Function at 0x1010d950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1010dc90
push ebx
push edi
push 0
push esi
call fcn.10116670
add esp, 8
mov bl, 0x73
push 4
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp - 0x58], 0x52444849
mov dword [ebp - 8], 0x54414449
mov dword [ebp - 0x28], 0x444e4549
mov dword [ebp - 0x10], 0x45544c50
mov dword [ebp - 0x68], 0x44474b62
mov dword [ebp - 0x38], 0x4d524863
mov dword [ebp - 0x88], 0x414d4167
mov dword [ebp - 0x48], 0x54534968
mov dword [ebp - 0x50], 0x50434369
mov word [ebp - 0x78], 0x466f
mov byte [ebp - 0x76], 0x46
mov byte [ebp - 0x75], bl
mov dword [ebp - 0x18], 0x4c414370
mov word [ebp - 0x20], 0x4870
mov byte [ebp - 0x1e], 0x59
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x30], bl
mov word [ebp - 0x2f], 0x4942
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x98], bl
mov word [ebp - 0x97], 0x4143
mov byte [ebp - 0x95], 0x4c
mov byte [ebp - 0x60], bl
mov word [ebp - 0x5f], 0x4c50
mov byte [ebp - 0x5d], 0x54
mov byte [ebp - 0x40], bl
mov word [ebp - 0x3f], 0x4752
mov byte [ebp - 0x3d], 0x42
mov dword [ebp - 0x70], 0x74584574
mov dword [ebp - 0x80], 0x454d4974
mov dword [ebp - 0x90], 0x534e5274
mov dword [ebp - 0xa0], 0x7458547a
call fcn.10112a00
lea ecx, [ebp + 8]
push ecx
push esi
call fcn.10116620
push esi
mov edi, eax
call fcn.1010c7d0
push 4
lea eax, [esi + 0x11c]
push eax
push esi
call fcn.101156a0
mov eax, dword [esi + 0x11c]
lea ecx, [esi + 0x11c]
add esp, 0x24
cmp eax, dword [ebp - 0x58]
jne 0x1010da87
mov edx, dword [ebp + 0xc]
push edi
push edx
push esi
call fcn.101167b0
jmp 0x1010dc81
cmp eax, dword [ebp - 0x28]
jne 0x1010da9c
mov eax, dword [ebp + 0xc]
push edi
push eax
push esi
call fcn.10116af0
jmp 0x1010dc81
push ecx
push esi
call fcn.1010cd10
add esp, 8
test eax, eax
je 0x1010daf6
mov ecx, dword [esi + 0x11c]
cmp ecx, dword [ebp - 8]
jne 0x1010dad0
test edi, edi
jne 0x1010dac2
test dword [esi + 0x68], 0x2000
je 0x1010dad0
push str.Too_many_IDATs_found
push esi
call fcn.101151f0
add esp, 8
mov edx, dword [ebp + 0xc]
push edi
push edx
push esi
call fcn.101188b0
mov eax, dword [esi + 0x11c]
add esp, 0xc
cmp eax, dword [ebp - 0x10]
jne 0x1010dc84
or dword [esi + 0x68], 2
jmp 0x1010dc84
mov eax, dword [esi + 0x11c]
cmp eax, dword [ebp - 8]
jne 0x1010db2b
test edi, edi
jne 0x1010db0e
test dword [esi + 0x68], 0x2000
je 0x1010db1c
push str.Too_many_IDATs_found
push esi
call fcn.101151f0
add esp, 8
push edi
push esi
call fcn.10116670
add esp, 8
jmp 0x1010dc84
push edi
cmp eax, dword [ebp - 0x10]
jne 0x1010db40
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.10116960
jmp 0x1010dc81
cmp eax, dword [ebp - 0x68]
jne 0x1010db54
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.10117b50
jmp 0x1010dc81
cmp eax, dword [ebp - 0x38]
jne 0x1010db68
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.10116e40
jmp 0x1010dc81
cmp eax, dword [ebp - 0x88]
jne 0x1010db7f
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.10116b40
jmp 0x1010dc81
cmp eax, dword [ebp - 0x48]
jne 0x1010db93
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.10117d50
jmp 0x1010dc81
cmp eax, dword [ebp - 0x78]
jne 0x1010dba7
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.10117fc0
jmp 0x1010dc81
cmp eax, dword [ebp - 0x18]
jne 0x1010dbbb
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.101180e0
jmp 0x1010dc81
cmp eax, dword [ebp - 0x98]
jne 0x1010dbd2
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.10118370
jmp 0x1010dc81
cmp eax, dword [ebp - 0x20]
jne 0x1010dbe6
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.10117ea0
jmp 0x1010dc81
cmp eax, dword [ebp - 0x30]
jne 0x1010dbfa
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.10116cd0
jmp 0x1010dc81
cmp eax, dword [ebp - 0x40]
jne 0x1010dc0b
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.101172c0
jmp 0x1010dc81
cmp eax, dword [ebp - 0x50]
jne 0x1010dc1c
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.101174c0
jmp 0x1010dc81
cmp eax, dword [ebp - 0x60]
jne 0x1010dc2d
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.10117680
jmp 0x1010dc81
cmp eax, dword [ebp - 0x70]
jne 0x1010dc3e
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.10118610
jmp 0x1010dc81
cmp eax, dword [ebp - 0x80]
jne 0x1010dc4f
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.10118510
jmp 0x1010dc81
cmp eax, dword [ebp - 0x90]
jne 0x1010dc63
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.101178d0
jmp 0x1010dc81
cmp eax, dword [ebp - 0xa0]
jne 0x1010dc77
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.10118740
jmp 0x1010dc81
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.101188b0
add esp, 0xc
test byte [esi + 0x68], 0x10
je 0x1010d974
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret