Function at 0x1000b730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x70
lea eax, [esp + 8]
lea edx, [ecx + 8]
push ebp
push esi
xor esi, esi
push eax
mov eax, dword [ecx + 4]
push 0xf003f
push esi
push edx
push eax
call dword [0x10021af0]
test eax, eax
jne 0x1000ba00
lea ecx, [esp + 0x64]
lea edx, [esp + 0x34]
push ecx
push edx
mov byte [esp + 0x3c], 0x41
mov byte [esp + 0x3d], 0x44
mov byte [esp + 0x3e], 0x56
mov byte [esp + 0x3f], 0x41
mov byte [esp + 0x40], 0x50
mov byte [esp + 0x41], 0x49
mov byte [esp + 0x42], 0x33
mov byte [esp + 0x43], 0x32
mov byte [esp + 0x44], 0x2e
mov byte [esp + 0x45], 0x64
mov byte [esp + 0x46], 0x6c
mov byte [esp + 0x47], 0x6c
mov byte [esp + 0x48], al
mov byte [esp + 0x6c], 0x52
mov byte [esp + 0x6d], 0x65
mov byte [esp + 0x6e], 0x67
mov byte [esp + 0x6f], 0x51
mov byte [esp + 0x70], 0x75
mov byte [esp + 0x71], 0x65
mov byte [esp + 0x72], 0x72
mov byte [esp + 0x73], 0x79
mov byte [esp + 0x74], 0x49
mov byte [esp + 0x75], 0x6e
mov byte [esp + 0x76], 0x66
mov byte [esp + 0x77], 0x6f
mov byte [esp + 0x78], 0x4b
mov byte [esp + 0x79], 0x65
mov byte [esp + 0x7a], 0x79
mov byte [esp + 0x7b], 0x41
mov byte [esp + 0x7c], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
lea ecx, [esp + 0x2c]
push esi
push ecx
lea edx, [esp + 0x38]
lea ecx, [esp + 0x3c]
push edx
push ecx
lea edx, [esp + 0x30]
push esi
lea ecx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push esi
push esi
push esi
push edx
call eax
test eax, eax
je 0x1000b835
pop esi
xor eax, eax
pop ebp
add esp, 0x70
ret
mov eax, dword [esp + 0x1c]
lea ebp, [eax + 1]
mov eax, dword [esp + 8]
test eax, eax
jbe 0x1000ba00
cmp ebp, 1
jbe 0x1000ba00
mov esi, ebp
push ebx
imul esi, eax
add esi, 0xe
push edi
push esi
push 0x40
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, esi
mov edx, eax
mov ebx, ecx
xor eax, eax
mov edi, edx
mov dword [esp + 0x20], edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
push ebp
and ecx, 3
inc edx
rep stosb byte es:[edi], al
mov byte [edx - 1], 0x86
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x58]
mov dword [edx], eax
mov al, byte [esp + 0x5c]
mov dword [edx + 4], ebp
mov dword [edx + 8], ecx
mov byte [edx + 0xc], al
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x14], 0
test eax, eax
jbe 0x1000b9da
mov ecx, dword [esp + 0x20]
add ecx, 0xd
mov dword [esp + 0x1c], ecx
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x28], ebp
and ecx, 3
mov byte [esp + 0x4c], 0x41
rep stosb byte es:[edi], al
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x4c]
push eax
push ecx
mov byte [esp + 0x55], 0x44
mov byte [esp + 0x56], 0x56
mov byte [esp + 0x57], 0x41
mov byte [esp + 0x58], 0x50
mov byte [esp + 0x59], 0x49
mov byte [esp + 0x5a], 0x33
mov byte [esp + 0x5b], 0x32
mov byte [esp + 0x5c], 0x2e
mov byte [esp + 0x5d], 0x64
mov byte [esp + 0x5e], 0x6c
mov byte [esp + 0x5f], 0x6c
mov byte [esp + 0x60], 0
mov byte [esp + 0x64], 0x52
mov byte [esp + 0x65], 0x65
mov byte [esp + 0x66], 0x67
mov byte [esp + 0x67], 0x45
mov byte [esp + 0x68], 0x6e
mov byte [esp + 0x69], 0x75
mov byte [esp + 0x6a], 0x6d
mov byte [esp + 0x6b], 0x4b
mov byte [esp + 0x6c], 0x65
mov byte [esp + 0x6d], 0x79
mov byte [esp + 0x6e], 0x45
mov byte [esp + 0x6f], 0x78
mov byte [esp + 0x70], 0x41
mov byte [esp + 0x71], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x34]
push 0
push edx
mov edx, dword [esp + 0x2c]
push ebx
push ecx
push edx
call eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
add edx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
cmp eax, ecx
mov dword [esp + 0x1c], edx
jb 0x1000b8c8
mov esi, dword [esp + 0x2c]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call dword [0x10021a94]
mov edx, dword [esp + 0x20]
push 0x42
push esi
push edx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
pop edi
mov esi, eax
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0x70
ret