Function at 0x1000df39
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f9e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
and dword [ebp - 0x30], 0
push 0x10038208
lea ecx, [ebp - 0x10]
call fcn.1000f833
and dword [ebp - 4], 0
mov ax, word [0x10038208]
mov word [ebp - 0x25c], ax
push 0x206
push 0
lea eax, [ebp - 0x25a]
push eax
call fcn.10014720
add esp, 0xc
push 0x104
lea eax, [ebp - 0x25c]
push eax
push 0
call fcn.1000db32
add esp, 0xc
push 2
pop eax
imul eax, eax, 5
push 0x70
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0xa
push 0x6c
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 6
push 0x69
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 7
push 0x2e
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 1
push 0x6c
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 9
push 0x6c
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0
push 0x53
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0xb
xor ecx, ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 3
push 0x64
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 3
push 0x77
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 0
push 0x68
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 2
push 0x61
pop ecx
mov word [ebp + eax - 0x54], cx
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1000e1ae
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x24], 0x50
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x24], 0x65
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x24], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x24], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x24], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x24], 0x4e
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x24], 0x74
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x24], 0x64
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x24], 0x46
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x24], 0x57
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x24], 0x61
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x24], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x24], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x24], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x24], 0x65
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x24], 0x69
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x24], 0x46
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x24], 0x68
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1000e1a5
lea eax, [ebp - 0x25c]
push eax
call dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000f81a
push 2
pop eax
imul eax, eax, 0
push 0x2e
pop ecx
mov word [ebp + eax - 0x3c], cx
push 2
pop eax
shl eax, 2
xor ecx, ecx
mov word [ebp + eax - 0x3c], cx
push 2
pop eax
imul eax, eax, 3
push 0x65
pop ecx
mov word [ebp + eax - 0x3c], cx
push 2
pop eax
shl eax, 0
push 0x65
pop ecx
mov word [ebp + eax - 0x3c], cx
push 2
pop eax
shl eax, 1
push 0x78
pop ecx
mov word [ebp + eax - 0x3c], cx
push 0x10038208
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000dd77
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000e83f
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1000f8ee
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret