Function at 0x1007afd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jl 0x1007af48
jmp 0x1007af4a
je 0x1007af45
xor eax, eax
test eax, eax
je 0x1007af53
jne 0x1007af52
call 0x930b9fda
rol byte [ebx + eax*4], 0xf0
add eax, 0x570273f8
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x1007af61
push edi
pop eax
je 0x1007af66
jne 0x1007af66
pop eax
pushf
push 0xa
jae 0x1007af73
jmp 0x1007af6e
call 0x1007af75
jae 0x1007af6e
add esp, 4
jmp 0x1007af7a
dec dword [esp]
jno 0x1007af7f
jns 0x1007af6a
jp 0x1007af83
add esp, 4
popf
jmp 0x1007af8a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007afa3
jne 0x1007afa3
call 0x1fc7e2f7
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10023fd0
movzx eax, al
cmp eax, 1
jne 0x1007afc6
jmp 0x1007b2af
pushf
push 0xa
jae 0x1007afd3
jmp 0x1007afce
call 0x1007afd5
jae 0x1007afce
add esp, 4
jmp 0x1007afda
dec dword [esp]
jno 0x1007afdf
jns 0x1007afca
jp 0x1007afe3
add esp, 4
popf
jmp 0x1007afea
clc
jae 0x1007afef
test al, 0xe7
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007b008
jne 0x1007b008
out 0x7c, eax
add ebp, ebx
add esp, edi
jl 0x1007b00d
jmp 0x1007b00f
je 0x1007b00a
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1007b029
jne 0x1007b028
call 0x930ba0b0
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1007b037
jne 0x1007b037
call 0x7ef3f601
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], pe_nt_image_headers32
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0
jl 0x1007b070
jmp 0x1007b072
je 0x1007b06d
xor eax, eax
test eax, eax
je 0x1007b07b
jne 0x1007b07a
call 0x930ba102
rol byte [ebx + eax*4], 0xf0
add eax, 0x270273f8
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x1007b089
daa
push ss
je 0x1007b08e
jne 0x1007b08e
push ss
pushf
push 0xa
jae 0x1007b09b
jmp 0x1007b096
call 0x1007b09d
jae 0x1007b096
add esp, 4
jmp 0x1007b0a2
dec dword [esp]
jno 0x1007b0a7
jns 0x1007b092
jp 0x1007b0ab
add esp, 4
popf
jmp 0x1007b0b2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007b0cb
jne 0x1007b0cb
call 0x1fc7e41f
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x101034a4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call dword [0x100e7c14]
call dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
jl 0x1007b100
jmp 0x1007b102
je 0x1007b0fd
xor eax, eax
test eax, eax
je 0x1007b10b
jne 0x1007b10a
call 0x930ba192
rol byte [ebx + eax*4], 0xf0
add eax, 0xc90273f8
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x1007b119
leave
aaa
je 0x1007b11e
jne 0x1007b11e
aaa
pushf
push 0xa
jae 0x1007b12b
jmp 0x1007b126
call 0x1007b12d
jae 0x1007b126
add esp, 4
jmp 0x1007b132
dec dword [esp]
jno 0x1007b137
jns 0x1007b122
jp 0x1007b13b
add esp, 4
popf
jmp 0x1007b142
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007b15b
jne 0x1007b15b
call 0x1fc7e4af
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
cmp dword [ebp - 0x40], 0
jne 0x1007b21f
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 0x6d
mov byte [ebp - 0x36], 0x75
mov byte [ebp - 0x35], 0x6c
mov byte [ebp - 0x34], 0x61
mov byte [ebp - 0x33], 0x74
mov byte [ebp - 0x32], 0x6f
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x21
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x64
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x3a
mov byte [ebp - 0x1a], 0x20
mov byte [ebp - 0x19], 0x33
mov byte [ebp - 0x18], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100e163a
push 0
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x1007b22c
jmp 0x1007b227
call 0x1007b22e
jae 0x1007b227
add esp, 4
jmp 0x1007b233
dec dword [esp]
jno 0x1007b238
jns 0x1007b223
jp 0x1007b23c
add esp, 4
popf
jmp 0x1007b243
clc
jae 0x1007b248
cdq
push eax
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1007b261
jne 0x1007b261
bnd jl 0x1007b266
jl 0x1007b266
jmp 0x1007b268
je 0x1007b263
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1007b282
jne 0x1007b281
call 0x930ba309
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1007b290
jne 0x1007b290
call 0x62c8081f
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [0x101034a4]
mov ecx, dword [eax + 0x12c]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
call dword [0x100e7c14]
call dword [ebp - 0x44]
nop
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret