Function at 0x10027090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10053040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], 0x2e342240
push edi
mov dword [ebp - 0x4c], esi
mov dl, 0x40
mov dword [ebp - 0x1c], 0x2f2c231f
xor eax, eax
mov word [ebp - 0x18], 0x2533
mov byte [ebp - 0x16], 0
xor byte [ebp + eax - 0x1f], dl
inc eax
cmp eax, 9
jae 0x100270d3
mov dl, byte [ebp - 0x20]
jmp 0x100270c4
sub esp, 0x18
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003da0
mov ecx, dword [esi]
call fcn.1000c655
add esp, 0x18
mov dword [esi + 4], eax
xor eax, eax
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x44], eax
sub esp, 0x18
mov dword [ebp - 0x20], 0x5e435631
mov edi, esp
mov dword [ebp - 0x1c], 0x146e4144
mov cl, 0x31
mov word [ebp - 0x18], 0x55
push eax
xor eax, eax
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 8
jae 0x1002712b
mov cl, byte [ebp - 0x20]
jmp 0x1002711c
sub esp, 0x18
mov byte [ebp - 0x17], 0
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.10003da0
push edi
call fcn.100039e5
mov ecx, dword [esi]
add esp, 0x20
call fcn.1000c655
mov ebx, eax
mov dword [ebp - 0x40], 5
add esp, 0x18
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x3c], eax
sub esp, 0x18
mov dword [ebp - 0x30], 0x61766504
mov edi, esp
mov dword [ebp - 0x2c], 0x676d5b65
mov cl, 4
mov dword [ebp - 0x28], 0x215b6a6b
mov word [ebp - 0x24], 0x60
push eax
xor eax, eax
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 0xc
jae 0x10027195
mov cl, byte [ebp - 0x30]
jmp 0x10027186
sub esp, 0x18
mov byte [ebp - 0x23], 0
lea eax, [ebp - 0x2f]
mov ecx, esp
push eax
call fcn.10003da0
push edi
call fcn.100039e5
add esp, 0x20
mov ecx, ebx
call fcn.1000c655
add esp, 0x18
mov edi, eax
call fcn.1000a5ae
mov ebx, eax
test ebx, ebx
je 0x1002728e
mov dword [ebp - 0x38], ebx
call fcn.1000cd26
test eax, eax
je 0x1002728e
mov dword [ebx], eax
mov ecx, eax
mov edx, dword [esi]
call fcn.1000c61f
mov ecx, dword [ebx]
xor edx, edx
mov esi, 0x3f340000
mov eax, dword [ecx]
mov eax, dword [eax + 0xcc]
mov dword [ecx + 0x13c], edx
mov dword [ecx + 0x140], edx
mov dword [ecx + 0x144], esi
mov dword [ecx + 0x148], esi
mov dword [ecx + 0x1f0], edx
mov dword [ecx + 0x1f4], edx
mov dword [ecx + 0x1f8], edx
mov dword [ecx + 0x1fc], edx
call eax
mov ecx, dword [ebx]
call fcn.1000c8fc
mov ecx, dword [ebx]
mov edx, pe_nt_image_headers32
call fcn.1000c99d
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.1000c6be
mov esi, eax
lea edi, [ebp - 0x14]
pop ecx
lea edx, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx]
call fcn.1000cd79
mov ecx, dword [ebx]
lea edx, [ebp - 0x14]
call fcn.1000c732
mov ecx, dword [ebx]
xor dl, dl
call fcn.1000c87f
mov esi, dword [ebp - 0x4c]
lea ecx, [esi + 8]
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x10027284
mov dword [eax], ebx
add dword [ecx + 4], 4
jmp 0x1002728e
lea edx, [ebp - 0x38]
push edx
push eax
call fcn.100279cc
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x34]
inc eax
sub dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], eax
jne 0x10027161
mov eax, dword [ebp - 0x44]
inc eax
sub dword [ebp - 0x48], 1
mov dword [ebp - 0x44], eax
jne 0x100270fe
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bff4
leave
ret