Function at 0x10027c30
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x100b6898], 0
je 0x10028195
mov ecx, 0x4c
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + 0x100a2e40]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10027c6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10027c50
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x20]
push eax
push 0
mov byte [ebp - 0x15], 0
call esi
test eax, eax
jne 0x10027cd1
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x14]
push eax
push 0
mov dword [ebp - 0x14], 0x6d616554
mov dword [ebp - 0x10], 0x77656956
mov word [ebp - 0xc], 0x7265
call esi
test eax, eax
jne 0x10027cd1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x44796e41
push eax
push 0
mov dword [ebp - 4], 0x6b7365
call esi
test eax, eax
jne 0x10027cd1
mov dword [0x100bc0dc], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x100bb6dc], 0
mov dword [0x100bfc40], 0
mov dword [0x100bb3c4], 0
mov dword [0x100baf6c], 0
mov dword [0x100bc260], 0
mov dword [0x100bc3bc], 0
mov dword [0x100baef8], 0
mov dword [0x100bb3d0], 0
mov dword [0x100ba70c], 0
mov dword [0x100b6c3c], 0
mov dword [0x100bb69c], 0
mov dword [0x100bc7d8], 0
mov dword [0x100baf44], 0
mov dword [0x100bb3ec], 0
mov dword [0x100b6ad8], 0
mov dword [0x100b6b34], 0
mov dword [0x100bb528], 0
mov dword [0x100b6768], 0
mov dword [0x100b6b24], 0
mov dword [0x100bb3dc], 0
mov dword [0x100ba8f0], 0
mov dword [0x100bfc90], 0
mov dword [0x100b6c6c], 0
mov dword [0x100b66f4], 0
mov dword [0x100c0378], 0
mov dword [0x100ba308], 0
mov dword [0x100bcb3c], 0
mov dword [0x100bc010], 0
mov dword [0x100bc0d8], 0
mov dword [0x100b6c48], 0
mov dword [0x100b66f8], 0
mov dword [0x100bb398], 0
mov dword [0x100bc098], 0
mov dword [0x100c0370], 0
mov dword [0x100ba310], 0
mov dword [0x100bfc8c], 0
mov dword [0x100ba714], 0
mov dword [0x100b6b04], 0
mov dword [0x100b6ad0], 0
mov dword [0x100b6c4c], 0
mov dword [0x100bbc24], 0
mov dword [0x100b6bc0], 0
mov dword [0x100c0140], 0
mov dword [0x100bcf3c], 0
mov dword [0x100bc3c8], 0
mov dword [0x100b66f0], 0
mov dword [0x100bb570], 0
mov dword [0x100bb650], 0
mov dword [0x100bc238], 0
mov dword [0x100b6764], 0
mov dword [0x100bb5b0], 0
mov dword [0x100bc7dc], 0
mov dword [0x100c0380], 0
mov dword [0x100bc08c], 0
mov dword [0x100bb3a0], 0
mov dword [0x100b62ec], 0
mov dword [0x100bfd54], 0
mov dword [0x100bb3d8], 0
mov dword [0x100bb694], 0
mov dword [0x100bc084], 0
mov dword [0x100b6780], 0
mov dword [0x100bc240], 0
mov dword [0x100b6788], 0
mov dword [0x100bb3e0], 0
mov dword [0x100b6aec], 0
mov dword [0x100ba31c], 0
mov dword [0x100bfc54], 0
mov dword [0x100baf28], 0
mov dword [0x100ba75c], 0
mov dword [0x100b6cd4], 0
mov dword [0x100bc274], 0
mov dword [0x100bcb34], 0
mov dword [0x100ba710], 0
mov dword [0x100b64f4], 0
mov dword [0x100b6ae4], 0
mov dword [0x100b6ae0], 0
mov dword [0x100bc264], 0
mov dword [0x100b6774], 0
mov dword [0x100baf60], 0
mov dword [0x100bfcbc], 0
mov dword [0x100baf40], 0
xorps xmm0, xmm0
mov dword [0x100bc7c0], 0
mov eax, 1
mov dword [0x100ba8fc], 0
mov dword [0x100bbbec], 0
mov dword [0x100bb5cc], 0
mov dword [0x100bc228], 0
mov dword [0x100bb388], 0
mov dword [0x100b9f04], 0
mov dword [0x100bbc08], 0
mov dword [0x100b6890], 0
mov dword [0x100ba304], 0
mov dword [0x100b68a4], 0
mov dword [0x100b678c], 0
mov dword [0x100c039c], 0
mov dword [0x100bb518], 0
mov dword [0x100bb52c], 0
mov dword [0x100bb394], 0
mov dword [0x100bcf38], 0
mov dword [0x100baf00], 0
mov dword [0x100ba744], 0
mov dword [0x100bc258], 0
mov dword [0x100bfcc8], 0
mov dword [0x100bb3a4], 0
mov dword [0x100b6b18], 0
mov dword [0x100bbc0c], 0
mov dword [0x100bb510], 0
mov dword [0x100ba2f4], 0
mov dword [0x100bc26c], 0
mov dword [0x100bb5e0], 0
mov dword [0x100ba748], 0
mov dword [0x100b68b0], 0
mov dword [0x100bb5d8], 0
mov dword [0x100b676c], 0
mov dword [0x100b3018], 0
mov dword [0x100bc0b4], 0
mov dword [0x100bfcc4], 0
movups xmmword [0x100bc7f0], xmm0
mov dword [0x100bc818], 0
movups xmmword [0x100bc800], xmm0
mov dword [0x100bfc84], 1
movq qword [0x100bc810], xmm0
mov dword [0x100bc0dc], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x100bc0dc], 0
mov esp, ebp
pop ebp
ret