Function at 0x10002990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029571
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x68
push esi
push edi
mov eax, dword [0x1003a04c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x14
call fcn.1000d010
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov ecx, dword [ecx]
mov edi, dword [ecx + 0x18]
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
cmp byte [0x1003c1e9], 0
jne 0x10002a40
call fcn.1000b070
cmp dword [0x1003c218], 0
jne 0x10002a30
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1003c218], eax
xor eax, eax
mov ecx, 0x1003c214
xchg dword [ecx], eax
mov byte [0x1003c1e9], 1
push esi
mov edx, 0x100025a0
mov ecx, edi
call fcn.1000b0c0
lea ecx, [esi + 0xc]
test ecx, ecx
je 0x10002a6e
test edi, edi
je 0x10002a64
mov eax, dword [edi]
mov dword [ecx], eax
mov al, byte [edi + 4]
mov byte [ecx + 4], al
jmp 0x10002a7e
mov dword [ecx], 0
mov byte [ecx + 4], 0
call fcn.10011dcd
mov dword [eax], 0x16
call fcn.10011baf
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 4], esi
mov ecx, dword [esi + 4]
call fcn.1000b520
push 0x14
call fcn.1000d010
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov eax, dword [ebx + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 4], 2
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov ecx, dword [eax]
mov edi, dword [ecx + 0x14]
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov byte [ebp - 4], 3
cmp byte [0x1003c1ea], 0
jne 0x10002b05
call fcn.1000b070
cmp dword [0x1003c218], 0
jne 0x10002af5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1003c218], eax
xor eax, eax
mov ecx, 0x1003c214
xchg dword [ecx], eax
mov byte [0x1003c1ea], 1
push esi
mov edx, 0x100025c0
mov ecx, edi
call fcn.1000b0c0
lea ecx, [esi + 0xc]
test ecx, ecx
je 0x10002b33
test edi, edi
je 0x10002b29
mov eax, dword [edi]
mov dword [ecx], eax
mov al, byte [edi + 4]
mov byte [ecx + 4], al
jmp 0x10002b43
mov dword [ecx], 0
mov byte [ecx + 4], 0
call fcn.10011dcd
mov dword [eax], 0x16
call fcn.10011baf
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 8], esi
mov ecx, dword [esi + 4]
call fcn.1000b520
mov dword [ebp - 0x70], 0xb3ebf1f7
mov dword [ebp - 0x6c], 0xfa315355
mov dword [ebp - 0x68], 0xb9f5dc68
mov dword [ebp - 0x64], 0x25163f25
mov dword [ebp - 0x60], 0x41024b8e
mov dword [ebp - 0x5c], 0xf4c9b380
mov dword [ebp - 0x58], 0x6061892d
mov dword [ebp - 0x54], 0xaf1055a
movaps xmm1, xmmword [ebp - 0x70]
mov dword [ebp - 0x50], 0xeca6a7bd
mov dword [ebp - 0x4c], 0x93573611
mov dword [ebp - 0x48], 0xd5b6b906
mov dword [ebp - 0x44], 0x72654c44
pxor xmm1, xmmword [ebp - 0x50]
movaps xmmword [ebp - 0x70], xmm1
movaps xmm1, xmmword [ebp - 0x60]
mov dword [ebp - 0x40], 0x126a3fe7
mov dword [ebp - 0x3c], 0x97bbc6ef
mov dword [ebp - 0x38], 0x60618948
mov dword [ebp - 0x34], 0xaf1055a
pxor xmm1, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x60], xmm1
mov dword [ebp - 0x30], 0xc2cbd1d7
mov dword [ebp - 0x2c], 0x933b5a75
mov dword [ebp - 0x28], 0xd5b6b906
mov dword [ebp - 0x24], 0x72654c44
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x40], 0xeca6a7bd
mov dword [ebp - 0x3c], 0x93573611
mov dword [ebp - 0x38], 0xd5b6b906
mov dword [ebp - 0x34], 0x72654c44
pxor xmm1, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x30], xmm1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 4
mov eax, dword [0x1003ad68]
push ecx
call eax
mov ecx, eax
test ecx, ecx
jne 0x10002c43
xor edi, edi
jmp 0x10002c51
mov eax, dword [0x1003ad78]
lea edx, [ebp - 0x70]
push edx
push ecx
call eax
mov edi, eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10002d04
push 0x14
call fcn.1000d010
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 5
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov byte [ebp - 4], 6
cmp byte [0x1003c1eb], 0
jne 0x10002cbf
call fcn.1000b070
cmp dword [0x1003c218], 0
jne 0x10002caf
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1003c218], eax
xor eax, eax
mov ecx, 0x1003c214
xchg dword [ecx], eax
mov byte [0x1003c1eb], 1
push esi
mov edx, 0x10002610
mov ecx, edi
call fcn.1000b0c0
lea ecx, [esi + 0xc]
test ecx, ecx
jne 0x10002ce5
call fcn.10011dcd
mov dword [eax], 0x16
call fcn.10011baf
jmp 0x10002cef
mov eax, dword [edi]
mov dword [ecx], eax
mov al, byte [edi + 4]
mov byte [ecx + 4], al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 0xc], esi
mov ecx, dword [esi + 4]
call fcn.1000b520
push 0x14
call fcn.1000d010
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 7
xorps xmm0, xmm0
mov edi, dword [0x1003ad78]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov byte [ebp - 4], 8
cmp byte [0x1003c1ec], 0
jne 0x10002d69
call fcn.1000b070
cmp dword [0x1003c218], 0
jne 0x10002d59
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1003c218], eax
xor eax, eax
mov ecx, 0x1003c214
xchg dword [ecx], eax
mov byte [0x1003c1ec], 1
push esi
mov edx, 0x10002690
mov ecx, edi
call fcn.1000b0c0
lea ecx, [esi + 0xc]
test ecx, ecx
je 0x10002d97
test edi, edi
je 0x10002d8d
mov eax, dword [edi]
mov dword [ecx], eax
mov al, byte [edi + 4]
mov byte [ecx + 4], al
jmp 0x10002da7
mov dword [ecx], 0
mov byte [ecx + 4], 0
call fcn.10011dcd
mov dword [eax], 0x16
call fcn.10011baf
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 0x10], esi
mov ecx, dword [esi + 4]
call fcn.1000b520
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc