Function at 0x1001e750
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x48
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
mov esi, dword [esp + 0x54]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x5c]
test esi, esi
je 0x1001eb79
mov ecx, dword [esp + 0x60]
cmp ecx, 0x10
je 0x1001e78a
cmp ecx, 0x18
je 0x1001e78a
cmp ecx, 0x20
jne 0x1001ebb0
mov eax, dword [esp + 0x64]
cmp eax, 0x10
je 0x1001e7a1
cmp eax, 0x18
je 0x1001e7a1
cmp eax, 0x20
jne 0x1001ec00
push eax
mov dword [ebx + 0x3cc], eax
lea eax, [ebx + 0x3d4]
push edi
push eax
mov dword [ebx + 0x3c8], ecx
call fcn.1002e880
push dword [ebx + 0x3cc]
lea eax, [ebx + 0x3f4]
push edi
push eax
call fcn.1002e880
mov eax, dword [ebx + 0x3c8]
add esp, 0x18
mov ecx, dword [ebx + 0x3cc]
cmp eax, 0x10
je 0x1001e7f8
cmp eax, 0x18
je 0x1001e7ee
mov eax, 0xe
jmp 0x1001e811
xor eax, eax
cmp ecx, 0x20
sete al
jmp 0x1001e80a
cmp ecx, 0x10
jne 0x1001e802
lea eax, [ecx - 6]
jmp 0x1001e811
xor eax, eax
cmp ecx, 0x18
setne al
lea eax, [eax*2 + 0xc]
mov dword [ebx + 0x3d0], eax
mov eax, ecx
cdq
xor ecx, ecx
and edx, 3
mov dword [esp + 0x10], ecx
push ebp
lea ebp, [edx + eax]
mov eax, dword [ebx + 0x3d0]
sar ebp, 2
mov dword [esp + 0x18], ebp
test eax, eax
js 0x1001e862
lea edx, [ebx + 8]
nop dword [eax + eax]
test ebp, ebp
jle 0x1001e850
mov ecx, ebp
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [ebx + 0x3d0]
inc ecx
add edx, 0x20
mov dword [esp + 0x14], ecx
cmp ecx, eax
jle 0x1001e840
xor edx, edx
test eax, eax
js 0x1001e88e
lea esi, [ebx + 0x1e8]
nop
test ebp, ebp
jle 0x1001e87c
mov ecx, ebp
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x3d0]
inc edx
add esi, 0x20
cmp edx, eax
jle 0x1001e870
mov esi, dword [esp + 0x5c]
inc eax
lea edi, [ebx + 0x414]
imul eax, ebp
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x3c8]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [esp + 0x14], eax
test eax, eax
jle 0x1001e94b
mov ebp, eax
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 4]
shl eax, 0x18
lea edi, [edi + 4]
mov dword [edi - 4], eax
movzx edx, byte [esi - 3]
shl edx, 0x10
or edx, eax
mov dword [edi - 4], edx
movzx ecx, byte [esi - 2]
shl ecx, 8
or ecx, edx
mov dword [edi - 4], ecx
movzx eax, byte [esi - 1]
or eax, ecx
mov dword [edi - 4], eax
sub ebp, 1
jne 0x1001e8c0
mov ebp, dword [esp + 0x18]
lea ecx, [ebx + 0x414]
mov dword [esp + 0x10], ecx
xor edi, edi
cmp edi, dword [esp + 0x20]
jge 0x1001eadc
mov eax, edi
mov ecx, dword [ecx]
cdq
inc edi
idiv ebp
lea esi, [edx + eax*8]
mov dword [ebx + esi*4 + 8], ecx
mov ecx, dword [ebx + 0x3d0]
mov esi, dword [esp + 0x14]
sub ecx, eax
mov eax, dword [esp + 0x10]
lea ecx, [edx + ecx*8]
mov eax, dword [eax]
mov dword [ebx + ecx*4 + 0x1e8], eax
mov ecx, dword [esp + 0x10]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp edi, esi
jl 0x1001e905
jmp 0x1001e94f
xor edi, edi
mov esi, eax
cmp edi, dword [esp + 0x20]
jge 0x1001eadc
mov dword [esp + 0x10], 0x100503f8
lea ebp, [ebx + 0x414]
nop word [eax + eax]
mov edx, dword [ebx + esi*4 + 0x410]
mov eax, edx
sar eax, 0x10
movzx eax, al
movsx ecx, byte [eax + str.cw]
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
movsx eax, byte [eax]
xor ecx, eax
mov eax, edx
sar eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
xor ecx, eax
movzx eax, dl
shl ecx, 8
sar edx, 0x18
movzx eax, byte [eax + str.cw]
xor ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
xor ecx, eax
xor dword [ebp], ecx
cmp esi, 8
je 0x1001e9fb
cmp esi, 1
jle 0x1001e9ee
lea ecx, [ebx + 0x418]
lea edx, [esi - 1]
nop
mov eax, dword [ecx - 4]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edx, 1
jne 0x1001e9e0
test esi, esi
jle 0x1001eace
jmp 0x1001ea7f
lea eax, [ebx + 0x418]
mov edx, 3
mov ecx, dword [eax - 4]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x1001ea06
mov edx, dword [ebx + 0x420]
mov eax, edx
sar eax, 0x18
movzx eax, al
movsx ecx, byte [eax + str.cw]
mov eax, edx
sar eax, 0x10
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
xor ecx, eax
mov eax, edx
sar eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
xor ecx, eax
movzx eax, dl
shl ecx, 8
mov edx, 3
movzx eax, byte [eax + str.cw]
xor ecx, eax
xor dword [ebx + 0x424], ecx
lea ecx, [ebx + 0x428]
mov eax, dword [ecx - 4]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edx, 1
jne 0x1001ea71
mov dword [esp + 0x1c], 0
cmp edi, dword [esp + 0x20]
jge 0x1001ead8
mov eax, edi
mov ecx, dword [ebp]
cdq
inc edi
idiv dword [esp + 0x18]
lea esi, [edx + eax*8]
mov dword [ebx + esi*4 + 8], ecx
mov ecx, dword [ebx + 0x3d0]
mov esi, dword [esp + 0x14]
sub ecx, eax
mov eax, dword [ebp]
add ebp, 4
lea ecx, [edx + ecx*8]
mov dword [ebx + ecx*4 + 0x1e8], eax
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, esi
jl 0x1001ea87
lea ebp, [ebx + 0x414]
cmp edi, dword [esp + 0x20]
jl 0x1001e970
mov ebp, dword [esp + 0x18]
mov eax, 1
mov dword [esp + 0x1c], eax
cmp dword [ebx + 0x3d0], eax
jle 0x1001eb60
lea ecx, [ebx + 0x208]
mov dword [esp + 0x18], ecx
test ebp, ebp
jle 0x1001eb4c
mov esi, ecx
mov edi, ebp
nop
mov edx, dword [esi]
lea esi, [esi + 4]
mov eax, edx
sar eax, 0x18
movzx ecx, al
mov eax, edx
sar eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x1004f3f8]
xor ecx, dword [eax*4 + 0x1004f7f8]
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004fbf8]
movzx eax, dl
xor ecx, dword [eax*4 + 0x1004fff8]
mov dword [esi - 4], ecx
sub edi, 1
jne 0x1001eb00
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
inc eax
add ecx, 0x20
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
cmp eax, dword [ebx + 0x3d0]
jl 0x1001eaf7
mov ecx, dword [esp + 0x54]
pop ebp
pop edi
pop esi
mov byte [ebx + 4], 1
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x48
ret 0x10
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0x74706d45
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x4d], 0x79656b20
mov byte [esp + 0x4c], 0x79
mov byte [esp + 0x51], 0
call fcn.1001fd70
push 0x1005dccc
lea eax, [esp + 0x24]
push eax
call fcn.1002e455
lea eax, [esp + 0x2c]
mov dword [esp + 0x37], 0x6c207965
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], 0x63657272
mov dword [esp + 0x3f], 0x74676e65
mov word [esp + 0x43], 0x68
mov dword [esp + 0x30], 0x6f636e49
mov word [esp + 0x39], 0x6b20
mov byte [esp + 0x38], 0x74
call fcn.1001fd70
push 0x1005dccc
lea eax, [esp + 0x24]
push eax
call fcn.1002e455
lea eax, [esp + 0x2c]
mov dword [esp + 0x3b], 0x6e656c20
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0x6c622074
mov dword [esp + 0x30], 0x6f636e49
mov dword [esp + 0x43], 0x687467
mov dword [esp + 0x34], 0x63657272
mov word [esp + 0x3d], 0x6b63
mov byte [esp + 0x3c], 0x6f
call fcn.1001fd70
push 0x1005dccc
lea eax, [esp + 0x24]
push eax
call fcn.1002e455
int3