Function at 0x100033f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019710
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x10023018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov bl, 0x2e
lea eax, [ebp - 0x18]
push eax
mov word [ebp - 0x18], 0x6263
mov byte [ebp - 0x16], bl
mov dword [ebp - 0x15], 0x6d6263
call esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
mov byte [ebp - 0x12], cl
test eax, eax
je 0x10003426
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea edi, [eax + 0x1000]
mov dword [ebp - 0x9c], edi
mov edi, edi
push 0x1c
lea ecx, [ebp - 0xc0]
push ecx
push edi
call esi
test eax, eax
je 0x10003460
mov ebx, dword [ebp - 0xb4]
add ebx, 0x1000
mov ecx, 0x95
xor eax, eax
mov dl, byte [eax + 0x1001c364]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x48], dl
jns 0x100034a0
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x20
jl 0x10003483
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x48]
push eax
mov eax, ebx
mov byte [ebp - 0x28], 0
call fcn.10003310
add esp, 4
add eax, 0x10
mov dword [ebp - 0xa0], eax
je 0x100034d2
mov ecx, dword [eax + 1]
mov dword [ebp - 0xa0], ecx
mov ecx, 0xbe
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x1001c388]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x98], dl
jns 0x10003500
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x4d
jl 0x100034e0
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
push eax
mov eax, ebx
mov byte [ebp - 0x4b], 0
call fcn.10003310
add esp, 4
add eax, 6
mov dword [ebp - 0xa4], eax
je 0x10003535
mov ecx, dword [eax + 1]
mov dword [ebp - 0xa4], ecx
mov ecx, 0x48
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + str.js]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x48], dl
jns 0x1000355d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x20
jl 0x10003540
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x48]
push eax
mov eax, ebx
mov byte [ebp - 0x28], 0
call fcn.10003310
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, 0xdf
xor eax, eax
mov dl, byte [eax + 0x1001c3fc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x100035a2
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10003585
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x38]
push eax
mov eax, ebx
mov byte [ebp - 0x2a], 0
call fcn.10003310
mov edi, eax
add esp, 4
test edi, edi
je 0x100035f4
cmp edi, 0x1000
jbe 0x100035f2
mov edi, edi
dec eax
cmp byte [eax], 0x55
jne 0x100035d0
cmp byte [eax + 1], 0x8b
jne 0x100035d0
cmp byte [eax + 2], 0xec
jne 0x100035d0
cmp byte [eax + 3], 0x6a
jne 0x100035d0
cmp byte [eax + 4], 0xff
jne 0x100035d0
mov edi, eax
jmp 0x100035f4
xor edi, edi
mov ecx, 0xb
xor eax, eax
jmp 0x10003600
mov dl, byte [eax + str.35_9:0T3_w6_9]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x3c], dl
jns 0x1000361d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10003600
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x3c]
push eax
mov eax, ebx
mov byte [ebp - 0x2b], 0
call fcn.10003310
mov esi, eax
add esp, 4
test esi, esi
je 0x10003674
cmp esi, 0x1000
jbe 0x10003672
lea esp, [esp]
dec eax
cmp byte [eax], 0x55
jne 0x10003650
cmp byte [eax + 1], 0x8b
jne 0x10003650
cmp byte [eax + 2], 0xec
jne 0x10003650
cmp byte [eax + 3], 0x6a
jne 0x10003650
cmp byte [eax + 4], 0xff
jne 0x10003650
mov esi, eax
jmp 0x10003674
xor esi, esi
mov ecx, 0x29
xor eax, eax
jmp 0x10003680
mov dl, byte [eax + 0x1001c420]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x3c], dl
jns 0x1000369d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10003680
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x3c]
push eax
mov eax, ebx
mov byte [ebp - 0x2b], 0
call fcn.10003310
add esp, 4
mov dword [ebp - 0x9c], eax
mov ecx, 0x48
xor eax, eax
jmp 0x100036d0
mov dl, byte [eax + str._v___]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x100036ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x100036d0
mov byte [ebp - 0x2b], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
mov ecx, dword [0x1011f940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push edx
lea edx, [ebp - 0x38]
push edx
call eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x1c], 0x63656843
mov dword [ebp - 0x18], 0x3162436b
mov byte [ebp - 0x14], al
mov dword [ebp - 4], 1
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push edi
lea eax, [ebp - 0x1c]
push eax
call edx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], al
mov dword [ebp - 0x30], 0x63656843
mov dword [ebp - 0x2c], 0x3262436b
mov byte [ebp - 0x28], al
mov dword [ebp - 4], 2
mov ecx, dword [0x1011f940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push esi
lea edx, [ebp - 0x30]
push edx
call eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], al
mov ecx, 0x28
mov dl, byte [eax + 0x1001c444]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x20], dl
jns 0x100037ae
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10003791
mov byte [ebp - 0x14], 0
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 4], 3
mov ecx, dword [0x1011f940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push edx
lea edx, [ebp - 0x20]
push edx
call eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], al
mov ecx, 0x6d
lea ebx, [ebx]
mov dl, byte [eax + 0x1001c454]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x1000380d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x100037f0
mov byte [ebp - 0x29], 0
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 4], 4
mov ecx, dword [0x1011f940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push edx
lea edx, [ebp - 0x38]
push edx
call eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov ecx, 0xdd
lea esp, [esp]
mov dl, byte [eax + 0x1001c464]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000386d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x12
jl 0x10003850
mov byte [ebp - 0x12], 0
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 4], 5
mov ecx, dword [0x1011f940]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push edx
lea edx, [ebp - 0x24]
push edx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017c55
mov esp, ebp
pop ebp
ret