Function at 0x100ba000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 8
mov eax, 0x100ea8f0
call fcn.10001371
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, 0x10181f8c
mov dword [edi], ebx
lock inc dword [0x10181f80]
and dword [ebp - 4], 0
mov dword [edi + 8], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0xc], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x10], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x14], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x1c], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x20], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x28], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x2c], ebx
lock inc dword [0x10181f80]
mov esi, 0x100ee764
mov byte [ebp - 4], 8
lea ecx, [edi + 0x34]
push esi
call sym.fpsrvutl.dll_Ordinal_1980
lea ecx, [edi + 0x44]
mov byte [ebp - 4], 9
push esi
call sym.fpsrvutl.dll_Ordinal_1980
lea ecx, [edi + 0x54]
mov byte [ebp - 4], 0xa
push esi
call sym.fpsrvutl.dll_Ordinal_1980
lea ecx, [edi + 0x64]
mov byte [ebp - 4], 0xb
push esi
call sym.fpsrvutl.dll_Ordinal_1980
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 0xc
push esi
call sym.fpsrvutl.dll_Ordinal_1980
lea ecx, [edi + 0x84]
mov byte [ebp - 4], 0xd
push esi
call sym.fpsrvutl.dll_Ordinal_1980
lea ecx, [edi + 0x94]
mov byte [ebp - 4], 0xe
push esi
call sym.fpsrvutl.dll_Ordinal_1980
lea ecx, [edi + 0xa4]
mov byte [ebp - 4], 0xf
push esi
call sym.fpsrvutl.dll_Ordinal_1980
lea esi, [edi + 0xb4]
mov byte [ebp - 4], 0x10
push 4
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.1004ba3f
and dword [esi + 8], 0
and dword [esi + 0xc], 0
mov byte [ebp - 4], 0x11
lea ecx, [edi + 0xcc]
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x118]
mov byte [ebp - 4], 0x12
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x164]
mov byte [ebp - 4], 0x13
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1b0]
mov byte [ebp - 4], 0x14
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1fc]
mov byte [ebp - 4], 0x15
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x248]
mov byte [ebp - 4], 0x16
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x294]
mov byte [ebp - 4], 0x17
call sym.fpsrvutl.dll_Ordinal_5519
mov dword [edi + 0x2e0], ebx
lock inc dword [0x10181f80]
lea ecx, [edi + 0x2e4]
mov byte [ebp - 4], 0x19
call sym.fpsrvutl.dll_Ordinal_5519
xor eax, eax
lea ecx, [edi + 0x344]
mov dword [edi + 0x330], eax
mov word [edi + 0x338], ax
mov dword [edi + 0x340], eax
mov dword [edi + 0x33c], eax
call sym.fpsrvutl.dll_Ordinal_4614
mov dword [edi + 0x1b80], ebx
lock inc dword [0x10181f80]
lea ecx, [edi + 0x1b9c]
mov byte [ebp - 4], 0x1c
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1be8]
mov byte [ebp - 4], 0x1d
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1c34]
mov byte [ebp - 4], 0x1e
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1c80]
mov byte [ebp - 4], 0x1f
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1ccc]
mov byte [ebp - 4], 0x20
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1d18]
mov byte [ebp - 4], 0x21
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1d64]
mov byte [ebp - 4], 0x22
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1db0]
mov byte [ebp - 4], 0x23
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1dfc]
mov byte [ebp - 4], 0x24
call sym.fpsrvutl.dll_Ordinal_5519
mov byte [ebp - 4], 0x25
lea ecx, [edi + 0x1e48]
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x1e94]
mov byte [ebp - 4], 0x26
call sym.fpsrvutl.dll_Ordinal_5519
mov dword [edi + 0x1ee4], ebx
lock inc dword [0x10181f80]
lea esi, [edi + 0x1ee8]
mov byte [ebp - 4], 0x28
push 4
mov ecx, esi
call sym.fpsrvutl.dll_Ordinal_3375
xor ecx, ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [edi + 0x1f38], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x1f3c], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x1f40], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x1f44], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x1f48], ecx
mov word [edi + 0x1f50], cx
mov dword [edi + 0x1f58], ecx
mov dword [edi + 0x1f54], ecx
mov dword [edi + 0x1f5c], ecx
mov word [edi + 0x1f64], cx
mov dword [edi + 0x1f6c], ecx
mov dword [edi + 0x1f68], ecx
