Function at 0x1003b2c0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [esp + 0x46], 0x6152616d
mov dword [esp + 0x59], 0x6152616d
mov dword [esp + 0x3a], 0x44746547
mov dword [esp + 0x3e], 0x63697665
mov dword [esp + 0x42], 0x6d614765
mov dword [esp + 0x49], 0x706d61
mov dword [esp + 0x4d], 0x44746553
mov dword [esp + 0x51], 0x63697665
mov dword [esp + 0x55], 0x6d614765
mov dword [esp + 0x5c], 0x706d61
cmp edx, eax
je 0x1003b328
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x34]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, edx
mov ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 4
mov dword [esp], edx
call ebp
sub esp, 0x10
test eax, eax
je 0x1003b31b
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], str.gdi32.dll
call esi
mov edx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
lea ecx, [esp + 0x3a]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x10], edx
call edx
sub esp, 8
mov dword [esp + 0x14], eax
mov dword [esp], str.gdi32.dll
call esi
sub esp, 4
lea ecx, [esp + 0x4d]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edx
sub esp, 8
mov esi, eax
lea eax, [edi + 0x1000]
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ebp
jmp 0x1003b3cf
mov eax, dword [ebx]
cmp esi, eax
je 0x1003b430
add ebx, 4
cmp dword [esp + 0x10], ebx
je 0x1003b3d7
test edi, edi
jne 0x1003b410
test esi, esi
jne 0x1003b3c0
lea eax, [esp + 0x34]
mov edi, dword [esp + 0x18]
mov dword [esp + 4], 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x1c]
mov dword [esp], edi
mov dword [esp + 8], eax
call ebp
sub esp, 0x10
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
cmp eax, edi
je 0x1003b710
test esi, esi
jne 0x1003b3c2
add ebx, 4
xor esi, esi
cmp dword [esp + 0x10], ebx
jne 0x1003b410
jmp 0x1003b3d7
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._HookEntryHook
mov dword [ebx], sym._wglSetDeviceGammaRamp3DFX_8
mov dword [esp + 4], 0x10052953
mov dword [esp], 0x10052955
call sym._fopen
mov dword [esp + 4], str...hooked__s
mov ebp, eax
lea eax, [esp + 0x4d]
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym._fprintf_1
mov dword [esp], ebp
mov esi, eax
call sym._fclose
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ebp, [esi + 1]
mov dword [esp + 0x14], eax
test ebp, 7
je 0x1003b740
call eax
mov edx, ebp
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
sar edx, 3
lea edx, [edx*8 + 8]
mov dword [esp + 8], edx
mov dword [esp + 0x24], eax
call eax
sub esp, 0xc
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x4d]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 8], ecx
mov dword [esp + 4], str...hooked__s
mov dword [esp + 0x2c], eax
call eax
mov eax, ebp
sar eax, 2
test ebp, 3
je 0x1003b781
add eax, 1
lea edx, [eax*4]
mov ecx, dword [0x100899bc]
mov ecx, dword [ecx]
add eax, ecx
mov esi, eax
and esi, 1
cmp esi, 1
mov esi, dword [0x100899bc]
sbb eax, 0xffffffff
mov dword [esi], eax
mov eax, dword [0x100899bc]
mov esi, dword [0x100899c4]
mov dword [esp + 8], edx
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sym._memcpy
mov eax, dword [esi]
mov dword [esi + 0x14], ebp
mov ebp, dword [esp + 0x20]
mov dword [esi + 4], 0x824b
mov dword [esi + 8], 0x8251
mov dword [esi + 0xc], 0x9148
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x18], ebp
mov dword [eax], 0x18c
mov eax, dword [esp + 0x14]
call eax
mov dword [esp + 8], ebp
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 4], 0
mov dword [esp + 0x28], eax
call eax
sub esp, 0xc
test edi, edi
je 0x1003b3d7
mov eax, dword [esp + 0x10]
add ebx, 4
cmp ebx, eax
je 0x1003b3d7
xor esi, esi
cmp edi, dword [ebx]
jne 0x1003b41e
lea esi, [esi]
nop
mov dword [esp + 4], edi
mov dword [esp], ebx
call sym._HookEntryHook
mov dword [ebx], sym._wglGetDeviceGammaRamp3DFX_8
mov dword [esp + 4], 0x10052953
mov dword [esp], 0x10052955
call sym._fopen
mov dword [esp + 4], str...hooked__s
mov ebp, eax
lea eax, [esp + 0x3a]
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym._fprintf_1
mov dword [esp], ebp
mov edi, eax
call sym._fclose
lea ebp, [edi + 1]
mov eax, dword [esp + 0x14]
test ebp, 7
je 0x1003b790
call eax
mov edx, ebp
mov dword [esp + 4], 0
sar edx, 3
mov dword [esp], eax
mov eax, dword [esp + 0x24]
lea edx, [edx*8 + 8]
mov dword [esp + 8], edx
call eax
sub esp, 0xc
lea ecx, [esp + 0x3a]
mov dword [esp + 0x20], eax
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], ecx
mov dword [esp + 4], str...hooked__s
call eax
mov eax, ebp
sar eax, 2
test ebp, 3
je 0x1003b7c7
add eax, 1
lea edx, [eax*4]
mov ecx, dword [0x100899bc]
mov ecx, dword [ecx]
add eax, ecx
mov edi, eax
and edi, 1
cmp edi, 1
mov edi, dword [0x100899bc]
sbb eax, 0xffffffff
mov dword [edi], eax
mov eax, dword [0x100899bc]
mov edi, dword [0x100899c4]
mov dword [esp + 8], edx
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sym._memcpy
mov eax, dword [edi]
mov dword [edi + 0x14], ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 4], 0x824b
mov dword [edi + 8], 0x8251
mov dword [edi + 0xc], 0x9148
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x18], ebp
mov dword [eax], 0x18c
mov eax, dword [esp + 0x14]
call eax
mov dword [esp + 8], ebp
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0
call eax
sub esp, 0xc
test esi, esi
je 0x1003b3d7
mov eax, dword [ebx]
xor edi, edi
jmp 0x1003b3c2
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x24], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 0x2c], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x28], eax
jmp 0x1003b5b0
call eax
mov dword [esp + 8], ebp
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 4], 0
mov dword [esp + 0x24], eax
call eax
sub esp, 0xc
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x4d]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 8], ecx
mov dword [esp + 4], str...hooked__s
mov dword [esp + 0x2c], eax
call eax
mov eax, ebp
mov edx, ebp
sar eax, 2
jmp 0x1003b4fa
call eax
mov dword [esp + 8], ebp
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], 0
call eax
sub esp, 0xc
lea ecx, [esp + 0x3a]
mov dword [esp + 0x20], eax
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], ecx
mov dword [esp + 4], str...hooked__s
call eax
mov eax, ebp
mov edx, ebp
sar eax, 2
jmp 0x1003b66b