Function at 0x3bea8c0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [0x3beecb8], 0x3beecb8
mov dword [0x3beecc4], 0x3bea3c0
mov dword [0x3beecc8], 0x3beb8f0
mov dword [0x3beeccc], 0x3bea250
mov dword [0x3bef430], 0
mov dword [0x3bef434], 0
mov dword [0x3bef424], 0
mov dword [0x3bef428], 0
mov dword [0x3bef42c], 0
mov dword [0x3bef438], 0x3bec0a0
mov eax, dword [eax + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
push 0
push 0xbbe11f17
mov esi, dword [eax + 0x18]
call fcn.03be9e50
push 0
push 0x60cf99af
mov dword [0x3bef3a8], eax
call fcn.03be9e50
mov ebx, dword [ebp + 8]
mov edi, eax
push 0
push 0x4dd0a472
test ebx, ebx
mov dword [0x3bef3b0], edi
push edi
cmove ebx, esi
mov esi, dword [0x3bef3a8]
push 0x3bef3a0
call fcn.03be9f20
push 0
push 0xdae698d3
push edi
push 0x3bef3a4
call fcn.03be9f20
push 1
push 0xdd71a6cc
push edi
push 0x3bef35c
call fcn.03be9f20
push 1
push 0x934f10fa
push edi
push 0x3bef360
call fcn.03be9f20
push 1
push 0xe497b485
push edi
push 0x3bef364
call fcn.03be9f20
push 1
push 0x21a37b6c
push edi
push 0x3bef3f8
call fcn.03be9f20
call dword [0x3bef3f8]
push 0x3bec0a0
push 1
mov dword [0x3beecd0], eax
mov dword [0x3beecd4], 1
call dword [0x3bef360]
push 1
push 0x9b30cc3f
push esi
push 0x3bef308
mov dword [0x3bef3b8], eax
call fcn.03be9f20
push 1
push 0xd2e93957
push esi
push 0x3bef30c
call fcn.03be9f20
push 1
push 0x3c1f3d90
push esi
push 0x3bef310
call fcn.03be9f20
push 1
push 0xf75ce257
push esi
push 0x3bef314
call fcn.03be9f20
push 1
push 0xeb426147
push esi
push 0x3bef318
call fcn.03be9f20
push 1
push 0x72f8b38e
push esi
push 0x3bef31c
call fcn.03be9f20
push 1
push 0xb78bdb16
push esi
push 0x3bef320
call fcn.03be9f20
push 1
push 0xd32e9d61
push esi
push 0x3bef324
call fcn.03be9f20
push 1
push 0x4748527b
push esi
push 0x3bef328
call fcn.03be9f20
push 1
push 0x5b8dd581
push esi
push 0x3bef32c
call fcn.03be9f20
push 1
push 0x5dc29570
push esi
push 0x3bef330
call fcn.03be9f20
push 1
push 0x4e62601b
push esi
push 0x3bef300
call fcn.03be9f20
push 1
push 0x27154a05
push esi
push 0x3bef304
call fcn.03be9f20
push 1
push 0x5e4bf6f0
push edi
push 0x3bef350
call fcn.03be9f20
push 1
push 0x5e4bf706
push edi
push 0x3bef354
call fcn.03be9f20
push 1
push 0x1552ae9b
push edi
push 0x3bef358
call fcn.03be9f20
push 1
push 0x376af5b2
push edi
push fcn.03bef334
call fcn.03be9f20
push 1
push 0x1552aeb1
push edi
push 0x3bef338
call fcn.03be9f20
push 1
push 0xd447896e
push edi
push 0x3bef33c
call fcn.03be9f20
push 1
push 0xbed1215b
push edi
push fcn.03bef340
call fcn.03be9f20
push 1
push 0xd8f81d2f
push edi
push 0x3bef344
call fcn.03be9f20
push 1
push 0x4db82756
push edi
push 0x3bef348
call fcn.03be9f20
push 1
push 0x942467dc
push edi
push 0x3bef34c
call fcn.03be9f20
push 1
push 0xe4b23a39
push edi
push 0x3bef368
call fcn.03be9f20
push 1
push 0x4df7d46e
push edi
push fcn.03bef36c
call fcn.03be9f20
push 1
push 0x15ec9667
push edi
push fcn.03bef370
call fcn.03be9f20
push 1
push 0x8b05fb05
push edi
push 0x3bef378
