Function at 0x10030130
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x4e546220
push edi
mov dword [ebp - 0x18], esi
mov dl, 0x20
mov dword [ebp - 0xc], 0x5049767f
xor ecx, ecx
mov dword [ebp - 8], 0x4c554176
mov word [ebp - 4], 0x54
nop dword [eax]
xor byte [ebp + ecx - 0xf], dl
inc ecx
cmp ecx, 0xc
jae 0x1003016f
mov dl, byte [ebp - 0x10]
jmp 0x10030160
xorps xmm0, xmm0
mov byte [ebp - 3], 0
lea ecx, [ebp - 0xf]
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10030195
sub ecx, edx
lea eax, [ebp - 0xf]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.10003370
cmp dword [ebp - 0x24], 0
mov ebx, dword [esi]
je 0x10030220
test ebx, ebx
je 0x10030220
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10030220
mov eax, dword [ebx + 0xc4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1003021d
cmp esi, dword [ebx + 0xc4]
jne 0x100301e0
call fcn.1008fc90
mov edi, dword [esi + 8]
test edi, edi
je 0x10030209
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x100301f2
mov ecx, dword [ecx]
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
cmova eax, dword [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10030281
cmp esi, dword [ebx + 0xc4]
jne 0x10030216
call fcn.1008fc90
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x100301d3
mov esi, dword [ebp - 0x18]
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [esi + 4], edi
call fcn.10002f50
mov eax, dword [ebp - 0x38]
push 8
push eax
mov dword [ebp - 0x38], 0
call fcn.100891b0
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 8
push 4
push dword [esi + 4]
call edi
test eax, eax
je 0x1003025a
mov dword [esi + 4], 0
mov dl, 0x59
mov dword [ebp - 0xc], 0x2a383b59
mov dword [ebp - 8], 0x363a063c
xor ecx, ecx
mov word [ebp - 4], 0x2a
xor byte [ebp + ecx - 0xb], dl
inc ecx
cmp ecx, 8
jae 0x10030286
mov dl, byte [ebp - 0xc]
jmp 0x10030272
mov esi, dword [ebp - 0x18]
jmp 0x10030222
xorps xmm0, xmm0
mov byte [ebp - 3], 0
lea ecx, [ebp - 0xb]
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100302b0
sub ecx, edx
lea eax, [ebp - 0xb]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.10003370
cmp dword [ebp - 0x24], 0
mov ebx, dword [esi]
je 0x10030341
test ebx, ebx
je 0x10030341
push 4
push ebx
call edi
test eax, eax
jne 0x10030341
mov eax, dword [ebx + 0xc4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1003033e
nop word [eax + eax]
cmp esi, dword [ebx + 0xc4]
jne 0x100302fd
call fcn.1008fc90
mov edi, dword [esi + 8]
test edi, edi
je 0x1003032a
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1003030f
mov ecx, dword [ecx]
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
cmova eax, dword [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100306cf
cmp esi, dword [ebx + 0xc4]
jne 0x10030337
call fcn.1008fc90
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x100302f0
mov esi, dword [ebp - 0x18]
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [esi + 8], edi
call fcn.10002f50
mov eax, dword [ebp - 0x38]
push 8
push eax
mov dword [ebp - 0x38], 0
call fcn.100891b0
movaps xmm0, xmmword [0x100e9770]
add esp, 8
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 4], 0
xor ecx, ecx
mov al, byte [ebp + ecx - 0x13]
xor al, byte [ebp - 0x14]
mov byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xf
jb 0x10030374
xorps xmm0, xmm0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100303b0
sub ecx, edx
lea eax, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.10003370
cmp dword [ebp - 0x24], 0
mov ebx, dword [esi]
je 0x10030441
test ebx, ebx
je 0x10030441
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10030441
mov eax, dword [ebx + 0xc4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1003043e
nop
cmp esi, dword [ebx + 0xc4]
jne 0x100303fd
call fcn.1008fc90
mov edi, dword [esi + 8]
test edi, edi
je 0x1003042a
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1003040f
mov ecx, dword [ecx]
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
cmova eax, dword [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100306d7
cmp esi, dword [ebx + 0xc4]
jne 0x10030437
call fcn.1008fc90
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x100303f0
mov esi, dword [ebp - 0x18]
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [esi + 0xc], edi
call fcn.10002f50
mov eax, dword [ebp - 0x38]
push 8
push eax
mov dword [ebp - 0x38], 0
call fcn.100891b0
movaps xmm0, xmmword [0x100e94c0]
add esp, 8
