Function at 0x10002e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001eca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [0x100270d4]
jne 0x10003088
mov al, byte [0x100270b4]
xor ebx, ebx
cmp al, bl
je 0x10003088
call fcn.100115c0
cmp eax, 0xffffffff
jne 0x10002e94
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetCursorPos]
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x10002fac
cmp dword [0x1002798c], ebx
jne 0x10003070
mov al, 0x65
mov dl, 0x61
mov byte [ebp - 0x2e], al
mov byte [ebp - 0x2d], dl
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x27], al
mov byte [ebp - 0x26], dl
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1c], al
mov cl, 0x72
mov dl, 0x64
mov al, 0x6c
mov byte [ebp - 0x30], 0x43
mov byte [ebp - 0x2f], cl
mov byte [ebp - 0x2c], 0x74
mov byte [ebp - 0x2a], 0x54
mov byte [ebp - 0x29], 0x68
mov byte [ebp - 0x28], cl
mov byte [ebp - 0x25], dl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], bl
push ecx
mov ecx, 0xc9ea8e34
xor ecx, esi
add ecx, eax
add ecx, edx
xor ecx, esp
nop
pop ecx
push ebx
add ebx, eax
mov ebx, 0x44c141c2
and ebx, ecx
sub ebx, ebx
pop ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x20]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
cmp eax, ebx
jne 0x10002f6e
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10003070
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x20]
push eax
push ecx
call esi
push eax
call edi
cmp eax, ebx
je 0x10003070
push 0x10027990
push ebx
push ebx
push 0x10008070
push ebx
push ebx
call eax
cmp eax, ebx
mov dword [0x1002798c], eax
je 0x10003070
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xfffffffe
jne 0x10003040
cmp dword [0x1002798c], ebx
je 0x10003070
mov edx, dword [0x10027990]
push ebx
push ebx
push 0x7ebc
push edx
mov dword [ebp - 4], ebx
call fcn.1000b410
add esp, 0x10
push edi
mov edi, 0xf4fa030d
mov edi, 0x75716f6f
xor edi, eax
add edi, esp
nop
pop edi
mov esi, dword [0x1002798c]
push 0xfa0
push esi
mov dword [0x1002798c], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xfffffffd
jne 0x10003065
cmp byte [0x10027ead], bl
je 0x10003070
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 1
sete al
mov byte [0x100270ac], al
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4