Function at 0x1001af22
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x64
mov eax, 0x10051f46
call fcn.100505de
mov eax, 0x10054e9c
lea ecx, [ebp - 0x1c]
sub eax, 0x63a923c9
push eax
call fcn.1001eea7
and dword [ebp - 4], 0
mov edx, 0x100d58a6
mov ecx, eax
call fcn.1003002c
cmp byte [0x100d58a6], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
je 0x1001afa7
call fcn.1004f2c0
call esi
push eax
call fcn.1004f7a0
push 0x1001891c
push 0x100d59ec
call fcn.1004ed40
call fcn.1004f320
push 0x3ba887ba
lea ecx, [ebp - 0x20]
call fcn.1001eee5
sub esp, 0xc
mov dword [ebp - 4], 1
mov edx, 0x100d5908
mov ecx, eax
call fcn.10033e78
add esp, 0xc
push 6
pop ecx
xor edx, edx
mov al, byte [edx + str.Ehdo]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001afc9
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x12
jl 0x1001afac
mov byte [ebp - 0x12], 0
mov edx, 0x100d589f
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.1003002c
cmp byte [0x100d589f], 0
push 0x14
pop ebx
je 0x1001b05b
call fcn.1004f2c0
call esi
push eax
call fcn.1004f7a0
push 0x10018a2d
push 0x100d59d4
call fcn.1004ed40
call fcn.1004f320
mov ecx, 0xaa
xor edx, edx
mov al, byte [edx + 0x10054ecc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x1001b038
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, ebx
jl 0x1001b01b
mov byte [ebp - 0x14], 0
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x100d5904
lea ecx, [ebp - 0x28]
call fcn.10033e78
add esp, 0xc
push 0x6b
pop ecx
xor edx, edx
mov al, byte [edx + 0x10054ee4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001b07d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1001b060
mov byte [ebp - 0x15], 0
mov edx, 0x100d589e
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x24]
call fcn.1003002c
cmp byte [0x100d589e], 0
je 0x1001b10d
call fcn.1004f2c0
call esi
push eax
call fcn.1004f7a0
push 0x10018a43
push 0x10060318
call fcn.1004ed40
call fcn.1004f320
mov ecx, 0xf7
xor edx, edx
mov al, byte [edx + 0x10054ef4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001b0e9
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x11
jl 0x1001b0cc
mov byte [ebp - 0x13], 0
sub esp, 0xc
mov dword [ebp - 4], 5
mov edx, 0x100d58fc
lea ecx, [ebp - 0x24]
call fcn.10033e78
add esp, 0xc
push 0xa
pop ecx
xor edx, edx
mov al, byte [edx + 0x10054f08]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001b12f
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1001b112
mov byte [ebp - 0x15], 0
mov edx, 0x100d589d
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.1003002c
cmp byte [0x100d589d], 0
je 0x1001b1bd
call fcn.1004f2c0
call esi
push eax
call fcn.1004f7a0
push 0x10018a59
push 0x10060310
call fcn.1004ed40
call fcn.1004f320
xor ecx, ecx
mov al, byte [ecx + str.76Uxkt]
xor al, bl
inc ebx
mov byte [ebp + ecx - 0x24], al
and ebx, 0x800000ff
jns 0x1001b196
dec ebx
or ebx, 0xffffff00
inc ebx
inc ecx
cmp ecx, 0x11
jl 0x1001b179
xor ebx, ebx
mov byte [ebp - 0x13], bl
sub esp, 0xc
mov dword [ebp - 4], 7
mov edx, 0x100d5900
lea ecx, [ebp - 0x24]
call fcn.10033e78
add esp, 0xc
jmp 0x1001b1bf
xor ebx, ebx
push 0x2e
pop ecx
mov edx, ebx
mov al, byte [edx + str.m_CWG_V]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001b1e1
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x11
jl 0x1001b1c4
mov byte [ebp - 0x13], bl
mov edx, 0x100d58a4
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x24]
call fcn.1003002c
or dword [ebp - 4], 0xffffffff
cmp byte [0x100d58a4], 0
je 0x1001b275
call fcn.1004f2c0
call esi
push eax
call fcn.1004f7a0
push 0x10018a6f
push 0x100d5a0c
call fcn.1004ed40
call fcn.1004f320
push 0x29
pop ecx
mov edx, ebx
mov al, byte [edx + str._n_thCCJDXQ]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x1001b24e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x1001b231
mov byte [ebp - 0x15], bl
sub esp, 0xc
mov dword [ebp - 4], 9
mov edx, 0x100d590c
lea ecx, [ebp - 0x28]
call fcn.10033e78
add esp, 0xc
or dword [ebp - 4], 0xffffffff
movaps xmm0, xmmword [0x1005a4c0]
mov ecx, ebx
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x18], 0xcdd3c5c4
movaps xmm0, xmmword [0x1005a1c0]
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x14], 0xdb
movaps xmm0, xmmword [str._06Y55_6:]
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 0x12], 1
lea eax, [ecx + 0x55]
xor byte [ebp + ecx - 0x48], al
inc ecx
cmp ecx, 0x35
jb 0x1001b2a9
lea eax, [ebp - 0x48]
mov byte [ebp - 0x12], bl
push eax
call fcn.1002d4ad
movaps xmm0, xmmword [0x1005a160]
pop ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0x21304620
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0x254b223d
mov dword [ebp - 0x18], 0x1004f39
call fcn.100145fc
push eax
call fcn.1002d4ad
movaps xmm0, xmmword [0x1005a1e0]
movups xmmword [ebp - 0x70], xmm0
pop ecx
movaps xmm0, xmmword [0x1005a120]
mov ecx, ebx
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x50], 0x3f393f21
mov word [ebp - 0x4c], 0x58
mov byte [ebp - 0x4a], 1
lea eax, [ecx + 0x55]
xor byte [ebp + ecx - 0x70], al
inc ecx
cmp ecx, 0x25
jb 0x1001b31b
lea eax, [ebp - 0x70]
mov byte [ebp - 0x4a], bl
push eax
call fcn.1002d4ad
pop ecx
call fcn.1005059c
ret