Function at 0x30dd670
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov esi, dword [esp + 0xac]
mov dword [esp + 0x94], ecx
add esi, dword [ecx + 0x60]
mov dword [esp + 0x60], 0x57acae83
mov dword [esp + 0x64], 0xea52aba1
mov dword [esp + 0x68], 0xae5a50bc
mov dword [esp + 0x6c], 0x5bafed96
mov dword [esp + 0x70], 0x9b919064
mov dword [esp + 0x74], 0x63989099
mov dword [esp + 0x78], 0x94d761d7
mov dword [esp + 0x7c], 0x9c9b979e
mov dword [esp + 0x80], 0xeee8ec74
mov word [esp + 0x84], 0xe5ee
mov dword [esp + 0x86], 0
mov word [esp + 0x8a], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x2b
ja 0x30dd73b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
movzx eax, byte [esp + eax + 0x60]
push dword [esp + 0xc]
push eax
call fcn.030de3b0
add esp, 8
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x60], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x2c
jb 0x30dd710
mov dword [esp + 4], 0xe9e49882
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 7
ja 0x30dd78b
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0xc]
push eax
call fcn.030de330
add esp, 8
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 4], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 8
jb 0x30dd760
mov dword [esp + 0xc], 0xaaa89495
mov dword [esp + 0x10], 0xa6a69884
mov dword [esp + 0x14], 0xa3d6d895
mov dword [esp + 0x18], 0x9ee3a2d7
mov dword [esp + 0x1c], 0xae9befee
mov dword [esp + 0x20], 0xe0b54341
mov dword [esp + 0x24], 0xe593e5e2
mov dword [esp + 0x28], 0xf2aea8e0
mov dword [esp + 0x2c], 0xf8fdf9ff
mov dword [esp + 0x30], 0xf0fbf9f5
mov dword [esp + 0x34], 0xfd46aff2
mov dword [esp + 0x38], 0xc687f3f7
mov dword [esp + 0x3c], 0xfe8af8fc
mov dword [esp + 0x40], 0xf2803dd3
mov dword [esp + 0x44], 0x31dbf48d
mov dword [esp + 0x48], 0xee968c8e
mov dword [esp + 0x4c], 0x952ec62e
mov dword [esp + 0x50], 0x91e79195
mov dword [esp + 0x54], 0xcae39ce1
mov word [esp + 0x58], 0x522
mov dword [esp + 0x5a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x51
ja 0x30dd876
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0xc]
push dword [esp]
push eax
call fcn.030de2b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x52
jb 0x30dd850
mov eax, dword [esp + 0xb0]
movzx ecx, byte [esp + 0xc]
mov ebx, esi
test cl, cl
je 0x30dd89b
lea edx, [esp + 0xd]
mov ebx, esi
nop
nop
mov byte [ebx], cl
inc ebx
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x30dd890
mov byte [ebx], 0
movzx ecx, byte [eax]
test cl, cl
je 0x30dd8bb
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], cl
inc ebx
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x30dd8b0
mov byte [ebx], 0
movzx eax, byte [esp + 4]
test al, al
mov dword [esp + 0x90], esi
je 0x30dd8eb
lea ecx, [esp + 5]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x30dd8e0
mov ebp, dword [esp + 0xb8]
mov esi, dword [esp + 0xb4]
mov byte [ebx], 0
movzx eax, byte [esp + 0x60]
test al, al
je 0x30dd91b
lea ecx, [esp + 0x61]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x30dd910
mov byte [ebx], 0
mov ecx, ebp
shr ecx, 2
mov eax, esi
mov edi, ebx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebp
and edx, 0xfffffffc
lea eax, [ebx + edx]
add edx, esi
mov ecx, ebp
and ecx, 3
mov esi, ecx
not esi
or esi, 1
add esi, ecx
shr ecx, 1
mov ebp, edx
mov edi, eax
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov edi, esi
inc edi
je 0x30dd9fd
mov ecx, dword [esp + 0xb8]
and ecx, 2
add edx, ecx
add eax, ecx
mov ebp, edi
and ebp, 7
je 0x30dd99b
mov dword [esp + 0x8c], edi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + edi]
mov byte [eax + edi], cl
inc edi
cmp ebp, edi
jne 0x30dd980
add edx, edi
add eax, edi
mov ecx, dword [esp + 0x8c]
sub ecx, edi
mov edi, ecx
cmp esi, 7
jb 0x30dd9fd
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
movzx ecx, byte [edx + esi + 1]
mov byte [eax + esi + 1], cl
movzx ecx, byte [edx + esi + 2]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edx + esi + 3]
mov byte [eax + esi + 3], cl
movzx ecx, byte [edx + esi + 4]
mov byte [eax + esi + 4], cl
movzx ecx, byte [edx + esi + 5]
mov byte [eax + esi + 5], cl
movzx ecx, byte [edx + esi + 6]
mov byte [eax + esi + 6], cl
movzx ecx, byte [edx + esi + 7]
mov byte [eax + esi + 7], cl
add esi, 8
cmp edi, esi
jne 0x30dd9b0
mov dword [esp + 0xc], 0x32331715
mov dword [esp + 0x10], 0x364a686a
mov dword [esp + 0x14], 0x7e336464
mov dword [esp + 0x18], 0x7c696174
mov dword [esp + 0x1c], 0x69687c61
mov dword [esp + 0x20], 0xd0f2c79
mov word [esp + 0x24], 0xf0d
mov byte [esp + 0x26], 0x16
mov dword [esp + 0x27], 0
mov byte [esp + 0x2b], 0
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0x60]
cmp eax, 0x1f
ja 0x30dda8b
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x60]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x60]
push eax
call fcn.030de420
add esp, 8
mov ecx, dword [esp + 0x60]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x60]
mov eax, dword [esp + 0x60]
cmp eax, 0x20
jb 0x30dda60
add ebx, dword [esp + 0xb8]
movzx eax, byte [esp + 0xc]
test al, al
mov edx, dword [esp + 0x90]
je 0x30ddabb
lea ecx, [esp + 0xd]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x30ddab0
mov byte [ebx], 0
mov eax, ebx
xor eax, edx
not edx
and edx, ebx
add edx, edx
sub edx, eax
mov eax, dword [esp + 0x94]
add dword [eax + 0x60], edx
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret 0x10