mov dword [edi + 0x1f70], ecx
mov word [edi + 0x1f78], cx
mov dword [edi + 0x1f80], ecx
mov dword [edi + 0x1f7c], ecx
mov dword [edi + 0x1f84], ecx
mov word [edi + 0x1f8c], cx
mov dword [edi + 0x1f94], ecx
mov dword [edi + 0x1f90], ecx
lea ecx, [edi + 0x1f98]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0x37d4]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0x5010]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0x684c]
call sym.fpsrvutl.dll_Ordinal_4614
mov dword [edi + 0x8088], ebx
lock inc dword [0x10181f80]
xor eax, eax
mov byte [ebp - 4], 0x32
lea ecx, [edi + 0x80a0]
mov dword [edi + 0x808c], eax
mov word [edi + 0x8094], ax
mov dword [edi + 0x809c], eax
mov dword [edi + 0x8098], eax
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x80ec]
call sym.fpsrvutl.dll_Ordinal_4614
mov dword [edi + 0x9928], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x992c], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x9930], ebx
lock inc dword [0x10181f80]
xor eax, eax
mov byte [ebp - 4], 0x37
lea ecx, [edi + 0x9948]
mov dword [edi + 0x9934], eax
mov word [edi + 0x993c], ax
mov dword [edi + 0x9944], eax
mov dword [edi + 0x9940], eax
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x9994]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0xb1d0]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0xca0c]
call sym.fpsrvutl.dll_Ordinal_4614
mov dword [edi + 0xe248], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0xe24c], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0xe250], ebx
lock inc dword [0x10181f80]
xor eax, eax
mov byte [ebp - 4], 0x3e
lea ecx, [edi + 0xe268]
mov dword [edi + 0xe254], eax
mov word [edi + 0xe25c], ax
mov dword [edi + 0xe264], eax
mov dword [edi + 0xe260], eax
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0xe2b4]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0xfaf0]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0x1132c]
call sym.fpsrvutl.dll_Ordinal_4614
mov dword [edi + 0x12b68], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x12b6c], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x12b70], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x12b74], ebx
lock inc dword [0x10181f80]
mov dword [edi + 0x12b78], ebx
lock inc dword [0x10181f80]
xor eax, eax
mov byte [ebp - 4], 0x47
lea ecx, [edi + 0x12b90]
mov dword [edi + 0x12b7c], eax
mov word [edi + 0x12b84], ax
mov dword [edi + 0x12b8c], eax
mov dword [edi + 0x12b88], eax
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x12bdc]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0x14418]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0x15c54]
call sym.fpsrvutl.dll_Ordinal_4614
lea ebx, [edi + 0x17490]
mov esi, 0x10181f8c
mov dword [ebx], esi
lock inc dword [0x10181f80]
mov dword [edi + 0x17494], esi
lock inc dword [0x10181f80]
mov dword [edi + 0x17498], esi
lock inc dword [0x10181f80]
xor eax, eax
mov byte [ebp - 4], 0x4e
lea ecx, [edi + 0x174b0]
mov dword [edi + 0x1749c], eax
mov word [edi + 0x174a4], ax
mov dword [edi + 0x174ac], eax
mov dword [edi + 0x174a8], eax
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [edi + 0x174fc]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0x18d38]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [edi + 0x1a574]
call sym.fpsrvutl.dll_Ordinal_4614
add edi, 0x1bdb0
mov dword [edi], esi
lock inc dword [0x10181f80]
mov esi, dword [ebp - 0x10]
mov eax, 0x10181f8c
mov dword [esi + 0x1bdb4], eax
lock inc dword [0x10181f80]
mov dword [esi + 0x1bdb8], eax
lock inc dword [0x10181f80]
xor eax, eax
mov byte [ebp - 4], 0x55
lea ecx, [esi + 0x1bdd0]
mov dword [esi + 0x1bdbc], eax
mov word [esi + 0x1bdc4], ax
mov dword [esi + 0x1bdcc], eax
mov dword [esi + 0x1bdc8], eax
call sym.fpsrvutl.dll_Ordinal_5519
lea ecx, [esi + 0x1be1c]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [esi + 0x1d658]
call sym.fpsrvutl.dll_Ordinal_4614
lea ecx, [esi + 0x1ee94]
call sym.fpsrvutl.dll_Ordinal_4614
add esi, 0x206d0
mov ecx, 0x10181f8c
mov dword [esi], ecx
lock inc dword [0x10181f80]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x206d4], ecx
lock inc dword [0x10181f80]
mov dword [eax + 0x206d8], ecx
lock inc dword [0x10181f80]
xor ecx, ecx
mov byte [ebp - 4], 0x5c
mov dword [eax + 0x206dc], ecx
mov word [eax + 0x206e4], cx
mov dword [eax + 0x206ec], ecx
mov dword [eax + 0x206e8], ecx
lea ecx, [eax + 0x206f0]
call sym.fpsrvutl.dll_Ordinal_5519
mov ecx, dword [ebp - 0x10]
add ecx, 0x2073c
call sym.fpsrvutl.dll_Ordinal_4614
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx + 0x21f78]
call sym.fpsrvutl.dll_Ordinal_4614
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx + 0x237b4]
call sym.fpsrvutl.dll_Ordinal_4614
mov byte [ebp - 4], 0x60
xor eax, eax
mov ecx, dword [ebp - 0x10]
inc eax
push 0
push eax
lea ecx, [ecx + 0x24ff8]
call sym.fpsrvutl.dll_Ordinal_2426
mov edx, dword [ebp - 0x10]
mov eax, 0x10181f8c
mov dword [edx + 0x25028], eax
lock inc dword [0x10181f80]
mov al, byte [ebp + 8]
xor ecx, ecx
mov byte [ebp - 4], 0x62
inc ecx
or dword [edx + 0x1ee0], 0xffffffff
mov byte [edx + 4], al
mov byte [edx + 5], al
mov eax, 0xff000000
push 2
mov dword [edx + 0x1f30], eax
mov dword [edx + 0x1ef8], eax
mov dword [edx + 0x1f00], eax
mov dword [edx + 0x1f08], eax
mov dword [edx + 0x1f10], eax
mov dword [edx + 0x1f18], eax
mov dword [edx + 0x1b8c], eax
mov dword [edx + 0x1f20], eax
mov dword [edx + 0x1b94], eax
mov dword [edx + 0x1b98], eax
mov dword [edx + 0x1f28], eax
pop eax
push 6
mov word [edx + 0x997c], ax
mov word [edx + 0xe29c], ax
pop eax
mov dword [edx + 0x18], ecx
mov word [edx + 0x318], cx
mov dword [edx + 0x80d0], ecx
mov word [edx + 0x12bc4], cx
mov word [edx + 0x174e4], cx
mov word [edx + 0x1be04], cx
mov word [edx + 0x20724], cx
mov byte [edx + 0x24ff0], cl
lea ecx, [edx + 0x2c]
push str.1252
mov dword [edx + 0x1b88], 0x93
mov word [edx + 0x80d4], ax
mov byte [edx + 0x24ff1], 0
call fcn.1004ba3f
mov edx, dword [ebp - 0x10]
lea eax, [edx + 0x2e0]
mov dword [edx + 0x330], eax
lea ecx, [edx + 0x44]
xor eax, eax
mov dword [edx + 0x334], ecx
mov byte [edx + 0x338], al
mov dword [edx + 0x340], eax
mov dword [edx + 0x33c], eax
lea eax, [edx + 0x1f38]
mov dword [edx + 0x1f48], eax
xor eax, eax
mov byte [edx + 0x1f50], al
mov dword [edx + 0x1f58], eax
mov dword [edx + 0x1f54], eax
lea eax, [edx + 0x1f3c]
mov dword [edx + 0x1f4c], ecx
mov dword [edx + 0x1f5c], eax
mov dword [edx + 0x1f60], ecx
xor eax, eax
mov byte [edx + 0x1f64], al
mov dword [edx + 0x1f6c], eax
mov dword [edx + 0x1f68], eax
lea eax, [edx + 0x1f40]
mov dword [edx + 0x1f70], eax
xor eax, eax
mov byte [edx + 0x1f78], al
mov dword [edx + 0x1f80], eax
mov dword [edx + 0x1f7c], eax
lea eax, [edx + 0x1f44]
mov dword [edx + 0x1f74], ecx
mov dword [edx + 0x1f84], eax
xor eax, eax
mov byte [edx + 0x1f8c], al
mov dword [edx + 0x1f94], eax
mov dword [edx + 0x1f90], eax
lea eax, [edx + 0x8088]
mov dword [edx + 0x1f88], ecx
mov dword [edx + 0x808c], eax
xor eax, eax
mov byte [edx + 0x8094], al
mov dword [edx + 0x809c], eax
mov dword [edx + 0x8098], eax
lea eax, [edx + 0x9928]
mov dword [edx + 0x8090], ecx
mov dword [edx + 0x9934], eax
xor eax, eax
mov byte [edx + 0x993c], al
mov dword [edx + 0x9944], eax
mov dword [edx + 0x9940], eax
lea eax, [edx + 0xe248]
mov dword [edx + 0x9938], ecx
mov dword [edx + 0xe254], eax
xor eax, eax
mov byte [edx + 0xe25c], al
mov dword [edx + 0xe264], eax
mov dword [edx + 0xe260], eax
lea eax, [edx + 0x12b70]
mov dword [edx + 0xe258], ecx
mov dword [edx + 0x12b7c], eax
xor eax, eax
mov dword [edx + 0x12b80], ecx
mov byte [edx + 0x12b84], al
mov dword [edx + 0x12b8c], eax
mov dword [edx + 0x12b88], eax
mov dword [edx + 0x1749c], ebx
xor ebx, ebx
mov dword [edx + 0x174a0], ecx
mov byte [edx + 0x174a4], al
mov dword [edx + 0x174ac], eax
mov dword [edx + 0x174a8], eax
mov dword [edx + 0x1bdc0], ecx
mov byte [edx + 0x1bdc4], al
mov dword [edx + 0x1bdcc], eax
mov dword [edx + 0x1bdc8], eax
mov dword [edx + 0x1bdbc], edi
mov dword [edx + 0x206e0], ecx
lea ecx, [edx + 0x1ee4]
mov byte [edx + 0x206e4], al
mov dword [edx + 0x206ec], eax
mov dword [edx + 0x206e8], eax
mov dword [edx + 0x206dc], esi
mov dword [edx + 0xc4], eax
mov dword [edx + 0xc8], eax
mov byte [edx + 0x24ff2], al
mov byte [edx + 0x31], al
mov byte [edx + 0x25020], al
inc eax
push 0x100ee700
mov byte [edx + 0x1b84], al
mov dword [edx + 0x25024], ebx
call fcn.1004ba3f
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2501c], ebx
mov dword [eax + 0x24ff4], ebx
call fcn.1000140a
ret 4