Function at 0x10001b30
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4dc
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], esi
and dword [edi], 0
test esi, esi
je 0x10002aa6
push ebx
push edi
call fcn.10001800
mov eax, dword [esi]
pop ecx
mov ecx, eax
mov ebx, eax
and ecx, 0xff00
and ebx, 0xff
and eax, 0xff0000
mov dword [ebp + 8], ecx
je 0x10002a88
cmp eax, 0x10000
je 0x10002a77
cmp eax, 0x20000
je 0x10002369
cmp eax, 0x30000
je 0x10002286
cmp eax, 0x40000
je 0x100021f2
cmp eax, 0x50000
je 0x10001da1
cmp eax, 0x60000
jne 0x10002a94
lea eax, [ebp - 0x24]
push 0x901
push eax
push dword [esi + 4]
call fcn.10001b30
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov ecx, dword [eax]
and ecx, 0xffff00
cmp ecx, 0x100
jne 0x10001ce9
mov ebx, dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp + 8], eax
mov eax, dword [esi + 8]
cmp dword [eax], 0x10000
je 0x10001c3a
lea ecx, [ebp - 0x28]
push 0x400
push ecx
push eax
call fcn.10001b0c
mov eax, dword [ebp - 0x28]
add esp, 0xc
mov eax, dword [eax + 4]
test eax, eax
jge 0x10001c1b
add eax, dword [ebp + 8]
cmp eax, dword [ebp + 8]
jg 0x10001c32
test eax, eax
jl 0x10001c32
mov al, byte [eax + ebx]
and byte [ebx + 1], 0
mov byte [ebx], al
jmp 0x10001d75
and byte [ebx], 0
jmp 0x10001d75
mov eax, dword [eax + 4]
test eax, eax
jne 0x10001c4b
call fcn.10003179
mov dword [ebp - 0x28], eax
jmp 0x10001c5d
lea ecx, [ebp - 0x28]
push 0x400
push ecx
push eax
call fcn.10001b0c
add esp, 0xc
mov eax, dword [esi + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 4]
test eax, eax
jne 0x10001c7f
call fcn.10003179
mov dword [ebp - 0x30], eax
or dword [eax + 4], 0xffffffff
mov eax, dword [ebp - 0x30]
or dword [eax + 8], 0xffffffff
jmp 0x10001c91
lea ecx, [ebp - 0x30]
push 0x400
push ecx
push eax
call fcn.10001b0c
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x30]
test ecx, ecx
mov eax, dword [eax + 4]
jge 0x10001ca6
add ecx, edx
test eax, eax
jge 0x10001cac
add eax, edx
test ecx, ecx
jge 0x10001cb2
xor ecx, ecx
test eax, eax
jge 0x10001cb8
xor eax, eax
cmp ecx, edx
jle 0x10001cbe
mov ecx, edx
cmp eax, edx
jl 0x10001cc5
lea eax, [edx - 1]
sub eax, ecx
add eax, ebx
mov esi, eax
jmp 0x10001cd3
mov al, byte [ecx + ebx]
mov byte [ebx], al
inc ebx
cmp ebx, esi
jbe 0x10001ccd
and byte [ebx], 0
lea eax, [ebp - 0x30]
push eax
call fcn.10001800
pop ecx
jmp 0x10001d75
lea eax, [ebp - 0x28]
push 0x400
push eax
mov eax, dword [ebp - 0x2c]
push dword [eax + 8]
call fcn.10001b0c
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [eax], 0x30400
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x24]
mov esi, dword [eax + 4]
mov eax, dword [eax + 8]
cmp eax, dword [esi + 8]
jl 0x10001d75
lea ecx, [eax + 1]
mov eax, dword [esi + 4]
cmp ecx, eax
mov dword [esi + 8], ecx
jle 0x10001d75
mov ebx, dword [esi]
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
and dword [ebp + 8], 0
cmp dword [esi + 4], 0
mov dword [esi], eax
jle 0x10001d63
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
shl eax, 2
inc dword [ebp + 8]
mov edx, dword [ebx + eax]
mov dword [eax + ecx], edx
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 4]
jl 0x10001d4a
shl dword [esi + 4], 1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jg 0x10001d30
lea eax, [ebp - 0x28]
push eax
call fcn.10001800
test byte [ebp + 0x10], 1
pop ecx
je 0x10001d99
push dword [ebp + 0x10]
push edi
push dword [ebp - 0x24]
call fcn.10001b30
lea eax, [ebp - 0x24]
jmp 0x100024cc
mov eax, dword [ebp - 0x24]
jmp 0x10002a92
cmp dword [ebp + 8], 0x400
jne 0x10001f18
imul ebx, ebx, 0x3c
add ebx, 0x10011108
mov esi, ebx
mov eax, dword [esi + 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax + 4]
call fcn.10003179
mov dword [ebp - 8], eax
call fcn.10003179
and dword [ebp + 8], 0
mov ebx, eax
invalid
retf 0x45c6
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10001e77
push eax
push esi
push dword [ebp + 8]
call fcn.10001e2c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10001e67
imul edi, edx, 0x9d88a2a4
jl 0x100022ec
invalid
invalid
test dword [eax - 1], eax
invalid
cmp dword [eax], ebx
je 0x1000251b
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
