Function at 0xf730d81
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
test esi, esi
je 0xf730dd3
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x20]
mov dword [esp + 0x10], eax
test edi, edi
jne 0xf730ddd
test byte [esi + 0x1d], 0x10
jne 0xf730e69
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test byte [ecx + 7], 8
jne 0xf730e89
push 0
mov ecx, dword [esi + 0x20]
push 0
push 0x105c
mov eax, dword [ecx]
push dword [esi + 0x2c]
push esi
call dword [eax + 8]
push esi
call fcn.0f731dea
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 4
mov eax, dword [0xf7b8848]
push eax
push edi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0xf746357
push 5
push esi
call fcn.0f72adb6
mov ebx, eax
test ebx, ebx
jne 0xf730e26
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test byte [ecx + 7], 8
jne 0xf730e12
push esi
call fcn.0f72a9c0
mov eax, dword [0xf7ae078]
cmp dword [esp + 0x10], eax
je 0xf730e3e
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0xf730da8
push 2
push ebx
call fcn.0f72adb6
mov ebp, eax
push ebx
mov ebx, ebp
call fcn.0f730d81
test ebp, ebp
jne 0xf730e26
jmp 0xf730e00
mov eax, dword [esi + 0x30]
mov edx, dword [0xf7b85e0]
mov ecx, dword [eax + 0x34]
test byte [ecx + edx], 4
je 0xf730e1d
push 0
mov eax, dword [0xf7ae160]
push edi
push 0x221
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0xf730da8
push esi
call fcn.0f72a9c0
push 0
mov ecx, dword [esi + 0x20]
push 0
push 0x82
mov eax, dword [ecx]
push dword [esi + 0x2c]
push esi
call dword [eax + 8]
jmp 0xf730da8
push esi
call fcn.0f72a9c0
jmp 0xf730db8
inc esp
stc
invalid
jne 0xf7462d9
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0f7454c9
cmp al, byte [edi]
sbb al, 0x4d
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0f7454a7
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0f7454d9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0f74548e
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0f7454c9
push es
invalid