Function at 0x10001cf8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60c
mov eax, dword [0x10015004]
xor eax, esp
mov dword [esp + 0x608], eax
push ebx
push esi
push edi
push 0x6b
pop eax
push 0x65
pop ebx
push 0x72
mov word [esp + 0x134], ax
pop eax
push 0x6e
pop edx
push 0x6c
pop ecx
push 0x33
mov word [esp + 0x138], ax
pop eax
push 0x32
mov word [esp + 0x140], ax
pop eax
push 0x2e
mov word [esp + 0x142], ax
pop eax
push 0x64
or dword [esp + 0x28], 0xffffffff
mov word [esp + 0x144], ax
pop eax
push 0x43
mov word [esp + 0x146], ax
pop eax
push 0x61
mov byte [esp + 0xb4], al
pop eax
push 0x74
mov byte [esp + 0xb7], al
pop eax
push 0x46
mov byte [esp + 0xb8], al
pop eax
push 0x69
mov byte [esp + 0xba], al
pop eax
push 0x44
mov word [esp + 0x13a], dx
pop edx
mov word [esp + 0x132], bx
mov word [esp + 0x138], bx
mov word [esp + 0x13a], cx
mov word [esp + 0x144], cx
mov word [esp + 0x146], cx
mov byte [esp + 0xb1], 0x72
mov byte [esp + 0xb2], bl
mov byte [esp + 0xb5], bl
mov byte [esp + 0xb7], al
mov byte [esp + 0xb8], cl
mov byte [esp + 0xb9], bl
mov byte [esp + 0xba], 0x57
mov byte [esp + 0xd4], dl
mov byte [esp + 0xd5], bl
mov byte [esp + 0xd6], cl
mov byte [esp + 0xd7], bl
mov byte [esp + 0xd8], 0x74
mov byte [esp + 0xd9], bl
mov byte [esp + 0xda], 0x46
mov byte [esp + 0xdb], al
mov byte [esp + 0xdc], cl
mov byte [esp + 0xdd], bl
mov byte [esp + 0xde], 0x57
mov word [esp + 0x98], 0x7257
mov byte [esp + 0x9a], al
mov byte [esp + 0x9b], 0x74
mov byte [esp + 0x9c], bl
mov byte [esp + 0x9d], 0x46
mov byte [esp + 0x9e], al
mov byte [esp + 0x9f], cl
mov byte [esp + 0xa0], bl
mov byte [esp + 0x88], 0x52
mov byte [esp + 0x89], bl
mov word [esp + 0x8a], 0x6461
mov byte [esp + 0x8c], 0x46
mov byte [esp + 0x8d], al
push 0x6e
pop edx
push 0x45
mov byte [esp + 0x92], cl
mov byte [esp + 0xc1], cl
mov byte [esp + 0xc9], cl
mov byte [esp + 0xd1], cl
mov byte [esp + 0xad], cl
mov byte [esp + 0xae], cl
mov byte [esp + 0x112], cl
pop ecx
push 0x76
mov byte [esp + 0x118], cl
mov byte [esp + 0x11e], cl
pop ecx
mov byte [esp + 0x8f], bl
mov byte [esp + 0xbc], 0x43
mov word [esp + 0xbe], 0x736f
mov byte [esp + 0xc0], bl
mov word [esp + 0xc1], 0x6148
mov byte [esp + 0xc3], dl
mov byte [esp + 0xc4], 0x64
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc8], 0x47
mov byte [esp + 0xc9], bl
mov word [esp + 0xca], 0x4674
mov byte [esp + 0xcc], al
mov byte [esp + 0xce], bl
mov byte [esp + 0xcf], 0x53
mov byte [esp + 0xd0], al
mov byte [esp + 0xd1], 0x7a
mov byte [esp + 0xd2], bl
mov byte [esp + 0xa4], 0x48
mov byte [esp + 0xa5], bl
mov word [esp + 0xa6], 0x7061
mov byte [esp + 0xa8], 0x41
mov word [esp + 0xab], 0x636f
mov byte [esp + 0x90], 0x48
mov byte [esp + 0x91], bl
mov dword [esp + 0x92], 0x72467061
mov byte [esp + 0x96], bl
mov byte [esp + 0x97], bl
mov byte [esp + 0xf0], 0x47
mov byte [esp + 0xf1], bl
mov dword [esp + 0xf2], 0x6f725074
mov byte [esp + 0xf6], 0x63
mov byte [esp + 0xf7], bl
mov word [esp + 0xf8], 0x7373
mov byte [esp + 0xfa], 0x48
mov byte [esp + 0xfb], bl
mov word [esp + 0xfc], 0x7061
mov byte [esp + 0xe0], 0x47
mov byte [esp + 0xe1], bl
mov dword [esp + 0xe2], 0x73795374
mov byte [esp + 0xe6], 0x74
mov byte [esp + 0xe7], bl
mov word [esp + 0xe8], 0x546d
mov byte [esp + 0xea], al
mov byte [esp + 0xeb], 0x6d
mov byte [esp + 0xec], bl
mov dword [esp + 0x100], 0x74737953
mov byte [esp + 0x104], bl
mov word [esp + 0x105], 0x546d
mov byte [esp + 0x107], al
mov byte [esp + 0x108], 0x6d
mov byte [esp + 0x109], bl
mov word [esp + 0x10a], 0x6f54
mov byte [esp + 0x10c], 0x46
mov byte [esp + 0x10d], al
mov byte [esp + 0x10f], bl
mov byte [esp + 0x110], 0x54
mov byte [esp + 0x111], al
mov byte [esp + 0x112], 0x6d
mov byte [esp + 0x113], bl
mov word [esp + 0x115], 0x7078
mov byte [esp + 0x117], 0x61
mov byte [esp + 0x118], dl
mov byte [esp + 0x119], 0x64
mov byte [esp + 0x11b], dl
mov byte [esp + 0x11c], cl
mov byte [esp + 0x11d], al
push 0x74
pop ecx
mov byte [esp + 0x128], al
lea edi, [esp + 0x28]
mov byte [esp + 0x124], cl
mov byte [esp + 0x126], cl
push 8
pop eax
mov ecx, eax
mov byte [esp + 0x122], bl
xor eax, eax
mov word [esp + 0x11e], 0x6f72
xor ebx, ebx
mov byte [esp + 0x120], dl
rep stosd dword es:[edi], eax
mov ecx, 0xbdbf9c13
mov byte [esp + 0x121], 0x6d
mov byte [esp + 0x123], dl
mov byte [esp + 0x125], 0x53
mov byte [esp + 0x127], 0x72
mov byte [esp + 0x129], dl
mov word [esp + 0x12a], 0x7367
mov byte [esp + 0x12c], 0x57
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
call fcn.10001986
mov ecx, 0x5ed941b5
mov edi, eax
call fcn.10001986
mov esi, eax
test edi, edi
je 0x10002a25
test esi, esi
je 0x10002a25
push 0x18
lea eax, [esp + 0x134]
mov dword [esp + 0x60], eax
pop eax
mov word [esp + 0x5a], ax
mov word [esp + 0x58], ax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
call edi
cmp dword [esp + 0x24], 0xffffffff
je 0x10002a25
push 0xb
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0xb0]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
push 8
pop edi
lea eax, [esp + 0x88]
mov word [esp + 0x1c], di
mov dword [esp + 0x20], eax
lea eax, [esp + 0x34]
push eax
push ebx
lea eax, [esp + 0x24]
mov word [esp + 0x26], di
push eax
push dword [esp + 0x30]
call esi
push 9
pop edi
lea eax, [esp + 0x98]
mov word [esp + 0x1c], di
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push eax
push ebx
lea eax, [esp + 0x24]
mov word [esp + 0x26], di
push eax
push dword [esp + 0x30]
call esi
push 0xb
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0xbc]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x30]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
push 0xb
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0xc8]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x38]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
lea eax, [esp + 0xa4]
mov word [esp + 0x1c], di
mov dword [esp + 0x20], eax
lea eax, [esp + 0x3c]
push eax
push ebx
lea eax, [esp + 0x24]
mov word [esp + 0x26], di
push eax
push dword [esp + 0x30]
call esi
push 8
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0x90]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x40]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
push 0xe
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0xf0]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x44]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
push 0xd
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0xe0]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x50]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
push 0x14
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0x100]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x4c]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
push 0xb
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0xd4]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x54]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
push 0x19
pop eax
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0x114]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x30]
call esi
cmp dword [esp + 0x28], ebx
je 0x10002a25
cmp dword [esp + 0x34], ebx
je 0x10002a25
cmp dword [esp + 0x2c], ebx
je 0x10002a25
cmp dword [esp + 0x30], ebx
je 0x10002a25
cmp dword [esp + 0x38], ebx
je 0x10002a25
cmp dword [esp + 0x3c], ebx
je 0x10002a25
cmp dword [esp + 0x40], ebx
je 0x10002a25
cmp dword [esp + 0x44], ebx
je 0x10002a25
cmp dword [esp + 0x50], ebx
je 0x10002a25
cmp dword [esp + 0x4c], ebx
je 0x10002a25
cmp dword [esp + 0x54], ebx
je 0x10002a25
mov esi, dword [esp + 0x48]
test esi, esi
je 0x10002a25
mov edi, 0x208
lea eax, [esp + 0x200]
push edi
push ebx
push eax
call fcn.10003a40
add esp, 0xc
lea eax, [esp + 0x408]
push edi
push ebx
push eax
call fcn.10003a40
add esp, 0xc
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
push 0x69
pop eax
push 0x61
pop ecx
push 0x63
pop edx
push 0x25
mov byte [esp + 0x7e], cl
mov byte [esp + 0x86], cl
pop ecx
push 0x41
mov byte [esp + 0x7d], al
mov byte [esp + 0x85], al
pop eax
push 0x4c
mov word [esp + 0x186], ax
pop eax
push 0x55
pop ebx
push 0x53
mov byte [esp + 0x84], dl
mov byte [esp + 0x87], dl
pop edx
push 0x45
pop edi
push 0x52
mov word [esp + 0x190], di
pop edi
push 0x50
mov word [esp + 0x18e], dx
mov word [esp + 0x194], dx
pop edx
push edi
mov word [esp + 0x196], dx
pop edx
push 0x4f
mov word [esp + 0x192], di
pop edi
push 0x46
mov word [esp + 0x198], dx
pop edx
push 0x49
mov word [esp + 0x19c], dx
pop edx
push 0x45
mov word [esp + 0x188], ax
mov word [esp + 0x18a], ax
mov word [esp + 0x1a0], ax
pop eax
push 0x5c
mov word [esp + 0x184], cx
mov word [esp + 0x1a4], cx
pop ecx
push 0x4d
mov word [esp + 0x1a2], ax
pop eax
mov byte [esp + 0x78], 0x64
mov word [esp + 0x7b], 0x67
mov word [esp + 0x84], 0x73
mov word [esp + 0x188], bx
mov word [esp + 0x196], di
mov word [esp + 0x19a], dx
mov word [esp + 0x1a2], cx
mov word [esp + 0x1a4], ax
push 0x69
pop eax
push 0x63
mov word [esp + 0x1aa], ax
pop eax
push 0x72
mov word [esp + 0x1ac], ax
pop eax
push 0x6f
mov word [esp + 0x1ae], ax
pop eax
push 0x73
mov word [esp + 0x1b0], ax
pop eax
push 0x6f
mov word [esp + 0x1b2], ax
pop eax
push 0x66
mov word [esp + 0x1b4], ax
pop eax
push 0x74
mov word [esp + 0x1b6], ax
pop eax
push 0x44
mov word [esp + 0x1b8], ax
pop eax
push 0x43
mov word [esp + 0x1bc], ax
pop eax
push 0x69
mov word [esp + 0x1be], ax
pop eax
push 0x6f
mov word [esp + 0x1c2], ax
pop eax
push 0x76
mov word [esp + 0x1c4], ax
pop eax
push 0x63
mov word [esp + 0x1c6], ax
pop eax
push 0x73
mov word [esp + 0x1c8], ax
pop eax
push 0x25
mov word [esp + 0x1ca], ax
xor eax, eax
mov word [esp + 0x1cc], ax
pop eax
push 0x41
mov word [esp + 0x14c], ax
pop eax
push 0x4c
mov word [esp + 0x14e], ax
pop eax
push 0x53
mov word [esp + 0x154], bx
pop ebx
push 0x45
pop edi
push 0x52
mov word [esp + 0x158], di
pop edi
push 0x50
mov word [esp + 0x156], bx
mov word [esp + 0x15c], bx
pop ebx
push edi
mov word [esp + 0x15e], bx
pop ebx
push 0x4f
mov word [esp + 0x15a], di
pop edi
push 0x46
mov word [esp + 0x160], bx
mov word [esp + 0x1ba], cx
mov word [esp + 0x1c0], cx
mov word [esp + 0x150], ax
mov word [esp + 0x152], ax
mov word [esp + 0x162], di
pop ebx
push 0x45
mov word [esp + 0x168], ax
mov edi, 0x104
pop eax
push 0x25
mov word [esp + 0x16a], ax
pop eax
push 0x75
mov word [esp + 0x16c], ax
pop eax
push 0x73
mov word [esp + 0x170], ax
pop eax
push 0x65
mov word [esp + 0x172], ax
pop eax
push 0x72
mov word [esp + 0x174], ax
pop eax
push 0x2e
mov word [esp + 0x176], ax
pop eax
push 0x64
mov word [esp + 0x178], ax
pop eax
push 0x61
mov word [esp + 0x17a], ax
pop eax
push 0x74
mov word [esp + 0x17c], ax
pop eax
mov word [esp + 0x17a], ax
xor eax, eax
mov word [esp + 0x17c], ax
lea eax, [esp + 0x200]
push edi
push eax
lea eax, [esp + 0x188]
mov word [esp + 0x168], bx
push eax
mov word [esp + 0x16e], dx
mov word [esp + 0x176], cx
call esi
test eax, eax
je 0x10002a25
push edi
