Function at 0x1000ff8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x64]
push 0x58
call fcn.1008fed9
add esp, 4
mov dword [eax], ebp
mov esi, eax
lea ebp, [esp + 0xb]
mov edx, 0xfcaac6fa
mov ecx, 0xece48a4b
movzx eax, word [edi + 2]
add edi, 4
mov dword [esp], ebp
mov dword [esi + 4], eax
mov eax, dword [esp + 0x58]
mov dword [esi + 8], ebx
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esi + 0x54], eax
lea eax, [esp + 0xa]
mov dword [esi + 0xc], edi
mov dword [eax - 6], 0x606f646d
mov word [eax - 2], 0x7c74
cmp edx, 0xece48a4b
je 0x1001000e
cmp edx, 0xfcaac6fa
jne 0x1000ffed
mov byte [eax], 0
inc eax
mov edx, 0xfcaac6fa
cmp eax, dword [esp]
cmove edx, ecx
jmp 0x1000ffed
xor ecx, ecx
mov eax, 0xac4cf4e0
mov edx, 0x52d4eb05
cmp edx, 0x84a55528
je 0x10010065
cmp edx, 0xac4cf4e0
je 0x10010045
cmp edx, 0x52d4eb05
jne 0x1001001a
mov dword [esp], ecx
mov edx, dword [esp]
cmp edx, 6
mov edx, 0x84a55528
cmovb edx, eax
jmp 0x1001001a
mov edx, dword [esp]
mov bl, byte [esp + edx + 4]
mov ecx, dword [esp]
mov bh, bl
not bh
and bh, cl
not cl
and cl, bl
or cl, bh
mov byte [esp + edx + 4], cl
mov ecx, dword [esp]
inc ecx
jmp 0x10010015
lea edi, [esp + 4]
mov ecx, edi
mov byte [edi + 6], 0
call fcn.100068cd
lea ecx, [esi + 0x10]
push 0x20
push dword [esp + 0x58]
push ecx
call eax
add esp, 0xc
lea eax, [esp + 0xa]
mov edx, 0xfcaac6fa
mov ecx, 0xece48a4b
mov dword [edi], 0x606f646d
mov word [edi + 4], 0x7c74
mov dword [esp], ebp
cmp edx, 0xece48a4b
je 0x100100c1
cmp edx, 0xfcaac6fa
jne 0x100100a0
mov byte [eax], 0
inc eax
mov edx, 0xfcaac6fa
cmp eax, dword [esp]
cmove edx, ecx
jmp 0x100100a0
xor ecx, ecx
mov eax, 0xac4cf4e0
mov edx, 0x52d4eb05
cmp edx, 0x84a55528
je 0x10010118
cmp edx, 0xac4cf4e0
je 0x100100f8
cmp edx, 0x52d4eb05
jne 0x100100cd
mov dword [esp], ecx
mov edx, dword [esp]
cmp edx, 6
mov edx, 0x84a55528
cmovb edx, eax
jmp 0x100100cd
mov edx, dword [esp]
mov bl, byte [esp + edx + 4]
mov ecx, dword [esp]
mov bh, bl
not bh
and bh, cl
not cl
and cl, bl
or cl, bh
mov byte [esp + edx + 4], cl
mov ecx, dword [esp]
inc ecx
jmp 0x100100c8
lea edi, [esp + 4]
mov ecx, edi
mov byte [edi + 6], 0
call fcn.100068cd
mov edx, dword [esp + 0x4c]
mov ecx, esi
add ecx, 0x30
add edx, 0x10
push 0x20
push edx
push ecx
call eax
add esp, 0xc
lea ebx, [esp + 0x34]
mov edx, 0x7371f918
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
lea eax, [esp + 0x24]
mov dword [ebx], 0
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea ecx, [esp + 0x31]
mov dword [eax], 0x62677343
mov dword [eax + 4], 0x6f526070
mov dword [eax + 8], 0x6f6b6c7a
lea eax, [esp + 0x30]
mov dword [edi], ecx
mov ecx, 0x741a295e
