebx
jne 0x1003d2cc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1003d2b8
mov esi, dword [ebp - 0x5c]
mov dl, 0xb3
mov cl, byte [esi]
call fcn.10042b7e
push 0x241a
push 0x5371
push edi
push ebx
push 0x712a
push ebx
push 0x79e4
push 0x5fe0
push 0x6757
mov edx, 0x5a41
mov byte [esi], al
mov ecx, 0x25b
call fcn.1003b775
mov ecx, dword [ebp - 0x9c]
add esp, 0x24
mov al, byte [ebp - 0x29]
mov byte [ecx], al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret