Function at 0x100109e0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4eac
call fcn.10011210
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x4ea4], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x4ea8], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x4eac], eax
mov dword [ebp - 0x10], 0x5f6c6a69
mov dword [ebp - 0xc], 0x642e3131
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
mov dword [ebp - 0x18], 0x496c6a69
mov dword [ebp - 0x14], 0x74696e
push ebp
add ebp, esp
add ebp, esi
xor ebp, eax
add ebp, edx
mov ebp, 0xb9c7d7e9
and ebp, ebp
pop ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [ebp - 0x4e98], eax
test eax, eax
jne 0x10010a90
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10010a90
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call ebx
push eax
call esi
mov dword [ebp - 0x4e98], eax
mov dword [ebp - 0x2c], 0x576c6a69
mov dword [ebp - 0x28], 0x65746972
mov byte [ebp - 0x24], 0
push ebp
add ebp, edx
sbb ebp, eax
sbb ebp, esi
mov ebp, 0x98db2168
or ebp, edi
or ebp, ecx
pop ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [ebp - 0x4e9c], eax
test eax, eax
jne 0x10010af7
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10010af7
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
push eax
call ebx
mov dword [ebp - 0x4e9c], eax
mov dword [ebp - 0x20], 0x466c6a69
mov dword [ebp - 0x1c], 0x656572
push edx
add edx, esp
sbb edx, eax
sbb edx, esp
add edx, eax
mov edx, 0x6fe762de
add edx, esi
pop edx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [ebp - 0x4ea0], eax
test eax, eax
jne 0x10010b66
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10010c4e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call ebx
push eax
call esi
mov dword [ebp - 0x4ea0], eax
test eax, eax
je 0x10010c4e
cmp dword [ebp - 0x4e9c], 0
je 0x10010c4e
lea eax, [ebp - 0x4e94]
push eax
call dword [ebp - 0x4e98]
mov dword [ebp - 0x4e98], eax
push eax
sbb eax, eax
xor eax, eax
xor eax, eax
mov eax, 0xf06ae563
sbb eax, eax
nop
pop eax
cmp dword [ebp - 0x4e98], 0
jne 0x10010c42
mov edx, dword [ebp + 0x10]
mov eax, edx
mov esi, dword [ebp + 0xc]
neg eax
mov edi, dword [ebp - 0x4eac]
mov dword [ebp - 0x4e88], eax
mov eax, dword [ebp - 0x4ea4]
mov dword [ebp - 0x4e90], eax
lea ecx, [esi + esi*2]
lea eax, [ecx + 3]
mov dword [ebp - 0x4e8c], esi
and eax, 0xfffffffc
mov dword [ebp - 0x4e68], esi
sub eax, ecx
mov dword [ebp - 0x4e64], edx
mov dword [ebp - 0x4e84], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4e44], eax
mov eax, dword [ebp - 0x4ea8]
mov dword [ebp - 0x4e70], eax
mov eax, dword [edi]
mov dword [ebp - 0x4e6c], eax
lea eax, [ebp - 0x4e94]
push 9
push eax
call dword [ebp - 0x4e9c]
mov esi, eax
lea eax, [ebp - 0x4e94]
push eax
call dword [ebp - 0x4ea0]
test esi, esi
jne 0x10010c42
mov eax, dword [ebp - 0x4e6c]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
push eax
sbb eax, edx
sbb eax, esp
add eax, esi
sbb eax, eax
sbb eax, edx
pop eax
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010ee3
mov esp, ebp
pop ebp
ret