Function at 0x1003b797
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x16c
mov eax, 0x1004978d
call fcn.10044ac9
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 8]
mov eax, dword [ebx]
mov dword [0x1005b620], eax
test edi, edi
je 0x1003c1e7
cmp dword [ebp + 0xc], 1
jne 0x1003c1e7
cmp dword [ebx + 4], 0
je 0x1003b7dc
cmp edi, dword [ebx + 4]
jne 0x1003b7dc
call fcn.10038f16
jmp 0x1003c1df
cmp dword [ebx + 8], 0
je 0x1003b7f1
cmp edi, dword [ebx + 8]
jne 0x1003b7f1
call fcn.1003ae1e
jmp 0x1003c1df
cmp dword [ebx + 0x38], 0
je 0x1003bb89
cmp edi, dword [ebx + 0x38]
jne 0x1003bb89
push dword [ebx + 0x24]
lea eax, [ebp - 0x94]
push eax
call fcn.1000e9a9
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x84], 4
jne 0x1003b958
push dword [ebx + 0x28]
lea eax, [ebp - 0x7c]
push eax
call fcn.1000e9a9
push dword [ebx + 0x2c]
xor eax, eax
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x64]
push eax
call fcn.1000e9a9
push dword [ebx + 0x30]
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 2
push eax
call fcn.1000e9a9
push dword [ebx + 0x34]
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 3
push eax
call fcn.1000e9a9
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.10037afc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.10037ad5
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 6
push ecx
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.10037ad5
add esp, 0x44
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 7
push ecx
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10037ad5
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x160]
xor esi, esi
inc eax
push esi
push eax
call fcn.10001cd4
xor eax, eax
lea ecx, [ebp - 0x178]
push esi
inc eax
push eax
call fcn.10001cd4
xor eax, eax
mov byte [ebp - 4], 0xb
push esi
inc eax
push eax
lea ecx, [ebp - 0xf0]
call fcn.10001cd4
xor eax, eax
cmp dword [ebp - 0x3c], 0x14
je 0x1003ba7c
push esi
inc eax
lea ecx, [ebp - 0x4c]
push eax
call fcn.10001cd4
xor eax, eax
lea ecx, [ebp - 0xac]
push esi
inc eax
push eax
call fcn.10001cd4
xor eax, eax
lea ecx, [ebp - 0xc4]
push esi
inc eax
push eax
call fcn.10001cd4
xor eax, eax
lea ecx, [ebp - 0x64]
push esi
inc eax
push eax
call fcn.10001cd4
xor eax, eax
mov byte [ebp - 4], 0
push esi
inc eax
lea ecx, [ebp - 0x7c]
push eax
call fcn.10001cd4
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, eax
call fcn.10044ee0
cvtsd2ss xmm0, xmm0
xor ecx, ecx
addss xmm0, dword [0x10050af8]
movss dword [ebx + 0x1ac], xmm0
movaps xmm0, xmmword [str.X_b7_u_r_x_v_7]
movups xmmword [ebp - 0x44], xmm0
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0xe
jb 0x1003b986
lea eax, [ebp - 0x43]
mov byte [ebp - 0x35], 0
push eax
lea ecx, [ebp - 0x64]
call fcn.100012e0
movaps xmm0, xmmword [0x10050c90]
xor ecx, ecx
movups xmmword [ebp - 0x148], xmm0
mov byte [ebp - 4], 0xe
movaps xmm0, xmmword [0x10050db0]
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x108], 0x33282f2b
movaps xmm0, xmmword [0x10050ca0]
movups xmmword [ebp - 0x128], xmm0
mov dword [ebp - 0x104], 0x68352332
movaps xmm0, xmmword [0x10050da0]
movups xmmword [ebp - 0x118], xmm0
mov word [ebp - 0x100], 0x67
mov al, byte [ebp - 0x148]
xor byte [ebp + ecx - 0x147], al
inc ecx
cmp ecx, 0x48
jb 0x1003b9fe
lea eax, [ebp - 0x147]
mov byte [ebp - 0xff], 0
push eax
lea ecx, [ebp - 0x7c]
call fcn.100012e0
push 0
push 0
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.1001685b
add esp, 0x10
lea ecx, [ebp - 0x7c]
xor eax, eax
inc eax
push 0
push eax
call fcn.10001cd4
xor eax, eax
mov byte [ebp - 4], 0
push 0
inc eax
lea ecx, [ebp - 0x64]
push eax
call fcn.10001cd4
mov ecx, ebx
call fcn.1003c953
xor eax, eax
lea ecx, [ebp - 0x94]
push 0
inc eax
push eax
call fcn.10001cd4
jmp 0x1003c1df
push 7
pop ecx
lea edi, [ebp - 0x34]
mov byte [ebp - 0x14], 0xa1
rep stosd dword es:[edi], eax
push 0x1000
lea ecx, [ebp - 0x34]
call fcn.100047ff
xor eax, eax
mov byte [ebp - 4], 0xc
inc eax
mov dword [ebp - 0x34], vtable.Packet.0
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
call fcn.1000540b
xor eax, eax
mov byte [ebp - 4], 0xd
inc eax
mov byte [ebp - 0x14], 0xa6
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
call fcn.1000540b
xor eax, eax
mov byte [ebp - 0x14], 0
inc eax
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000540b
xor eax, eax
mov byte [ebp - 0x14], 3
inc eax
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000540b
cmp dword [ebp - 0x38], 0x10
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x34]
cmovae eax, dword [ebp - 0x4c]
push eax
call fcn.100104d0
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.1000f4f9
pop ecx
pop ecx
mov ecx, ebx
call fcn.1003c953
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x34], vtable.ByteBuffer.0
call fcn.100053e5
xor eax, eax
lea ecx, [ebp - 0x4c]
xor ebx, ebx
inc eax
push ebx
push eax
call fcn.10001cd4
xor eax, eax
lea ecx, [ebp - 0xac]
push ebx
inc eax
push eax
call fcn.10001cd4
xor eax, eax
lea ecx, [ebp - 0xc4]
push ebx
inc eax
push eax
call fcn.10001cd4
xor eax, eax
lea ecx, [ebp - 0x64]
push ebx
inc eax
push eax
call fcn.10001cd4
xor eax, eax
lea ecx, [ebp - 0x7c]
push ebx
inc eax
push eax
call fcn.10001cd4
push ebx
inc ebx
lea ecx, [ebp - 0x94]
push ebx
call fcn.10001cd4
mov al, bl
jmp 0x1003c1e9
cmp dword [ebx + 0x3c], 0
je 0x1003bb9e
cmp edi, dword [ebx + 0x3c]
jne 0x1003bb9e
call fcn.1003c953
jmp 0x1003c1df
cmp dword [ebx + 0x54], 0
je 0x1003bc77
cmp edi, dword [ebx + 0x54]
jne 0x1003bc77
cmp dword [ebx + 0x5c], 0
jbe 0x1003c1df
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x14], 0xa1
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
push 0x1000
lea ecx, [ebp - 0x34]
call fcn.100047ff
xor eax, eax
mov dword [ebp - 4], 0x10
inc eax
mov dword [ebp - 0x34], vtable.Packet.0
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
call fcn.1000540b
xor eax, eax
mov dword [ebp - 4], 0x11
inc eax
mov byte [ebp - 0x14], 0xa6
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
call fcn.1000540b
xor eax, eax
mov byte [ebp - 0x14], 0xa
inc eax
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000540b
xor eax, eax
mov byte [ebp - 0x14], 2
inc eax
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000540b
mov eax, dword [ebx + 0x5c]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
call fcn.1000540b
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.1000f4f9
pop ecx
pop ecx
mov ecx, ebx
call fcn.1003c9cb
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x34], vtable.ByteBuffer.0
call fcn.100053e5
jmp 0x1003c1df
cmp dword [ebx + 0x58], 0
je 0x1003bc8c
cmp edi, dword [ebx + 0x58]
jne 0x1003bc8c
call fcn.1003c9cb
jmp 0x1003c1df
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x1003bca4
cmp edi, eax
jne 0x1003bca4
call fcn.1003b63d
jmp 0x1003c1df
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x1003bcbc
cmp edi, eax
jne 0x1003bcbc
call fcn.1003cb78
jmp 0x1003c1df
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x1003bce2
cmp edi, eax
jne 0x1003bce2
sub esp, 0x18
mov eax, esp
push dword [ebx + 0x88]
push eax
call fcn.1000e9a9
pop ecx
pop ecx
jmp 0x1003bd68
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x1003bcfa
cmp edi, eax
jne 0x1003bcfa
call fcn.1003b4bb
jmp 0x1003c1df
mov eax, dword [ebx + 0x18c]
test eax, eax
je 0x1003bd12
cmp edi, eax
jne 0x1003bd12
call fcn.1003c858
jmp 0x1003c1df
mov eax, dword [ebx + 0x198]
test eax, eax
je 0x1003bd35
cmp edi, eax
jne 0x1003bd35
mov eax, dword [ebx + 0x19c]
cmp eax, dword [ebx + 0x1a0]
jae 0x1003c1df
inc eax
jmp 0x1003bd53
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x1003bd82
cmp edi, eax
jne 0x1003bd82
mov eax, dword [ebx + 0x19c]
cmp eax, 1
jbe 0x1003c1df
dec eax
sub esp, 0x18
mov dword [ebx + 0x19c], eax
mov ecx, esp
push 0x1004a610
call fcn.100012e0
movzx eax, byte [ebx + 0x1a4]
mov ecx, ebx
push eax
push dword [ebx + 0x19c]
call fcn.1003cc53
jmp 0x1003c1df
xor al, al
lea ecx, [ebx + 0x90]
mov byte [ebp - 0x14], al
mov esi, ecx
cmp dword [esi], 0
je 0x1003bdfe
cmp edi, dword [esi]
jne 0x1003bdfe
push 6
mov edi, ecx
pop ebx
push 2
push dword [edi]
call fcn.1000e831
lea edi, [edi + 4]
pop ecx
pop ecx
sub ebx, 1
jne 0x1003bd9d
push 3
push dword [esi]
call fcn.1000e831
mov ebx, dword [ebp - 0x18]
xor eax, eax
sub esp, 0x10
inc eax
mov ecx, esp
mov dword [ebx + 0x19c], eax
mov al, byte [ebp - 0x14]
push 0x1004a610
mov byte [ebx + 0x1a4], al
call fcn.100012e0
movzx eax, byte [ebx + 0x1a4]
mov ecx, ebx
push eax
push dword [ebx + 0x19c]
call fcn.1003cc53
mov edi, dword [ebp + 8]
lea ecx, [ebx + 0x90]
mov al, byte [ebp - 0x14]
inc al
add esi, 4
mov byte [ebp - 0x14], al
cmp al, 6
jb 0x1003bd8f
mov byte [ebp - 0xc8], 0
call fcn.1000a3a6
push dword [ebx + 0x18]
mov esi, eax
mov dword [ebp - 0xcc], edx
call fcn.1000e5a6
pop ecx
test al, al
je 0x1003be54
push dword [ebp - 0xcc]
push esi
push dword [ebx + 0x18]
call fcn.1000e579
mov ecx, dword [ebp - 0xc8]
add esp, 0xc
test al, al
movzx ecx, cl
push 1
pop eax
cmovne ecx, eax
mov dword [ebp - 0xc8], ecx
push dword [ebx + 0x1c]
call fcn.1000e5a6
pop ecx
test al, al
je 0x1003be8a
push dword [ebp - 0xcc]
push esi
push dword [ebx + 0x1c]
call fcn.1000e579
mov ecx, dword [ebp - 0xc8]
add esp, 0xc
test al, al
movzx ecx, cl
push 1
pop eax
cmovne ecx, eax
mov byte [ebp - 0xc8], cl
push dword [ebx + 0x20]
call fcn.1000e5a6
pop ecx
test al, al
je 0x1003bebe
push dword [ebp - 0xcc]
push esi
push dword [ebx + 0x20]
call fcn.1000e579
mov ecx, dword [ebp - 0xc8]
add esp, 0xc
test al, al
movzx ecx, cl
push 1
pop eax
cmovne ecx, eax
mov al, cl
jmp 0x1003bec4
mov eax, dword [ebp - 0xc8]
test al, al
jne 0x1003c1df
mov eax, dword [ebx + 0xe0]
sub eax, dword [ebx + 0xdc]
push 0x38
pop esi
cdq
idiv esi
mov dword [ebp - 0xd0], esi
test eax, eax
je 0x1003c1df
mov eax, dword [ebx + 0xe0]
xor ecx, ecx
sub eax, dword [ebx + 0xdc]
cdq
idiv esi
mov dword [ebp - 0xc8], ecx
test eax, eax
je 0x1003c1df
xor esi, esi
mov dword [ebp - 0xd4], esi
mov eax, dword [ebx + 0xdc]
cmp dword [esi + eax + 0xc], 0
je 0x1003c031
cmp edi, dword [esi + eax + 0xc]
jne 0x1003c031
mov eax, dword [esi + eax + 0x1c]
xor edx, edx
mov dword [ebx + 0x5c], eax
mov eax, dword [ebx + 0xdc]
mov dword [ebp - 0x18], edx
mov eax, dword [esi + eax + 0x20]
mov dword [ebp - 0xd8], eax
mov dword [ebx + 0x60], eax
mov eax, dword [ebx + 0xec]
sub eax, dword [ebx + 0xe8]
sar eax, 6
test eax, eax
je 0x1003c024
xor ecx, ecx
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebx + 0xe8]
mov esi, dword [ebx + 0x5c]
cmp dword [ecx + eax + 0x18], esi
mov esi, dword [ebp - 0xd4]
jne 0x1003bf9b
mov edi, dword [ebp - 0xcc]
mov ecx, eax
mov eax, dword [ebx + 0x60]
cmp eax, dword [edi + ecx + 0x1c]
mov edi, dword [ebp + 8]
je 0x1003bfbd
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ebx + 0xec]
inc edx
sub eax, dword [ebx + 0xe8]
add ecx, 0x40
sar eax, 6
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xcc], ecx
cmp edx, eax
jb 0x1003bf6c
jmp 0x1003c024
mov eax, dword [ebp - 0xd8]
dec eax
cmp eax, 0x5f5e0fe
ja 0x1003bffa
mov esi, edx
add ecx, 0x34
shl esi, 6
add ecx, esi
push ecx
lea ecx, [ebx + 0x70]
call fcn.1003876b
mov eax, dword [ebx + 0xe8]
add eax, esi
push eax
push dword [ebx + 0x40]
call fcn.1000f1a6
mov esi, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x18]
pop ecx
pop ecx
mov eax, dword [ebx + 0xe8]
shl edx, 6
mov eax, dword [edx + eax + 0x20]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0xe8]
mov eax, dword [edx + eax + 0x24]
mov dword [ebx + 0x68], eax
mov eax, dword [ebx + 0xe8]
mov eax, dword [edx + eax + 0x28]
mov dword [ebx + 0x6c], eax
mov ecx, ebx
call fcn.1003af2f
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebx + 0xdc]
cmp dword [esi + eax + 0x10], 0
je 0x1003c1b2
cmp edi, dword [esi + eax + 0x10]
jne 0x1003c1b2
mov eax, dword [ebx + 0xec]
xor ecx, ecx
sub eax, dword [ebx + 0xe8]
sar eax, 6
test eax, eax
je 0x1003c1ac
xor edx, edx
mov eax, dword [ebx + 0xdc]
cmp dword [esi + eax + 0x20], 0
jbe 0x1003c07e
cmp dword [esi + eax + 0x20], 0x5f5e100
jb 0x1003c0d0
mov eax, dword [ebx + 0xe8]
mov edi, dword [ebx + 0xdc]
mov eax, dword [edx + eax + 0x18]
cmp eax, dword [esi + edi + 0x1c]
mov edi, dword [ebp + 8]
jne 0x1003c0b4
mov eax, dword [ebx + 0xe8]
mov edi, dword [ebx + 0xdc]
mov eax, dword [edx + eax + 0x1c]
cmp eax, dword [esi + edi + 0x20]
mov edi, dword [ebp + 8]
je 0x1003c18c
mov eax, dword [ebx + 0xec]
inc ecx
sub eax, dword [ebx + 0xe8]
add edx, 0x40
sar eax, 6
cmp ecx, eax
jb 0x1003c067
jmp 0x1003c1ac
movaps xmm0, xmmword [0x10050b00]
xor ecx, ecx
movups xmmword [ebp - 0x44], xmm0
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0xe
jb 0x1003c0dd
lea eax, [ebp - 0x43]
mov byte [ebp - 0x35], 0
push eax
lea ecx, [ebp - 0x64]
call fcn.100012e0
movaps xmm0, xmmword [0x10050d00]
xor ecx, ecx
movups xmmword [ebp - 0xfc], xmm0
mov dword [ebp - 4], 0x12
movaps xmm0, xmmword [0x10050d60]
movups xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0xdc], 0x60953
mov al, byte [ebp - 0xfc]
xor byte [ebp + ecx - 0xfb], al
inc ecx
cmp ecx, 0x22
jb 0x1003c129
lea eax, [ebp - 0xfb]
mov byte [ebp - 0xd9], 0
push eax
lea ecx, [ebp - 0x7c]
call fcn.100012e0
push 0
push 0
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.1001685b
add esp, 0x10
lea ecx, [ebp - 0x7c]
xor eax, eax
inc eax
push 0
push eax
call fcn.10001cd4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
xor eax, eax
push 0
inc eax
push eax
call fcn.10001cd4
jmp 0x1003c1ac
mov eax, dword [ebx + 0xe8]
shl ecx, 6
push dword [ecx + eax + 0x24]
push dword [ecx + eax + 0x20]
push dword [ecx + eax + 0x1c]
push dword [ecx + eax + 0x18]
mov ecx, ebx
call fcn.10038878
mov ecx, dword [ebp - 0xc8]
push 0x38
pop eax
add esi, eax
inc ecx
mov eax, dword [ebx + 0xe0]
sub eax, dword [ebx + 0xdc]
cdq
idiv dword [ebp - 0xd0]
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xd4], esi
cmp ecx, eax
jb 0x1003bf13
xor ebx, ebx
inc ebx
jmp 0x1003bb82
xor al, al
call fcn.10044a84
ret 8