Function at 0x10002b56
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x30
mov eax, 0x10071de6
call fcn.1003bd50
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor ebx, ebx
push 0x10088176
mov dword [ebp - 0x3c], ebx
call fcn.1000416d
mov dword [ebp - 4], ebx
mov edi, dword [0x10098bc0]
test edi, edi
je case.0x10002b4f.113
cmp byte [0x10098bdb], bl
je 0x10002b38
mov ecx, 0x10b8134
call fcn.1000dd00
mov ebx, eax
test ebx, ebx
je 0x10002b36
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002b36
push 4
add ebx, 0x6e4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002b36
mov ax, word [ebx]
mov word [edi + 0x3e], ax
xor ebx, ebx
movzx eax, word [edi + 0x3e]
add eax, 0xffffff9b
cmp eax, 0x6f
ja case.0x10002b4f.113
movzx eax, byte [eax + 0x10002d31]
jmp dword [eax*4 + 0x10002d0d]
mov cl, 0x45
mov dword [ebp - 0x38], 0x74757445
mov dword [ebp - 0x34], 0x37243268
mov eax, ebx
mov dword [ebp - 0x30], 0x372a2c37
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10002b81
mov cl, byte [ebp - 0x38]
jmp 0x10002b72
mov byte [ebp - 0x2c], bl
jmp 0x10002cc9
mov cl, 0x62
mov dword [ebp - 0x38], 0x50525362
mov dword [ebp - 0x34], 0x50d104f
mov eax, ebx
mov word [ebp - 0x30], 0x717
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10002bb3
mov cl, byte [ebp - 0x38]
jmp 0x10002ba4
mov byte [ebp - 0x2e], bl
jmp 0x10002cc9
mov cl, 0x53
mov dword [ebp - 0x38], 0x60636253
mov dword [ebp - 0x34], 0x34323e7e
mov eax, ebx
mov word [ebp - 0x30], 0x36
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10002be2
mov cl, byte [ebp - 0x38]
jmp 0x10002bd3
mov byte [ebp - 0x2f], bl
jmp 0x10002cc9
mov cl, 0x31
mov dword [ebp - 0x38], 0x5010031
mov dword [ebp - 0x34], 0x5843411c
mov eax, ebx
mov dword [ebp - 0x30], 0x454254
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xa
jae 0x10002cc6
mov cl, byte [ebp - 0x38]
jmp 0x10002c03
mov cl, 0x5c
mov dword [ebp - 0x38], 0x6d6c6e5c
mov dword [ebp - 0x34], 0x2e3d2b71
mov eax, ebx
mov dword [ebp - 0x30], 0x2e33352e
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10002b81
mov cl, byte [ebp - 0x38]
jmp 0x10002c32
mov cl, 0x39
mov dword [ebp - 0x38], 0xb090b39
mov dword [ebp - 0x34], 0x5e564b14
mov eax, ebx
mov word [ebp - 0x30], 0x5c4c
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10002bb3
mov cl, byte [ebp - 0x38]
jmp 0x10002c60
mov cl, 9
mov dword [ebp - 0x38], 0x3a393b09
mov dword [ebp - 0x34], 0x6e686424
mov eax, ebx
mov word [ebp - 0x30], 0x6c
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10002be2
mov cl, byte [ebp - 0x38]
jmp 0x10002c8b
mov cl, 0x70
mov dword [ebp - 0x38], 0x44404270
mov dword [ebp - 0x34], 0x1902005d
mov eax, ebx
mov dword [ebp - 0x30], 0x40315
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xa
jae 0x10002cc6
mov cl, byte [ebp - 0x38]
jmp 0x10002cb7
mov byte [ebp - 0x2d], bl
lea eax, [ebp - 0x37]
push eax
call fcn.10004150
pop ecx
push eax
lea eax, [ebp - 0x37]
push eax
lea ecx, [ebp - 0x28]
call fcn.100040d7
lea eax, [ebp - 0x28]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.10003bbc
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10004022
mov eax, esi
call fcn.1003bcfa
ret 4