Function at 0x10011a6e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1001181e
jmp 0x10011819
call fcn.10011820
jae 0x10011819
add esp, 4
jmp 0x10011825
dec dword [esp]
jno 0x1001182a
jns 0x10011815
jp 0x1001182e
add esp, 4
popf
jmp 0x10011835
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001184e
jne 0x1001184e
call 0x1fc14ba2
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x38], 0x4d
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 0x20
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x68
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x6b
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x73
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x7a
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x20
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x25
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0
push 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x4a0]
push ecx
call fcn.10010af0
add esp, 0xc
lea edx, [ebp - 0x38]
push edx
call fcn.10021b20
add esp, 4
xor eax, eax
test eax, eax
je 0x10011951
jne 0x10011950
call 0x930509d8
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001195f
jmp 0x10011961
je 0x1001195c
clc
jae 0x10011966
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x1001196b
jne 0x1001196b
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x10011978
jmp 0x10011973
call 0x1001197a
jae 0x10011973
add esp, 4
jmp 0x1001197f
dec dword [esp]
jno 0x10011984
jns 0x1001196f
jp 0x10011988
add esp, 4
popf
jmp 0x1001198f
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100119a8
jne 0x100119a8
call 0x1fc14cfc
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10021e20
clc
jae 0x100119c3
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x100119d0
jmp 0x100119cb
call 0x100119d2
jae 0x100119cb
add esp, 4
jmp 0x100119d7
dec dword [esp]
jno 0x100119dc
jns 0x100119c7
jp 0x100119e0
add esp, 4
popf
jmp 0x100119e7
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011a00
jne 0x10011a00
lcall 0x749a, 0x3eb037c
sti
jl 0x10011a05
jmp 0x10011a07
je 0x10011a02
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011a21
jne 0x10011a20
call 0x93050aa8
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10011a2f
jne 0x10011a2f
call 0x50957b6
pop es
adc byte [eax], al
cmp dword [0x1007f508], 0
jne 0x10011c7d
xor eax, eax
test eax, eax
je 0x10011a45
jne 0x10011a44
call 0x93050acc
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
test byte [ebx + edi*8 - 8], dh
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011a53
jmp 0x10011a55
je 0x10011a50
clc
jae 0x10011a5a
ja 0x100119de
je 0x10011a5f
jne 0x10011a5f
test byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10011a6c
jmp 0x10011a67
call 0x10011a6e
jae 0x10011a67
add esp, 4
jmp 0x10011a73
dec dword [esp]
jno 0x10011a78
jns 0x10011a63
jp 0x10011a7c
add esp, 4
popf
jmp 0x10011a83
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011a9c
jne 0x10011a9c
call 0x1fc14df0
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0x6c], 0x4d
mov byte [ebp - 0x6b], 0x61
mov byte [ebp - 0x6a], 0x63
mov byte [ebp - 0x69], 0x72
mov byte [ebp - 0x68], 0x6f
mov byte [ebp - 0x67], 0x20
mov byte [ebp - 0x66], 0x63
mov byte [ebp - 0x65], 0x68
mov byte [ebp - 0x64], 0x65
mov byte [ebp - 0x63], 0x63
mov byte [ebp - 0x62], 0x6b
mov byte [ebp - 0x61], 0x65
mov byte [ebp - 0x60], 0x72
mov byte [ebp - 0x5f], 0x20
mov byte [ebp - 0x5e], 0x69
mov byte [ebp - 0x5d], 0x73
mov byte [ebp - 0x5c], 0x20
mov byte [ebp - 0x5b], 0x6e
mov byte [ebp - 0x5a], 0x6f
mov byte [ebp - 0x59], 0x74
mov byte [ebp - 0x58], 0x20
mov byte [ebp - 0x57], 0x69
mov byte [ebp - 0x56], 0x6e
mov byte [ebp - 0x55], 0x69
mov byte [ebp - 0x54], 0x74
mov byte [ebp - 0x53], 0x69
mov byte [ebp - 0x52], 0x61
mov byte [ebp - 0x51], 0x6c
mov byte [ebp - 0x50], 0x69
mov byte [ebp - 0x4f], 0x7a
mov byte [ebp - 0x4e], 0x65
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x4c], 0x20
mov byte [ebp - 0x4b], 0x6f
mov byte [ebp - 0x4a], 0x72
mov byte [ebp - 0x49], 0x20
mov byte [ebp - 0x48], 0x74
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x6d
mov byte [ebp - 0x44], 0x69
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x42], 0x61
mov byte [ebp - 0x41], 0x74
mov byte [ebp - 0x40], 0x65
mov byte [ebp - 0x3f], 0x64
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x25
mov byte [ebp - 0x3c], 0x64
mov byte [ebp - 0x3b], 0
push 2
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x8a0]
push ecx
call fcn.10010af0
add esp, 0xc
lea edx, [ebp - 0x6c]
push edx
call fcn.10021b20
add esp, 4
xor eax, eax
test eax, eax
je 0x10011b9f
jne 0x10011b9e
call 0x93050c26
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011bad
jmp 0x10011baf
je 0x10011baa
clc
jae 0x10011bb4
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x10011bb9
jne 0x10011bb9
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x10011bc6
jmp 0x10011bc1
call 0x10011bc8
jae 0x10011bc1
add esp, 4
jmp 0x10011bcd
dec dword [esp]
jno 0x10011bd2
jns 0x10011bbd
jp 0x10011bd6
add esp, 4
popf
jmp 0x10011bdd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011bf6
jne 0x10011bf6
call 0x1fc14f4a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10021e20
clc
jae 0x10011c11
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10011c1e
jmp 0x10011c19
call 0x10011c20
jae 0x10011c19
add esp, 4
jmp 0x10011c25
dec dword [esp]
jno 0x10011c2a
jns 0x10011c15
jp 0x10011c2e
add esp, 4
popf
jmp 0x10011c35
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011c4e
jne 0x10011c4e
lcall 0x749a, 0x3eb037c
sti
jl 0x10011c53
jmp 0x10011c55
je 0x10011c50
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011c6f
jne 0x10011c6e
call 0x93050cf6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10011c7d
jne 0x10011c7d
call 0x5055a04
pop es
adc byte [eax], al
cmp dword [0x1007f504], 0
jne 0x10011c93
cmp dword [0x1007f508], 0
je 0x10011f6d
push 0
push 0
push 0
lea eax, [ebp - 0xde8]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x10011cc6
lea ecx, [ebp - 0xde8]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0xde8]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x10011c93
xor eax, eax
test eax, eax
je 0x10011ccf
jne 0x10011cce
call 0x93050d56
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
test byte [ebx + edi*8 - 8], dh
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011cdd
jmp 0x10011cdf
je 0x10011cda
clc
jae 0x10011ce4
ja 0x10011c68
je 0x10011ce9
jne 0x10011ce9
test byte [esi - 0x64], ah
pushf
push 0xa
jae 0x10011cf6
jmp 0x10011cf1
call 0x10011cf8
jae 0x10011cf1
add esp, 4
jmp 0x10011cfd
dec dword [esp]
jno 0x10011d02
jns 0x10011ced
jp 0x10011d06
add esp, 4
popf
jmp 0x10011d0d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011d26
jne 0x10011d26
call 0x1fc1507a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov byte [ebp - 0xa0], 0x4d
mov byte [ebp - 0x9f], 0x61
mov byte [ebp - 0x9e], 0x63
mov byte [ebp - 0x9d], 0x72
mov byte [ebp - 0x9c], 0x6f
mov byte [ebp - 0x9b], 0x20
mov byte [ebp - 0x9a], 0x63
mov byte [ebp - 0x99], 0x68
mov byte [ebp - 0x98], 0x65
mov byte [ebp - 0x97], 0x63
mov byte [ebp - 0x96], 0x6b
mov byte [ebp - 0x95], 0x65
mov byte [ebp - 0x94], 0x72
mov byte [ebp - 0x93], 0x20
mov byte [ebp - 0x92], 0x69
mov byte [ebp - 0x91], 0x73
mov byte [ebp - 0x90], 0x20
mov byte [ebp - 0x8f], 0x6e
mov byte [ebp - 0x8e], 0x6f
mov byte [ebp - 0x8d], 0x74
mov byte [ebp - 0x8c], 0x20
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x6e
mov byte [ebp - 0x89], 0x69
mov byte [ebp - 0x88], 0x74
mov byte [ebp - 0x87], 0x69
mov byte [ebp - 0x86], 0x61
mov byte [ebp - 0x85], 0x6c
mov byte [ebp - 0x84], 0x69
mov byte [ebp - 0x83], 0x7a
mov byte [ebp - 0x82], 0x65
mov byte [ebp - 0x81], 0x64
mov byte [ebp - 0x80], 0x20
mov byte [ebp - 0x7f], 0x6f
mov byte [ebp - 0x7e], 0x72
mov byte [ebp - 0x7d], 0x20
mov byte [ebp - 0x7c], 0x74
mov byte [ebp - 0x7b], 0x65
mov byte [ebp - 0x7a], 0x72
mov byte [ebp - 0x79], 0x6d
mov byte [ebp - 0x78], 0x69
mov byte [ebp - 0x77], 0x6e
mov byte [ebp - 0x76], 0x61
mov byte [ebp - 0x75], 0x74
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x73], 0x64
mov byte [ebp - 0x72], 0x2e
mov byte [ebp - 0x71], 0x25
mov byte [ebp - 0x70], 0x64
mov byte [ebp - 0x6f], 0
push 3
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xca0]
push ecx
call fcn.10010af0
add esp, 0xc
lea edx, [ebp - 0xa0]
push edx
call fcn.10021b20
add esp, 4
xor eax, eax
test eax, eax
je 0x10011e8f
jne 0x10011e8e
call 0x93050f16
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
sal dword [ebx + edi*8 - 8], 1
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011e9d
jmp 0x10011e9f
je 0x10011e9a
clc
jae 0x10011ea4
cwde
sal dword [ebx + eax + 0x75], 1
add ecx, edx
je 0x10011ea9
jne 0x10011ea9
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x10011eb6
jmp 0x10011eb1
call 0x10011eb8
jae 0x10011eb1
add esp, 4
jmp 0x10011ebd
dec dword [esp]
jno 0x10011ec2
jns 0x10011ead
jp 0x10011ec6
add esp, 4
popf
jmp 0x10011ecd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011ee6
jne 0x10011ee6
call 0x1fc1523a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10021e20
clc
jae 0x10011f01
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10011f0e
jmp 0x10011f09
call 0x10011f10
jae 0x10011f09
add esp, 4
jmp 0x10011f15
dec dword [esp]
jno 0x10011f1a
jns 0x10011f05
jp 0x10011f1e
add esp, 4
popf
jmp 0x10011f25
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011f3e
jne 0x10011f3e
lcall 0x749a, 0x3eb037c
sti
jl 0x10011f43
jmp 0x10011f45
je 0x10011f40
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011f5f
jne 0x10011f5e
call 0x93050fe6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10011f6d
jne 0x10011f6d
call 0x17f62412
adc byte [eax - 1], dl
adc eax, sym.imp.USER32.dll_UnhookWindowsHookEx
mov eax, dword [0x1007f504]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x1007f508]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret 4