Function at 0x100525e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x3c], ecx
jl 0x100525bb
jmp 0x100525bd
je 0x100525b8
xor eax, eax
test eax, eax
je 0x100525c6
jne 0x100525c5
call 0x9309164d
rol byte [ebx + eax*4], 0xf0
add eax, 0x8a0273f8
add byte [ebx + eax + 0x75], dh
add dword [eax], eax
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x100525d4
mov al, byte [eax]
je 0x100525d9
jne 0x100525d9
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x100525e6
jmp 0x100525e1
call 0x100525e8
jae 0x100525e1
add esp, 4
jmp 0x100525ed
dec dword [esp]
jno 0x100525f2
jns 0x100525dd
jp 0x100525f6
add esp, 4
popf
jmp 0x100525fd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10052616
jne 0x10052616
call 0x1fc5596a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 3
push 0
push 0x1005b8e0
mov ecx, dword [0x101034c4]
call fcn.1004e9c0
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1005272d
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], pe_nt_image_headers32
mov byte [ebp - 7], 0x33
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d3f4f
push 0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
pushf
push 0xa
jae 0x1005273a
jmp 0x10052735
call 0x1005273c
jae 0x10052735
add esp, 4
jmp 0x10052741
dec dword [esp]
jno 0x10052746
jns 0x10052731
jp 0x1005274a
add esp, 4
popf
jmp 0x10052751
clc
jae 0x10052756
sub bh, byte [ecx + 0x50]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1005276f
jne 0x1005276f
jns 0x100527ec
jl 0x10052774
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x10052776
je 0x10052771
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10052790
jne 0x1005278f
call 0x93091817
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1005279e
jne 0x1005279e
call 0x6fcd6d2d
mov eax, dword [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret
and al, 0x71
add byte [ecx - 0x17], bh
jp 0x100527f3
add esp, 4
popf
jmp 0x100527fa
clc
jae 0x100527ff
mov ah, 0x79
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10052818
jne 0x10052818
jns 0x10052895
jl 0x1005281d
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x1005281f
je 0x1005281a
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10052839
jne 0x10052838
call 0x930918c0
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10052847
jne 0x10052847
call 0x60d16dd8
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
call fcn.10007e30
push eax
call fcn.10051d70
add esp, 8
test eax, eax
jne 0x10052869
mov dword [ebp - 0x3c], 1
jmp 0x10052870
mov dword [ebp - 0x3c], 0
mov cl, byte [ebp - 0x3c]
mov byte [ebp - 0x35], cl
movzx edx, byte [ebp - 0x35]
test edx, edx
jne 0x100528c7
mov ecx, dword [ebp + 8]
call fcn.10007e30
push eax
mov eax, dword [0x101034a4]
mov ecx, dword [eax + 0x180]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x40]
call dword [0x100e7c9c]
call dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffff
je 0x100528bb
mov edx, dword [ebp - 0x44]
and edx, 0x10
jne 0x100528bb
mov dword [ebp - 0x48], 1
jmp 0x100528c2
mov dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
jmp 0x100528ca
mov al, byte [ebp - 0x35]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret 4