Function at 0x100031c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7414
call fcn.10010ab0
mov eax, dword [0x100200b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x808]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x808]
push 0x5c
push eax
call fcn.1000b8f0
pop ecx
pop ecx
cmp eax, ebx
je 0x1000355d
push esi
mov ecx, eax
push edi
xor edi, edi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x10003215
sub ecx, esi
je 0x1000355b
mov cl, byte [edi + eax]
cmp cl, 0x2d
je 0x1000324e
cmp cl, 0x23
je 0x1000324e
cmp cl, 0x3d
je 0x1000324e
mov ecx, eax
inc edi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1000323c
sub ecx, esi
cmp edi, ecx
jb 0x10003224
jmp 0x1000355b
lea eax, [ebp - 0x740c]
push eax
lea eax, [ebp - 0x7408]
push eax
mov dword [ebp - 0x740c], 0x64
call fcn.10002fdd
pop ecx
pop ecx
test al, al
je 0x1000355b
mov dword [ebp - 0x7410], ebx
cmp dword [ebp - 0x740c], ebx
jbe 0x1000355b
lea eax, [ebp - 0x7408]
mov dword [ebp - 0x7414], eax
mov esi, 0x100
push esi
push dword [ebp - 0x7414]
lea eax, [ebp - 0x704]
push eax
call fcn.1000b6c0
push 0xf6
lea eax, [ebp - 0x4fb]
push ebx
push eax
mov dword [ebp - 0x504], 0x616c435f
mov dword [ebp - 0x500], 0x73657373
mov byte [ebp - 0x4fc], bl
call fcn.1000cce0
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x704]
push eax
call fcn.1000b560
add esp, 0x20
test eax, eax
je 0x1000344f
push 0xe6
lea eax, [ebp - 0x1eb]
push ebx
push eax
mov dword [ebp - 0x204], 0x745c7325
mov dword [ebp - 0x200], 0x68735c67
mov dword [ebp - 0x1fc], 0x5c6c6c65
mov dword [ebp - 0x1f8], 0x6e65706f
mov dword [ebp - 0x1f4], 0x6d6f635c
mov dword [ebp - 0x1f0], 0x646e616d
mov byte [ebp - 0x1ec], bl
call fcn.1000cce0
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0xa08]
push eax
call fcn.1000ad50
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0xa08]
call fcn.10002f16
add esp, 0x1c
test al, al
je 0x1000344f
lea eax, [ebp - 0x1008]
push 0x22
push eax
call fcn.1000b600
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x1000344f
inc edi
push 0x22
push edi
call fcn.1000b600
pop ecx
pop ecx
cmp eax, ebx
je 0x1000344f
push 0xd8
mov byte [eax], bl
lea eax, [ebp - 0xdd]
push ebx
push eax
mov dword [ebp - 0x104], 0x74202d2d
mov dword [ebp - 0x100], 0x2f2f3a67
mov dword [ebp - 0xfc], 0x6c746573
mov dword [ebp - 0xf8], 0x75676e61
mov dword [ebp - 0xf4], 0x3f656761
mov dword [ebp - 0xf0], 0x676e616c
mov dword [ebp - 0xec], 0x616c633d
mov dword [ebp - 0xe8], 0x63697373
mov dword [ebp - 0xe4], 0x2d687a2d
mov word [ebp - 0xe0], 0x6e63
mov byte [ebp - 0xde], bl
call fcn.1000cce0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xc08]
push eax
call fcn.1000ad50
push 0x1001c714
push edi
call fcn.1000b560
add esp, 0x1c
test eax, eax
jne 0x10003472
inc dword [ebp - 0x7410]
mov eax, dword [ebp - 0x7410]
add dword [ebp - 0x7414], esi
cmp eax, dword [ebp - 0x740c]
jb 0x10003298
jmp 0x1000355b
push 0xf3
lea eax, [ebp - 0x3f8]
push ebx
push eax
mov dword [ebp - 0x404], 0x6c656853
mov dword [ebp - 0x400], 0x2e32336c
mov dword [ebp - 0x3fc], 0x6c6c64
call fcn.1000cce0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0xf1
mov dword [ebp - 0x740c], eax
lea eax, [ebp - 0x2f6]
push ebx
push eax
mov dword [ebp - 0x304], 0x6c656853
mov dword [ebp - 0x300], 0x6578456c
mov dword [ebp - 0x2fc], 0x65747563
mov word [ebp - 0x2f8], 0x41
call fcn.1000cce0
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
push dword [ebp - 0x740c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x10003547
push 0xfa
lea eax, [ebp - 0x5ff]
push ebx
push eax
mov dword [ebp - 0x604], 0x6e65704f
mov byte [ebp - 0x600], bl
call fcn.1000cce0
add esp, 0xc
push 5
push ebx
lea eax, [ebp - 0xc08]
push eax
push edi
lea eax, [ebp - 0x604]
push eax
push ebx
call esi
cmp dword [ebp - 0x740c], ebx
je 0x1000355b
push dword [ebp - 0x740c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000ad41
leave
ret