Function at 0x10073b84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x188], eax
lea eax, [esp + 0x84]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push 0x104
push 0
push dword [esp + 0x14]
call fcn.1008c000
add esp, 0xc
lea eax, [esp + 0x6c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
lea ebp, [esp + 0x3e]
mov byte [ebp - 2], 1
mov byte [ebp - 1], 4
mov al, 0x7a
mov byte [ebp], al
mov cl, 0x65
mov byte [ebp + 1], cl
mov byte [ebp + 2], 0x6d
mov dl, pe_nt_image_headers32
mov byte [ebp + 3], dl
mov byte [ebp + 4], al
mov ah, 0x6f
mov byte [ebp + 5], ah
mov ch, 0x7d
mov byte [ebp + 6], ch
mov byte [ebp + 7], cl
mov byte [ebp + 8], ch
mov byte [ebp + 9], ah
mov byte [ebp + 0xa], 0x4a
mov byte [ebp + 0xb], 0x47
mov cl, 0x57
mov byte [ebp + 0xc], cl
mov byte [ebp + 0xd], 0x49
mov ah, 0x54
mov byte [ebp + 0xe], ah
mov byte [ebp + 0xf], cl
mov cl, 0x5f
mov byte [ebp + 0x10], cl
mov byte [ebp + 0x11], 0x4e
mov byte [ebp + 0x12], 0x67
mov dh, 0x6b
mov byte [ebp + 0x13], dh
mov byte [ebp + 0x14], ah
mov byte [ebp + 0x15], 0x50
mov byte [ebp + 0x16], 0x5b
mov byte [ebp + 0x17], cl
mov byte [ebp + 0x18], 0x46
mov byte [ebp + 0x19], 0x41
mov byte [ebp + 0x1a], 0x13
mov byte [ebp + 0x1b], al
mov byte [ebp + 0x1c], 0x61
mov al, 0x6a
mov byte [ebp + 0x1d], al
mov byte [ebp + 0x1e], 0x74
mov byte [ebp + 0x1f], ch
mov byte [ebp + 0x20], 0x7b
mov byte [ebp + 0x21], dl
mov byte [ebp + 0x22], 0x6e
mov byte [ebp + 0x23], 0x62
mov byte [ebp + 0x24], 0x79
mov byte [ebp + 0x25], 0x58
mov byte [ebp + 0x26], al
mov cl, 0x72
mov byte [ebp + 0x27], cl
mov byte [ebp + 0x28], cl
mov byte [ebp + 0x29], dh
mov byte [ebp + 0x2a], 0x6c
mov byte [ebp + 0x2b], al
lea eax, [esp + 0x6a]
lea ecx, [esp + 0x6c]
mov dword [esp + 4], ecx
mov edx, 0xa6f9a04
mov ecx, 0xc732c4ad
cmp edx, 0xc732c4ad
je 0x10073cbb
cmp edx, 0xa6f9a04
jne 0x10073c99
mov byte [eax], 0
inc eax
cmp eax, dword [esp + 4]
mov edx, 0xa6f9a04
cmove edx, ecx
jmp 0x10073c99
lea esi, [esp + 0x3c]
mov dword [esp + 8], esi
mov eax, dword [esp + 8]
mov al, byte [eax]
mov byte [esp + 3], al
mov edx, 0x47bb2354
mov eax, 0xc6014712
mov ecx, 0x36f4ecc5
cmp edx, 0x47bb2353
jg 0x10073d11
cmp edx, 0xc6014712
je 0x10073d38
cmp edx, 0x36f4ecc5
je 0x10073da4
cmp edx, 0x43a6b9b0
jne 0x10073cdc
mov edx, dword [esp + 0x20]
cmp edx, 0x2c
mov edx, 0x670beac6
cmovb edx, eax
jmp 0x10073cdc
cmp edx, 0x670beac6
je 0x10073d67
cmp edx, 0x596e327c
je 0x10073d86
cmp edx, 0x47bb2354
jne 0x10073cdc
test byte [esp + 3], 1
mov edx, 0x596e327c
cmove edx, ecx
jmp 0x10073cdc
mov edx, dword [esp + 0x20]
mov bl, byte [esp + edx + 0x3e]
mov edx, dword [esp + 0x20]
mov bh, byte [esp + 0x3d]
inc dl
xor dl, bh
xor dl, bl
xor dl, 0x2c
mov edi, dword [esp + 0x20]
mov byte [esp + edi + 0x3e], dl
inc dword [esp + 0x20]
mov edx, 0x43a6b9b0
jmp 0x10073cdc
mov edx, dword [esp + 4]
mov byte [esp + 0x6a], 0
mov byte [esp + 0x6b], 0
mov edx, dword [esp + 8]
mov byte [edx], 0
mov edx, 0x36f4ecc5
jmp 0x10073cdc
lea edx, [esp + 0x20]
mov dword [esp + 4], edx
mov edx, dword [esp + 4]
mov dword [esp + 0x20], 0
