Function at 0x10004920
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1003f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword fs:[0x30]
mov dword [ebp - 0x54], ecx
mov eax, dword [edi + 0xc]
add eax, 0x14
mov esi, dword [eax]
cmp esi, eax
je 0x10004970
mov ebx, dword [sym.imp.VCRUNTIME140.dll_wcsstr]
nop
test esi, esi
je 0x10004970
push ecx
push dword [esi + 0x20]
call ebx
add esp, 8
test eax, eax
jne 0x10004983
mov eax, dword [edi + 0xc]
mov esi, dword [esi]
add eax, 0x14
mov ecx, dword [ebp - 0x54]
cmp esi, eax
jne 0x10004950
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031912
mov esp, ebp
pop ebp
ret
push dword [esi + 0x28]
push 0x10037718
push 0x1003f8f0
call fcn.10004900
mov eax, dword fs:[0x2c]
add esp, 0xc
mov ecx, dword [0x1003f8dc]
mov dword [ebp - 0x20], 0x3f3f2901
mov dword [ebp - 0x1c], 0xe292b2d
mov dword [ebp - 0x18], 0x28623f39
mov ebx, dword [eax + ecx*4]
mov eax, dword [0x10112068]
mov word [ebp - 0x14], 0x2020
mov byte [ebp - 0x4d], 0x4c
cmp eax, dword [ebx + 4]
jle 0x10004a27
push 0x10112068
call fcn.10031abc
add esp, 4
cmp dword [0x10112068], 0xffffffff
jne 0x10004a27
mov eax, dword [ebp - 0x18]
movq xmm0, qword [ebp - 0x20]
mov dword [0x10112060], eax
mov ax, word [ebp - 0x14]
mov word [0x10112064], ax
mov al, byte [ebp - 0x4d]
push 0x100339e0
movq qword [0x10112058], xmm0
mov byte [0x10112066], al
call fcn.10031ee1
push 0x10112068
call fcn.10031a72
add esp, 8
cmp byte [0x10112066], 0
je 0x10004a3f
xor eax, eax
xor byte [eax + 0x10112058], 0x4c
inc eax
cmp eax, 0xf
jb 0x10004a32
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
push 0xf
push 0x10112058
push 0x1003f8f0
call edi
add esp, 0xc
test eax, eax
je 0x10004970
movaps xmm0, xmmword [0x1003bb00]
mov eax, dword [0x10112040]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0x2b222538
mov dword [ebp - 0x38], 0x28627e7f
mov word [ebp - 0x34], 0x2020
mov byte [ebp - 0x32], 0x4c
cmp eax, dword [ebx + 4]
jle 0x10004acb
push 0x10112040
call fcn.10031abc
add esp, 4
cmp dword [0x10112040], 0xffffffff
jne 0x10004acb
push 0x1b
lea eax, [ebp - 0x4c]
push eax
push 0x1011206c
call sub.VCRUNTIME140.dll_memcpy
push 0x100339b0
call fcn.10031ee1
push 0x10112040
call fcn.10031a72
add esp, 0x14
cmp byte [0x10112086], 0
je 0x10004aff
movups xmm0, xmmword [0x1011206c]
mov eax, 0x10
movaps xmm1, xmmword [0x1003be00]
pxor xmm1, xmm0
movups xmmword [0x1011206c], xmm1
xor byte [eax + 0x1011206c], 0x4c
inc eax
cmp eax, 0x1b
jb 0x10004af2
push 0x1b
push 0x1011206c
push 0x1003f8f0
call edi
add esp, 0xc
test eax, eax
je 0x10004970
mov eax, dword [0x10112054]
mov dword [ebp - 0x30], 0x75282b25
mov dword [ebp - 0x2c], 0x2d3a3428
mov dword [ebp - 0x28], 0x28627e7f
mov word [ebp - 0x24], 0x2020
mov byte [ebp - 0x4d], 0x4c
cmp eax, dword [ebx + 4]
jle 0x10004b98
push 0x10112054
call fcn.10031abc
add esp, 4
cmp dword [0x10112054], 0xffffffff
jne 0x10004b98
mov eax, dword [ebp - 0x28]
movq xmm0, qword [ebp - 0x30]
mov dword [0x1011204c], eax
mov ax, word [ebp - 0x24]
mov word [0x10112050], ax
mov al, byte [ebp - 0x4d]
push 0x10033980
movq qword [0x10112044], xmm0
mov byte [0x10112052], al
call fcn.10031ee1
push 0x10112054
call fcn.10031a72
add esp, 8
cmp byte [0x10112052], 0
je 0x10004bb0
xor eax, eax
xor byte [eax + 0x10112044], 0x4c
inc eax
cmp eax, 0xf
jb 0x10004ba3
push 0xf
push 0x10112044
push 0x1003f8f0
call edi
add esp, 0xc
test eax, eax
je 0x10004970
mov eax, dword [0x1011203c]
mov dword [ebp - 0x10], 0x3428212d
mov dword [ebp - 0xc], 0x627e7f22
mov dword [ebp - 8], 0x4c202028
cmp eax, dword [ebx + 4]
jle 0x10004c2d
push 0x1011203c
call fcn.10031abc
add esp, 4
cmp dword [0x1011203c], 0xffffffff
jne 0x10004c2d
movq xmm0, qword [ebp - 0x10]
mov eax, dword [ebp - 8]
push 0x10033960
movq qword [0x10112030], xmm0
mov dword [0x10112038], eax
call fcn.10031ee1
push 0x1011203c
call fcn.10031a72
add esp, 8
cmp byte [0x1011203b], 0
je 0x10004c4d
xor eax, eax
nop dword [eax + eax]
xor byte [eax + 0x10112030], 0x4c
inc eax
cmp eax, 0xc
jb 0x10004c40
push 0xc
push 0x10112030
push 0x1003f8f0
call edi
add esp, 0xc
test eax, eax
je 0x10004970
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031912
mov esp, ebp
pop ebp
ret