Function at 0x100189ba
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
mov eax, dword [0x10054040]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
mov esi, ecx
mov dword [esp + 0x14], 0x425f4a2d
push edi
mov dword [esp + 0x78], esi
mov cl, 0x2d
mov dword [esp + 0x1c], 0x59725d58
xor eax, eax
mov edi, dword [esi]
mov word [esp + 0x20], 0x5d42
mov byte [esp + 0x22], 0
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 9
jae 0x10018a0e
mov cl, byte [esp + 0x18]
jmp 0x100189fe
sub esp, 0x18
mov byte [esp + 0x3a], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, eax
mov dword [esp + 0x40], 0x776a7b0f
add esp, 0x18
mov dword [esi + 4], edi
mov cl, 0xf
mov dword [esp + 0x2c], 0x667b507b
mov dword [esp + 0x30], 0x6a637b
xor eax, eax
xor byte [esp + eax + 0x29], cl
inc eax
cmp eax, 0xa
jae 0x10018a5d
mov cl, byte [esp + 0x28]
jmp 0x10018a4d
sub esp, 0x18
mov byte [esp + 0x4b], 0
lea eax, [esp + 0x41]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 8], eax
mov cl, 0x66
mov word [esp + 8], 0x1266
mov dword [esp + 0xb], 0x1139121e
push 3
pop eax
mov dword [esp + 0x74], eax
mov byte [esp + 0xa], al
mov byte [esp + 0x12], al
xor eax, eax
mov word [esp + 0xf], 0x80f
mov byte [esp + 0x11], 8
mov word [esp + 0x13], 0x1514
mov byte [esp + 0x15], 0
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xc
jae 0x10018acb
mov cl, byte [esp + 8]
jmp 0x10018abb
sub esp, 0x18
mov byte [esp + 0x2d], 0
lea eax, [esp + 0x21]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0xc], eax
mov cl, 0x3d
mov dword [esp + 0x18], 0x4558493d
xor eax, eax
mov dword [esp + 0x1c], 0x54496249
mov word [esp + 0x20], 0x5850
mov byte [esp + 0x22], 0
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 9
jae 0x10018b1f
mov cl, byte [esp + 0x18]
jmp 0x10018b0f
sub esp, 0x18
mov byte [esp + 0x3a], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
add esp, 0x18
xor edx, edx
mov dword [esi + 0x10], eax
mov cl, 0x73
mov dword [esp + 0x18], 0x1d073173
mov dword [esp + 0x1c], 0x1c1f302c
mov eax, edx
mov word [esp + 0x20], 0x1600
mov byte [esp + 0x22], dl
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 9
jae 0x10018b74
mov cl, byte [esp + 0x18]
jmp 0x10018b64
sub esp, 0x18
mov byte [esp + 0x3a], dl
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0x14], eax
mov cl, 1
mov dword [esp + 0x40], 0x6f754301
xor eax, eax
mov dword [esp + 0x44], 0x64714e5e
mov word [esp + 0x48], 0x6f
xor byte [esp + eax + 0x41], cl
inc eax
cmp eax, 8
jae 0x10018bc2
mov cl, byte [esp + 0x40]
jmp 0x10018bb2
sub esp, 0x18
mov byte [esp + 0x61], 0
lea eax, [esp + 0x59]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi + 4]
add esp, 0x18
xor edx, edx
mov dword [esi + 0x18], eax
mov cl, 0x69
mov dword [esp + 0x40], 0x71d2b69
mov dword [esp + 0x44], 0xd002136
mov eax, edx
mov word [esp + 0x48], 0xc
xor byte [esp + eax + 0x41], cl
inc eax
cmp eax, 8
jae 0x10018c13
mov cl, byte [esp + 0x40]
jmp 0x10018c03
sub esp, 0x18
mov byte [esp + 0x61], dl
lea eax, [esp + 0x59]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edi, dword [esi]
add esp, 0x18
mov dword [esi + 0x1c], eax
mov cl, 0x13
mov dword [esp + 8], 0x7c617413
xor eax, eax
mov dword [esp + 0xc], 0x704c6366
mov dword [esp + 0x10], 0x76677d7c
mov word [esp + 0x14], 0x677d
mov byte [esp + 0x16], 0
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xd
jae 0x10018c6d
mov cl, byte [esp + 8]
jmp 0x10018c5d
sub esp, 0x18
mov byte [esp + 0x2e], 0
lea eax, [esp + 0x21]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov dword [esi + 0x20], eax
add esp, 0x18
lea eax, [esi + 0x24]
mov dword [esp + 0x5c], 3
mov dword [esp + 0x38], eax
xor ecx, ecx
lea eax, [esi + 0x50]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], eax
mov edi, dword [esi + 0x20]
sub esp, 0x18
mov dword [esp + 0x4c], esp
xor eax, eax
mov dword [esp + 0x58], 0x2a372245
mov dword [esp + 0x5c], 0x601a3530
push ecx
mov cl, 0x45
mov word [esp + 0x64], 0x21
xor byte [esp + eax + 0x5d], cl
inc eax
cmp eax, 8
jae 0x10018ce0
mov cl, byte [esp + 0x5c]
jmp 0x10018cd0
sub esp, 0x18
mov byte [esp + 0x7d], 0
lea eax, [esp + 0x75]
mov ecx, esp
push eax
call fcn.10003d99
push dword [esp + 0x68]
call fcn.100039e2
add esp, 0x20
mov ecx, edi
call fcn.1000c67f
mov edi, eax
mov dword [esp + 0x40], 0xd07036a
mov eax, dword [esp + 0x50]
add esp, 0x18
mov cl, 0x6a
mov dword [esp + 0x2c], 0xf0f0435
mov word [esp + 0x30], 0x190e
mov byte [esp + 0x32], 0
mov dword [eax], edi
xor eax, eax
xor byte [esp + eax + 0x29], cl
inc eax
cmp eax, 9
jae 0x10018d42
mov cl, byte [esp + 0x28]
jmp 0x10018d32
sub esp, 0x18
mov byte [esp + 0x4a], 0
lea eax, [esp + 0x41]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov ecx, dword [esp + 0x6c]
add esp, 0x18
mov dword [esp + 8], 0x41414a24
mov dword [esp + 0xc], 0x477b5740
mov dword [esp + 0x10], 0x504a514b
mov dword [ecx - 4], eax
mov cl, 0x24
mov eax, dword [esp + 0x38]
mov byte [esp + 0x14], 0
mov edi, dword [eax]
xor eax, eax
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xb
jae 0x10018d9e
mov cl, byte [esp + 8]
jmp 0x10018d8e
sub esp, 0x18
mov byte [esp + 0x2c], 0
lea eax, [esp + 0x21]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov ecx, dword [esp + 0x6c]
add esp, 0x18
movups xmm0, xmmword [0x1004c780]
mov dword [ecx], eax
xor ecx, ecx
mov eax, dword [esp + 0x38]
movups xmmword [esp + 0x7c], xmm0
mov edi, dword [eax]
mov al, byte [esp + 0x7c]
xor byte [esp + ecx + 0x7d], al
inc ecx
cmp ecx, 0xe
jb 0x10018dd6
sub esp, 0x18
mov byte [esp + 0xa3], 0
lea eax, [esp + 0x95]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov ecx, dword [esp + 0x6c]
add esp, 0x18
mov dword [esp + 0x18], 0x606c6014
mov dword [esp + 0x1c], 0x79757a4b
mov word [esp + 0x20], 0x71
mov dword [ecx + 4], eax
mov cl, 0x14
mov eax, dword [esp + 0x38]
mov edi, dword [eax]
xor eax, eax
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 8
jae 0x10018e40
mov cl, byte [esp + 0x18]
jmp 0x10018e30
sub esp, 0x18
mov byte [esp + 0x39], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
mov edx, dword [esp + 0x6c]
add esp, 0x18
mov ecx, dword [esp + 0x58]
add dword [esp + 0x38], 4
inc ecx
mov dword [esp + 0x58], ecx
mov dword [edx + 8], eax
add edx, 0x18
sub dword [esp + 0x5c], 1
mov dword [esp + 0x54], edx
jne 0x10018caa
mov edi, dword [esi]
xor eax, eax
push 0x79
pop ecx
mov byte [esp + 8], cl
mov dword [esp + 9], 0xc160b1e
mov dword [esp + 0xd], 0x1c0b2609
mov dword [esp + 0x11], 0x1d0b180e
mov byte [esp + 0x15], 0
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xc
jae 0x10018ebd
mov cl, byte [esp + 8]
jmp 0x10018ead
sub esp, 0x18
mov byte [esp + 0x2d], 0
lea eax, [esp + 0x21]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
add esp, 0x18
mov dword [esp + 0x29], 0x3c0d1721
mov edi, eax
mov dword [esp + 0x2d], 0x2140631
mov dword [esi + 0x30], edi
xor eax, eax
mov word [esp + 0x31], 0x711
push 0x63
pop ecx
mov byte [esp + 0x28], cl
mov byte [esp + 0x33], 0
xor byte [esp + eax + 0x29], cl
inc eax
cmp eax, 0xa
jae 0x10018f15
mov cl, byte [esp + 0x28]
jmp 0x10018f05
sub esp, 0x18
mov byte [esp + 0x4b], 0
lea eax, [esp + 0x41]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000c67f
add esp, 0x18
mov dword [esi + 0x40], eax
xor ecx, ecx
lea edi, [esi + 0x8c]
lea eax, [esi + 0x34]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x30]
sub esp, 0x18
mov dword [esp + 0x4c], esp
mov dword [esp + 0x6c], eax
xor eax, eax
mov dword [esp + 0x20], 0x6a7e691b
push ecx
mov cl, 0x1b
mov dword [esp + 0x28], 0x7a6f726e
mov dword [esp + 0x2c], 0x7f3e4477
mov byte [esp + 0x30], 0
xor byte [esp + eax + 0x25], cl
inc eax
cmp eax, 0xb
jae 0x10018f8d
