Function at 0x1004cde0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x10070264]
xor eax, esp
mov dword [esp + 0x30], eax
mov dword [esp], ecx
mov eax, 0x474a3662
lea ebp, [esp + 0x10]
lea esi, [esp + 0x20]
jmp 0x1004ce10
mov eax, 0x4e9681cd
nop dword [eax]
cmp eax, 0xd2854149
jle 0x1004ce90
cmp eax, 0x20891ffc
jle 0x1004ced0
cmp eax, 0x4c736de7
jle 0x1004cf6b
cmp eax, 0x4e9681cd
je 0x1004d04e
cmp eax, 0x76c98380
jne 0x1004d11d
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov word [esp + 0x1c], 0x41
mov dword [esp + 0x18], 0x6f735d73
mov dword [esp + 0x14], 0x62777364
mov dword [esp + 0x10], 0x55717344
mov eax, dword [esp]
push ebp
call fcn.1004a030
mov eax, 0xd46d052c
mov dword [esp + 4], edi
test edi, edi
je 0x1004ce10
mov eax, 0x84651951
jmp 0x1004ce10
cmp eax, 0xb9526a06
jg 0x1004cf40
cmp eax, 0xae307ae5
jg 0x1004cfb1
cmp eax, 0x84651951
je 0x1004d091
cmp eax, 0xaa84b1cd
jne 0x1004ce10
mov eax, 0xba9d1a1b
jmp 0x1004ce10
cmp eax, 0xf3f14a0d
jg 0x1004d00c
cmp eax, 0xd285414a
je 0x1004d0aa
cmp eax, 0xd46d052c
jne 0x1004ce10
mov ecx, ebx
mov ebx, esi
mov esi, ebp
mov eax, dword [0x10070bb8]
lea edx, [eax + 1]
imul edx, eax
mov ebp, edx
xor ebp, 0xfffffffe
mov eax, 0xc3f171fd
mov edi, 0xb3e0de45
test ebp, edx
sete dl
je 0x1004cf1d
mov edi, 0xc3f171fd
cmp dword [0x10070bbc], 0xa
cmovl eax, edi
setl dh
xor dl, dh
mov edx, 0xb3e0de45
cmovne eax, edx
mov ebp, esi
mov esi, ebx
mov ebx, ecx
jmp 0x1004ce10
cmp eax, 0xc10b8da2
jg 0x1004d02c
cmp eax, 0xb9526a07
je 0x1004d0ed
cmp eax, 0xba9d1a1b
jne 0x1004ce10
mov eax, 0xf3f14a0e
jmp 0x1004ce10
cmp eax, 0x20891ffd
je 0x1004d0fb
cmp eax, 0x474a3662
jne 0x1004ce10
mov byte [esp + 0x2c], 0
mov dword [esp + 0x28], 0x7a7a7238
mov dword [esp + 0x24], 0x24257f66
mov dword [esp + 0x20], 0x77607257
mov eax, dword [esp]
push esi
call fcn.1004a030
mov eax, 0x76c98380
jmp 0x1004ce10
cmp eax, 0xae307ae6
je 0x1004d105
cmp eax, 0xb3e0de45
jne 0x1004ce10
mov eax, dword [0x10070bb8]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
mov ecx, 0xae307ae6
mov eax, 0xc3f171fd
mov edi, 0xae307ae6
cmp edx, 0xffffffff
sete dl
je 0x1004cff3
mov edi, 0xc3f171fd
cmp dword [0x10070bbc], 0xa
setl dh
cmovl eax, edi
xor dl, dh
cmovne eax, ecx
xor ebx, ebx
jmp 0x1004ce10
cmp eax, 0xf3f14a0e
je 0x1004d10f
cmp eax, 0x390d1b8
jne 0x1004ce10
mov eax, 0xba9d1a1b
jmp 0x1004ce10
cmp eax, 0xc10b8da3
je 0x1004ce04
cmp eax, 0xc3f171fd
jne 0x1004ce10
mov eax, 0xb3e0de45
xor ebx, ebx
jmp 0x1004ce10
mov eax, dword [0x10070bb8]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
mov ecx, 0xaa84b1cd
mov eax, 0xc10b8da3
mov edi, 0xaa84b1cd
cmp edx, 0xffffffff
sete dl
je 0x1004d07a
mov edi, 0xc10b8da3
cmp dword [0x10070bbc], 0xa
cmovl eax, edi
setl dh
xor dh, dl
cmovne eax, ecx
jmp 0x1004ce10
push ebp
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 8], eax
mov eax, 0xb9526a07
jmp 0x1004ce10
mov eax, dword [0x10070bb8]
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
mov ecx, 0x4e9681cd
mov eax, 0xc10b8da3
mov edi, 0x4e9681cd
cmp edx, 0xffffffff
sete dl
je 0x1004d0d6
mov edi, 0xc10b8da3
cmp dword [0x10070bbc], 0xa
cmovl eax, edi
setl dh
xor dl, dh
cmovne eax, ecx
jmp 0x1004ce10
mov eax, 0x390d1b8
mov ebx, dword [esp + 8]
jmp 0x1004ce10
mov eax, 0xd285414a
jmp 0x1004ce10
mov eax, 0x20891ffd
jmp 0x1004ce10
mov dword [esp + 0xc], ebx
mov eax, 0x4c736de8
jmp 0x1004ce10
cmp eax, 0x4c736de8
jne 0x1004ce10
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1005429d
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret