Function at 0x103bed7f
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Write file on windows

Disassembly:
push 0
jmp 0x1043164c
push ecx
movsx cx, bl
mov cx, di
movzx ecx, word [esp + 0x26]
jmp 0x1040c2ab
je 0x103efda0
cmp esi, 0xf
jmp 0x103bd19e
call fcn.10004f40
mov edi, dword [esp + 0x1c]
mov ebx, 1
lea esp, [esp + 8]
cmp sp, 0x6289
stc
mov dword [esp + 0x2c], 0x32
cmp dword [edi - 4], ebx
jle 0x10171087
mov edx, dword [edi - 0xc]
cmovno cx, di
xchg ch, cl
setb ch
push edx
lea ecx, [esp + 0x18]
call fcn.10004e50
mov edi, dword [esp + 0x14]
movzx dx, bh
rdtsc
mov eax, edi
movsx edx, si
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
clc
cmc
test cl, cl
jmp 0x103f0bad
push ecx
movzx ecx, word [esp + 0x26]
push edx
cmovne dx, cx
movzx dx, al
movzx edx, word [esp + 0x28]
jmp 0x10349a2c
call fcn.100609c0
add esp, 0xc
jmp 0x101d40cf
lea eax, [esp + 0x30]
jmp 0x102da676
test edx, edx
jmp 0x1038e1d2
jg 0x1033c399
mov ecx, dword [edi]
mov edx, esi
xchg al, dh
movsx eax, di
mov edx, dword [ecx]
mov ax, 0x2a76
mov eax, dword [edx + 4]
push edi
call eax
jmp 0x1033c399
call fcn.10450919
add esp, 4
clc
test eax, eax
jmp 0x1035f9b1
push eax
jmp 0x10323608
mov byte [esp + 0x23b], 0xac
jmp 0x10316f57
push esi
jmp 0x1044e4e5
mov dword [esp + 0x18], esi
jmp 0x103ca814
push eax
mov al, 0x72
movzx eax, word [esp + 0x28]
jmp 0x102e3ab0
mov edx, 0x25
mov al, 0xec
mov eax, 0x64
cmp si, 0x5fdc
stc
mov word [esp + 0x276], ax
mov word [esp + 0x272], cx
mov ax, sp
mov word [esp + 0x274], dx
mov word [esp + 0x278], cx
rol al, 0
bts ax, sp
mov word [esp + 0x27a], dx
rcl ch, cl
mov eax, 0x30
bts cx, dx
stc
mov ecx, 0x34
bsf dx, bx
jmp 0x103ef88b
push edx
jmp 0x103ad4dc
lock xadd dword [edx], eax
jmp 0x1030a9b6
xor eax, esp
cmc
stc
mov dword [esp + 0x4c0], eax
sar ax, 0xca
push ebx
push esi
or ax, bx
inc bl
ror bl, cl
push edi
sar ax, cl
stc
mov eax, dword [0x10106de0]
shrd ebx, ebp, 0xfd
xor eax, esp
rcl bh, cl
adc bh, 0xc5
push eax
rcr al, cl
btr ebx, 0x1c
lahf
lea eax, [esp + 0x4d8]
mov dword fs:[0], eax
sbb bx, 0x229c
xadd bh, bh
mov ebx, ecx
cmp ebp, 0x146b5fb1
cmc
sub esi, esi
test ebp, 0x5a3a27ba
cmp dword [0x1011b668], esi
jmp 0x1036d082
cmp ebx, 1
jmp 0x103d6547
jle 0x1024a9bf
mov eax, dword [edi - 0xc]
push eax
xchg cx, cx
mov ecx, ebp
lea ecx, [esp + 0x18]
jmp 0x1024a9b4
jbe 0x103efda0
lea edx, [esp + 0x240]
push 0xffffffffffffffff
push edx
not edi
movzx edi, cx
lea edi, [esp + 0x1c]
call fcn.10004f40
add esp, 8
mov esi, edi
jmp 0x10392755
inc eax
cmp edi, ecx
test ax, 0x4a6
test ebp, edi
cmp eax, 0xa
jmp 0x100354c1
inc eax
clc
stc
cmc
test cl, cl
jne 0x1036ca20
sub eax, edx
mov di, bx
movsx edi, si
lea esi, [esp + 0x14]
cmovs di, bp
xchg di, di
mov edi, eax
jmp 0x100277c7
call eax
lea edi, [eax + 0x10]
or al, 0x17
mov dword [esp + 0x14], edi
sub al, 7
xadd cl, cl
jmp 0x10310d9b
mov byte [esp + 0x253], 0
cmc
mov word [esp + 0x284], cx
rcr ax, 0x2b
or ecx, 0x532f7f85
rol ah, 0x91
mov word [esp + 0x286], dx
btc ax, 0x33
mov eax, 0x32
movzx dx, dl
or edx, edi
test al, 4
mov word [esp + 0x288], ax
cmc
bt cx, sp
sar ax, 0xe2
mov ecx, 0x64
xor dl, 0x81
rcl al, cl
mov word [esp + 0x28a], cx
or al, 0x83
btc eax, esi
adc eax, ecx
mov edx, 0x5f
mov word [esp + 0x28c], dx
mov ecx, 0x30
inc dh
mov word [esp + 0x290], cx
sbb ecx, 0x20294e12
mov eax, 0x25
mov word [esp + 0x28e], ax
sbb al, 0x92
not edx
jmp 0x102e94d7
call fcn.10004e50
mov edi, dword [esp + 0x14]
not ecx
push edi
dec cx
jmp 0x103e9ed6
mov word [esp + 0x2c8], dx
jmp 0x102f8fde
call fcn.100120c0
jmp 0x1033c399
call fcn.10450919
add esp, 4
cmp dh, 0x72
test eax, eax
jmp 0x10454f9b
push ecx
call fcn.1005dc8c
lea edx, [esp + 0x244]
add esp, 0xc
push edx
jmp 0x10176920
push ecx
jmp 0x104252c2
test eax, eax
jmp 0x102cefc9
call dword [0x100d3308]
push eax
setnp ch
lea ecx, [esp + 0x270]
setae dl
mov dl, 0xb2
push ecx
jmp 0x1002dd94
jne 0x103e35d9
mov eax, dword [0x1011bd10]
jmp 0x10229137
call fcn.103858b6
add esp, 4
cmovno eax, esi
mov ax, 0x2a06
lea eax, [esp + 0x1c]
jmp 0x1032b240
push ecx
jmp 0x1030ff96
mov edx, 0x32
shl cl, cl
mov word [esp + 0x292], dx
cwd
mov ecx, 0x5f
mov word [esp + 0x296], cx
rdtsc
adc eax, esi
mov eax, 0x64
bsf edx, ecx
mov word [esp + 0x294], ax
mov edx, 0x25
xchg ch, ah
cmp ecx, edx
mov word [esp + 0x298], dx
and dx, 0x268f
seta al
mov ecx, 0x32
mov word [esp + 0x29c], cx
test cx, 0x33fc
rcr ecx, cl
cbw
mov eax, 0x30
mov word [esp + 0x29a], ax
mov edx, 0x64
test bp, cx
mov word [esp + 0x29e], dx
mov ecx, 0x25
cmp ebp, 0x457b6bc7
mov word [esp + 0x2a2], cx
mov eax, 0x5f
or cx, bp
and cx, di
mov word [esp + 0x2a0], ax
movzx edx, si
bsf eax, ebp
mov edx, 0x30
sar ax, 0xb3
mov word [esp + 0x2a4], dx
rol ecx, cl
shl ah, cl
mov ecx, 0x64
ror ax, cl
mov word [esp + 0x2a8], cx
inc ch
mov eax, 0x32
mov word [esp + 0x2a6], ax
and dx, 0x70d2
bsr ecx, edx
mov edx, 0x5f
clc
bts cx, ax
mov word [esp + 0x2aa], dx
cmovae eax, eax
cwd
shrd ax, dx, 0x1b
mov ecx, 0x30
rcr ah, 0x74
and ax, 0x600a
btc edx, ecx
mov word [esp + 0x2ae], cx
bts edx, ebp
lahf
mov eax, 0x25
mov word [esp + 0x2ac], ax
adc ch, dl
mov edx, 0x32
and ah, 0x54
mov word [esp + 0x2b0], dx
clc
sar eax, cl
mov ecx, 0x2e
lahf
rcl ax, cl
or eax, esi
mov edx, 0x74
mov eax, 0x64
test bl, 0xd1
clc
cmc
mov word [esp + 0x2b4], cx
mov cx, bp
mov ecx, 0x762f1c49
mov ecx, edx
cmp bp, 0x4ffd
mov word [esp + 0x2b2], ax
neg ah
mov eax, 0x78
test sp, sp
cmp di, 0x2b0a
test ebp, 0x15955de9
push 0x206
cmp edi, 0x603b3c10
cmc
mov word [esp + 0x2be], cx
mov word [esp + 0x2ba], dx
mov word [esp + 0x2bc], ax
mov cl, 0xdd
stc
lea ecx, [esp + 0x2ca]
cmc
xor edx, edx
sub eax, eax
jmp 0x101c9f8a
mov word [esp + 0x2d0], ax
jmp 0x10176912
mov byte [esp + 0x243], dl
shr cl, cl
mov byte [esp + 0x249], dl
adc cl, 0x87
add al, 0x5e
mov al, 0x65
cmp dx, ax
shr cl, 0x85
rol dl, 0xb1
mov byte [esp + 0x246], al
mov byte [esp + 0x24d], al
mov cl, 0x63
add dx, 0x5420
mov byte [esp + 0x244], cl
mov byte [esp + 0x24a], cl
sal al, 0x57
mov edx, 0x2f
sub cx, si
and eax, 0x74a26942
mov word [esp + 0x256], dx
mov eax, 0x6c
mov word [esp + 0x258], ax
shr ax, cl
mov ecx, 0x2e
not dl
mov word [esp + 0x254], cx
rol dx, cl
rcr ah, cl
mov edx, 0x67
rcl eax, 0x30
cbw
mov word [esp + 0x25c], dx
inc al
add dx, si
mov eax, 0x2f
mov word [esp + 0x25e], ax
rcl dh, cl
shrd ax, sp, 1
mov ecx, 0x6f
mov word [esp + 0x25a], cx
mov al, 0x88
mov edx, 0x69
movzx eax, si
movsx ecx, si
mov word [esp + 0x262], dx
cwde
bt dx, 0x67
xor dx, dx
mov edx, 0x72
ror eax, 0xef
cmc
cmovnp ecx, ebx
mov eax, 0x6e
shr cx, 0xe0
inc cl
shl ch, 0xff
mov word [esp + 0x264], ax
xadd ecx, ecx
jmp 0x10410ca8
mov dword [esp + 0x2c], 0x34
jmp 0x1036ca16
mov edi, eax
jmp 0x104399a5
jne 0x10392765
sub eax, edx
jmp 0x10443fa6
dec eax
cmc
test bx, 0x1b1a
test eax, eax
jmp 0x101afe1e
push edx
push eax
jmp 0x102c36e2
mov dword [esp + 0x4e0], esi
rol dl, 0xd4
mov dl, 0x20
or al, 0xf6
jmp 0x102fa706
mov byte [esp + 0x23c], 0x6e
jmp 0x1031fec7
call dword [0x100d3308]
push eax
call fcn.1005c106
add esp, 4
jmp 0x1043cae5
call fcn.1005add9
mov eax, dword [esp + 0x4c]
test dh, bh
clc
lea esp, [esp + 0x34]
stc
cmp edi, 0x38d675ff
cmc
test eax, eax
jmp 0x103dc6a5
call fcn.1005bada
push 0x100fa68c
cwd
mov edx, ebx
lea edx, [esp + 0x2f0]
movzx eax, dx
not ax
push edx
movsx ax, dl
lea eax, [esp + 0x48]
jmp 0x101b898b
cmp ebx, 0xffffffff
jmp 0x104073c2
push eax
call 0x10368c16
movzx ecx, word [esp + 0x28]
movzx edx, word [esp + 0x26]
bswap eax
movzx eax, word [esp + 0x24]
jmp 0x10123781
push ecx
push edx
jmp 0x1044e16f
call edx
mov ecx, dword [esp + 0x4d8]
movzx esi, si
sal esi, 0xfc
cmp edx, ebx
mov dword fs:[0], ecx
movsx esi, dx
jmp 0x104145b2
lea ecx, [esp + 0x240]
not di
push 0
movzx edi, ax
jmp 0x103a0304
push eax
jmp 0x1033911c
push eax
jmp 0x10008376
jne 0x103c3719
call fcn.103fa533
mov ebx, eax
call fcn.1012a6b5
test al, al
jmp 0x1016a2aa
call fcn.10036e80
lea edx, [eax + 1]
not cl
mov cl, byte [eax]
jmp 0x102379d1
je 0x1033c399
call fcn.10052b32
xor ecx, ecx
sar cl, cl
cmp eax, esi
not cl
setne cl
cmp ecx, edx
cmp bh, 0x83
cmp ecx, esi
jmp 0x1042855a
call fcn.1005a469
mov esp, ebp
movsx ebp, dx
pop ebp
ret
call fcn.10005010
mov edx, dword [eax]
setle cl
bswap ecx
mov ecx, eax
mov eax, dword [edx + 0xc]
jmp 0x10240158
push 0x204
jmp 0x102828eb
call 0x103d820f
movzx eax, word [esp + 0x28]
not edx
mov cl, bh
movsx cx, al
movzx ecx, word [esp + 0x26]
cmovs edx, esp
jmp 0x103e130e
jg 0x1033c399
mov ecx, dword [edi]
cwd
rdtsc
cdq
mov eax, dword [ecx]
cwd
bswap dx
jmp 0x103f6648
mov dword [esp + 0x2c], 0x35
call fcn.10036e80
lea edx, [eax + 1]
mov cl, byte [eax]
jmp 0x10424fa2
jne 0x10209521
push 0xdeadcd00
call fcn.10450919
lea esp, [esp + 4]
test eax, eax
jmp 0x103e35d3
push ecx
movzx edi, bx
lea edi, [esp + 0x1c]
jmp 0x1017103e
push edi
jmp 0x1042df1a
call fcn.1005c4f9
mov eax, dword [esp + 0x2c]
cmc
add esp, 0x14
jmp 0x1035b28a
cmp ebx, 2
jmp 0x103bbf8f
jne 0x1032a07f
push 0xdeadcd02
jmp 0x10262925
jge 0x103efda0
cmp ebx, 0xa
jmp 0x102153fa
push ebp
sub ax, si
shrd ax, bp, 0xd6
lahf
mov ebp, esp
btr eax, ebx
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100cf9db
cwde
ror ah, 0x85
mov eax, dword fs:[0]
cmp edx, edi
push eax
btc eax, 0xa8
sub esp, 0x4c8
bts ax, cx
ror ah, 0xdc
sar eax, cl
mov eax, dword [0x10106de0]
cmp di, 0x85
jmp 0x102015f7
call fcn.1005dc8c
lea ecx, [esp + 0x244]
rcl ax, 0xa7
xor ah, 0x2b
xadd ah, ah
add esp, 0xc
lahf
movsx eax, cx
push ecx
setbe al
mov eax, ecx
bswap ax
lea eax, [esp + 0x30]
call fcn.103858b6
add esp, 4
cdq
bswap dx
lea edx, [esp + 0x1c]
jmp 0x103f80dc
lea ecx, [esp + 0x14]
jmp 0x1025e047
mov byte [esp + 0x238], 0x44
mov byte [esp + 0x239], 0x2d
mov byte [esp + 0x23a], 0x97
jmp 0x101c4320
jne 0x103b36b0
push 0xdeadcd01
call fcn.10450919
lea esp, [esp + 4]
jmp 0x10297ee7
je 0x1000837e
push eax
seto ch
push 1
not cl
lea ecx, [esp + 0x34]
jmp 0x1038be7f
movzx edx, word [esp + 0x24]
push eax
movzx eax, word [esp + 0x26]
jmp 0x10172824
je 0x10346833
add edi, 0xfffffff0
cmp ebp, 0x5b0e4731
xadd dh, dh
add dx, bp
mov dword [esp + 0x4e0], 0xffffffff
btr dx, 0xed
lea edx, [edi + 0xc]
cmc
cmp ebx, ebp
test ecx, edi
or eax, 0xffffffff
jmp 0x101ee68d
inc esi
xchg cl, ch
lea ecx, [esp + 0x34]
jmp 0x10405b48
mov edx, 0x64
cmp ebx, edi
mov word [esp + 0x27c], ax
rol eax, cl
ror al, cl
mov eax, 0x5f
cmp ebp, 0x13c95851
mov word [esp + 0x27e], cx
rcl cl, 0xb4
mov word [esp + 0x280], dx
mov ecx, 0x25
rcl edx, cl
mov edx, 0x30
cmp eax, 0x306a5fe6
cmp al, cl
test edi, 0x20867746
mov word [esp + 0x282], ax
mov byte [esp + 0x240], 0x42
and ax, ax
bt eax, 0xf0
mov byte [esp + 0x241], 0x61
bsf ax, cx
mov byte [esp + 0x242], 0x64
mov byte [esp + 0x245], 0x68
mov byte [esp + 0x247], 0x61
mov ah, dh
dec ax
mov byte [esp + 0x248], 0x74
rcl ax, 0x8f
mov byte [esp + 0x24b], 0x6f
adc eax, edi
shr ax, cl
mov byte [esp + 0x24c], 0x64
mov ax, si
shr ah, cl
mov byte [esp + 0x24e], 0x3a
mov byte [esp + 0x24f], 0x25
mov byte [esp + 0x250], 0x30
adc ax, bp
mov byte [esp + 0x251], 0x38
neg eax
mov ah, 0x89
nop
mov byte [esp + 0x252], 0x58
jmp 0x102430b6
lea edi, [edi - 0x10]
not cx
mov dword [esp + 0x4e0], 0xffffffff
clc
bt ecx, 0xa1
lea ecx, [edi + 0xc]
cmp edi, 0x970013
test bp, 0x1e1f
or edx, 0xffffffff
test ecx, 0x41c76200
lock xadd dword [ecx], edx
jmp 0x10452745
jne 0x1017108f
sub eax, edx
mov si, 0x2fb4
cmp dword [edi - 4], ebx
mov esi, eax
jmp 0x1020c882
mov edx, dword [eax + 4]
push edi
jmp 0x1033c397
push edx
jmp 0x1038cc29
push ecx
jmp 0x10327e9b
push esi
jmp 0x10266127
jne 0x103efda0
push 0xdeadcd03
jmp 0x101b4519
push edx
movzx edx, word [esp + 0x26]
jmp 0x101d555b
mov eax, edx
cmp ah, 0x4a
mov ecx, 0x4c
mov word [esp + 0x260], cx
mov word [esp + 0x26a], ax
mov ecx, 0x45
xadd ax, ax
or ax, 0x45a9
shl ax, 0x79
mov word [esp + 0x266], cx
mov eax, 0x58
or cx, 0x7533
inc ecx
add ch, 0xf0
mov word [esp + 0x270], ax
rol cl, cl
not cl
mov ecx, 0x6f
mov word [esp + 0x268], dx
mov word [esp + 0x26c], cx
mov word [esp + 0x26e], dx
rcr ecx, 0x8a
btr ax, bp
mov ecx, 0x5f
jmp 0x101d7b56
pop ecx
sets bl
pop edi
pop esi
pop ebx
sbb ch, 7
mov ecx, dword [esp + 0x4c0]
cmp edx, edi
cmc
xor ecx, esp
jmp 0x10370d9a
inc eax
test bh, 0xc2
stc
cmp di, 0x6bd2
test cl, cl
jmp 0x1030a8fc
call fcn.1005c2ed
mov edx, dword [esp + 0x28]
jmp 0x101d9364
jne 0x103864fa
push 0x80004005
jmp 0x103864f5
push eax
jmp 0x103c14bd
call fcn.10036e80
push eax
lahf
mov ax, cx
inc edi
lea eax, [esp + 0x34]
jmp 0x103a16fe
call fcn.1005c118
cdq
and ecx, 0x63f23c0d
mov ecx, ecx
mov ecx, 0x64
xadd si, si
inc si
idiv ecx
mov esi, edx
inc esi
test ebx, ebx
jmp 0x1039ab0d
lea esi, [esp + 0x14]
movzx edi, si
jmp 0x102fe3dd
call dword [0x100d3308]
push eax
movzx cx, ah
bswap ecx
movsx ax, ah
lea eax, [esp + 0x270]
xchg ch, cl
cmovle ecx, ebp
push eax
not ecx
cmovge ecx, ecx
movzx ecx, bx
lea ecx, [esp + 0x2e4]
push 0x104
jmp 0x103ff639
push ecx
jmp 0x1024b91d
dec edx
jmp 0x1019da42
jne 0x103c3719
lea eax, [esp + 0x240]
push ebx
bswap edi
xchg di, di
cmovne di, ax
push eax
mov edi, 0x31a75436
not edi
lea edi, [esp + 0x1c]
call fcn.10004f40
add esp, 8
cmovp esi, eax
mov esi, edi
jmp 0x102fb34d