call fcn.03be9f20
push 1
push 0xdf09dc26
push edi
push 0x3bef374
call fcn.03be9f20
push 1
push 0x228333bc
push edi
push 0x3bef388
call fcn.03be9f20
push 1
push 0x4abb6b25
push edi
push 0x3bef38c
call fcn.03be9f20
push 1
push 0xac3a78a9
push edi
push 0x3bef390
call fcn.03be9f20
push 1
push 0x2066074a
push edi
push 0x3bef394
call fcn.03be9f20
push 1
push 0x2b19b2ad
push edi
push 0x3bef398
call fcn.03be9f20
push 1
push 0x6bfaf860
push edi
push 0x3bef39c
call fcn.03be9f20
push 1
push 0x1291cb13
push edi
push 0x3bef3d8
call fcn.03be9f20
push 1
push 0xab10ad07
push edi
push 0x3bef3f0
call fcn.03be9f20
push 1
push 0x4b07dd7e
push edi
push 0x3bef3e0
call fcn.03be9f20
push 1
push 0x96b79b23
push edi
push 0x3bef3ec
call fcn.03be9f20
push 1
push 0x4f75ef12
push edi
push 0x3bef3e4
call fcn.03be9f20
push 1
push 0xf44a4406
push edi
push 0x3bef3e8
call fcn.03be9f20
push 1
push 0xb25b6481
push edi
push 0x3bef3fc
call fcn.03be9f20
push 1
push 0xae980712
push edi
push fcn.03bef408
call fcn.03be9f20
push 1
push 0xf4a11ee3
push edi
push 0x3bef40c
call fcn.03be9f20
push 1
push 0x830c3f86
push edi
push 0x3bef414
call fcn.03be9f20
push 1
push 0x885e90c
push edi
push 0x3bef410
call fcn.03be9f20
push 1
push 0xb3ea952b
push edi
push 0x3bef418
call fcn.03be9f20
mov eax, dword [0x3bef3f0]
xor edx, edx
mov dword [0x3beecb4], eax
mov dword [ebp - 0x10], 0x5e
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x3b
mov byte [ebp - 9], 0x2c
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x70
mov byte [ebp - 5], 0x3a
mov byte [ebp - 4], 0x32
mov byte [ebp - 3], 0x32
mov al, byte [ebp - 0xc]
mov byte [ebp - 2], 0
mov al, byte [ebp + edx - 0xc]
movsx ecx, byte [ebp - 0x10]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0xc], al
inc edx
cmp edx, 0xa
jb 0x3bead80
lea eax, [ebp - 0xc]
mov byte [ebp - 2], 0
push eax
call dword [0x3bef350]
push 1
mov esi, eax
push 0xbc022598
push esi
push 0x3bef37c
mov dword [0x3bef3b4], esi
call fcn.03be9f20
push 1
push 0xcd6a1508
push esi
push 0x3bef384
call fcn.03be9f20
push 1
push 0x81225c79
push esi
push 0x3bef380
call fcn.03be9f20
push 1
push 0xcd6a151e
push esi
push 0x3bef420
call fcn.03be9f20
push 1
push 0x81225c8f
push esi
push 0x3bef41c
call fcn.03be9f20
push 1
push 0x1f2ae094
push esi
push fcn.03bef400
call fcn.03be9f20
push 1
push 0xff9a9fe
push esi
push fcn.03bef404
call fcn.03be9f20
push ebx
mov dword [fcn.03bef43c], 0x3beb1a0
mov dword [0x3bef440], 0x3beb260
mov dword [0x3bef444], 0x3beb300
call fcn.03beb4c0
mov ecx, dword [0x3bf3448]
add esp, 4
cmp ecx, 0xffffffff
je 0x3beb0ac
movzx eax, word [0x3bef552]
mov ecx, 0xc0de
mov word [eax*2 + 0x3bef554], cx
mov ax, word [0x3bef552]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3bef550]
jne 0x3beae9c
mov eax, dword [0x3bef550]
inc eax
and eax, 0x7f
mov word [0x3bef550], ax
push 0xc0de
push 0x3beecb8
mov word [0x3bef552], cx
call dword [fcn.03bef43c]
mov ecx, dword [0x3bf3448]
add esp, 8
cmp ecx, 0xffffffff
je 0x3beb0ac
movzx eax, word [0x3bef552]
mov ecx, 0xcafe
mov word [eax*2 + 0x3bef554], cx
mov ax, word [0x3bef552]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3bef550]
jne 0x3beaf00
mov eax, dword [0x3bef550]
inc eax
and eax, 0x7f
mov word [0x3bef550], ax
push 0xcafe
push 0x3beecb8
mov word [0x3bef552], cx
call dword [fcn.03bef43c]
mov ecx, dword [0x3bf3448]
add esp, 8
cmp ecx, 0xffffffff
je 0x3beb0ac
movzx eax, word [0x3bef552]
mov ecx, 0xbaad
mov word [eax*2 + 0x3bef554], cx
mov ax, word [0x3bef552]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3bef550]
jne 0x3beaf64
mov eax, dword [0x3bef550]
inc eax
and eax, 0x7f
mov word [0x3bef550], ax
push 0xbaad
push 0x3beecb8
mov word [0x3bef552], cx
call dword [fcn.03bef43c]
mov ecx, dword [0x3bf3448]
add esp, 8
cmp ecx, 0xffffffff
je 0x3beb0ac
movzx eax, word [0x3bef552]
mov ecx, 0xface
mov word [eax*2 + 0x3bef554], cx
mov ax, word [0x3bef552]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3bef550]
jne 0x3beafc8
mov eax, dword [0x3bef550]
inc eax
and eax, 0x7f
mov word [0x3bef550], ax
push 0xface
push 0x3beecb8
mov word [0x3bef552], cx
call dword [fcn.03bef43c]
mov ecx, dword [0x3bf3448]
add esp, 8
cmp ecx, 0xffffffff
je 0x3beb0ac
movzx eax, word [0x3bef552]
mov ecx, 0xdead
mov word [eax*2 + 0x3bef554], cx
mov ax, word [0x3bef552]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3bef550]
jne 0x3beb02c
mov eax, dword [0x3bef550]
inc eax
and eax, 0x7f
mov word [0x3bef550], ax
push 0xdead
push 0x3beecb8
mov word [0x3bef552], cx
call dword [fcn.03bef43c]
mov ecx, dword [0x3bf3448]
add esp, 8
cmp ecx, 0xffffffff
je 0x3beb0ac
movzx eax, word [0x3bef552]
mov ecx, 0xbeef
mov word [eax*2 + 0x3bef554], cx
mov ax, word [0x3bef552]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3bef550]
jne 0x3beb08c
mov eax, dword [0x3bef550]
inc eax
and eax, 0x7f
mov word [0x3bef550], ax
push 0xbeef
push 0x3beecb8
mov word [0x3bef552], cx
call dword [fcn.03bef43c]
mov ecx, dword [0x3bf3448]
add esp, 8
mov esi, dword [0x3beecb0]
add esi, ebx
cmp dword [esi + 8], 0x1dfb0
je 0x3beb126
cmp ecx, 0xffffffff
je 0x3beb117
movzx eax, word [0x3bef552]
mov ecx, 0x427
mov word [eax*2 + 0x3bef554], cx
mov ax, word [0x3bef552]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3bef550]
jne 0x3beb0fd
mov eax, dword [0x3bef550]
inc eax
and eax, 0x7f
mov word [0x3bef550], ax
push 0x427
push 0x3beecb8
mov word [0x3bef552], cx
call dword [fcn.03bef43c]
add esp, 8
push 0xe0410009
push 0x3beecb8
call fcn.03bec3c0
xor ecx, ecx
mov eax, 0x3c11404
cmp eax, 0x3bf3454
sbb edx, edx
and edx, 0xfffe2050
add edx, 0x1dfb0
je 0x3beb150
mov al, byte [ecx + esi]
mov byte [ecx + 0x3bf3454], al
inc ecx
cmp ecx, edx
jb 0x3beb142
mov dword [0x3bf3450], esi
mov dword [0x3bef3bc], ebx
mov dword [0x3bef3c4], 0x3bea6b0
mov eax, dword [ebx + 0x3c]
pop edi
pop esi
mov eax, dword [eax + ebx + 0x50]
add eax, ebx
mov dword [0x3bef3c0], eax
mov eax, dword [0x3bf34b0]
and eax, 0x8000
neg eax
pop ebx
sbb eax, eax
and eax, 0x3bec960
mov dword [0x3bef3f4], eax
mov esp, ebp
pop ebp
ret 4