dec eax
or byte [ebx], al
ror byte [ecx - 0x35c4f7b3], 1
jae 0x10002516
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10002500
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10002508
cmp edx, ebx
jne 0x10002656
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x100024d7
add eax, dword [eax + 4]
jmp 0x100024c4
mov dword [ebp + 0xc], ebx
jmp 0x10002526
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000253e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000255c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100025ba
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100025a1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100025aa
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100025b4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10002596
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10002520
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10002607
dec eax
je 0x100025fe
sub eax, 3
je 0x100025f5
mov dword [ebp - 4], 0x40
jmp 0x10002624
mov dword [ebp - 4], 4
jmp 0x1000260a
mov dword [ebp - 4], 0x20
jmp 0x1000260a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10002656
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100025d6
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10001e67
pminub mm4, mm0
out dx, eax
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x10002662
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.10001e77
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001e2c
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.10001e67
jnp 0x10002a5a
invalid
fcmovnbe st(0), st(0)
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
cli
invalid
jmp [eax - 0x3a]
test ebx, esi
cli
invalid
call [edx - 0x3a]
test esp, esi
cli
invalid
push dword [ebp - 0x3a]
test ebp, esi
cli
invalid
push dword [eax - 0x3a]
test esi, esi
cli
invalid
invalid
jns 0x10002a92
test edi, esi
cli
invalid
dec dword [edi - 0x3a]
test eax, edi
cli
invalid
push dword [ebp - 0x3a]
test ecx, edi
cli
invalid
jmp dword [esi - 0x3a]
test edx, edi
cli
invalid
invalid
jns 0x10002aae
test ebx, edi
cli
invalid
call [ecx*4 - 0x5137b]
call dword [eax - 0x18]
jge 0x10002aeb
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001e2c
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.10001e67
inc edx
add ebp, dword [esi + esi]
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x10002b5b
cli
invalid
jecxz 0x10002a14
movsd dword es:[edi], dword [esi]
out dx, eax
cli
invalid
invalid
cmp dword [ebp - 0x398], 0
je 0x10002d25
cmp dword [ebp + 0xc], 1
je 0x10002d25
cmp dword [ebp + 0xc], 8
jne 0x10002ced
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
call dword [edi]
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
pop esp
stc
invalid
call dword [esi]
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.10001e77
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001e2c
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
mov ch, 0x8c
stc
invalid
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.10001e67
jb 0x10002cc5
jb 0x10002c88
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10002043
add esp, 0x14
call fcn.10001e67
jnp 0x10002c83
mov esi, dword [ecx - 0x6974a01]
mov ch, 0x68
stc
invalid
call fcn.10001e67
pop edx
salc
out 0xb5, al
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.10001e67
fidiv word [ebx - 0x5a7fe33d]
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10001e45
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10001e77
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001e2c
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10001e67
popfd
dec ebp
je 0x10002e82
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.10001e67
lodsb al, byte [esi]
push ebx
inc edx
sbb dword [eax - 0x7fff1f9b], eax
loope 0x10002e89
loopne 0x10002e85
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.10001e77
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001e2c
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x10002f13
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x10002f33
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0