Function at 0x1004be30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xc0
mov eax, 0x1011b95b
call fcn.1011094a
mov esi, ecx
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x5c]
and dword [ebp - 4], 0
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xcc], esi
call fcn.10082bd8
push 6
pop ecx
xor eax, eax
mov byte [ebp - 4], 1
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
mov ecx, ebx
push eax
push str.deviceDetails
lea eax, [ebp - 0x2c]
push eax
call fcn.10063887
push 6
pop ecx
xor eax, eax
mov byte [ebp - 4], 2
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
mov ecx, ebx
push eax
push str.appDetails
lea eax, [ebp - 0x44]
push eax
call fcn.10063887
mov edi, 0x1014a0f1
mov byte [ebp - 4], 3
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 4
push eax
push str.npdId
lea eax, [ebp - 0xb0]
mov ecx, ebx
push eax
call fcn.10063887
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 4]
call fcn.10063887
lea ecx, [ebp - 0xc8]
call fcn.1001524d
lea ecx, [ebp - 0xb0]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push 0
lea ecx, [ebp - 0x98]
call fcn.10063887
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 6
push eax
push str.npdPrecedence
lea eax, [ebp - 0xb0]
mov ecx, ebx
push eax
call fcn.10063887
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.100842a6
lea ecx, [ebp - 0xb0]
mov dword [esi + 0x1c], eax
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 8
push eax
push str.asnpTemplateId
lea eax, [ebp - 0xc8]
mov ecx, ebx
push eax
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 9
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x20]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0xa
push eax
push str.nglAppId
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0xb
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x38]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0xc
push eax
push str.nglAppVersion
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x50]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0xe
push eax
push str.nglLibVersion
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0xf
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x68]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x10
push eax
push str.nglAppProfileScope
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x11
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x80]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x12
push eax
push str.currentAsnpId
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x13
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x98]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x14
push eax
push str.locale
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x15
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0xb0]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x16
push eax
push str.appNameForLocale
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x17
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0xc8]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x18
push eax
push str.appVersionForLocale
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x19
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0xe0]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x1a
push eax
push str.nglAppLaunchState
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0xf8]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x1c
push eax
push str.asnpCertsGroupId
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1d
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x110]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x98]
push eax
push str.customerCertsGroupId
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x44]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x128]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x20
push eax
push str.deviceId
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x21
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x140]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x22
push eax
push str.osUserId
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x23
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x158]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x24
push eax
push str.deviceName
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x25
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x170]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x26
push eax
push str.osName
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x27
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x188]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x28
push eax
push str.osVersion
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x29
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x1a0]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x2a
push eax
push str.currentTimestamp
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x2b
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x1b8]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x2c
push eax
push str.embeddedBrowserVersion
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x2d
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x1d0]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
xor ebx, ebx
lea ecx, [ebp - 0x98]
push ebx
call fcn.10063887
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x2e
push eax
push str.enableVdiMarkerExists
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
mov ecx, eax
mov byte [ebp - 4], 0x2f
call fcn.10083b22
lea ecx, [ebp - 0xb0]
mov byte [esi + 0x1e8], al
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push ebx
lea ecx, [ebp - 0x98]
call fcn.10063887
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x30
push eax
push str.isVirtualEnvironment
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
mov ecx, eax
mov byte [ebp - 4], 0x31
call fcn.10083b22
lea ecx, [ebp - 0xb0]
mov byte [esi + 0x1e9], al
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push ebx
lea ecx, [ebp - 0x98]
call fcn.10063887
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x32
push eax
push str.isOsUserAccountInDomain
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
mov ecx, eax
mov byte [ebp - 4], 0x33
call fcn.10083b22
lea ecx, [ebp - 0xb0]
mov byte [esi + 0x1ea], al
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x34
push eax
push str.ipAddress
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x35
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x1ec]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.10082ec8
push edi
lea ecx, [ebp - 0x98]
call fcn.10082b43
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x36
push eax
push str.macAddress
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10063887
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x37
push ecx
mov ecx, eax
call fcn.10083ffb
push eax
lea ecx, [esi + 0x204]
call fcn.10063887
lea ecx, [ebp - 0xb0]
call fcn.1001524d
lea ecx, [ebp - 0xc8]
call fcn.10082ec8
lea ecx, [ebp - 0x98]
call fcn.10082ec8
lea ecx, [ebp - 0x44]
call fcn.10082ec8
lea ecx, [ebp - 0x2c]
call fcn.10082ec8
lea ecx, [ebp - 0x5c]
call fcn.10082ec8
call fcn.10110897
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x1004b2b5