Function at 0x10001ecc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
nop
nop
mov edi, edi
nop
mov ecx, ecx
nop
xor ebx, ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.10002e16
mov esi, eax
push esi
call fcn.10002e60
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x100023ee
cmp esi, ebx
je 0x100023ee
or byte [ebp - 0x1e], 0xff
push 1
lea eax, [ebp - 0x20]
push 6
push eax
push edi
push esi
mov byte [ebp - 0x20], 0x8b
mov byte [ebp - 0x1f], 0xcd
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x50
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x10001f41
lea eax, [eax + esi + 0xb]
mov dword [0x100052f4], eax
jmp 0x10001f4e
mov dword [ebp - 4], 1
mov dword [0x100052f4], ebx
push 1
lea eax, [ebp - 0x10]
push 5
push eax
push edi
push esi
mov byte [ebp - 0x10], 0x8a
mov byte [ebp - 0xf], 0x4c
mov byte [ebp - 0xe], 0x24
mov byte [ebp - 0xd], 0x28
mov byte [ebp - 0xc], 0x53
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x10001f82
add eax, esi
mov dword [0x100052e8], eax
jmp 0x10001f8b
inc dword [ebp - 4]
mov dword [0x100052e8], ebx
or byte [ebp - 0x3b], 0xff
or byte [ebp - 0x3a], 0xff
or byte [ebp - 0x39], 0xff
or byte [ebp - 0x38], 0xff
mov dword [ebp - 0xc4], 0x5c697567
mov dword [ebp - 0xc0], 0x6f6c6552
mov dword [ebp - 0xbc], 0x556e6967
mov dword [ebp - 0xb8], 0x2e726573
mov dword [ebp - 0xb4], 0x6c6d78
mov dword [ebp - 0xb0], ebx
mov byte [ebp - 0x40], 0x50
mov byte [ebp - 0x3f], 0xc7
mov byte [ebp - 0x3e], 0x44
mov byte [ebp - 0x3d], 0x24
mov byte [ebp - 0x3c], 0x20
mov dword [ebp - 8], esi
push ebx
lea eax, [ebp - 0x40]
push 9
push eax
push edi
push dword [ebp - 8]
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
mov dword [ebp - 0xa4], eax
je 0x10002063
mov ecx, dword [ebp - 8]
push 4
add eax, ecx
mov dword [ebp - 0xa8], eax
mov eax, dword [eax - 4]
push eax
mov dword [ebp - 0xac], eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002041
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xac]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x1000204f
mov eax, dword [ebp - 0xa8]
add eax, 9
mov dword [ebp - 8], eax
jmp 0x10001fea
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xa4]
lea eax, [eax + ecx - 5]
mov dword [0x100053b4], eax
jmp 0x1000206c
inc dword [ebp - 4]
mov dword [0x100053b4], ebx
or byte [ebp - 0x61], 0xff
push 1
lea eax, [ebp - 0x6c]
push 0xe
push eax
push edi
push esi
mov byte [ebp - 0x6c], 0x8b
mov byte [ebp - 0x6b], 0x11
mov byte [ebp - 0x6a], 0x6a
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x6a
mov byte [ebp - 0x67], 0x16
mov byte [ebp - 0x66], 0x8d
mov byte [ebp - 0x65], 0x44
mov byte [ebp - 0x64], 0x24
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x50
mov byte [ebp - 0x60], 0x52
mov byte [ebp - 0x5f], 0x10
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x100020c3
add eax, esi
mov dword [0x10005388], eax
jmp 0x100020cc
inc dword [ebp - 4]
mov dword [0x10005388], ebx
or byte [ebp - 0x81], 0xff
push 1
lea eax, [ebp - 0x8c]
push 0x10
push eax
push edi
push esi
mov byte [ebp - 0x8c], 0x8b
mov byte [ebp - 0x8b], 0x11
mov byte [ebp - 0x8a], 0x6a
mov byte [ebp - 0x89], bl
mov byte [ebp - 0x88], 0x6a
mov byte [ebp - 0x87], 0xa
mov byte [ebp - 0x86], 0x8d
mov byte [ebp - 0x85], 0x44
mov byte [ebp - 0x84], 0x24
mov byte [ebp - 0x83], 0x14
mov byte [ebp - 0x82], 0x50
mov byte [ebp - 0x80], 0x52
mov byte [ebp - 0x7f], 0x10
mov byte [ebp - 0x7e], 0x8b
mov byte [ebp - 0x7d], 0xd
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002152
add eax, esi
mov dword [0x100052e4], eax
jmp 0x1000215b
inc dword [ebp - 4]
mov dword [0x100052e4], ebx
or byte [ebp - 0x95], 0xff
push 1
lea eax, [ebp - 0xa0]
push 0x11
push eax
push edi
push esi
mov byte [ebp - 0xa0], 0x8b
mov byte [ebp - 0x9f], 0x11
mov byte [ebp - 0x9e], 0x6a
mov byte [ebp - 0x9d], bl
mov byte [ebp - 0x9c], 0x6a
mov byte [ebp - 0x9b], 0xe
mov byte [ebp - 0x9a], 0x8d
mov byte [ebp - 0x99], 0x44
mov byte [ebp - 0x98], 0x24
mov byte [ebp - 0x97], 0x20
mov byte [ebp - 0x96], 0x50
mov byte [ebp - 0x94], 0x52
mov byte [ebp - 0x93], 0x10
mov byte [ebp - 0x92], 0x8b
mov byte [ebp - 0x91], 0xce
mov byte [ebp - 0x90], 0xe8
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x100021f4
add eax, esi
mov dword [0x1000535c], eax
jmp 0x100021fd
inc dword [ebp - 4]
mov dword [0x1000535c], ebx
push 1
lea eax, [ebp - 0x4c]
push 0xb
push eax
push edi
push esi
mov byte [ebp - 0x4c], 0xb8
mov byte [ebp - 0x4b], 1
mov byte [ebp - 0x4a], bl
mov byte [ebp - 0x49], bl
mov byte [ebp - 0x48], bl
mov byte [ebp - 0x47], 0x84
mov byte [ebp - 0x46], 0xc8
mov byte [ebp - 0x45], 0x75
mov byte [ebp - 0x44], 0x25
mov byte [ebp - 0x43], 0x8b
mov byte [ebp - 0x42], 0x15
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x1000224f
lea eax, [eax + esi + 0x12]
mov dword [0x100052b4], eax
mov eax, dword [eax]
mov dword [0x100052b4], eax
jmp 0x10002258
inc dword [ebp - 4]
mov dword [0x100052b4], ebx
push 1
lea eax, [ebp - 0x34]
push 9
push eax
push edi
push esi
mov byte [ebp - 0x34], 0xf
mov byte [ebp - 0x33], 0xb7
mov byte [ebp - 0x32], 0x47
mov byte [ebp - 0x31], 0x24
mov byte [ebp - 0x30], 0x50
mov byte [ebp - 0x2f], 0x8d
mov byte [ebp - 0x2e], 0x4c
mov byte [ebp - 0x2d], 0x24
mov byte [ebp - 0x2c], 0x20
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x1000229c
add eax, esi
mov dword [0x100053e8], eax
jmp 0x100022a5
inc dword [ebp - 4]
mov dword [0x100053e8], ebx
push 1
lea eax, [ebp - 0x28]
push 7
push eax
push edi
push esi
mov byte [ebp - 0x28], 0xf
mov byte [ebp - 0x27], 0xb7
mov byte [ebp - 0x26], 0x82
mov byte [ebp - 0x25], 0x3d
mov byte [ebp - 0x24], 5
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x100022e7
add eax, esi
mov dword [0x100053b0], eax
mov eax, dword [eax + 9]
mov dword [0x100053b0], eax
jmp 0x100022f0
inc dword [ebp - 4]
mov dword [0x100053b0], ebx
push 1
lea eax, [ebp - 0x18]
push 5
push eax
push edi
push esi
mov byte [ebp - 0x18], 0xc6
mov byte [ebp - 0x17], 6
mov byte [ebp - 0x16], 1
mov byte [ebp - 0x15], 0x5e
mov byte [ebp - 0x14], 0xc3
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002326
lea eax, [eax + esi + 3]
mov dword [0x10005358], eax
jmp 0x1000232f
inc dword [ebp - 4]
mov dword [0x10005358], ebx
push 2
lea eax, [ebp - 0x5c]
push 0xe
push eax
push edi
push esi
mov byte [ebp - 0x5c], 0x85
mov byte [ebp - 0x5b], 0xc0
mov byte [ebp - 0x5a], 0x75
mov byte [ebp - 0x59], 0xc
mov byte [ebp - 0x58], 0xb8
mov byte [ebp - 0x57], 0x90
mov byte [ebp - 0x56], 1
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], bl
mov byte [ebp - 0x53], 0xb9
mov byte [ebp - 0x52], 0xe
mov byte [ebp - 0x51], 1
mov byte [ebp - 0x50], bl
mov byte [ebp - 0x4f], bl
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002385
lea eax, [eax + esi - 0x1b]
mov dword [0x100053e0], eax
jmp 0x1000238e
inc dword [ebp - 4]
mov dword [0x100053e0], ebx
push 1
lea eax, [ebp - 0x7c]
push 0xf
push eax
push edi
push esi
mov byte [ebp - 0x7c], 0x33
mov byte [ebp - 0x7b], 0xc0
mov byte [ebp - 0x7a], 0xc6
mov byte [ebp - 0x79], 0x84
mov byte [ebp - 0x78], 0x24
mov byte [ebp - 0x77], 0xb4
mov byte [ebp - 0x76], bl
mov byte [ebp - 0x75], bl
mov byte [ebp - 0x74], bl
mov byte [ebp - 0x73], bl
mov byte [ebp - 0x72], 0xb9
mov byte [ebp - 0x71], 0x1f
mov byte [ebp - 0x70], bl
mov byte [ebp - 0x6f], bl
mov byte [ebp - 0x6e], bl
call fcn.10002ed5
add esp, 0x14
cmp eax, 0xffffffff
je 0x100023e5
lea eax, [eax + esi + 0xa]
mov dword [0x1000538c], eax
jmp 0x100023ee
inc dword [ebp - 4]
mov dword [0x1000538c], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret