Function at 0x10017200
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x100e0804]
sub esp, 0x24
mov eax, dword [ecx]
push esi
push edi
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100176c5
cmp dword [0x10117a8c], 0
je 0x100176c5
mov esi, dword [ebp + 0x18]
xor edx, edx
movaps xmm0, xmmword [0x10089b40]
mov ecx, edx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x1d001b0e
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x10], 0x21d0e30
mov word [ebp - 0xc], 0x1c
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x18
jb 0x10017253
lea eax, [ebp - 0x23]
mov byte [ebp - 0xb], dl
push eax
add edi, 4
push edi
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
mov dword [ebp - 8], eax
mov cl, 0x6b
mov dword [ebp - 0x10], 0x6190a6b
xor eax, eax
mov word [ebp - 0xc], 0x18
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 4
jae 0x10017295
mov cl, byte [ebp - 0x10]
jmp 0x10017286
lea eax, [ebp - 0xf]
mov byte [ebp - 0xb], 0
push eax
push edi
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
je 0x100172b3
cmp dword [ebp - 8], 0
mov byte [ebp - 1], 1
je 0x100172b7
mov byte [ebp - 1], 0
mov cl, 0x5c
mov dword [ebp - 0x18], 0x3d392b5c
mov dword [ebp - 0x14], 0x2f32332c
xor eax, eax
mov dword [ebp - 0x10], 0x32a73
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xa
jae 0x100172df
mov cl, byte [ebp - 0x18]
jmp 0x100172d0
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
push edi
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
je 0x100172fd
cmp byte [ebp - 1], 0
mov byte [ebp - 2], 1
je 0x10017301
mov byte [ebp - 2], 0
mov cl, 0xd
mov dword [ebp - 0x1c], 0x6962600d
mov dword [ebp - 0x18], 0x227e6168
xor eax, eax
mov dword [ebp - 0x14], 0x746c617d
mov word [ebp - 0x10], 0x7f68
mov byte [ebp - 0xe], 0
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xd
jae 0x10017333
mov cl, byte [ebp - 0x1c]
jmp 0x10017324
lea eax, [ebp - 0x1b]
mov byte [ebp - 0xe], 0
push eax
push edi
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
mov dword [ebp - 8], eax
mov cl, 0x24
mov dword [ebp - 0x14], 0x41485724
xor eax, eax
mov dword [ebp - 0x10], 0x415241
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 6
jae 0x10017367
mov cl, byte [ebp - 0x14]
jmp 0x10017358
lea eax, [ebp - 0x13]
mov byte [ebp - 0xd], 0
push eax
push edi
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
mov ecx, dword [0x100e0800]
push dword [esi + 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
cmp dword [ebp - 8], 0
mov edi, eax
je 0x1001753d
push dword [0x100df12c]
push dword [0x100e0b00]
call fcn.1007c579
pop ecx
pop ecx
test al, al
je 0x1001753d
test edi, edi
je 0x100176c5
mov ecx, edi
call fcn.1000e789
cmp dword [eax], 0
jle 0x100176c5
lea ecx, [edi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
test al, al
jne 0x100176c5
mov ecx, dword [0x10117a8c]
cmp edi, ecx
je 0x100176c5
call fcn.1000ede7
mov ecx, edi
mov esi, eax
call fcn.1000ede7
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x100176c5
cmp byte [0x100e0b0c], 0
je 0x10017449
push 0x100df140
lea ecx, [ebp - 0x1c]
call fcn.10009ae7
sub esp, 0x10
mov esi, eax
mov edi, esp
push dword [0x100e0b10]
movsd dword es:[edi], dword [esi]
push 0
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10016f9f
mov esi, dword [ebp + 0x18]
add esp, 0x1c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x20]
jmp 0x1001744c
mov esi, dword [ebp + 0x18]
cmp byte [0x100e0b1c], 0
je 0x1001749b
push 0x100df160
lea ecx, [ebp - 0x1c]
call fcn.10009ae7
sub esp, 0x10
mov esi, eax
movzx eax, byte [0x100e0b04]
mov edi, esp
push dword [0x100e0b20]
movsd dword es:[edi], dword [esi]
push eax
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100170a7
mov esi, dword [ebp + 0x18]
add esp, 0x1c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x20]
mov ecx, dword [0x100e0afc]
xor edx, edx
push edx
push edx
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [0x100e0b05], 0
je 0x100174f4
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x20]
push 0x100df130
lea ecx, [ebp - 0x1c]
call fcn.10009ae7
sub esp, 0x10
mov esi, eax
mov edi, esp
push dword [0x100e0b08]
movsd dword es:[edi], dword [esi]
push 0
push 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10016f9f
mov esi, dword [ebp + 0x18]
add esp, 0x1c
cmp byte [0x100e0b14], 0
je 0x100176c5
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x20]
push 0x100df150
lea ecx, [ebp - 0x1c]
call fcn.10009ae7
sub esp, 0x10
mov esi, eax
movzx eax, byte [0x100e0b04]
mov edi, esp
push dword [0x100e0b18]
push eax
push 0
jmp 0x100176b9
cmp byte [ebp - 1], 0
je 0x100175ff
mov al, byte [0x100e0b24]
test al, al
je 0x100175a4
cmp byte [0x100e0b26], 0
je 0x1001756c
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x20]
push 0x100df170
lea ecx, [ebp - 0x1c]
call fcn.10009ae7
sub esp, 0x10
mov esi, eax
movzx eax, byte [0x100e0b25]
mov edi, esp
push dword [0x100e0b28]
movsd dword es:[edi], dword [esi]
push 0
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10016f9f
mov al, byte [0x100e0b24]
add esp, 0x1c
mov esi, dword [ebp + 0x18]
cmp byte [0x100e0b2c], 0
je 0x100176c5
cmp byte [0x100e0b26], 0
jne 0x100175be
test al, al
je 0x100175d1
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x20]
push 0x100df180
lea ecx, [ebp - 0x1c]
call fcn.10009ae7
sub esp, 0x10
mov esi, eax
movzx eax, byte [0x100e0b2d]
mov edi, esp
push dword [0x100e0b30]
push eax
movzx eax, byte [0x100e0b25]
jmp 0x100176b8
cmp byte [ebp - 2], 0
je 0x100176c5
mov al, byte [0x100e0b34]
test al, al
je 0x10017666
cmp byte [0x100e0b36], 0
je 0x1001762e
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x20]
push 0x100df190
lea ecx, [ebp - 0x1c]
call fcn.10009ae7
sub esp, 0x10
mov esi, eax
movzx eax, byte [0x100e0b35]
mov edi, esp
push dword [0x100e0b38]
movsd dword es:[edi], dword [esi]
push 0
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10016f9f
mov al, byte [0x100e0b34]
add esp, 0x1c
mov esi, dword [ebp + 0x18]
cmp byte [0x100e0b3c], 0
je 0x100176c5
cmp byte [0x100e0b36], 0
jne 0x1001767c
test al, al
je 0x1001768f
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x20]
push 0x100df1a0
lea ecx, [ebp - 0x1c]
call fcn.10009ae7
sub esp, 0x10
mov esi, eax
movzx eax, byte [0x100e0b3d]
mov edi, esp
push dword [0x100e0b40]
push eax
movzx eax, byte [0x100e0b35]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100170a7
add esp, 0x1c
pop edi
pop esi
leave
ret