Function at 0x1165910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x678
push esi
push edi
mov dword [ebp - 0x664], ecx
movzx eax, word [ebp + 0x14]
mov ecx, dword [ebp - 0x664]
imul eax, dword [ecx + 8]
push eax
call fcn.0108d7a0
add esp, 4
mov dword [ebp - 0x65c], eax
mov edx, dword [ebp - 0x65c]
mov dword [ebp - 4], edx
movzx eax, word [ebp + 0x14]
mov ecx, dword [ebp - 0x664]
imul eax, dword [ecx + 8]
push eax
push 0
mov edx, dword [ebp - 4]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x228], 0
xor eax, eax
mov dword [ebp - 0x226], eax
mov dword [ebp - 0x222], eax
mov dword [ebp - 0x21e], eax
mov word [ebp - 0x21a], ax
lea ecx, [ebp - 0x228]
push ecx
call fcn.0108fe80
mov ecx, 0x80
mov esi, 0x11c5988
lea edi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x664]
mov ax, word [edx + 8]
mov word [ebp - 0x20d], ax
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 0xa8]
mov word [ebp - 0x200], dx
mov eax, dword [ebp + 8]
mov cx, word [eax + 0xa6]
mov word [ebp - 0x1fe], cx
mov edx, dword [ebp + 8]
mov al, byte [edx + 0xa4]
mov byte [ebp - 0x20b], al
mov cx, word [ebp + 0x14]
mov word [ebp - 0x20a], cx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x1f4], edx
mov byte [ebp - 0x208], 2
mov word [ebp - 0x207], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x1fc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1f8], eax
mov word [ebp - 0x205], 0
mov dword [ebp - 0x1ec], 2
mov byte [ebp - 0x203], 0xf8
mov word [ebp - 0x202], 0
mov word [ebp - 0x1f0], 0
mov word [ebp - 0x1ee], 0
mov word [ebp - 0x1e8], 1
mov word [ebp - 0x1e6], 6
xor ecx, ecx
mov dword [ebp - 0x1e4], ecx
mov dword [ebp - 0x1e0], ecx
mov dword [ebp - 0x1dc], ecx
mov byte [ebp - 0x1d8], 0x80
mov byte [ebp - 0x1d7], 0
mov byte [ebp - 0x1d6], 0x29
movzx edx, word [ebp - 0x226]
imul edx, edx, 0x64
movzx eax, word [ebp - 0x222]
add edx, eax
movzx ecx, word [ebp - 0x21c]
imul ecx, ecx, 0x64
add edx, ecx
movzx eax, word [ebp - 0x21a]
add edx, eax
mov word [ebp - 0x18], dx
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x220]
imul edx, edx, 0x64
add ecx, edx
movzx eax, word [ebp - 0x21e]
add ecx, eax
mov word [ebp - 0x14], cx
movzx ecx, word [ebp - 0x18]
and ecx, 0xffff
movzx edx, cx
movzx eax, word [ebp - 0x14]
and eax, 0xffff
movzx ecx, ax
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x1d5], edx
mov edx, dword [ebp + 8]
add edx, 0x20
mov dword [ebp - 0x668], edx
mov eax, dword [ebp - 0x668]
add eax, 2
mov dword [ebp - 0x66c], eax
mov ecx, dword [ebp - 0x668]
mov dx, word [ecx]
mov word [ebp - 0x66e], dx
add dword [ebp - 0x668], 2
cmp word [ebp - 0x66e], 0
jne 0x1165b21
mov eax, dword [ebp - 0x668]
sub eax, dword [ebp - 0x66c]
sar eax, 1
mov dword [ebp - 0x674], eax
je 0x1165bc8
mov byte [ebp - 0x248], 0
xor ecx, ecx
mov dword [ebp - 0x247], ecx
mov dword [ebp - 0x243], ecx
mov dword [ebp - 0x23f], ecx
mov dword [ebp - 0x23b], ecx
mov dword [ebp - 0x237], ecx
mov dword [ebp - 0x233], ecx
mov dword [ebp - 0x22f], ecx
mov word [ebp - 0x22b], cx
mov byte [ebp - 0x229], cl
push 0x20
mov edx, dword [ebp + 8]
add edx, 0x20
push edx
lea eax, [ebp - 0x248]
push eax
call sub.ntdll.dll_wcstombs
add esp, 0xc
push 0xb
lea ecx, [ebp - 0x248]
push ecx
lea edx, [ebp - 0x1d1]
push edx
call sub.ntdll.dll_strncpy
add esp, 0xc
mov dword [ebp - 0x10], 0x33544146
mov dword [ebp - 0xc], 0x20202032
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c6], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c2], ecx
mov ecx, 0x80
lea esi, [ebp - 0x218]
mov edi, dword [ebp - 4]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x664]
mov edi, dword [edx + 8]
imul edi, edi, 6
add edi, dword [ebp - 4]
mov ecx, 0x80
lea esi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
push 0x200
push 0
lea eax, [ebp - 0x658]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push 0
lea ecx, [ebp - 0x450]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x458], 0xaa550000
mov dword [ebp - 0x24c], 0x41615252
mov dword [ebp - 0x454], 0x61417272
mov dword [ebp - 0x658], 0x41615252
mov dword [ebp - 0x45c], 0xaa550000
mov dword [ebp - 0x474], 0x61417272
mov edx, dword [ebp + 0x1c]
sub edx, 1
mov eax, dword [ebp + 0x20]
sbb eax, 0
mov dword [ebp - 0x470], edx
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x46c], ecx
mov dword [ebp - 0x254], 0xaa550000
mov edx, dword [ebp - 0x664]
mov edi, dword [ebp - 4]
add edi, dword [edx + 8]
mov ecx, 0x80
lea esi, [ebp - 0x658]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x664]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 4]
lea edi, [edx + ecx*2]
mov ecx, 0x80
lea esi, [ebp - 0x450]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x664]
mov edi, dword [eax + 8]
imul edi, edi, 7
add edi, dword [ebp - 4]
mov ecx, 0x80
lea esi, [ebp - 0x658]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x664]
mov edx, dword [ecx + 8]
mov eax, dword [ebp - 4]
lea edi, [eax + edx*8]
mov ecx, 0x80
lea esi, [ebp - 0x450]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x664]
mov edi, dword [ecx + 8]
imul edi, edi, 0xc
add edi, dword [ebp - 4]
mov ecx, 0x80
mov esi, 0x11c5d88
rep movsd dword es:[edi], dword [esi]
movzx eax, word [ebp + 0x14]
cdq
push edx
push eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [edx + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.01165160
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x660]
push edx
call fcn.0108d7c0
add esp, 4
cmp dword [ebp - 8], 0
jne 0x1165db3
call fcn.010947d0
mov dword [ebp - 0x678], eax
push 0x259
push 0x1013594
call fcn.01164f50
push eax
push 0x1013368
mov eax, dword [ebp - 0x678]
push eax
mov ecx, dword [ebp - 0x678]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
push 0x69
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
call eax
xor eax, eax
jmp 0x1165db8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x24