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x4c5e
xor ecx, ecx
mov byte [ebp - 2], 0
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x13]
xor al, byte [ebp - 0x14]
mov byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x11
jb 0x10030480
xorps xmm0, xmm0
mov byte [ebp - 2], 0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100304b7
sub ecx, edx
lea eax, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.10003370
cmp dword [ebp - 0x24], 0
mov ebx, dword [esi]
je 0x10030546
test ebx, ebx
je 0x10030546
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10030546
mov eax, dword [ebx + 0xc4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x10030543
cmp esi, dword [ebx + 0xc4]
jne 0x10030502
call fcn.1008fc90
mov edi, dword [esi + 8]
test edi, edi
je 0x1003052f
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x10030514
mov ecx, dword [ecx]
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
cmova eax, dword [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100306df
cmp esi, dword [ebx + 0xc4]
jne 0x1003053c
call fcn.1008fc90
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x100304f5
mov esi, dword [ebp - 0x18]
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [esi + 0x10], edi
call fcn.10002f50
mov eax, dword [ebp - 0x38]
push 8
push eax
mov dword [ebp - 0x38], 0
call fcn.100891b0
movaps xmm0, xmmword [0x100e98d0]
add esp, 8
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x7163
xor ecx, ecx
mov byte [ebp - 2], 0
nop
mov al, byte [ebp + ecx - 0x13]
xor al, byte [ebp - 0x14]
mov byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x11
jb 0x10030580
xorps xmm0, xmm0
mov byte [ebp - 2], 0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x38], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100305b7
sub ecx, edx
lea eax, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.10003370
cmp dword [ebp - 0x24], 0
mov ebx, dword [esi]
je 0x1003063f
test ebx, ebx
je 0x1003063f
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1003063f
mov eax, dword [ebx + 0xc4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1003063f
cmp esi, dword [ebx + 0xc4]
jne 0x10030602
call fcn.1008fc90
mov edi, dword [esi + 8]
test edi, edi
je 0x1003062b
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x10030614
mov ecx, dword [ecx]
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
cmova eax, dword [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10030641
cmp esi, dword [ebx + 0xc4]
jne 0x10030638
call fcn.1008fc90
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x100305f5
xor edi, edi
mov ebx, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
mov dword [ebx + 0x14], edi
call fcn.10002f50
mov eax, dword [ebp - 0x38]
push 8
push eax
mov dword [ebp - 0x38], 0
call fcn.100891b0
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 8
push 4
push dword [ebx + 8]
call edi
test eax, eax
je 0x1003067c
mov dword [ebx + 8], 0
push 4
push dword [ebx + 0xc]
call edi
test eax, eax
je 0x1003068e
mov dword [ebx + 0xc], 0
push 4
push dword [ebx + 0x10]
call edi
test eax, eax
je 0x100306a0
mov dword [ebx + 0x10], 0
push 4
push dword [ebx + 0x14]
call edi
test eax, eax
je 0x100306b2
mov dword [ebx + 0x14], 0
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x100306fa
cmp dword [0x100f647c], 0
push 4
push esi
je 0x100306e7
call edi
test eax, eax
jne 0x100306fa
mov dl, 3
jmp 0x100306ef
mov esi, dword [ebp - 0x18]
jmp 0x10030343
mov esi, dword [ebp - 0x18]
jmp 0x10030443
mov esi, dword [ebp - 0x18]
jmp 0x10030548
call edi
test eax, eax
jne 0x100306fa
mov dl, 2
lea ecx, [esi + 0xd0]
call fcn.1001e280
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x1003072a
cmp dword [0x100f6480], 0
push 4
push esi
je 0x10030717
call edi
test eax, eax
jne 0x1003072a
mov dl, 3
jmp 0x1003071f
call edi
test eax, eax
jne 0x1003072a
mov dl, 2
lea ecx, [esi + 0xd0]
call fcn.1001e280
cmp dword [ebx + 0x14], 0
je 0x10030790
cmp dword [0x100f6484], 0
mov eax, 0xeb
mov ecx, 0x74
cmovne eax, ecx
mov byte [0x427dcd], al
cmp dword [0x100f6484], 0
mov esi, dword [ebx + 0x14]
je 0x10030776
test esi, esi
je 0x10030790
push 4
push esi
call edi
test eax, eax
jne 0x10030790
mov dl, 3
lea ecx, [esi + 0xd0]
call fcn.1001e280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10030790
push 4
push esi
call edi
test eax, eax
jne 0x10030790
mov dl, 2
lea ecx, [esi + 0xd0]
call fcn.1001e280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret