Function at 0x1004d910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1017a5c8
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x101cf40c]
xor eax, esp
mov dword [esp + 0x468], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101cf40c]
xor eax, esp
push eax
lea eax, [esp + 0x480]
mov dword fs:[0], eax
mov esi, dword [esp + 0x490]
mov edi, dword [esp + 0x494]
mov ebp, dword [esp + 0x498]
lea eax, [esp + 0x3a4]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov ecx, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x3b4], eax
mov dword [esp + 0x3b8], ecx
mov dword [esp + 0x488], 1
mov edx, dword [esp + 0x3b4]
mov byte [edx], bl
mov dword [esp + 0x488], 2
mov edi, edi
cmp dword [edi + 0x32c4], ebx
jne 0x1004d9c9
push ebp
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1004d9c9
lea eax, [esp + 0x3a4]
push eax
mov ecx, esi
call fcn.1000a210
jmp 0x1004dd8d
mov dword [esp + 0x14], ebx
mov ch, ch
cmp dword [edi + 0x32c4], ebx
je 0x1004d9df
mov dword [esp + 0x14], ebp
push edx
pop edx
jmp 0x1004d9ef
lea ecx, [esp + 0x14]
push ecx
push ebp
call fcn.10067530
add esp, 8
mov dl, dl
mov edx, dword [esp + 0x14]
push edx
call fcn.1006bb90
add esp, 4
mov bl, bl
test al, al
jne 0x1004dc10
mov ecx, ecx
mov al, 0x6c
mov bl, 0x65
mov byte [esp + 0x3bc], 0x6b
mov byte [esp + 0x3bd], bl
mov byte [esp + 0x3be], 0x72
mov byte [esp + 0x3bf], 0x6e
mov byte [esp + 0x3c0], bl
mov byte [esp + 0x3c1], al
mov byte [esp + 0x3c2], 0x33
mov byte [esp + 0x3c3], 0x32
mov byte [esp + 0x3c4], 0x2e
mov byte [esp + 0x3c5], 0x64
mov byte [esp + 0x3c6], al
mov byte [esp + 0x3c7], al
mov byte [esp + 0x3c8], 0
push ecx
pop ecx
lea eax, [esp + 0x3bc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov ch, ch
test eax, eax
je 0x1004dd7e
mov cl, 0x6d
mov byte [esp + 0x3cc], 0x47
mov byte [esp + 0x3cd], bl
mov byte [esp + 0x3ce], 0x74
mov byte [esp + 0x3cf], 0x43
mov byte [esp + 0x3d0], 0x6f
mov byte [esp + 0x3d1], cl
mov byte [esp + 0x3d2], cl
mov byte [esp + 0x3d3], 0x61
mov byte [esp + 0x3d4], 0x6e
mov byte [esp + 0x3d5], 0x64
mov byte [esp + 0x3d6], 0x4c
mov byte [esp + 0x3d7], 0x69
mov byte [esp + 0x3d8], 0x6e
mov byte [esp + 0x3d9], bl
mov byte [esp + 0x3da], 0x41
mov byte [esp + 0x3db], 0
mov edi, edi
lea edx, [esp + 0x3cc]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
xchg ebx, eax
xchg ebx, eax
test eax, eax
jne 0x1004db2b
lea eax, [esp + 0x3a4]
push eax
jmp 0x1004dd86
push eax
call fcn.1004b530
add esp, 4
mov dh, dh
push eax
call fcn.1004b530
add esp, 4
mov dl, dl
push eax
call fcn.1004b530
add esp, 4
mov edi, edi
mov eax, dword [eax + 1]
mov ebx, ebx
push eax
lea ecx, [esp + 0x3e0]
push 0x101838c0
push ecx
call fcn.10119290
add esp, 0xc
mov bh, bh
push 0
lea edx, [esp + 0x3e0]
push edx
push ebp
push edi
call fcn.10046580
add esp, 0x10
mov esi, eax
mov al, al
test esi, esi
jne 0x1004db96
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x3a4]
push eax
jmp 0x1004dd86
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
push ecx
pop ecx
push esi
lea ecx, [esp + 0x3e0]
push 0x101838c0
push ecx
call fcn.10119290
add esp, 0xc
mov edi, edi
push 2
lea edx, [esp + 0x3e0]
push edx
push ebp
push edi
call fcn.10046580
add esp, 0x10
mov byte [esp + 0x18], al
mov edx, edx
cmp byte [esp + 0x18], 0
je 0x1004dd7a
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1004dbe6
sub eax, edx
lea eax, [esp + eax + 0x18]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x3ac]
call fcn.1000a280
push eax
pop eax
add esi, 1
mov bh, bh
jmp 0x1004dba2
mov edx, dword [esp + 0x14]
push edx
call fcn.1004b660
add esp, 4
mov eax, eax
mov ecx, eax
or ecx, edx
je 0x1004dd7e
mov cl, cl
mov dword [esp + 0x18], ebx
mov bl, bl
lea ecx, [esp + 0x18]
push ecx
push 0x380
lea ecx, [esp + 0x2c]
push ecx
push edx
mov edx, dword [esp + 0x24]
push eax
push edx
call fcn.100670d0
add esp, 0x18
mov dl, dl
test al, al
je 0x1004dd7e
mov ebx, ebx
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x48]
push 0x80
lea ecx, [esp + 0x404]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
call fcn.100670d0
add esp, 0x18
xchg ebx, eax
xchg ebx, eax
test al, al
je 0x1004dd7e
push ebx
pop ebx
mov ch, ch
movzx edx, word [esp + 0x46c]
add edx, 2
push edx
call fcn.1011741c
add esp, 4
mov edi, eax
mov ebx, ebx
cmp edi, ebx
je 0x1004dd7e
movzx eax, word [esp + 0x46c]
add eax, 2
push eax
push ebx
push edi
call fcn.101184b0
add esp, 0xc
mov ah, ah
movzx edx, word [esp + 0x46c]
mov eax, dword [esp + 0x474]
lea ecx, [esp + 0x18]
push ecx
push edx
cdq
push edi
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.100670d0
add esp, 0x18
mov ebx, ebx
test al, al
je 0x1004dd6d
mov dl, dl
movzx ecx, word [esp + 0x46c]
add ecx, 1
push ecx
call fcn.1011741c
add esp, 4
mov esi, eax
mov dh, dh
test esi, esi
je 0x1004dd69
movzx edx, word [esp + 0x46c]
add edx, 1
push edx
push 0
push esi
call fcn.101184b0
add esp, 0xc
mov ebp, ebp
movzx eax, word [esp + 0x46c]
push 0
push 0
add eax, 1
push eax
push esi
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dh, dh
push ebx
pop ebx
push esi
lea ecx, [esp + 0x3a8]
call fcn.100113f0
mov edi, edi
push esi
call fcn.101174df
add esp, 4
mov eax, eax
mov esi, dword [esp + 0x20]
push edi
call fcn.101174df
add esp, 4
mov ah, ah
jmp 0x1004dd7e
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x3a4]
push ecx
mov ecx, esi
call fcn.1000a210
mov dword [esp + 0x1c], 1
mov byte [esp + 0x488], 0
lea ecx, [esp + 0x3a4]
call fcn.10006800
mov eax, esi
mov ecx, dword [esp + 0x480]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x468]
xor ecx, esp
call fcn.101179ba
add esp, 0x478
ret