Function at 0x10018f2c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
mov eax, dword [0x10054040]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
mov esi, ecx
mov dword [esp + 0x14], 0x34293c5b
push edi
mov dword [esp + 0x78], esi
mov cl, 0x5b
mov dword [esp + 0x1c], 0x2f042b2e
xor eax, eax
mov edi, dword [esi]
mov word [esp + 0x20], 0x2b34
mov byte [esp + 0x22], 0
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 9
jae 0x10018f80
mov cl, byte [esp + 0x18]
jmp 0x10018f70
sub esp, 0x18
mov byte [esp + 0x3a], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov edi, eax
mov dword [esp + 0x40], 0x667b6a1e
add esp, 0x18
mov dword [esi + 4], edi
mov cl, 0x1e
mov dword [esp + 0x2c], 0x776a416a
mov dword [esp + 0x30], 0x7b726a
xor eax, eax
xor byte [esp + eax + 0x29], cl
inc eax
cmp eax, 0xa
jae 0x10018fcf
mov cl, byte [esp + 0x28]
jmp 0x10018fbf
sub esp, 0x18
mov byte [esp + 0x4b], 0
lea eax, [esp + 0x41]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 8], eax
xor edx, edx
mov cl, 0x74
mov dword [esp + 8], 0xc110074
mov word [esp + 0xc], 0x2b00
push 3
pop eax
mov dword [esp + 0x74], eax
mov byte [esp + 0xe], al
mov eax, edx
mov dword [esp + 0xf], 0x111a1a1d
mov word [esp + 0x13], 0x706
mov byte [esp + 0x15], dl
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xc
jae 0x10019036
mov cl, byte [esp + 8]
jmp 0x10019026
sub esp, 0x18
mov byte [esp + 0x2d], dl
lea eax, [esp + 0x21]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esp + 0x19], 0x48445948
mov dword [esp + 0x1d], 0x51554863
push 0x3c
pop ecx
mov byte [esp + 0x18], cl
mov word [esp + 0x21], 0x59
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 9
jae 0x10019089
mov cl, byte [esp + 0x18]
jmp 0x10019079
sub esp, 0x18
mov byte [esp + 0x3a], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0x10], eax
mov cl, 0x2c
mov dword [esp + 0x18], 0x42586e2c
xor eax, eax
mov dword [esp + 0x1c], 0x43406f73
mov word [esp + 0x20], 0x495f
mov byte [esp + 0x22], 0
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 9
jae 0x100190dd
mov cl, byte [esp + 0x18]
jmp 0x100190cd
sub esp, 0x18
mov byte [esp + 0x3a], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0x14], eax
mov cl, 0x27
mov dword [esp + 0x40], 0x49536527
xor eax, eax
mov dword [esp + 0x44], 0x42576878
mov word [esp + 0x48], 0x49
xor byte [esp + eax + 0x41], cl
inc eax
cmp eax, 8
jae 0x1001912c
mov cl, byte [esp + 0x40]
jmp 0x1001911c
sub esp, 0x18
mov byte [esp + 0x61], 0
lea eax, [esp + 0x59]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov edi, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0x18], eax
mov cl, 0x54
mov dword [esp + 0x40], 0x3a201654
xor eax, eax
mov dword [esp + 0x44], 0x303d1c0b
mov word [esp + 0x48], 0x31
xor byte [esp + eax + 0x41], cl
inc eax
cmp eax, 8
jae 0x1001917b
mov cl, byte [esp + 0x40]
jmp 0x1001916b
sub esp, 0x18
mov byte [esp + 0x61], 0
lea eax, [esp + 0x59]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov edi, dword [esi]
add esp, 0x18
mov dword [esi + 0x1c], eax
mov cl, 0x3b
mov dword [esp + 8], 0x54495c3b
xor eax, eax
mov dword [esp + 0xc], 0x58644b4e
mov dword [esp + 0x10], 0x5e4f5554
mov word [esp + 0x14], 0x4f55
mov byte [esp + 0x16], 0
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xd
jae 0x100191d6
mov cl, byte [esp + 8]
jmp 0x100191c6
sub esp, 0x18
mov byte [esp + 0x2e], 0
lea eax, [esp + 0x21]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov dword [esi + 0x20], eax
add esp, 0x18
lea eax, [esi + 0x24]
mov dword [esp + 0x5c], 3
mov dword [esp + 0x38], eax
xor ecx, ecx
lea eax, [esi + 0x50]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], eax
mov edi, dword [esi + 0x20]
sub esp, 0x18
mov dword [esp + 0x4c], esp
xor eax, eax
mov dword [esp + 0x58], 0x3e233651
mov dword [esp + 0x5c], 0x740e2124
push ecx
mov cl, 0x51
