Function at 0x10003770
Capabilities:
Create thread
Encode data using xor
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
mov dword [0x1000988c], ebx
mov dword [0x10009608], ebx
xor eax, eax
lea esp, [esp]
mov byte [eax + 0x10007e98], bl
add eax, 0x12c
cmp eax, 0x1770
jb 0x10003790
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push str.error
push 0x64
push 0x10009688
push 0xffffffffffffffff
push eax
push 0x200
push ebx
call esi
mov ecx, dword [ebp + 0xc]
push ebx
push str.error
push 0x64
push 0x100096f0
push 0xffffffffffffffff
push ecx
push 0x200
push ebx
call esi
call fcn.10001000
test eax, eax
je 0x10003a2f
xor eax, eax
lea ecx, [ecx]
mov dl, al
add dl, 1
xor byte [eax + str.8:_570_01_::_], dl
add eax, 1
cmp eax, 0x2e
jb 0x100037f0
push 0x10009648
push str.wuxiaodizhi
mov dword [0x10007028], 1
call dword [sym.imp.MSVCR80.dll__stricmp]
add esp, 8
test eax, eax
je 0x10003831
mov eax, dword [0x10009680]
push eax
push 0x10009648
jmp 0x10003867
xor eax, eax
jmp 0x10003840
mov cl, byte [eax + str.8:_570_01_::_]
mov byte [eax + 0x10009648], cl
add eax, 1
test cl, cl
jne 0x10003840
push 0x323
mov dword [0x10009680], 0x323
push str.8:_570_01_::_
call fcn.10004040
add esp, 8
cmp eax, ebx
jne 0x1000394a
call fcn.10003bf0
mov edi, eax
cmp edi, ebx
jne 0x1000389a
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
call fcn.10003bf0
mov edi, eax
cmp edi, ebx
je 0x10003888
mov eax, 0x431bde83
mul edi
mov ecx, edx
mov eax, 0x10624dd3
mul edi
shr edx, 6
shr ecx, 0x12
mov esi, edx
imul edx, edx, 0x3e8
mov eax, ecx
imul eax, eax, 0x3e8
sub esi, eax
sub edi, edx
mov eax, 0x51eb851f
mul ecx
mov dword [esp + 0x10], edi
mov edi, edx
mov eax, 0x51eb851f
mul esi
mov ebx, edx
mov eax, 0x51eb851f
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
shr edx, 5
mov dword [esp + 0x14], edx
imul edx, edx, 0x64
sub eax, edx
push eax
mov eax, dword [esp + 0x18]
lea edx, [eax + eax*4 + 0x100051db]
shr ebx, 5
mov eax, ebx
imul eax, eax, 0x64
sub esi, eax
shr edi, 5
mov eax, edi
imul eax, eax, 0x64
push edx
push esi
lea edx, [ebx + ebx*4 + 0x100051db]
push edx
sub ecx, eax
push ecx
lea ecx, [edi + edi*4 + 0x100051db]
push ecx
push str._s_d_s_d_s_d
push 0x100098f4
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x20
mov dword [0x10007028], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x64
push ebx
push 0x10009828
mov dword [0x10009990], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [0x10009638], ebx
jne 0x1000398b
push 0x10009638
push 0x10003750
push 0x10003740
mov ecx, 0x10007c28
mov ebx, 0x866d88
call fcn.10001cf0
add esp, 0xc
xor ebx, ebx
cmp dword [0x10009640], ebx
jne 0x100039b6
push 0x10009640
push 0x10002f80
push 0x10002f60
mov ecx, 0x10007d60
mov ebx, 0x68cab0
call fcn.10001cf0
add esp, 0xc
xor ebx, ebx
mov edx, dword [0x10009754]
push 0x3e8
mov dword [0x10007e94], 1
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x10009754]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x10007e94], ebx
je 0x100039f2
push 1
push eax
call esi
mov dword [0x10009754], ebx
push ebx
push ebx
push ebx
push 0x10001900
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10009754], eax
mov eax, dword [0x100097bc]
cmp eax, ebx
je 0x10003a1b
push 1
push eax
call esi
mov dword [0x100097bc], ebx
mov eax, dword [0x10009824]
cmp eax, ebx
je 0x10003a2f
push 1
push eax
call esi
mov dword [0x10009824], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret