Function at 0x10002bce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x14
mov eax, 0x1003d7bd
call fcn.1003d39e
mov dword [ebp - 0x10], 1
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x10041857
call fcn.10003da0
xor edx, edx
mov dword [ebp - 4], edx
mov edi, dword [0x10056840]
mov dword [ebp - 0x10], 1
test edi, edi
je case.default.0x10002b98
cmp byte [0x100568bc], dl
je 0x10002a92
mov ecx, 0x10b8134
call fcn.1000d217
mov ebx, eax
test ebx, ebx
je 0x10002a90
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002a90
push 4
add ebx, 0x6e4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor edx, edx
test eax, eax
jne 0x10002a92
mov ax, word [ebx]
mov word [edi + 0x3e], ax
jmp 0x10002a92
xor edx, edx
movzx eax, word [edi + 0x3e]
mov ecx, 0xc9
cmp eax, ecx
ja 0x10002b83
je case.0x10002b98.205
sub eax, 0x65
cmp eax, 0xb
ja case.default.0x10002b98
movzx eax, byte [eax + 0x10002c79]
jmp dword [eax*4 + 0x10002c69]
mov cl, 0x76
mov dword [ebp - 0x20], 0x47464776
mov dword [ebp - 0x1c], 0x417015b
mov eax, edx
mov dword [ebp - 0x18], 0x4191f04
mov byte [ebp - 0x14], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x10002aee
mov cl, byte [ebp - 0x20]
jmp 0x10002adf
mov byte [ebp - 0x14], dl
jmp 0x10002c52
mov cl, 0x1f
mov dword [ebp - 0x20], 0x2d2f2e1f
mov dword [ebp - 0x1c], 0x78706d32
mov eax, edx
mov word [ebp - 0x18], 0x7a6a
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002b20
mov cl, byte [ebp - 0x20]
jmp 0x10002b11
mov byte [ebp - 0x16], dl
jmp 0x10002c52
mov cl, 0x18
mov dword [ebp - 0x20], 0x2b282918
mov dword [ebp - 0x1c], 0x7f797535
mov eax, edx
mov word [ebp - 0x18], 0x7d
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 8
jae 0x10002b4f
mov cl, byte [ebp - 0x20]
jmp 0x10002b40
mov byte [ebp - 0x17], dl
jmp 0x10002c52
mov cl, 0x30
mov dword [ebp - 0x20], 0x4000130
mov dword [ebp - 0x1c], 0x5942401d
mov eax, edx
mov dword [ebp - 0x18], 0x444355
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xa
jae 0x10002c4f
mov cl, byte [ebp - 0x20]
jmp 0x10002b70
sub eax, 0xca
cmp eax, 0xa
ja case.default.0x10002b98
movzx eax, byte [eax + 0x10002c95]
jmp dword [eax*4 + 0x10002c85]
mov cl, 0x4a
mov dword [ebp - 0x20], 0x7b7a784a
mov dword [ebp - 0x1c], 0x382b3d67
mov eax, edx
mov dword [ebp - 0x18], 0x38252338
mov byte [ebp - 0x14], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x10002aee
mov cl, byte [ebp - 0x20]
jmp 0x10002bbb
mov cl, 0x59
mov dword [ebp - 0x20], 0x6b696b59
mov dword [ebp - 0x1c], 0x3e362b74
mov eax, edx
mov word [ebp - 0x18], 0x3c2c
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002b20
mov cl, byte [ebp - 0x20]
jmp 0x10002be9
mov cl, 0x4e
mov dword [ebp - 0x20], 0x7d7e7c4e
mov dword [ebp - 0x1c], 0x292f2363
mov eax, edx
mov word [ebp - 0x18], 0x2b
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 8
jae 0x10002b4f
mov cl, byte [ebp - 0x20]
jmp 0x10002c14
mov cl, 0x29
mov dword [ebp - 0x20], 0x1d191b29
mov dword [ebp - 0x1c], 0x405b5904
mov eax, edx
mov dword [ebp - 0x18], 0x5d5a4c
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xa
jae 0x10002c4f
mov cl, byte [ebp - 0x20]
jmp 0x10002c40
mov byte [ebp - 0x15], dl
lea eax, [ebp - 0x1f]
mov ecx, esi
push eax
call fcn.10003b50
mov eax, esi
call fcn.1003d37b
ret 4