mov word [esp + 0x64], 0x35
xor byte [esp + eax + 0x5d], cl
inc eax
cmp eax, 8
jae 0x10019249
mov cl, byte [esp + 0x5c]
jmp 0x10019239
sub esp, 0x18
mov byte [esp + 0x7d], 0
lea eax, [esp + 0x75]
mov ecx, esp
push eax
call fcn.10003d99
push dword [esp + 0x68]
call fcn.100039e2
add esp, 0x20
mov ecx, edi
call fcn.1000cc8b
mov edi, eax
mov dword [esp + 0x40], 0x606a6e07
mov eax, dword [esp + 0x50]
add esp, 0x18
mov cl, 7
mov dword [esp + 0x2c], 0x62626958
mov word [esp + 0x30], 0x7463
mov byte [esp + 0x32], 0
mov dword [eax], edi
xor eax, eax
xor byte [esp + eax + 0x29], cl
inc eax
cmp eax, 9
jae 0x100192ab
mov cl, byte [esp + 0x28]
jmp 0x1001929b
sub esp, 0x18
mov byte [esp + 0x4a], 0
lea eax, [esp + 0x41]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov ecx, dword [esp + 0x6c]
add esp, 0x18
mov word [esp + 8], 0x1c72
mov dword [esp + 0xc], 0x112d0116
mov dword [esp + 0x10], 0x61c071d
mov dword [ecx - 4], eax
mov cl, 0x72
mov eax, dword [esp + 0x38]
push 0x17
mov byte [esp + 0x18], 0
mov edi, dword [eax]
pop eax
mov byte [esp + 0xa], al
mov byte [esp + 0xb], al
xor eax, eax
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xb
jae 0x10019311
mov cl, byte [esp + 8]
jmp 0x10019301
sub esp, 0x18
mov byte [esp + 0x2c], 0
lea eax, [esp + 0x21]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov ecx, dword [esp + 0x6c]
add esp, 0x18
movups xmm0, xmmword [0x1004c820]
mov dword [ecx], eax
xor ecx, ecx
mov eax, dword [esp + 0x38]
movups xmmword [esp + 0x7c], xmm0
mov edi, dword [eax]
mov al, byte [esp + 0x7c]
xor byte [esp + ecx + 0x7d], al
inc ecx
cmp ecx, 0xe
jb 0x10019349
sub esp, 0x18
mov byte [esp + 0xa3], 0
lea eax, [esp + 0x95]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov ecx, dword [esp + 0x6c]
add esp, 0x18
mov dword [esp + 0x18], 0x55595521
mov dword [esp + 0x1c], 0x4c404f7e
mov word [esp + 0x20], 0x44
mov dword [ecx + 4], eax
mov cl, 0x21
mov eax, dword [esp + 0x38]
mov edi, dword [eax]
xor eax, eax
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 8
jae 0x100193b3
mov cl, byte [esp + 0x18]
jmp 0x100193a3
sub esp, 0x18
mov byte [esp + 0x39], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
mov edx, dword [esp + 0x6c]
add esp, 0x18
mov ecx, dword [esp + 0x58]
add dword [esp + 0x38], 4
inc ecx
mov dword [esp + 0x58], ecx
mov dword [edx + 8], eax
add edx, 0x18
sub dword [esp + 0x5c], 1
mov dword [esp + 0x54], edx
jne 0x10019213
mov edi, dword [esi]
xor eax, eax
push 0x17
pop ecx
mov byte [esp + 8], cl
mov dword [esp + 9], 0x62786570
mov dword [esp + 0xd], 0x72654867
mov dword [esp + 0x11], 0x73657660
mov byte [esp + 0x15], 0
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xc
jae 0x10019430
mov cl, byte [esp + 8]
jmp 0x10019420
sub esp, 0x18
mov byte [esp + 0x2d], 0
lea eax, [esp + 0x21]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
add esp, 0x18
mov dword [esp + 0x29], 0x70415b6d
mov edi, eax
mov dword [esp + 0x2d], 0x4e584a7d
mov dword [esi + 0x30], edi
xor eax, eax
mov word [esp + 0x31], 0x4b5d
push 0x2f
pop ecx
mov byte [esp + 0x28], cl
mov byte [esp + 0x33], 0
xor byte [esp + eax + 0x29], cl
inc eax
cmp eax, 0xa
jae 0x10019488
mov cl, byte [esp + 0x28]
jmp 0x10019478
sub esp, 0x18
mov byte [esp + 0x4b], 0
lea eax, [esp + 0x41]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, edi
call fcn.1000cc8b
add esp, 0x18
mov dword [esi + 0x40], eax
xor ecx, ecx
lea edi, [esi + 0x8c]
lea eax, [esi + 0x34]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x30]
sub esp, 0x18
mov dword [esp + 0x4c], esp
mov dword [esp + 0x6c], eax
xor eax, eax
mov dword [esp + 0x20], 0x10041361
push ecx
mov cl, 0x61
mov dword [esp + 0x28], 0x150814
mov dword [esp + 0x2c], 0x5443e0d
mov byte [esp + 0x30], 0
xor byte [esp + eax + 0x25], cl
inc eax
cmp eax, 0xb
jae 0x10019500
mov cl, byte [esp + 0x24]
jmp 0x100194f0
sub esp, 0x18
mov byte [esp + 0x48], 0
lea eax, [esp + 0x3d]
mov ecx, esp
push eax
call fcn.10003d99
push dword [esp + 0x68]
call fcn.100039e2
mov ecx, dword [esp + 0x8c]
add esp, 0x20
call fcn.1000cc8b
mov ecx, eax
mov dword [esp + 0x30], 0x76617213
mov eax, dword [esp + 0x50]
add esp, 0x18
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], 0x76614c72
mov dword [esp + 0x20], 0x77617264
mov dword [eax], ecx
mov cl, 0x13
mov byte [esp + 0x24], 0
xor eax, eax
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 0xb
jae 0x1001956c
mov cl, byte [esp + 0x18]
jmp 0x1001955c
sub esp, 0x18
mov byte [esp + 0x3c], 0
lea eax, [esp + 0x31]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, dword [esp + 0x4c]
call fcn.1000cc8b
mov dword [edi + 8], eax
add esp, 0x18
mov eax, dword [esp + 0x38]
mov cl, 0x49
mov dword [esp + 0x28], 0x3d313d49
mov dword [esp + 0x2c], 0x3e2c3b16
mov dword [esp + 0x30], 0x2d3b28
mov eax, dword [eax]
mov dword [esp + 0x34], eax
xor eax, eax
xor byte [esp + eax + 0x29], cl
inc eax
cmp eax, 0xa
jae 0x100195c5
mov cl, byte [esp + 0x28]
jmp 0x100195b5
sub esp, 0x18
mov byte [esp + 0x4b], 0
lea eax, [esp + 0x41]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, dword [esp + 0x4c]
call fcn.1000cc8b
movups xmm0, xmmword [0x1004d6c0]
mov dword [edi + 0xc], eax
add esp, 0x18
mov eax, dword [esp + 0x38]
xor ecx, ecx
movups xmmword [esp + 0x60], xmm0
mov word [esp + 0x70], 0x7f
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov al, byte [esp + 0x60]
xor byte [esp + ecx + 0x61], al
inc ecx
cmp ecx, 0x10
jb 0x10019607
sub esp, 0x18
mov byte [esp + 0x89], 0
lea eax, [esp + 0x79]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, dword [esp + 0x4c]
call fcn.1000cc8b
movups xmm0, xmmword [0x1004d7e0]
mov dword [edi + 0x10], eax
add esp, 0x18
mov eax, dword [esp + 0x38]
xor ecx, ecx
movups xmmword [esp + 0x60], xmm0
mov byte [esp + 0x70], 0
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov al, byte [esp + 0x60]
xor byte [esp + ecx + 0x61], al
inc ecx
cmp ecx, 0xf
jb 0x10019658
sub esp, 0x18
mov byte [esp + 0x88], 0
lea eax, [esp + 0x79]
mov ecx, esp
push eax
call fcn.10003d99
mov ecx, dword [esp + 0x4c]
call fcn.1000cc8b
add esp, 0x18
mov dword [edi + 0x14], eax
call fcn.1000a76a
test eax, eax
je 0x1001975b
mov dword [edi], eax
call fcn.1000d360
test eax, eax
je 0x1001975b
mov ecx, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov edx, dword [esi]
mov ecx, dword [ecx]
call fcn.1000cc55
mov eax, dword [edi]
xor edx, edx
mov esi, 0x3f340000
mov ecx, dword [eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0xcc]
mov dword [ecx + 0x13c], edx
mov dword [ecx + 0x140], edx
mov dword [ecx + 0x144], esi
mov dword [ecx + 0x148], esi
mov dword [ecx + 0x1f0], edx
mov dword [ecx + 0x1f4], edx
mov dword [ecx + 0x1f8], edx
mov dword [ecx + 0x1fc], edx
call eax
mov ecx, dword [edi]
mov ecx, dword [ecx]
call fcn.1000cf34
mov ecx, dword [edi]
mov edx, pe_nt_image_headers32
mov ecx, dword [ecx]
call fcn.1000cfd6
mov ecx, dword [edi + 8]
lea eax, [esp + 0x40]
push eax
call fcn.1000ccf4
mov esi, eax
lea edi, [esp + 0x80]
pop ecx
lea edx, [esp + 0x7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x58]
mov ecx, dword [edi]
mov ecx, dword [ecx]
call fcn.1000d3b5
mov ecx, dword [edi]
lea edx, [esp + 0x7c]
mov ecx, dword [ecx]
call fcn.1000cd68
mov ecx, dword [edi]
xor dl, dl
mov ecx, dword [ecx]
call fcn.1000ceb6
mov esi, dword [esp + 0x78]
call fcn.1000a76a
test eax, eax
je 0x10019767
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x5c]
add edi, 0x18
add dword [esp + 0x38], 4
inc ecx
sub dword [esp + 0x74], 1
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], edi
jne 0x100194c0
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
xor ecx, esp
call fcn.1003c8c4
mov esp, ebp
pop ebp
ret