Function at 0x994e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.009a9480
add esp, 0xc
xchg esi, edi
add byte [ebx - 0x178f33c], al
xchg esi, edi
lea edi, [edi + 0x5f53]
sub edi, 0x5f53
mov edx, edx
jnp 0x994e74
xchg ebx, eax
xchg ebx, eax
xchg edi, edi
lea esi, [esi + 0x35c8]
lea esi, [esi - 0x35c8]
lea eax, [eax]
jp 0x994e74
lcall 0x45c6, 0x66b0db16
call 0xeddf14c5
jae 0x994e45
mov al, 0x66
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x46
inc ebp
inc esi
mov byte [ebp - 0x17], al
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0x15], 0x57
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], al
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xc], 0x58
xchg edi, edi
jmp 0x994eb0
cmp ecx, esi
jl 0x994ebc
jb 0x994eb6
jmp 0x994eb8
jge 0x994ebc
mov edi, 0xe8558aa3
mov dl, byte [ebp - 0x18]
mov cl, byte [ebp - 0x13]
mov al, byte [ebp - 0x17]
mov bl, byte [ebp - 0x12]
dec dl
dec cl
mov byte [ebp - 0x18], dl
mov dl, byte [ebp - 0x16]
dec al
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0x11]
dec bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x15]
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0x10]
mov byte [ebp - 0x16], dl
mov dl, byte [ebp - 0x14]
dec cl
dec al
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0xf]
dec bl
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0xd]
dec dl
mov byte [ebp - 0x10], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 0x14], dl
mov dl, byte [ebp - 0xe]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xe], dl
dec ebx
inc ebx
jne 0x994f37
pushf
test dword [esp + 0x10], ecx
popf
jns 0x994f32
xchg esi, esi
je 0x994f37
mov esi, 0x1e814e8
add byte [ebp + 0x5f0975c0], al
call fcn.009b3750
test eax, eax
jne 0x994f49
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
jae 0x994f4b
je 0x994f5d
pushf
and esp, 0xffffffff
popf
jl 0x994f56
lea edi, [edi]
ja 0x994f5a
jne 0x994f5d
mov esi, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.009b6060
push 0xe
lea edx, [ebp - 0x18]
mov esi, eax
push 0
push edx
mov dword [ebp - 8], esi
call fcn.009a9480
add esp, 0xc
jl 0x994f7e
jge 0x994f8d
pushf
jle 0x994f84
je 0x994f86
popf
jg 0x994f8a
jl 0x994f8d
mov ebp, 0xb75f685
test esi, esi
jne 0x994f9c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor edx, dword [esp + 4]
xor edx, dword [esp + 4]
jne 0x994fa6
test dword [esp], ebx
jno 0x994fbc
lea eax, [eax + 0x16a]
lea eax, [eax - 0x16a]
jne 0x994fb9
jo 0x994fbc
jmp 0xe2f83816
push esi
call fcn.009a3220
lea ecx, [ecx]
xchg edx, edx
jl 0x994fe7
lea edi, [edi + 0x440]
lea edi, [edi - 0x440]
xchg esp, esp
jl 0x994fd8
lea edi, [edi + 0xef3]
lea edi, [edi - 0xef3]
jge 0x994fe7
mov esi, 0x458d0e6a
call 0xe8e9505a
mov word [ecx + eax], es
push 0xe
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.009a9480
add esp, 0x10
js 0x994ff9
jp 0x995003
js 0x994ffd
jnp 0x994fff
jnp 0x995003
call 0xc70000cd
inc ebp
call 0xeddf1654
jae 0x994fd4
mov al, 0x66
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x46
inc ebp
inc esi
mov byte [ebp - 0x17], al
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0x15], 0x57
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], al
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xc], 0x42
add eax, 0
je 0x995054
xchg esp, esp
jle 0x995044
lea ecx, [ecx + 0x3c65]
lea ecx, [ecx - 0x3c65]
jne 0x995054
mov esi, 0xe84d8a92
mov cl, byte [ebp - 0x18]
mov al, byte [ebp - 0x13]
mov bl, byte [ebp - 0x17]
mov dl, byte [ebp - 0x12]
dec cl
dec al
mov byte [ebp - 0x18], cl
mov cl, byte [ebp - 0x16]
dec bl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x11]
dec dl
mov byte [ebp - 0x17], bl
mov bl, byte [ebp - 0x15]
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x10]
mov byte [ebp - 0x16], cl
mov cl, byte [ebp - 0x14]
dec al
dec bl
mov byte [ebp - 0x11], al
mov al, byte [ebp - 0xf]
dec dl
mov byte [ebp - 0x15], bl
mov bl, byte [ebp - 0xd]
dec cl
mov byte [ebp - 0x10], dl
mov dl, byte [ebp - 0xc]
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 0xe]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0xf], al
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xe], cl
xor edi, 0x2f9b
xor edi, 0x2f9b
jg 0x9950dd
pushf
nop
sub edx, 0
popf
mov esp, esp
jbe 0x9950d6
xchg edi, edx
xchg edi, edx
jle 0x9950dd
mov edx, 0x9903d0a1
add byte [ebp - 0x7de8b40], al
mov eax, dword [0x9903d0]
test eax, eax
je 0x995107
clc
jge 0x9950f4
nop
jg 0x9950ec
lea esp, [esp]
ja 0x9950f1
jl 0x9950f4
mov esp, 0x3d0158b
cdq
add byte [ebp + 0x5251e84d], cl
mov edx, dword [0x9903d0]
lea ecx, [ebp - 0x18]
push ecx
push edx
call fcn.009b6060
mov dword [ebp - 4], eax
lea esp, [esp]
sub esp, 0
or ecx, 0
jle 0x99511f
jl 0x995114
jb 0x995116
xchg esp, esp
xchg edx, ebx
xchg edx, ebx
jg 0x99511f
sub dword [edx + 0xe], 0x6ae8458d
add byte [eax - 0x18], dl
push esp
inc ebx
add dword [eax], eax
push 0xe
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.009a9480
add esp, 0xc
cmp edi, edx
xor edi, dword [esp + 4]
xor edi, dword [esp + 4]
jl 0x995140
jne 0x99513d
jge 0x995140
add eax, 0x85fc458b
sal byte [ebx - 0x3f], 0xec
add byte [ebx], bh
inc esp
and al, 8
mov eax, dword [ebp - 4]
test eax, eax
je 0x99516a
shr esp, 0
cmp eax, dword [esp + 8]
jmp 0x995150
jns 0x99515c
xchg edi, esi
xchg edi, esi
lea esi, [esi]
js 0x99515c
lcall 0xbce8, 0x51c88b55
loopne 0x995163
mov ecx, eax
push ecx
call fcn.009a3220
mov esi, dword [ebp - 8]
add esp, 4
add byte [ebx - 0x3b7c078b], cl
add al, 0xc1
retf 0xc11c
ror edx, 0x1c
ror edx, 4
push edi
pop edi
test dword [esp], edi
std
cld
jl 0x995184
pushf
jle 0x99517d
popf
jge 0x995181
jge 0x995184
mov ecx, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4