Function at 0x10013400
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005dacd
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10126ba4], 0
mov edi, dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
jne 0x1001348b
mov edx, 0x3e
xor ecx, ecx
mov al, byte [ecx + str.__1__7___]
xor al, dl
inc edx
mov byte [ebp + ecx - 0x1c], al
and edx, 0x800000ff
jns 0x10013460
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xb
jl 0x10013443
push 0x10126ba4
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x11], 0
push eax
push 0
push 4
push 0
push 1
push 0
push 1
push 0x190
push 0
push 0xe
push esi
call edi
cmp dword [0x10126b80], 0
jne 0x100134e8
mov ecx, 0x3e
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + str.__1__7___]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x100134bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x100134a0
push 0x10126b80
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x11], 0
push eax
push 0
push 5
push 0
push 1
push 0
push 1
push 0x190
push 0
push 0x12
push esi
call edi
cmp dword [0x10126b58], 0
jne 0x100134fd
push 0x10126b58
push esi
call dword [sym.imp.d3dx9_43.dll_D3DXCreateLine]
call fcn.1000aa80
mov eax, dword [esi]
push 0x10126bb0
push esi
call dword [eax + 0xc0]
cmp byte [0x383dabf0], 1
jne 0x10013552
call fcn.1000f000
call fcn.100109e0
mov ecx, esi
call fcn.1000d500
call fcn.10011270
call fcn.1000f750
call fcn.10010040
call fcn.100101c0
call fcn.10010b90
call fcn.10010790
call fcn.100108f0
call fcn.1000efc0
call fcn.10010f10
cmp byte [0x1012699f], 0
je 0x100135e5
mov eax, dword [esi]
lea ecx, [ebp - 0x54]
push ecx
push esi
call dword [eax + 0xc0]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
shr edx, 1
shr ecx, 1
push 0
push ecx
lea eax, [edx - 0xf]
mov dword [esp], 0
mov dword [ebp - 0x2c], eax
lea eax, [edx + 0xf]
mov dword [ebp - 0x24], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x20], eax
lea eax, [ecx - 0xf]
mov dword [ebp - 0x38], eax
lea eax, [edx + 1]
push 0xffff0000
mov dword [ebp - 0x34], eax
lea eax, [ecx + 0xf]
push 1
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x30], eax
mov eax, dword [esi]
push 1
push esi
mov dword [ebp - 0x3c], edx
call dword [eax + 0xac]
mov eax, dword [esi]
push 0
push ecx
mov dword [esp], 0
lea ecx, [ebp - 0x3c]
push 0xffff0000
push 1
push ecx
push 1
push esi
call dword [eax + 0xac]
mov eax, dword [esi]
push 0x100b1548
push esi
call dword [eax + 0xc0]
cmp byte [0x383dabf0], 1
jne 0x100136f8
call fcn.10004b20
call fcn.10006240
call fcn.100048e0
call fcn.10006630
mov dword [0x100b1564], 0x4840e0
mov ecx, dword [0x383c39f0]
mov dword [0x10126b60], ecx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x10126b60], 0
mov ecx, eax
mov dword [0x100b158c], ecx
je 0x100136f8
cmp byte [0x101269e9], 0
je 0x100136f8
mov dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x5c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x24]
xor esi, esi
test eax, eax
jne 0x1001367f
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x1001367f
mov eax, dword [ecx]
mov esi, ecx
mov dword [ebp - 0x58], ecx
call dword [eax + 4]
mov dword [ebp - 4], 1
mov ecx, esi
mov eax, dword [esi]
push 8
push 0xb6
call dword [eax + 0x24]
mov eax, dword [esi]
mov ecx, esi
push 8
push 4
call dword [eax + 0x24]
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
call dword [eax + 0x24]
mov eax, dword [esi]
mov ecx, esi
mov ebx, dword [0x100b1564]
call dword [eax + 0x1c]
mov edi, eax
mov dword [ebp - 0x60], edi
test edi, edi
je 0x100136c7
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
push 1
push edi
mov byte [ebp - 4], 2
call ebx
mov byte [ebp - 4], 3
test edi, edi
je 0x100136df
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov dword [ebp - 4], 4
test esi, esi
je 0x100136f1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x383c39d8
mov dword [0x10126b7c], 0x383c39d8
call esi
test eax, eax
jne 0x10013799
mov ecx, dword [0x10126b7c]
push 4
mov eax, dword [ecx + 0x1c]
mov edi, dword [ecx]
mov dword [0x10126b50], eax
mov dword [0x10126b9c], edi
mov eax, dword [0x38414828]
push edi
mov dword [0x10126b68], eax
call esi
test eax, eax
jne 0x1001374d
test edi, edi
je 0x1001374d
mov eax, 1
jmp 0x1001374f
xor eax, eax
test eax, eax
je 0x10013799
mov edi, dword [0x10126b68]
push 4
push edi
call esi
test eax, eax
jne 0x1001376d
test edi, edi
je 0x1001376d
mov eax, 1
jmp 0x1001376f
xor eax, eax
test eax, eax
je 0x10013799
mov ecx, dword [0x10126b68]
mov eax, dword [ecx]
call dword [eax + 0xd0]
mov ecx, dword [0x10126b68]
mov dword [0x10126bac], eax
mov eax, dword [ecx]
call dword [eax + 0xc4]
mov dword [0x10126b64], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x65685343
mov dword [ebp - 0x18], 0x642e6c6c
mov word [ebp - 0x14], 0x6c6c
mov byte [ebp - 0x12], 0
call esi
test eax, eax
je 0x100137ce
cmp dword [0x100b1560], 0
jne 0x100137ce
mov al, 1
jmp 0x100137d0
xor al, al
test al, al
je 0x100138af
mov dword [ebp - 0x1c], 0xf6fac2d3
xor ecx, ecx
mov dword [ebp - 0x18], 0xf3b8f9f8
mov dword [ebp - 0x14], 0x100f5f4
nop
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 0xa
jb 0x100137f0
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x11], 0
push eax
call esi
mov dword [ebp - 0x1c], 0xfaf5ffd5
xor ecx, ecx
mov dword [ebp - 0x18], 0xf2b8f0fa
mov dword [ebp - 0x14], 0x100fce0
nop
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 0xa
jb 0x10013820
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x11], 0
push eax
call esi
push 0
call esi
cmp dword [0x10126b88], 0
mov dword [0x100b1560], 0x374f8080
mov dword [0x10126b5c], 0x37479910
mov dword [0x10126b54], 0x37185530
mov dword [0x100b1544], 0x375bdb00
mov dword [0x100b1590], 0x371c6220
mov dword [0x10126ba0], 0x37507820
jne 0x100138af
mov dword [0x10126b88], 0x37507820
call fcn.1005a420
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1005a8f0
push 0x10013260
push 0x10126b88
call fcn.10059e80
call fcn.1005a480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b824
mov esp, ebp
pop ebp
ret