lea eax, [esp + 0x40c]
push eax
lea eax, [esp + 0x150]
push eax
call dword [esp + 0x54]
test eax, eax
je 0x10002a25
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x208]
lea ecx, [esp + 0x30]
call fcn.10001c43
mov ebx, dword [esp + 0x1c]
pop ecx
pop ecx
test eax, eax
je 0x10002a15
push 0xb
pop ecx
mov esi, ebx
lea edi, [esp + 0x1d4]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x1d4], 0x74696e79
jne 0x10002a15
cmp dword [esp + 0x1d8], 0xffffffff
jne 0x100028ae
mov esi, dword [esp + 0x4c]
lea edi, [esp + 0x68]
xor eax, eax
xorps xmm0, xmm0
stosd dword es:[edi], eax
movlpd qword [esp + 0x60], xmm0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x68]
push eax
call dword [esp + 0x54]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x6c]
push eax
call esi
test eax, eax
jne 0x1000282e
xorps xmm0, xmm0
movlpd qword [esp + 0x60], xmm0
mov eax, dword [esp + 0x60]
jmp 0x1000284e
push 0
push 0x989680
push dword [esp + 0x6c]
push dword [esp + 0x6c]
call fcn.1000e5d0
sub eax, 0xb6109100
sbb edx, 2
mov dword [esp + 0x64], edx
cmp eax, 0xffffffff
je 0x10002a15
push 0xb
pop ecx
mov dword [esp + 0x1d8], eax
lea esi, [esp + 0x1d4]
mov edi, ebx
lea eax, [esp + 0x200]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push eax
mov dword [esp + 0x7c], edi
call dword [esp + 0x44]
mov esi, eax
cmp esi, 0xffffffff
je 0x100028a9
push edi
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x20]
push ebx
push esi
call dword [esp + 0x40]
test esi, esi
je 0x100028ae
push esi
call dword [esp + 0x34]
mov esi, dword [esp + 0x1e0]
push esi
push 8
pop edi
push edi
call dword [esp + 0x4c]
push eax
call dword [esp + 0x48]
mov dword [esp + 0x60], eax
test eax, eax
je 0x10002a15
push dword [esp + 0x1e4]
push edi
call dword [esp + 0x4c]
push eax
call dword [esp + 0x48]
mov edi, eax
test edi, edi
je 0x100029f5
push esi
mov esi, dword [esp + 0x1e0]
lea ecx, [esi + 0x2c]
add ecx, ebx
push ecx
push dword [esp + 0x68]
call fcn.100042e0
mov edx, dword [esp + 0x1ec]
add esp, 0xc
mov ecx, dword [esp + 0x60]
call fcn.10001cd3
mov eax, dword [esp + 0x1e0]
push dword [esp + 0x1e4]
add eax, 0x2c
add eax, esi
add eax, ebx
push eax
push edi
call fcn.100042e0
mov edx, dword [esp + 0x1f0]
add esp, 0xc
mov ecx, edi
call fcn.10001cd3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x410]
lea ecx, [esp + 0x30]
call fcn.10001c43
pop ecx
pop ecx
test eax, eax
je 0x100029ac
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
call fcn.10001cd3
lea esi, [esp + 0x80]
xor edx, edx
mov cl, byte [esi]
ror edx, 0xd
movsx eax, cl
add edx, eax
inc esi
test cl, cl
jne 0x10002977
mov esi, dword [esp + 0x60]
mov ecx, esi
push 3
push dword [esp + 0x14]
push dword [esp + 0x14]
call section..text
add esp, 0xc
lea eax, [esp + 0x408]
push eax
call dword [esp + 0x58]
jmp 0x100029b0
mov esi, dword [esp + 0x60]
lea ebx, [esp + 0x78]
xor edx, edx
mov cl, byte [ebx]
ror edx, 0xd
movsx eax, cl
add edx, eax
inc ebx
test cl, cl
jne 0x100029b6
push 3
push dword [esp + 0x1e8]
mov ecx, esi
push edi
call section..text
add esp, 0xc
cmp dword [esp + 0xc], 0
mov ebx, dword [esp + 0x14]
je 0x100029f9
push dword [esp + 0xc]
push 0
call dword [esp + 0x4c]
push eax
call dword [esp + 0x4c]
jmp 0x100029f9
mov esi, dword [esp + 0x60]
push esi
push 0
call dword [esp + 0x4c]
push eax
call dword [esp + 0x4c]
test edi, edi
je 0x10002a15
push edi
push 0
call dword [esp + 0x4c]
push eax
call dword [esp + 0x4c]
test ebx, ebx
je 0x10002a25
push ebx
push 0
call dword [esp + 0x4c]
push eax
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x614]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002a3a
mov esp, ebp
pop ebp
ret