mov cl, byte [esp + 0x24]
jmp 0x10018f7d
sub esp, 0x18
mov byte [esp + 0x48], 0
lea eax, [esp + 0x3d]
mov ecx, esp
push eax
call fcn.10003d99
push dword [esp + 0x68]
call fcn.100039e2
mov ecx, dword [esp + 0x8c]
add esp, 0x20
call fcn.1000c67f
mov ecx, eax
mov dword [esp + 0x30], 0x35223150
mov eax, dword [esp + 0x50]
add esp, 0x18
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], 0x35220f31
mov dword [esp + 0x20], 0x34223127
mov dword [eax], ecx
mov cl, 0x50
mov byte [esp + 0x24], 0
xor eax, eax
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 0xb
jae 0x10018ff9
mov cl, byte [esp + 0x18]
jmp 0x10018fe9
sub esp, 0x18
mov byte [esp + 0x3c], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, dword [esp + 0x4c]
call fcn.1000c67f
mov dword [edi + 8], eax
add esp, 0x18
mov eax, dword [esp + 0x38]
mov cl, 0x73
mov dword [esp + 0x28], 0x70b0773
mov dword [esp + 0x2c], 0x416012c
mov dword [esp + 0x30], 0x170112
mov eax, dword [eax]
mov dword [esp + 0x34], eax
xor eax, eax
xor byte [esp + eax + 0x29], cl
inc eax
cmp eax, 0xa
jae 0x10019052
mov cl, byte [esp + 0x28]
jmp 0x10019042
sub esp, 0x18
mov byte [esp + 0x4b], 0
lea eax, [esp + 0x41]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, dword [esp + 0x4c]
call fcn.1000c67f
movups xmm0, xmmword [0x1004d070]
mov dword [edi + 0xc], eax
add esp, 0x18
mov eax, dword [esp + 0x38]
xor ecx, ecx
movups xmmword [esp + 0x60], xmm0
mov word [esp + 0x70], 0x2d
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov al, byte [esp + 0x60]
xor byte [esp + ecx + 0x61], al
inc ecx
cmp ecx, 0x10
jb 0x10019094
sub esp, 0x18
mov byte [esp + 0x89], 0
lea eax, [esp + 0x79]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, dword [esp + 0x4c]
call fcn.1000c67f
movups xmm0, xmmword [0x1004d000]
mov dword [edi + 0x10], eax
add esp, 0x18
mov eax, dword [esp + 0x38]
xor ecx, ecx
movups xmmword [esp + 0x60], xmm0
mov byte [esp + 0x70], 0
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov al, byte [esp + 0x60]
xor byte [esp + ecx + 0x61], al
inc ecx
cmp ecx, 0xf
jb 0x100190e5
sub esp, 0x18
mov byte [esp + 0x88], 0
lea eax, [esp + 0x79]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, dword [esp + 0x4c]
call fcn.1000c67f
add esp, 0x18
mov dword [edi + 0x14], eax
call fcn.1000a608
test eax, eax
je 0x100191e8
mov dword [edi], eax
call fcn.1000cd54
test eax, eax
je 0x100191e8
mov ecx, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov edx, dword [esi]
mov ecx, dword [ecx]
call fcn.1000c649
mov eax, dword [edi]
xor edx, edx
mov esi, 0x3f340000
mov ecx, dword [eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0xcc]
mov dword [ecx + 0x13c], edx
mov dword [ecx + 0x140], edx
mov dword [ecx + 0x144], esi
mov dword [ecx + 0x148], esi
mov dword [ecx + 0x1f0], edx
mov dword [ecx + 0x1f4], edx
mov dword [ecx + 0x1f8], edx
mov dword [ecx + 0x1fc], edx
call eax
mov ecx, dword [edi]
mov ecx, dword [ecx]
call fcn.1000c928
mov ecx, dword [edi]
mov edx, pe_nt_image_headers32
mov ecx, dword [ecx]
call fcn.1000c9ca
mov ecx, dword [edi + 8]
lea eax, [esp + 0x40]
push eax
call fcn.1000c6e8
mov esi, eax
lea edi, [esp + 0x80]
pop ecx
lea edx, [esp + 0x7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x58]
mov ecx, dword [edi]
mov ecx, dword [ecx]
call fcn.1000cda9
mov ecx, dword [edi]
lea edx, [esp + 0x7c]
mov ecx, dword [ecx]
call fcn.1000c75c
mov ecx, dword [edi]
xor dl, dl
mov ecx, dword [ecx]
call fcn.1000c8aa
mov esi, dword [esp + 0x78]
call fcn.1000a608
test eax, eax
je 0x100191f4
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x5c]
add edi, 0x18
add dword [esp + 0x38], 4
inc ecx
sub dword [esp + 0x74], 1
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], edi
jne 0x10018f4d
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
xor ecx, esp
call fcn.1003c3d4
mov esp, ebp
pop ebp
ret