Function at 0x100b512
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x690
mov eax, dword [0xa5cf8fb0]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x660], eax
xor eax, eax
mov esi, 0xa5cf14e8
lea edi, [ebp - 0x23c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7f
pop ecx
lea edi, [ebp - 0x232]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0xa5cf14f4]
mov dword [ebp - 0x34], eax
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x65c], bx
lea edi, [ebp - 0x65a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x678], ebx
lea edi, [ebp - 6]
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], bl
stosw word es:[edi], ax
lea edi, [ebp - 0x674]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x648], ebx
lea edi, [ebp - 0x644]
stosd dword es:[edi], eax
lea edi, [ebp - 0x68c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xffdf0030
stosd dword es:[edi], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x64c], ebx
call fcn.01006112
push 0xa5cf14f8
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.01006112
xor eax, eax
movsx cx, byte [ebp + eax - 0x10]
mov word [ebp + eax*2 - 0x32], cx
inc eax
cmp eax, 0xa
jb 0x100b616
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.01006112
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x65c]
push eax
call dword [0xa5cf60c8]
push 0x18
pop esi
push ebx
push ebx
push 0x20
push 1
push 1
push 0x80
lea eax, [ebp - 0x65c]
mov dword [ebp - 0x670], eax
push ebx
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x678]
push eax
push 0x80000000
lea eax, [ebp - 0x640]
push eax
mov dword [ebp - 0x678], esi
mov dword [ebp - 0x674], ebx
mov dword [ebp - 0x66c], 0x240
mov dword [ebp - 0x668], ebx
mov dword [ebp - 0x664], ebx
call dword [0xa5cf6134]
cmp eax, ebx
jl 0x100b7c8
push 5
push esi
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x648]
push eax
push dword [ebp - 0x640]
call dword [0xa5cf6130]
cmp eax, ebx
jge 0x100b6db
mov ebx, eax
jmp 0x100b7ba
mov eax, dword [ebp - 0x688]
push 0x70466266
push eax
push 1
mov dword [ebp - 0x650], eax
call dword [0xa5cf6190]
cmp eax, ebx
mov ecx, dword [ebp - 0x654]
mov dword [ecx], eax
jne 0x100b74d
mov ebx, 0xc0000001
jmp 0x100b7ba
mov ecx, dword [ebp - 0x644]
cmp ecx, ebx
je 0x100b784
mov eax, dword [ebp - 0x654]
mov edi, dword [eax]
mov eax, dword [ebp - 0x64c]
mov edx, ecx
shr ecx, 2
add edi, eax
lea esi, [ebp - 0x63c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, dword [ebp - 0x644]
cmp eax, dword [ebp - 0x650]
mov dword [ebp - 0x64c], eax
jae 0x100b7ac
push ebx
push ebx
xor eax, eax
push 0x400
lea edi, [ebp - 0x63c]
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x648]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x640]
call dword [0xa5cf612c]
test eax, eax
je 0x100b70b
mov eax, dword [ebp - 0x650]
cmp dword [ebp - 0x64c], eax
jae 0x100b7ac
mov esi, dword [ebp - 0x654]
push 0x70466266
push dword [esi]
call dword [0xa5cf618c]
mov dword [esi], ebx
jmp 0x100b701
mov eax, dword [ebp - 0x660]
mov ecx, dword [ebp - 0x650]
mov dword [eax], ecx
push dword [ebp - 0x640]
call dword [0xa5cf60dc]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100f6a2
leave
ret 8