Function at 0x1002cc70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100ef0f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100f29c4]
push esi
push edi
mov dword [ebp - 0x14], 0x4b4b5e5d
mov edi, dword [eax + ecx*4]
mov eax, dword [0x10101f70]
mov dword [ebp - 0x10], 0x4d4f464a
mov dword [ebp - 0xc], 0x424a0045
mov word [ebp - 8], 0x2e42
cmp eax, dword [edi + 4]
jle 0x1002cd05
push 0x10101f70
call fcn.10084984
add esp, 4
cmp dword [0x10101f70], 0xffffffff
jne 0x1002cd05
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x10101f7c], eax
mov ax, word [ebp - 8]
push 0x100c5080
movq qword [0x10101f74], xmm0
mov word [0x10101f80], ax
call fcn.10084d5f
push 0x10101f70
call fcn.1008493a
add esp, 8
cmp byte [0x10101f81], 0
je 0x1002cd1d
xor eax, eax
xor byte [eax + 0x10101f74], 0x2e
inc eax
cmp eax, 0xe
jb 0x1002cd10
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x10101f74
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101ff0]
push ebx
mov bl, 0x2e
mov dword [ebp - 0x14], 0x4b4b5e5d
mov dword [ebp - 0x10], 0x4f46034a
mov dword [ebp - 0xc], 0x4a00454d
mov word [ebp - 8], 0x4242
cmp eax, dword [edi + 4]
jle 0x1002cdaf
push 0x10101ff0
call fcn.10084984
add esp, 4
cmp dword [0x10101ff0], 0xffffffff
jne 0x1002cdaf
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x1010201c], eax
mov ax, word [ebp - 8]
push 0x100c5050
movq qword [0x10102014], xmm0
mov word [0x10102020], ax
mov byte [0x10102022], bl
call fcn.10084d5f
push 0x10101ff0
call fcn.1008493a
add esp, 8
cmp byte [0x10102022], 0
je 0x1002cdcc
xor eax, eax
nop word [eax + eax]
xor byte [eax + 0x10102014], bl
inc eax
cmp eax, 0xf
jb 0x1002cdc0
push 0x10102014
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101f5c]
mov dword [ebp - 0x14], 0x4b4b5e5d
mov dword [ebp - 0x10], 0x4f46034a
mov dword [ebp - 0xc], 0x4a00454d
mov word [ebp - 8], 0x4242
cmp eax, dword [edi + 4]
jle 0x1002ce55
push 0x10101f5c
call fcn.10084984
add esp, 4
cmp dword [0x10101f5c], 0xffffffff
jne 0x1002ce55
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x1010200c], eax
mov ax, word [ebp - 8]
push 0x100c5020
movq qword [0x10102004], xmm0
mov word [0x10102010], ax
mov byte [0x10102012], bl
call fcn.10084d5f
push 0x10101f5c
call fcn.1008493a
add esp, 8
cmp byte [0x10102012], 0
je 0x1002ce6c
xor eax, eax
xor byte [eax + 0x10102004], bl
inc eax
cmp eax, 0xf
jb 0x1002ce60
push 0x10102004
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101fc8]
mov dword [ebp - 0x14], 0x4b4b5e5d
mov dword [ebp - 0x10], 0x4f46714a
mov dword [ebp - 0xc], 0x4a00454d
mov word [ebp - 8], 0x4242
cmp eax, dword [edi + 4]
jle 0x1002cef5
push 0x10101fc8
call fcn.10084984
add esp, 4
cmp dword [0x10101fc8], 0xffffffff
jne 0x1002cef5
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x10101fe8], eax
mov ax, word [ebp - 8]
push 0x100c4ff0
movq qword [0x10101fe0], xmm0
mov word [0x10101fec], ax
mov byte [0x10101fee], bl
call fcn.10084d5f
push 0x10101fc8
call fcn.1008493a
add esp, 8
cmp byte [0x10101fee], 0
je 0x1002cf0c
xor eax, eax
xor byte [eax + 0x10101fe0], bl
inc eax
cmp eax, 0xf
jb 0x1002cf00
push 0x10101fe0
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10102024]
mov dword [ebp - 0x14], 0x454d4f46
mov dword [ebp - 0x10], 0x4b5e5d71
mov dword [ebp - 0xc], 0x4a004a4b
mov word [ebp - 8], 0x4242
cmp eax, dword [edi + 4]
jle 0x1002cf95
push 0x10102024
call fcn.10084984
add esp, 4
cmp dword [0x10102024], 0xffffffff
jne 0x1002cf95
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x10101fac], eax
mov ax, word [ebp - 8]
push 0x100c4fc0
movq qword [0x10101fa4], xmm0
mov word [0x10101fb0], ax
mov byte [0x10101fb2], bl
call fcn.10084d5f
push 0x10102024
call fcn.1008493a
add esp, 8
cmp byte [0x10101fb2], 0
je 0x1002cfac
xor eax, eax
xor byte [eax + 0x10101fa4], bl
inc eax
cmp eax, 0xf
jb 0x1002cfa0
push 0x10101fa4
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101f1c]
mov dword [ebp - 0x14], 0x454d4f46
mov dword [ebp - 0x10], 0x4b5e5d03
mov dword [ebp - 0xc], 0x4a004a4b
mov word [ebp - 8], 0x4242
cmp eax, dword [edi + 4]
jle 0x1002d035
push 0x10101f1c
call fcn.10084984
add esp, 4
cmp dword [0x10101f1c], 0xffffffff
jne 0x1002d035
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x10102040], eax
mov ax, word [ebp - 8]
push 0x100c4f90
movq qword [0x10102038], xmm0
mov word [0x10102044], ax
mov byte [0x10102046], bl
call fcn.10084d5f
push 0x10101f1c
call fcn.1008493a
add esp, 8
cmp byte [0x10102046], 0
je 0x1002d04c
xor eax, eax
xor byte [eax + 0x10102038], bl
inc eax
cmp eax, 0xf
jb 0x1002d040
push 0x10102038
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101fdc]
mov dword [ebp - 0x14], 0x454d4f46
mov dword [ebp - 0x10], 0x4b4b5e5d
mov dword [ebp - 0xc], 0x424a004a
mov word [ebp - 8], 0x2e42
cmp eax, dword [edi + 4]
jle 0x1002d0cf
push 0x10101fdc
call fcn.10084984
add esp, 4
cmp dword [0x10101fdc], 0xffffffff
jne 0x1002d0cf
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x10101f50], eax
mov ax, word [ebp - 8]
push 0x100c4f70
movq qword [0x10101f48], xmm0
mov word [0x10101f54], ax
call fcn.10084d5f
push 0x10101fdc
call fcn.1008493a
add esp, 8
cmp byte [0x10101f55], 0
je 0x1002d0ec
xor eax, eax
nop word [eax + eax]
xor byte [eax + 0x10101f48], bl
inc eax
cmp eax, 0xe
jb 0x1002d0e0
push 0x10101f48
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101f0c]
mov dword [ebp - 0x10], 0x454d4f46
mov dword [ebp - 0xc], 0x42424a00
cmp eax, dword [edi + 4]
jle 0x1002d156
push 0x10101f0c
call fcn.10084984
add esp, 4
cmp dword [0x10101f0c], 0xffffffff
jne 0x1002d156
movq xmm0, qword [ebp - 0x10]
push 0x100c4f50
movq qword [0x10101fcc], xmm0
mov byte [0x10101fd4], bl
call fcn.10084d5f
push 0x10101f0c
call fcn.1008493a
add esp, 8
mov al, byte [0x10101fd4]
test al, al
je 0x1002d196
xor byte [0x10101fcc], bl
xor byte [0x10101fcd], bl
xor byte [0x10101fce], bl
xor byte [0x10101fcf], bl
xor byte [0x10101fd0], bl
xor byte [0x10101fd1], bl
xor byte [0x10101fd2], bl
xor byte [0x10101fd3], bl
xor al, 0x2e
mov byte [0x10101fd4], al
push 0x10101fcc
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10102048]
mov dword [ebp - 0x10], 0x5e4b5e59
mov dword [ebp - 0xc], 0x4a00415c
mov word [ebp - 8], 0x4242
cmp eax, dword [edi + 4]
jle 0x1002d210
push 0x10102048
call fcn.10084984
add esp, 4
cmp dword [0x10102048], 0xffffffff
jne 0x1002d210
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x100c4f30
movq qword [0x10101fb4], xmm0
mov word [0x10101fbc], ax
mov byte [0x10101fbe], bl
call fcn.10084d5f
push 0x10102048
call fcn.1008493a
add esp, 8
cmp byte [0x10101fbe], 0
je 0x1002d22c
xor eax, eax
nop dword [eax + eax]
xor byte [eax + 0x10101fb4], bl
inc eax
cmp eax, 0xb
jb 0x1002d220
push 0x10101fb4
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101f58]
mov dword [ebp - 0x14], 0x4d1a5c6d
mov dword [ebp - 0x10], 0x5c1d45
mov dword [ebp - 0xc], 0x2e42424a
cmp eax, dword [edi + 4]
jle 0x1002d29f
push 0x10101f58
call fcn.10084984
add esp, 4
cmp dword [0x10101f58], 0xffffffff
jne 0x1002d29f
movq xmm0, qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push 0x100c4f10
movq qword [0x10101f10], xmm0
mov dword [0x10101f18], eax
call fcn.10084d5f
push 0x10101f58
call fcn.1008493a
add esp, 8
cmp byte [0x10101f1b], 0
je 0x1002d2bc
xor eax, eax
nop word [eax + eax]
xor byte [eax + 0x10101f10], bl
inc eax
cmp eax, 0xc
jb 0x1002d2b0
push 0x10101f10
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10102034]
mov dword [ebp - 0x14], 0x5e4b5e59
mov dword [ebp - 0x10], 0x5e5d415c
mov dword [ebp - 0xc], 0x424a0057
mov word [ebp - 8], 0x2e42
cmp eax, dword [edi + 4]
jle 0x1002d33f
push 0x10102034
call fcn.10084984
add esp, 4
cmp dword [0x10102034], 0xffffffff
jne 0x1002d33f
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x10101f34], eax
mov ax, word [ebp - 8]
push 0x100c4ef0
movq qword [0x10101f2c], xmm0
mov word [0x10101f38], ax
call fcn.10084d5f
push 0x10102034
call fcn.1008493a
add esp, 8
cmp byte [0x10101f39], 0
je 0x1002d35c
xor eax, eax
nop word [eax + eax]
xor byte [eax + 0x10101f2c], bl
inc eax
cmp eax, 0xe
jb 0x1002d350
push 0x10101f2c
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101f98]
mov dword [ebp - 0x10], 0x4749404b
mov dword [ebp - 0xc], 0x4a004b40
mov word [ebp - 8], 0x4242
cmp eax, dword [edi + 4]
jle 0x1002d3d6
push 0x10101f98
call fcn.10084984
add esp, 4
cmp dword [0x10101f98], 0xffffffff
jne 0x1002d3d6
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x100c4ed0
movq qword [0x10101f20], xmm0
mov word [0x10101f28], ax
mov byte [0x10101f2a], bl
call fcn.10084d5f
push 0x10101f98
call fcn.1008493a
add esp, 8
cmp byte [0x10101f2a], 0
pop ebx
je 0x1002d3ef
xor eax, eax
xor byte [eax + 0x10101f20], 0x2e
inc eax
cmp eax, 0xb
jb 0x1002d3e2
push 0x10101f20
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10102030]
cmp eax, dword [edi + 4]
jle 0x1002d446
push 0x10102030
call fcn.10084984
add esp, 4
cmp dword [0x10102030], 0xffffffff
jne 0x1002d446
movaps xmm0, xmmword [0x100e64b0]
push 0x100c4ec0
movups xmmword [0x10101ff4], xmm0
call fcn.10084d5f
push 0x10102030
call fcn.1008493a
add esp, 8
cmp byte [0x10102003], 0
je 0x1002d468
movups xmm0, xmmword [0x10101ff4]
movaps xmm1, xmmword [0x100e64a0]
pxor xmm1, xmm0
movups xmmword [0x10101ff4], xmm1
push 0x10101ff4
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101f90]
mov dword [ebp - 0x10], 0x4b004d
mov dword [ebp - 0xc], 0x2e42424a
cmp eax, dword [edi + 4]
jle 0x1002d4d0
push 0x10101f90
call fcn.10084984
add esp, 4
cmp dword [0x10101f90], 0xffffffff
jne 0x1002d4d0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
push 0x100c4eb0
mov dword [0x10101f9c], eax
mov dword [0x10101fa0], ecx
call fcn.10084d5f
push 0x10101f90
call fcn.1008493a
add esp, 8
mov al, byte [0x10101fa3]
test al, al
je 0x1002d511
xor byte [0x10101f9c], 0x2e
xor byte [0x10101f9d], 0x2e
xor byte [0x10101f9e], 0x2e
xor byte [0x10101f9f], 0x2e
xor byte [0x10101fa0], 0x2e
xor byte [0x10101fa1], 0x2e
xor byte [0x10101fa2], 0x2e
xor al, 0x2e
mov byte [0x10101fa3], al
push 0x10101f9c
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101fd8]
mov dword [ebp - 0x10], 0x4f4b464d
mov dword [ebp - 0xc], 0x424a005a
mov word [ebp - 8], 0x2e42
cmp eax, dword [edi + 4]
jle 0x1002d585
push 0x10101fd8
call fcn.10084984
add esp, 4
cmp dword [0x10101fd8], 0xffffffff
jne 0x1002d585
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x100c4e90
movq qword [0x10101f3c], xmm0
mov word [0x10101f44], ax
call fcn.10084d5f
push 0x10101fd8
call fcn.1008493a
add esp, 8
mov al, byte [0x10101f45]
test al, al
je 0x1002d5d4
xor byte [0x10101f3c], 0x2e
xor byte [0x10101f3d], 0x2e
xor byte [0x10101f3e], 0x2e
xor byte [0x10101f3f], 0x2e
xor byte [0x10101f40], 0x2e
xor byte [0x10101f41], 0x2e
xor byte [0x10101f42], 0x2e
xor byte [0x10101f43], 0x2e
xor byte [0x10101f44], 0x2e
xor al, 0x2e
mov byte [0x10101f45], al
push 0x10101f3c
call esi
test eax, eax
jne 0x1002d6ba
mov eax, dword [0x10101fc0]
mov dword [ebp - 0x10], 0x4241435d
mov dword [ebp - 0xc], 0x424a0042
mov word [ebp - 8], 0x2e42
cmp eax, dword [edi + 4]
jle 0x1002d648
push 0x10101fc0
call fcn.10084984
add esp, 4
cmp dword [0x10101fc0], 0xffffffff
jne 0x1002d648
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x100c4e70
movq qword [0x10101f84], xmm0
mov word [0x10101f8c], ax
call fcn.10084d5f
push 0x10101fc0
call fcn.1008493a
add esp, 8
mov al, byte [0x10101f8d]
test al, al
je 0x1002d697
xor byte [0x10101f84], 0x2e
xor byte [0x10101f85], 0x2e
xor byte [0x10101f86], 0x2e
xor byte [0x10101f87], 0x2e
xor byte [0x10101f88], 0x2e
xor byte [0x10101f89], 0x2e
xor byte [0x10101f8a], 0x2e
xor byte [0x10101f8b], 0x2e
xor byte [0x10101f8c], 0x2e
xor al, 0x2e
mov byte [0x10101f8d], al
push 0x10101f84
call esi
pop edi
pop esi
test eax, eax
jne 0x1002d6ba
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084864
mov esp, ebp
pop ebp
ret
call fcn.1002caf0
int3