Function at 0x1003b2a0
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100449b1
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x1005600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x23c]
push 0
push 0x1004d9f4
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x228], 0xf
mov dword [ebp - 0x22c], 0
mov byte [ebp - 0x23c], 0
call fcn.100029b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x210], 0xf
mov dword [ebp - 0x214], 0
mov byte [ebp - 0x224], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
mov esi, 0x5c
mov dword [ebp - 0x4e], 0x610044
xor eax, eax
mov dword [ebp - 0x42], 0x650073
mov dword [ebp - 0x46], 0x610062
lea edx, [ecx + 2]
mov dword [ebp - 0x3e], 0x6d005c
mov ebx, 0x61
mov dword [ebp - 0x32], 0x760063
mov dword [ebp - 0x36], 0x2e006e
mov dword [ebp - 0x2e], 0x64
mov dword [ebp - 0x3a], 0x690061
mov word [ebp - 0x50], si
mov dword [ebp - 0x4a], 0x610074
mov dword [ebp - 0x1f4], 7
mov dword [ebp - 0x1f8], 0
mov word [ebp - 0x208], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b3a4
sub ecx, edx
lea eax, [ebp - 0x50]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x208]
call fcn.10002560
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [0x10058a20], ax
jne 0x1003b3e8
xor ecx, ecx
jmp 0x1003b3ff
mov ecx, 0x10058a20
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b3f0
sub ecx, edx
sar ecx, 1
push ecx
push 0x10058a20
lea ecx, [ebp - 0x28]
call fcn.10002560
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x26c]
call fcn.10004070
add esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x1003b43e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10003220
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1f4]
cmp eax, 8
jb 0x1003b474
inc eax
lea ecx, [ebp - 0x208]
push eax
push dword [ebp - 0x208]
call fcn.10003220
xor eax, eax
mov dword [ebp - 0x1f4], 7
cmp dword [ebp - 0x258], 8
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x26c]
cmovae eax, dword [ebp - 0x26c]
push eax
mov dword [ebp - 0x1f8], 0
call dword [0x10058c40]
test eax, eax
jne 0x1003b587
mov word [ebp - 0x1c0], ax
lea ecx, [ebp - 0x2bc]
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x1e4], 0x44005c
push eax
mov dword [ebp - 0x1c8], 0x63002e
mov dword [ebp - 0x1d0], 0x61006d
mov dword [ebp - 0x1d6], 0x650073
mov dword [ebp - 0x1de], 0x610074
mov word [ebp - 0x1e0], bx
mov dword [ebp - 0x1c4], 0x64006c
mov dword [ebp - 0x1cc], 0x6e0069
mov dword [ebp - 0x1da], 0x610062
mov word [ebp - 0x1d2], si
call fcn.10001970
mov esi, eax
push 0x10058a20
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 7
call fcn.10001970
push esi
mov edx, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2a4]
call fcn.10004070
add esp, 4
lea ecx, [ebp - 0x26c]
push eax
call fcn.10001870
lea ecx, [ebp - 0x2a4]
call fcn.10001830
lea ecx, [ebp - 0x28c]
call fcn.10001830
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 4], 6
call fcn.10001830
cmp dword [ebp - 0x258], 8
lea eax, [ebp - 0x26c]
push 0
cmovae eax, dword [ebp - 0x26c]
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [0x10058c98]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x1003b675
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x100
lea eax, [ebp - 0x1bc]
push eax
push esi
call edi
push esi
call ebx
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x199]
push 0x1004da68
push eax
call fcn.10026e91
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1003b66f
push 0x1004da6c
lea ecx, [ebp - 0x28c]
call fcn.10001be0
mov esi, eax
push edi
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 9
call fcn.10001be0
push esi
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2bc]
call fcn.10003f30
add esp, 4
lea ecx, [ebp - 0x224]
push eax
call fcn.10001ab0
lea ecx, [ebp - 0x2bc]
call fcn.10001a40
lea ecx, [ebp - 0x2a4]
call fcn.10001a40
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 6
call fcn.10001a40
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, 0x61
mov dword [ebp - 0x5c], 0x6c0063
lea eax, [ebp - 0x7c]
mov word [ebp - 0x66], cx
mov word [ebp - 0x78], cx
lea ecx, [ebp - 0x2a4]
push eax
mov dword [ebp - 0x72], 0x610062
mov dword [ebp - 0x6a], 0x64005c
mov dword [ebp - 0x60], 0x2e0079
mov dword [ebp - 0x6e], 0x650073
mov dword [ebp - 0x76], 0x610074
mov dword [ebp - 0x64], 0x6c0069
mov dword [ebp - 0x7c], 0x44005c
mov dword [ebp - 0x58], 0x64
call fcn.10001970
mov esi, eax
push 0x10058a20
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0xb
call fcn.10001970
push esi
mov edx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x254]
call fcn.10004070
add esp, 4
mov eax, dword [ebp - 0x278]
cmp eax, 8
jb 0x1003b719
inc eax
lea ecx, [ebp - 0x28c]
push eax
push dword [ebp - 0x28c]
call fcn.10003220
xor eax, eax
mov dword [ebp - 0x278], 7
mov dword [ebp - 0x27c], 0
mov word [ebp - 0x28c], ax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x290]
cmp eax, 8
jb 0x1003b758
inc eax
lea ecx, [ebp - 0x2a4]
push eax
push dword [ebp - 0x2a4]
call fcn.10003220
xor eax, eax
mov dword [ebp - 0x290], 7
cmp dword [ebp - 0x240], 8
mov word [ebp - 0x2a4], ax
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
mov dword [ebp - 0x294], 0
call dword [0x10058c40]
test eax, eax
jne 0x1003b870
lea ecx, [eax + 0x61]
mov dword [ebp - 0x1c8], 0x760063
mov eax, 0x65
mov word [ebp - 0x1d2], cx
mov word [ebp - 0x1d8], ax
lea ecx, [ebp - 0x208]
lea eax, [ebp - 0x1e8]
mov dword [ebp - 0x1c4], 0x64
push eax
mov dword [ebp - 0x1d6], 0x64005c
mov dword [ebp - 0x1dc], 0x730061
mov dword [ebp - 0x1e8], 0x44005c
mov dword [ebp - 0x1d0], 0x6c0069
mov dword [ebp - 0x1e0], 0x620061
mov dword [ebp - 0x1cc], 0x2e0079
mov dword [ebp - 0x1e4], 0x740061
call fcn.10001970
mov esi, eax
push 0x10058a20
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.10001970
push esi
mov edx, eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2bc]
call fcn.10004070
add esp, 4
lea ecx, [ebp - 0x254]
push eax
call fcn.10001870
lea ecx, [ebp - 0x2bc]
call fcn.10001830
lea ecx, [ebp - 0x28]
call fcn.10001830
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0xf
call fcn.10001830
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
push 0
cmovae eax, dword [ebp - 0x254]
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [0x10058c98]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003b9e3
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x100
lea eax, [ebp - 0x1bc]
push eax
push esi
call edi
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x199]
push 0x1004da68
push eax
call fcn.10026e91
add esp, 0xc
test eax, eax
je 0x1003b924
push eax
lea ecx, [ebp - 0x28]
call fcn.10001be0
push eax
lea edx, [ebp - 0x224]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2bc]
call fcn.10003f90
add esp, 4
lea ecx, [ebp - 0x224]
push eax
call fcn.10001ab0
lea ecx, [ebp - 0x2bc]
call fcn.10001a40
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xf
call fcn.10001a40
lea eax, [ebp - 0x1f0]
push eax
push esi
call dword [0x10058c3c]
test eax, eax
je 0x1003b9e0
push 0x40
lea eax, [ebp - 0xbc]
push 0
push eax
call fcn.10020430
add esp, 0xc
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x1dc]
push eax
call dword [0x10058c38]
movzx eax, word [ebp - 0x200]
sub eax, 0x7d0
mov word [ebp - 0x1d], 0x6432
push eax
movzx eax, word [ebp - 0x1fa]
push eax
movzx eax, word [ebp - 0x1fe]
push eax
lea eax, [ebp - 0x24]
mov word [ebp - 0x20], 0x252f
push eax
lea eax, [ebp - 0xbc]
mov word [ebp - 0x23], 0x3230
push 0x40
push eax
mov dword [ebp - 0x1b], 0x3230252f
mov word [ebp - 0x17], 0x64
mov byte [ebp - 0x24], 0x25
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x1e], 0x30
call fcn.10001100
add esp, 0x18
lea ecx, [ebp - 0x224]
push 0x1004da70
call fcn.10001a00
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x224]
call fcn.10001a00
push esi
call ebx
lea eax, [ebp - 0x224]
push eax
lea edx, [ebp - 0x23c]
lea ecx, [ebp - 0x2bc]
call fcn.10003fc0
add esp, 4
lea ecx, [ebp - 0x23c]
push eax
call fcn.10001ab0
lea ecx, [ebp - 0x2bc]
call fcn.10001a40
cmp dword [ebp - 0x228], 0x10
lea edx, [ebp - 0x23c]
mov ecx, dword [ebp - 0x274]
cmovae edx, dword [ebp - 0x23c]
call fcn.10041c00
lea ecx, [ebp - 0x254]
call fcn.10001830
lea ecx, [ebp - 0x26c]
call fcn.10001830
lea ecx, [ebp - 0x224]
call fcn.10001a40
lea ecx, [ebp - 0x23c]
call fcn.10001a40
mov eax, dword [ebp - 0x274]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10006f48
mov esp, ebp
pop ebp
ret 4