Function at 0x10001bbf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x1000f060]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], eax
test edi, edi
jne 0x10001bea
xor al, al
jmp 0x10001e10
and dword [esp + 0x10], 0
push 0x80c
push 0
push eax
mov byte [esp + 0x30], 0x73
mov byte [esp + 0x31], 0x63
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x31
mov byte [esp + 0x34], 0
mov byte [esp + 0x38], 0x63
mov byte [esp + 0x39], 0x66
mov byte [esp + 0x3a], 0x67
mov byte [esp + 0x3b], 0x69
mov byte [esp + 0x3c], 0x6e
mov byte [esp + 0x3d], 0x74
mov byte [esp + 0x3e], 0
call fcn.10007ef0
add esp, 0xc
push str.__t_n_v_f_r
push edi
call fcn.10003060
mov esi, eax
add esi, edi
mov al, byte [esi]
pop ecx
pop ecx
cmp al, 0x3c
je 0x10001be3
test al, al
je 0x10001e06
mov edi, 0x1000dd20
push edi
push esi
call fcn.100030b0
mov ebx, eax
add ebx, esi
pop ecx
pop ecx
cmp ebx, esi
jne 0x10001c80
push edi
push esi
call fcn.10003060
pop ecx
pop ecx
add esi, eax
jmp 0x10001dfd
lea edx, [ebx - 1]
jmp 0x10001c92
movsx eax, byte [edx]
call fcn.10001baa
test eax, eax
je 0x10001c96
dec edx
cmp edx, esi
ja 0x10001c85
inc edx
cmp byte [ebx], 0x3d
mov dword [esp + 0x20], edx
jne 0x10001ca1
inc ebx
push str.__t_v_f
push ebx
call fcn.10003060
add ebx, eax
push 0x1000dd2c
push ebx
mov dword [esp + 0x2c], ebx
call fcn.100030b0
mov edi, eax
add esp, 0x10
add edi, ebx
jmp 0x10001cd3
movsx eax, byte [edi]
call fcn.10001baa
test eax, eax
je 0x10001cd7
dec edi
cmp edi, ebx
ja 0x10001cc6
movsx eax, byte [edi]
call fcn.10001baa
test eax, eax
jne 0x10001ce4
inc edi
mov eax, dword [esp + 0x20]
mov cl, byte [eax]
mov byte [esp + 0x16], cl
mov cl, byte [edi]
mov byte [eax], 0
lea eax, [esp + 0x2c]
push eax
mov ebx, esi
mov byte [esp + 0x1b], cl
mov byte [edi], 0
call fcn.10002d8e
pop ecx
test eax, eax
jne 0x10001d32
mov eax, dword [esp + 0x1c]
call fcn.10002f6a
mov ecx, dword [esp + 0x18]
mov edx, 0xe10
cmp eax, edx
mov dword [ecx], eax
jge 0x10001d25
mov dword [ecx], edx
mov eax, 0x15180
cmp dword [ecx], eax
jle 0x10001da2
mov dword [ecx], eax
jmp 0x10001da2
push 0x1000dd30
mov ebx, esi
call fcn.10002d8e
pop ecx
test eax, eax
jne 0x10001d55
mov eax, dword [esp + 0x1c]
call fcn.10002f6a
mov ecx, dword [esp + 0x18]
mov dword [ecx + 8], eax
jmp 0x10001da2
lea eax, [esp + 0x24]
push eax
mov ebx, esi
call fcn.10002d8e
pop ecx
test eax, eax
jne 0x10001d81
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push 0x400
add ecx, 0x40c
call fcn.10002ed4
pop ecx
jmp 0x10001da2
push 0x1000dd34
mov ebx, esi
call fcn.10002d8e
pop ecx
test eax, eax
jne 0x10001da8
mov eax, dword [esp + 0x1c]
call fcn.10002f6a
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
inc dword [esp + 0x10]
jmp 0x10001ddd
push str.allowed
mov ebx, esi
call fcn.10002d8e
pop ecx
test eax, eax
jne 0x10001ddd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push 0x400
add ecx, 0xc
call fcn.10002ed4
inc dword [esp + 0x14]
pop ecx
call esi
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x20]
mov byte [edi], al
mov al, byte [esp + 0x16]
push str.__t_n_v_f_r
push edi
mov byte [ecx], al
call dword [sym.imp.SHLWAPI.dll_StrSpnA]
mov esi, eax
add esi, edi
cmp byte [esi], 0
jne 0x10001c5a
xor eax, eax
cmp dword [esp + 0x10], 5
setge al
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10003014
mov esp, ebp
pop ebp
ret