mov edx, 0x43a6b9b0
jmp 0x10073cdc
xor eax, eax
lea edi, [esp + 0x6c]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
push ebp
call fcn.1009ee80
add esp, 4
mov ecx, edi
push eax
push ebp
call fcn.10007b00
lea eax, [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
lea eax, [esp + 0x47]
mov byte [eax - 0xb], 1
mov byte [eax - 0xa], 4
mov byte [eax - 9], 0x5c
mov cl, 0x7d
mov byte [eax - 8], cl
mov byte [eax - 7], 0x61
mov byte [eax - 6], 0x6d
mov byte [eax - 5], cl
mov byte [eax - 4], 0x68
mov byte [eax - 3], 0x7e
mov byte [eax - 2], 0x4c
mov byte [eax - 1], 0x60
lea ecx, [esp + 0x49]
mov dword [esp + 4], ecx
mov edx, 0xf81aa07d
mov ecx, 0x9441fccc
cmp edx, 0x9441fccc
je 0x10073e3b
cmp edx, 0xf81aa07d
jne 0x10073e19
mov byte [eax], 0
inc eax
cmp eax, dword [esp + 4]
mov edx, 0xf81aa07d
cmove edx, ecx
jmp 0x10073e19
mov dword [esp + 8], esi
mov eax, dword [esp + 8]
mov al, byte [eax]
mov byte [esp + 3], al
mov edx, 0x9bbe385f
mov eax, 0xbd20a046
mov ecx, 0xe335f963
cmp edx, 0xbd20a045
jg 0x10073e91
cmp edx, 0x84f4911e
je 0x10073eed
cmp edx, 0x9bbe385f
je 0x10073f0c
cmp edx, 0xa964b470
jne 0x10073e58
mov edx, dword [esp + 0x20]
cmp edx, 9
mov edx, 0x84f4911e
cmovb edx, ecx
jmp 0x10073e58
cmp edx, 0xbd20a046
je 0x10073f3c
cmp edx, 0xe0f7fd3e
je 0x10073f1e
cmp edx, 0xe335f963
jne 0x10073e58
mov edx, dword [esp + 0x20]
mov bl, byte [esp + edx + 0x3e]
mov edx, dword [esp + 0x20]
mov bh, byte [esp + 0x3d]
mov esi, 0x7e
sub esi, edx
and esi, 0x77
inc edx
and edx, 0x88
or edx, esi
xor dl, bh
xor dl, bl
xor dl, 0x7e
mov esi, dword [esp + 0x20]
mov byte [esp + esi + 0x3e], dl
inc dword [esp + 0x20]
mov edx, 0xa964b470
jmp 0x10073e58
mov edx, dword [esp + 4]
mov byte [esp + 0x47], 0
mov byte [esp + 0x48], 0
mov edx, dword [esp + 8]
mov byte [edx], 0
mov edx, 0xbd20a046
jmp 0x10073e58
test byte [esp + 3], 1
mov edx, 0xe0f7fd3e
cmove edx, eax
jmp 0x10073e58
lea edx, [esp + 0x20]
mov dword [esp + 4], edx
mov edx, dword [esp + 4]
mov dword [esp + 0x20], 0
mov edx, 0xa964b470
jmp 0x10073e58
xor eax, eax
lea edi, [esp + 0x24]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
push ebp
call fcn.1009ee80
add esp, 4
mov ecx, edi
push eax
push ebp
call fcn.10007b00
lea eax, [esp + 0x84]
mov dword [esp + 0x18], eax
mov ecx, edi
call fcn.10007bca
mov edi, eax
lea ecx, [esp + 0x6c]
call fcn.10007bca
push 0x104
push dword [esp + 0x1c]
push edi
push eax
call fcn.1005b834
add esp, 0x10
mov dword [esp + 0x1c], eax
mov eax, 0x791f4e2e
mov esi, 0xaa5a1330
cmp eax, 0xaa5a1330
je 0x10073fc5
cmp eax, 0x60e1d75d
je 0x10073fe7
cmp eax, 0x791f4e2e
jne 0x10073fa1
cmp dword [esp + 0x1c], 0
mov eax, 0x60e1d75d
cmove eax, esi
jmp 0x10073fa1
mov edi, dword [esp + 0x18]
push edi
call fcn.1009ee80
add esp, 4
mov ecx, dword [esp + 0x1a0]
push eax
push edi
call fcn.10007b00
mov eax, 0x60e1d75d
jmp 0x10073fa1
lea ecx, [esp + 0x24]
call fcn.100087f0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x6c]
call fcn.100087f0
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x18c
pop esi
pop edi
pop ebx
pop ebp
ret