Function at 0x10002ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x30
mov eax, 0x100399b6
call fcn.10039131
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor ebx, ebx
push 0x1003d65f
mov dword [ebp - 0x3c], ebx
call fcn.1000409e
mov dword [ebp - 4], ebx
mov esi, dword [0x100500a0]
test esi, esi
je case.0x10002ab9.113
cmp byte [0x100500bb], bl
je 0x10002aa2
mov ecx, 0x10b8134
call fcn.1000b9e3
mov ebx, eax
test ebx, ebx
je 0x10002aa0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002aa0
push 4
add ebx, 0x6e4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002aa0
mov ax, word [ebx]
mov word [esi + 0x3e], ax
xor ebx, ebx
movzx eax, word [esi + 0x3e]
add eax, 0xffffff9b
cmp eax, 0x6f
ja case.0x10002ab9.113
movzx eax, byte [eax + 0x10002c9b]
jmp dword [eax*4 + 0x10002c77]
mov cl, 0x54
mov dword [ebp - 0x38], 0x65646554
mov dword [ebp - 0x34], 0x26352379
mov eax, ebx
mov dword [ebp - 0x30], 0x263b3d26
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10002aeb
mov cl, byte [ebp - 0x38]
jmp 0x10002adc
mov byte [ebp - 0x2c], bl
jmp 0x10002c33
mov cl, 0x65
mov dword [ebp - 0x38], 0x57555465
mov dword [ebp - 0x34], 0x20a1748
mov eax, ebx
mov word [ebp - 0x30], 0x10
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10002b1d
mov cl, byte [ebp - 0x38]
jmp 0x10002b0e
mov byte [ebp - 0x2e], bl
jmp 0x10002c33
mov cl, 0x4f
mov dword [ebp - 0x38], 0x7c7f7e4f
mov dword [ebp - 0x34], 0x282e2262
mov eax, ebx
mov word [ebp - 0x30], 0x2a
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10002b4c
mov cl, byte [ebp - 0x38]
jmp 0x10002b3d
mov byte [ebp - 0x2f], bl
jmp 0x10002c33
mov cl, 0x46
mov dword [ebp - 0x38], 0x72767746
mov dword [ebp - 0x34], 0x2f34366b
mov eax, ebx
mov dword [ebp - 0x30], 0x323523
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xa
jae 0x10002c30
mov cl, byte [ebp - 0x38]
jmp 0x10002b6d
mov cl, 0x21
mov dword [ebp - 0x38], 0x10111321
mov dword [ebp - 0x34], 0x5340560c
mov eax, ebx
mov dword [ebp - 0x30], 0x534e4853
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10002aeb
mov cl, byte [ebp - 0x38]
jmp 0x10002b9c
mov cl, 0x53
mov dword [ebp - 0x38], 0x61636153
mov dword [ebp - 0x34], 0x343c217e
mov eax, ebx
mov word [ebp - 0x30], 0x3626
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10002b1d
mov cl, byte [ebp - 0x38]
jmp 0x10002bca
mov cl, 0x3f
mov dword [ebp - 0x38], 0xc0f0d3f
mov dword [ebp - 0x34], 0x585e5212
mov eax, ebx
mov word [ebp - 0x30], 0x5a
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10002b4c
mov cl, byte [ebp - 0x38]
jmp 0x10002bf5
mov cl, 0x26
mov dword [ebp - 0x38], 0x12161426
mov dword [ebp - 0x34], 0x4f54560b
mov eax, ebx
mov dword [ebp - 0x30], 0x525543
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xa
jae 0x10002c30
mov cl, byte [ebp - 0x38]
jmp 0x10002c21
mov byte [ebp - 0x2d], bl
lea ecx, [ebp - 0x37]
call fcn.10004086
push eax
lea eax, [ebp - 0x37]
push eax
lea ecx, [ebp - 0x28]
call fcn.10004017
lea eax, [ebp - 0x28]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov ecx, edi
push eax
mov byte [edi], bl
call fcn.10003b0e
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10003f4a
mov eax, edi
call fcn.100390db
ret 4