Function at 0x1000e0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push ebx
mov bl, 0x45
mov byte [esp + 0x25], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x31], bl
mov dl, 0xec
mov cl, 8
mov bl, 0xe4
push ebp
mov byte [esp + 9], dl
mov byte [esp + 0xc], cl
mov byte [esp + 0x19], dl
mov byte [esp + 0x1d], cl
mov byte [esp + 0x36], bl
mov byte [esp + 0x39], bl
mov al, 0x8b
mov cl, 0x8d
mov dl, 0x4d
mov bl, 0xe8
push 0xa00000
push 0
mov byte [esp + 0x18], 0x64
mov byte [esp + 0x19], 0xa1
mov byte [esp + 0x1a], 0x18
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
mov byte [esp + 0x10], al
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x55
mov byte [esp + 0x20], al
mov byte [esp + 0x22], 0x57
mov byte [esp + 0x23], al
mov byte [esp + 0x24], 0x7d
mov byte [esp + 0x30], cl
mov byte [esp + 0x32], 0x44
mov byte [esp + 0x33], 0x50
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], dl
mov byte [esp + 0x36], 0x2c
mov byte [esp + 0x37], 0xc6
mov byte [esp + 0x39], 0xfc
mov byte [esp + 0x3a], 0x20
mov byte [esp + 0x3c], 0x89
mov byte [esp + 0x3f], 0x83
mov byte [esp + 0x40], 0x7d
mov byte [esp + 0x42], 0
mov byte [esp + 0x43], 0x75
mov byte [esp + 0x44], 0xb
mov byte [esp + 0x45], 0xff
mov byte [esp + 0x46], 0x15
mov byte [esp + 0x48], 0x81
mov byte [esp + 0x49], 0xc6
mov byte [esp + 0x4a], 0x70
mov byte [esp + 0x4b], 1
mov byte [esp + 0x4c], 0
mov byte [esp + 0x4d], 0
mov byte [esp + 0x4e], 0x56
mov byte [esp + 0x4f], cl
mov byte [esp + 0x50], dl
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], bl
mov byte [esp + 0x28], al
mov byte [esp + 0x29], 0xf8
mov byte [esp + 0x2a], 0x6a
mov byte [esp + 0x2b], 0x2a
mov byte [esp + 0x2c], cl
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], 0xf0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x1000e3fb
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
je 0x1000e2e4
mov eax, dword [ebx + 0x3c]
mov esi, dword [eax + ebx + 0x50]
cmp esi, 0xa00000
jbe 0x1000e221
mov esi, 0xa00000
mov edx, dword [0x1002d994]
push esi
lea ecx, [ebx + 0x300000]
push ebp
push ecx
push edx
call fcn.1001a470
add esp, 0x10
test eax, eax
je 0x1000e2e4
lea eax, [esp + 0x28]
push 7
push eax
push esi
push ebp
call fcn.1001a3d0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1000e27f
lea ecx, [esp + 0x28]
push 7
push ecx
lea edx, [edi + ebp + 7]
push esi
push edx
call fcn.1001a3d0
add esp, 0x10
test eax, eax
je 0x1000e27f
add eax, edi
lea eax, [eax + ebx + 0x300002]
mov dword [0x1002d9b4], eax
lea ecx, [esp + 0x30]
push 0xb
push ecx
push esi
push ebp
call fcn.1001a3d0
add esp, 0x10
test eax, eax
je 0x1000e2a1
lea edx, [eax + ebx + 0x300010]
mov dword [0x1002d9b0], edx
lea eax, [esp + 0x3c]
push 0xb
push eax
push esi
push ebp
call fcn.1001a3d0
add esp, 0x10
test eax, eax
je 0x1000e2c3
lea ecx, [eax + ebx + 0x300000]
mov dword [0x1002d998], ecx
lea edx, [esp + 0x48]
push 0xb
push edx
push esi
push ebp
call fcn.1001a3d0
add esp, 0x10
test eax, eax
je 0x1000e2e4
lea eax, [eax + ebx + 0x300000]
mov dword [0x1002d99c], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x10001d3c
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10001d30
push eax
call ebx
mov ecx, dword [0x1002d994]
mov esi, eax
push 0x100
push ebp
push esi
push ecx
call fcn.1001a470
add esp, 0x10
test eax, eax
je 0x1000e345
lea edx, [esp + 0x10]
push 5
push edx
push 0x100
push ebp
call fcn.1001a3d0
add esp, 0x10
test eax, eax
je 0x1000e345
add esi, eax
mov dword [0x1002d9a8], esi
add esi, 5
mov dword [0x1002d9ac], esi
push 0x10001694
call edi
mov esi, eax
push 0x10001d1c
push esi
call ebx
mov edi, eax
mov eax, dword [0x1002d994]
push 0x100
push ebp
push edi
push eax
call fcn.1001a470
add esp, 0x10
test eax, eax
je 0x1000e399
lea ecx, [esp + 0x20]
push 6
push ecx
push 0x100
push ebp
call fcn.1001a3d0
add esp, 0x10
test eax, eax
je 0x1000e399
add eax, edi
mov dword [0x1002d9a0], eax
add eax, 6
mov dword [0x1002d9a4], eax
push 0x10001d10
push esi
call ebx
mov edx, dword [0x1002d994]
mov ebx, eax
push 0x100
push ebp
push ebx
push edx
call fcn.1001a470
add esp, 0x10
test eax, eax
je 0x1000e3f2
lea eax, [esp + 0x18]
push 6
push eax
push 0x100
push ebp
call fcn.1001a3d0
add esp, 0x10
test eax, eax
je 0x1000e3da
add ebx, eax
jmp 0x1000e3ec
mov ecx, 3
lea edi, [esp + 0x18]
mov esi, ebp
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x1000e3f2
mov dword [0x1002d9bc], ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, dword [0x1002d9a0]
pop ebp
test eax, eax
pop ebx
je 0x1000e445
mov eax, dword [0x1002d9a8]
test eax, eax
je 0x1000e445
mov eax, dword [0x1002d9b0]
test eax, eax
je 0x1000e445
mov eax, dword [0x1002d9b4]
test eax, eax
je 0x1000e445
mov eax, dword [0x1002d998]
test eax, eax
je 0x1000e445
mov eax, dword [0x1002d99c]
test eax, eax
je 0x1000e445
mov eax, dword [0x1002d9bc]
test eax, eax
je 0x1000e445
mov eax, 1
add esp, 0x44
ret
xor eax, eax
add esp, 0x44
ret