Function at 0x1021cd7a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xde4
mov eax, 0x1024bf6f
call fcn.1021e3df
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.10220c90
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.10212ca1
push eax
lea ecx, [ebp - 0xc80]
call fcn.1020f98d
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1021d2cc
cmp dword [edi + 8], 0x4a
jne 0x1021d2cc
mov esi, dword [edi]
test esi, esi
je 0x1021d2cc
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1021d2be
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
mov ecx, 0x30a
mov dword [ebp - 0xddc], 0x714d694e
rep movsd dword es:[edi], dword [esi]
push 0x64
pop eax
mov dword [ebp - 0xdd8], 0x6a636e47
movsw word es:[edi], word [esi]
mov dword [ebp - 0xdd4], 0x71776d44
mov dword [ebp - 0xdd0], 0x716b3245
mov dword [ebp - 0xdcc], 0x5167774f
mov dword [ebp - 0xdc8], 0x46736846
mov dword [ebp - 0xdc4], 0x4f67524d
mov dword [ebp - 0xdc0], 0x63636949
mov dword [ebp - 0xdbc], 0x51596a63
mov dword [ebp - 0xdb8], 0x344d3259
mov dword [ebp - 0xdb4], 0x2f77334a
mov dword [ebp - 0xdb0], 0x68417a42
mov dword [ebp - 0xdac], 0x62594243
mov dword [ebp - 0xda8], 0x50636741
mov dword [ebp - 0xda4], 0x75636766
mov dword [ebp - 0xda0], 0x35306e50
mov dword [ebp - 0xd9c], 0x31734447
mov dword [ebp - 0xd98], 0x3134674d
mov dword [ebp - 0xd94], 0x77395349
mov dword [ebp - 0xd90], 0x6141534a
mov dword [ebp - 0xd8c], 0x4c59784f
mov dword [ebp - 0xd88], 0x496f524b
mov dword [ebp - 0xd84], 0x4f677741
mov dword [ebp - 0xd80], 0x75526848
mov dword [ebp - 0xd7c], 0x78525344
mov dword [ebp - 0xd78], 0x466f5859
mov dword [ebp - 0xd74], 0x69497765
mov dword [ebp - 0xd70], 0x53304341
mov dword [ebp - 0xd6c], 0x75347746
mov dword [ebp - 0xd68], 0x35674846
mov dword [ebp - 0xd64], 0x57513346
mov dword [ebp - 0xd60], 0x67514144
mov dword [ebp - 0xd5c], 0x77736947
mov dword [ebp - 0xd58], 0x56774243
mov byte [ebp - 0xd54], al
mov dword [ebp - 0xd53], 0x4b496f42
mov dword [ebp - 0xd4f], 0x465a6b43
mov dword [ebp - 0xd4b], 0x596a4267
mov dword [ebp - 0xd47], 0x49535143
mov dword [ebp - 0xd43], 0x48703069
mov dword [ebp - 0xd3f], 0x45423877
mov dword [ebp - 0xd3b], 0x4c556f79
mov dword [ebp - 0xd37], 0x496c7367
mov dword [ebp - 0xd33], 0x43514552
mov dword [ebp - 0xd2f], 0x41346742
mov dword [ebp - 0xd2b], 0x4b30686d
mov dword [ebp - 0xd27], 0x44626b44
mov dword [ebp - 0xd23], 0x5a2b5143
mov word [ebp - 0xd1f], 0x4177
mov byte [ebp - 0xd1d], 0x56
mov byte [ebp - 0xd1c], al
mov dword [ebp - 0xd1b], 0x4f313442
mov dword [ebp - 0xd17], 0x47696733
mov dword [ebp - 0xd13], 0x462f7751
mov dword [ebp - 0xd0f], 0x5a554941
mov dword [ebp - 0xd0b], 0x43775967
mov dword [ebp - 0xd07], 0x46683051
mov dword [ebp - 0xd03], 0x48574141
mov dword [ebp - 0xcff], 0x4f496378
mov dword [ebp - 0xcfb], 0x4763496d
mov dword [ebp - 0xcf7], 0x49325944
mov dword [ebp - 0xcf3], 0x502f6b54
mov dword [ebp - 0xcef], 0x4e315179
mov dword [ebp - 0xceb], 0x4d31597a
mov byte [ebp - 0xce7], 0x67
mov byte [ebp - 0xce6], al
mov dword [ebp - 0xce5], 0x73414b70
mov dword [ebp - 0xce1], 0x46574b36
mov dword [ebp - 0xcdd], 0x41694271
mov word [ebp - 0xcd9], 0x4e32
mov byte [ebp - 0xcd7], 0x48
mov byte [ebp - 0xcd6], al
mov byte [ebp - 0xcd5], 0x32
mov byte [ebp - 0xcd4], al
lea eax, [ebp - 0xb53]
mov dword [ebp - 0xcd3], 0x476e7778
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xccf], 0x41456369
push eax
lea eax, [ebp - 0xc57]
mov dword [ebp - 0xccb], 0x446b4543
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xcc7], 0x41333454
mov ecx, esp
mov dword [ebp - 0xcc3], 0x454d3869
lea eax, [ebp - 0xc80]
mov dword [ebp - 0xcbf], 0x416c4554
mov dword [ebp - 0xcbb], 0x4a4c7741
push dword [ebp - 0xde0]
mov dword [ebp - 0xcb7], 0x666a346e
push eax
mov dword [ebp - 0xcb3], 0x594e5144
lea eax, [ebp - 0xddc]
mov dword [ebp - 0xcaf], 0x45776842
mov dword [ebp - 0xcab], 0x416b6343
mov dword [ebp - 0xca7], 0x44734953
mov dword [ebp - 0xca3], 0x59787077
mov dword [ebp - 0xc9f], 0x456d5152
mov dword [ebp - 0xc9b], 0x63344951
mov dword [ebp - 0xc97], 0x43455541
mov dword [ebp - 0xc93], 0x4e416f54
mov dword [ebp - 0xc8f], 0x4a565168
mov dword [ebp - 0xc8b], 0x62736741
mov dword [ebp - 0xc87], 0x41416f7a
mov word [ebp - 0xc83], 0x4441
mov byte [ebp - 0xc81], 0x31
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1020f1e0
lea eax, [ebp - 0xdf0]
push eax
call fcn.102122eb
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1021b9b7
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.10212790
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdf0]
call fcn.1021b7ff
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.10220c90
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.1020fb06
lea ecx, [ebp - 0x50]
call fcn.1020fbdc
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.10210a9c
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10210a9c
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.10210a9c
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xde0], esp
push esi
call fcn.1020fb06
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.1020fa78
mov byte [ebp - 4], 3
call fcn.10217cd7
add esp, 0xc
call fcn.102289d9
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1021d2b1
lea eax, [ebp - 0x50]
push eax
call fcn.10216c98
pop ecx
lea ecx, [ebp - 0x50]
call fcn.10210725
lea ecx, [esi - 0x10]
jmp 0x1021d2e3
cmp eax, 0x4d835
jne 0x1021d2cc
push ebx
call fcn.1021a4de
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.10216974
call fcn.1021e32c
ret 0xc