Function at 0x1001f500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
mov al, 0xb6
mov cl, 0x89
push ebx
push esi
mov byte [esp + 0x2f], al
mov byte [esp + 0x33], al
mov byte [esp + 0x1c], cl
xor ebx, ebx
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], al
mov dl, 2
mov al, 0x8b
mov cl, 0xc
push 0xa00000
push ebx
mov byte [esp + 0x30], 0x33
mov byte [esp + 0x31], 0xc9
mov byte [esp + 0x32], 0x83
mov byte [esp + 0x33], 0xc0
mov byte [esp + 0x34], dl
mov byte [esp + 0x35], 0x57
mov byte [esp + 0x36], 0xf
mov byte [esp + 0x38], 0x50
mov byte [esp + 0x39], 0xfe
mov byte [esp + 0x3a], 0xf
mov byte [esp + 0x3c], 0x70
mov byte [esp + 0x25], 0x87
mov byte [esp + 0x26], 0x10
mov byte [esp + 0x27], 0xf
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x5f
mov byte [esp + 0x2b], 0x5e
mov byte [esp + 0x2c], 0x5d
mov byte [esp + 0x10], 0xb9
mov byte [esp + 0x11], 0x64
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 0xbf
mov byte [esp + 0x19], 0x4d
mov byte [esp + 0x1a], 0xe8
mov byte [esp + 0x1b], 0x33
mov byte [esp + 0x1c], 0xf6
mov byte [esp + 0x1d], 0xf
mov byte [esp + 0x1f], 0x7a
mov byte [esp + 0x20], dl
mov byte [esp + 0x40], al
mov byte [esp + 0x41], 0x45
mov byte [esp + 0x42], 0xbc
mov byte [esp + 0x43], al
mov byte [esp + 0x44], 0x4e
mov byte [esp + 0x45], cl
mov byte [esp + 0x46], al
mov byte [esp + 0x47], 0x40
mov byte [esp + 0x48], 4
mov byte [esp + 0x49], 0x51
mov byte [esp + 0x4a], 0xff
mov byte [esp + 0x4b], 0xd0
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], 0x75
mov byte [esp + 0x4e], cl
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1001f7cf
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov eax, dword [0x10035ec4]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebx
push 0xa00000
push esi
push 0x500000
push eax
call edi
test eax, eax
je 0x1001f7c7
lea ecx, [esp + 0x14]
push 9
push ecx
push 0xa00000
push esi
call fcn.10019ab0
cmp eax, ebx
je 0x1001f699
add eax, 0x4ffff7
push ebx
mov dword [0x10035e88], eax
push 0x100
mov edx, dword [eax + 2]
lea ecx, [eax + 6]
mov dword [0x10035e8c], edx
mov edx, dword [0x10035ec4]
add eax, 0xffffff80
push 0x10035f14
push eax
push edx
mov dword [0x10035e90], ecx
call edi
mov eax, dword [0x10035e88]
mov dword [0x10035f04], eax
jmp 0x1001f6f7
lea ecx, [esp + 0x2c]
push 0xd
push ecx
push 0xa00000
push esi
call fcn.10019ab0
cmp eax, ebx
je 0x1001f6f7
add eax, 0x4ffff8
push ebx
mov dword [0x10035e94], eax
push 0x100
mov edx, dword [eax + 2]
lea ecx, [eax + 6]
mov dword [0x10035e98], edx
mov edx, dword [0x10035ec4]
add eax, 0xffffff80
push 0x10036214
push eax
push edx
mov dword [0x10035e9c], ecx
call edi
mov eax, dword [0x10035e94]
mov dword [0x10035ed0], 1
mov dword [0x10035f10], eax
lea ecx, [esp + 0x20]
push 9
push ecx
push 0xa00000
push esi
call fcn.10019ab0
cmp eax, ebx
je 0x1001f739
mov edx, dword [0x10035ec4]
add eax, 0x500007
mov dword [0x10035ea0], eax
push ebx
push 0x100
add eax, 0xffffff80
push 0x10036014
push eax
push edx
call edi
mov eax, dword [0x10035ea0]
mov dword [0x10035f08], eax
lea ecx, [esp + 0xc]
push 6
push ecx
push 0xa00000
push esi
call fcn.10019ab0
cmp eax, ebx
je 0x1001f77b
mov edx, dword [0x10035ec4]
add eax, 0x500000
mov dword [0x10035ea8], eax
push ebx
push 0x100
add eax, 0xffffff80
push 0x10036114
push eax
push edx
call edi
mov eax, dword [0x10035ea8]
mov dword [0x10035f0c], eax
lea ecx, [esp + 0x3c]
push 0xf
push ecx
push 0xa00000
push esi
call fcn.10019ab0
cmp eax, ebx
je 0x1001f7c7
add eax, 0x50001e
push ebx
mov dword [0x10035eac], eax
push 0x100
lea edx, [eax + 6]
add eax, 0xffffff80
push 0x10036314
push eax
mov eax, dword [0x10035ec4]
mov dword [0x10035eb0], edx
push eax
call edi
mov ecx, dword [0x10035eac]
mov dword [0x10035f14], ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
cmp dword [0x10035ea8], ebx
je 0x1001f7fa
cmp dword [0x10035e94], ebx
je 0x1001f7fa
cmp dword [0x10035ea0], ebx
je 0x1001f7fa
cmp dword [0x10035eac], ebx
je 0x1001f7fa
pop esi
mov eax, 1
pop ebx
add esp, 0x40
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x40
ret