Function at 0x100063c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x328
mov eax, dword [0x100900d4]
xor eax, esp
mov dword [esp + 0x324], eax
push ebx
push esi
push 0
push 2
xor bl, bl
mov dword [esp + 0x10], 0x22c
call dword [0x100b0a6c]
mov esi, eax
cmp esi, 0xffffffff
je 0x100067fe
lea eax, [esp + 8]
push eax
push esi
call dword [0x100b0a68]
cmp eax, 1
jne 0x100067f7
push ebp
push edi
mov edi, 0x65
lea ebp, [eax + 0x77]
nop dword [eax]
nop dword [eax + eax]
mov eax, 0x72
mov dword [esp + 0x2d4], 0x760061
mov word [esp + 0x2de], ax
mov eax, 0x67
mov word [esp + 0x2d8], ax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x2d8]
mov dword [esp + 0x2ee], edi
push eax
mov dword [esp + 0x2e8], 0x780076
mov dword [esp + 0x2e2], 0x730063
mov dword [esp + 0x2ec], 0x65002e
mov word [esp + 0x2f0], bp
call dword [0x100b0ae4]
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x2b8], edi
cmove ebx, eax
mov dword [esp + 0x2a8], 0x650067
mov eax, 0x6d
mov dword [esp + 0x2a4], 0x760061
mov word [esp + 0x2ac], ax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x2a8]
mov dword [esp + 0x2b2], 0x780063
push eax
mov dword [esp + 0x2ba], 0x65002e
mov word [esp + 0x2be], bp
call dword [0x100b0ae4]
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x338], 0x780065
cmove ebx, eax
mov dword [esp + 0x322], 0x670076
mov eax, 0x61
mov dword [esp + 0x33c], edi
mov word [esp + 0x32c], ax
mov ecx, 0x6e
mov word [esp + 0x320], ax
lea eax, [esp + 0x44]
push eax
mov word [esp + 0x336], cx
lea eax, [esp + 0x324]
mov ecx, 0x69
mov dword [esp + 0x32c], 0x730064
push eax
mov dword [esp + 0x33c], 0x2e0074
mov dword [esp + 0x336], 0x650067
mov word [esp + 0x32e], cx
call dword [0x100b0ae4]
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x270], 0x6e0067
cmove ebx, eax
mov dword [esp + 0x27c], 0x650078
xor eax, eax
mov dword [esp + 0x26c], 0x760061
mov word [esp + 0x280], ax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x270]
mov dword [esp + 0x278], 0x780073
push eax
mov dword [esp + 0x280], 0x65002e
call dword [0x100b0ae4]
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x29c], 0x650078
cmove ebx, eax
mov dword [esp + 0x290], 0x720067
mov eax, 0x73
mov dword [esp + 0x28c], 0x760061
mov dword [esp + 0x296], 0x2e0078
mov word [esp + 0x294], ax
mov word [esp + 0x29a], di
xor eax, eax
mov word [esp + 0x2a0], ax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x290]
push eax
call dword [0x100b0ae4]
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x2e0], 0x760061
cmove ebx, eax
mov dword [esp + 0x2ec], 0x2e0078
lea eax, [esp + 0x5c]
mov dword [esp + 0x2f0], 0x780065
push eax
lea eax, [esp + 0x2e4]
mov dword [esp + 0x2f8], edi
push eax
mov dword [esp + 0x2ec], 0x730067
mov dword [esp + 0x2f0], 0x630076
call dword [0x100b0ae4]
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x26c], 0x760061
cmove ebx, eax
mov dword [esp + 0x27c], edi
lea eax, [esp + 0x64]
mov dword [esp + 0x274], 0x2e0069
push eax
lea eax, [esp + 0x270]
mov dword [esp + 0x274], 0x750067
push eax
mov dword [esp + 0x280], 0x780065
call dword [0x100b0ae4]
test eax, eax
movzx ebx, bl
mov eax, 1
mov dword [esp + 0x2bc], 0x760061
cmove ebx, eax
mov dword [esp + 0x2ce], edi
lea eax, [esp + 0x6c]
mov dword [esp + 0x2c8], 0x65002e
push eax
lea eax, [esp + 0x2c0]
mov dword [esp + 0x2c8], 0x780069
push eax
mov dword [esp + 0x2c8], 0x750067
mov word [esp + 0x2d4], bp
call dword [0x100b0ae4]
add esp, 0x40
movzx ebx, bl
test eax, eax
mov dword [esp + 0x2f0], 0x760061
mov eax, 1
mov dword [esp + 0x308], edi
cmove ebx, eax
mov dword [esp + 0x300], 0x2e0078
mov eax, 0x64
mov dword [esp + 0x2fa], 0x760073
mov word [esp + 0x2f8], ax
mov eax, 0x63
mov word [esp + 0x2fe], ax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x2f4]
mov dword [esp + 0x2f8], 0x770067
push eax
mov dword [esp + 0x30c], 0x780065
call dword [0x100b0ae4]
add esp, 8
movzx ebx, bl
test eax, eax
mov eax, 1
cmove ebx, eax
lea eax, [esp + 0x10]
push eax
push esi
call dword [0x100b0a64]
cmp eax, 1
je 0x10006420
pop edi
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x32c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.100153ee
add esp, 0x328
ret