Function at 0x10002af5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x30
mov eax, 0x10039916
call fcn.10039093
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor ebx, ebx
push 0x1004633c
mov dword [ebp - 0x3c], ebx
call fcn.100040a5
mov dword [ebp - 4], ebx
mov esi, dword [0x100500a0]
test esi, esi
je case.0x10002abb.113
cmp byte [0x100500bb], bl
je 0x10002aa4
mov ecx, 0x10b8134
call fcn.1000ba22
mov ebx, eax
test ebx, ebx
je 0x10002aa2
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002aa2
push 4
add ebx, 0x6e4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002aa2
mov ax, word [ebx]
mov word [esi + 0x3e], ax
xor ebx, ebx
movzx eax, word [esi + 0x3e]
add eax, 0xffffff9b
cmp eax, 0x6f
ja case.0x10002abb.113
movzx eax, byte [eax + 0x10002c9d]
jmp dword [eax*4 + 0x10002c79]
mov cl, 0x74
mov dword [ebp - 0x38], 0x45444574
mov dword [ebp - 0x34], 0x6150359
mov eax, ebx
mov dword [ebp - 0x30], 0x61b1d06
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10002aed
mov cl, byte [ebp - 0x38]
jmp 0x10002ade
mov byte [ebp - 0x2c], bl
jmp 0x10002c35
mov cl, 0x43
mov dword [ebp - 0x38], 0x71737243
mov dword [ebp - 0x34], 0x242c316e
mov eax, ebx
mov word [ebp - 0x30], 0x2636
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10002b1f
mov cl, byte [ebp - 0x38]
jmp 0x10002b10
mov byte [ebp - 0x2e], bl
jmp 0x10002c35
mov cl, 0x64
mov dword [ebp - 0x38], 0x57545564
mov dword [ebp - 0x34], 0x3050949
mov eax, ebx
mov word [ebp - 0x30], 1
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10002b4e
mov cl, byte [ebp - 0x38]
jmp 0x10002b3f
mov byte [ebp - 0x2f], bl
jmp 0x10002c35
mov cl, 0x5b
mov dword [ebp - 0x38], 0x6f6b6a5b
mov dword [ebp - 0x34], 0x32292b76
mov eax, ebx
mov dword [ebp - 0x30], 0x2f283e
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xa
jae 0x10002c32
mov cl, byte [ebp - 0x38]
jmp 0x10002b6f
mov cl, 0x50
mov dword [ebp - 0x38], 0x61606250
mov dword [ebp - 0x34], 0x2231277d
mov eax, ebx
mov dword [ebp - 0x30], 0x223f3922
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10002aed
mov cl, byte [ebp - 0x38]
jmp 0x10002b9e
mov cl, 0x17
mov dword [ebp - 0x38], 0x25272517
mov dword [ebp - 0x34], 0x7078653a
mov eax, ebx
mov word [ebp - 0x30], 0x7262
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10002b1f
mov cl, byte [ebp - 0x38]
jmp 0x10002bcc
mov cl, 0x69
mov dword [ebp - 0x38], 0x5a595b69
mov dword [ebp - 0x34], 0xe080444
mov eax, ebx
mov word [ebp - 0x30], 0xc
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10002b4e
mov cl, byte [ebp - 0x38]
jmp 0x10002bf7
mov cl, 0x7b
mov dword [ebp - 0x38], 0x4f4b497b
mov dword [ebp - 0x34], 0x12090b56
mov eax, ebx
mov dword [ebp - 0x30], 0xf081e
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xa
jae 0x10002c32
mov cl, byte [ebp - 0x38]
jmp 0x10002c23
mov byte [ebp - 0x2d], bl
lea ecx, [ebp - 0x37]
call fcn.1000408d
push eax
lea eax, [ebp - 0x37]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000401e
lea eax, [ebp - 0x28]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov ecx, edi
push eax
mov byte [edi], bl
call fcn.10003b15
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10003f51
mov eax, edi
call fcn.1003903d
ret 4