cmp edx, 0x741a295e
je 0x100101a4
cmp edx, 0x7371f918
jne 0x10010182
mov byte [eax], 0
inc eax
mov edx, 0x7371f918
cmp eax, dword [esp + 4]
cmove edx, ecx
jmp 0x10010182
xor ecx, ecx
mov edi, 0xade85fba
mov edx, 0x23aa364b
cmp edx, 0xade85fba
je 0x100101dd
cmp edx, 0xfdcc9849
je 0x1001020d
cmp edx, 0x23aa364b
jne 0x100101b0
mov dword [esp + 4], ecx
mov edx, dword [esp + 4]
cmp edx, 0xc
mov edx, 0xfdcc9849
cmovb edx, edi
jmp 0x100101b0
mov edx, dword [esp + 4]
mov al, byte [esp + edx + 0x24]
mov ecx, dword [esp + 4]
mov ah, al
and al, 0x89
not ah
and ah, 0x76
or al, ah
mov ah, cl
and cl, 0x89
not ah
and ah, 0x76
or cl, ah
xor cl, al
mov byte [esp + edx + 0x24], cl
mov ecx, dword [esp + 4]
inc ecx
jmp 0x100101ab
lea ecx, [esp + 0x24]
mov byte [ecx + 0xc], 0
call fcn.100068cd
xor edi, edi
push ebx
push edi
push esi
push 0x10012f34
push edi
push edi
call eax
mov dword [esp + 0x14], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xc4c391da
mov esi, 0xd93044a0
cmp dword [esp + 0x14], edi
sete byte [esp + 0x13]
cmp ebx, 0xd930449f
jle 0x10010274
cmp ebx, 0xd93044a0
je 0x10010385
cmp ebx, 0x151b7321
je 0x1001029e
cmp ebx, 0x5783fc18
jne 0x10010245
mov ebx, 0x151b7321
call ebp
mov edi, eax
jmp 0x10010245
cmp ebx, 0x80a061af
je 0x100102b1
cmp ebx, 0xc4c391da
jne 0x10010245
mov eax, dword [esp + 0x1c]
cmp byte [esp + 0x13], 0
mov ebx, 0x151b7321
mov eax, 0x5783fc18
cmovne ebx, eax
xor edi, edi
jmp 0x10010245
mov dword [esp + 0x20], edi
mov ebx, 0x80a061af
cmp dword [esp + 0x14], 0
cmove ebx, esi
jmp 0x10010245
lea eax, [esp + 0x10]
mov ecx, 0x47c7a77e
mov dword [esp + 4], 0x706d6d43
mov dword [esp + 8], 0x69674d61
mov word [esp + 0xc], 0x656c
mov byte [esp + 0xe], 0x6f
mov dword [esp], eax
lea eax, [esp + 0xf]
cmp ecx, 0x86774c74
je 0x10010303
cmp ecx, 0x47c7a77e
jne 0x100102dd
mov byte [eax], 0
inc eax
mov ecx, 0x47c7a77e
mov edx, 0x86774c74
cmp eax, dword [esp]
cmove ecx, edx
jmp 0x100102dd
xor eax, eax
mov ecx, 0x4365cb22
cmp ecx, 0x389d28ca
je 0x1001033a
cmp ecx, 0x78c8d1d2
je 0x10010367
cmp ecx, 0x4365cb22
jne 0x1001030a
mov dword [esp], eax
mov edx, 0x389d28ca
mov ecx, dword [esp]
cmp ecx, 0xb
mov ecx, 0x78c8d1d2
cmovb ecx, edx
jmp 0x1001030a
mov ecx, dword [esp]
mov dl, byte [esp + ecx + 4]
mov eax, dword [esp]
mov dh, dl
mov ebx, eax
and dl, 0x56
and al, 0x56
not dh
not bl
and dh, 0xa9
and bl, 0xa9
or dl, dh
or al, bl
xor al, dl
mov byte [esp + ecx + 4], al
mov eax, dword [esp]
inc eax
jmp 0x10010305
lea ecx, [esp + 4]
mov byte [esp + 0xf], 0
call fcn.100068cd
push dword [esp + 0x14]
call eax
mov ebx, 0xd93044a0
jmp 0x10010245
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c