Function at 0x1021d5e5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xcdc
mov eax, 0x1024d18e
call fcn.1021e9a7
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.10221230
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.102134e2
push eax
lea ecx, [ebp - 0xc80]
call fcn.10210155
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1021d881
cmp dword [edi + 8], 0x4a
jne 0x1021d881
mov esi, dword [edi]
test esi, esi
je 0x1021d881
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1021d873
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
push 0x64
pop eax
mov byte [ebp - 0xcc6], al
mov ecx, 0x30a
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xb53]
mov byte [ebp - 0xc84], bl
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xcd8], 0x6741794b
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xcd4], 0x714d4846
mov ecx, esp
mov dword [ebp - 0xcd0], 0x304d6d44
lea eax, [ebp - 0xc84]
mov dword [ebp - 0xccc], 0x6c496e43
mov word [ebp - 0xcc8], 0x5444
push dword [ebp - 0xc84]
mov dword [ebp - 0xcc5], 0x4152662b
push eax
mov dword [ebp - 0xcc1], 0x30774c71
lea eax, [ebp - 0xcd8]
mov dword [ebp - 0xcbd], 0x4d574e55
mov dword [ebp - 0xcb9], 0x6b776535
mov dword [ebp - 0xcb5], 0x6b544879
mov dword [ebp - 0xcb1], 0x38694748
mov dword [ebp - 0xcad], 0x4551476c
mov dword [ebp - 0xca9], 0x416e4d7a
mov dword [ebp - 0xca5], 0x7852424e
mov dword [ebp - 0xca1], 0x67786575
mov dword [ebp - 0xc9d], 0x49784b4e
mov dword [ebp - 0xc99], 0x7753486f
mov dword [ebp - 0xc95], 0x31524937
mov dword [ebp - 0xc91], 0x34676532
mov dword [ebp - 0xc8d], 0x77784e4b
mov dword [ebp - 0xc89], 0x41414141
mov byte [ebp - 0xc85], 0x76
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1020f8ef
lea eax, [ebp - 0xce8]
push eax
call fcn.10212b28
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1021c23a
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.10212fd1
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xce8]
call fcn.1021c080
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.10221230
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.102102ce
lea ecx, [ebp - 0x50]
call fcn.1021039d
mov byte [ebp - 4], 3
lea eax, [ebp - 0xb53]
push eax
lea ecx, [ebp - 0x20]
call fcn.1021125c
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1021125c
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.1021125c
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xc84], esp
push esi
call fcn.102102ce
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.10210240
mov byte [ebp - 4], 3
call fcn.10218195
add esp, 0xc
call fcn.10228fca
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1021d866
lea eax, [ebp - 0x50]
push eax
call fcn.1021704c
pop ecx
lea ecx, [ebp - 0x50]
call fcn.10210ee6
lea ecx, [esi - 0x10]
jmp 0x1021d898
cmp eax, 0x4d835
jne 0x1021d881
push ebx
call fcn.1021a9cf
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.10216d2a
call fcn.1021e8f4
ret 0xc