Function at 0x1000e370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e98
call fcn.10012ed0
push ebx
mov bl, 0x6c
mov al, 0x31
push esi
push edi
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], 0x5f
mov byte [ebp - 8], al
mov byte [ebp - 7], al
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], bl
mov byte [ebp - 3], bl
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], 0x49
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0
push ecx
add ecx, esp
add ecx, eax
xor ecx, esp
add ecx, eax
add ecx, esp
nop
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0xc]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
mov dword [ebp - 0x2c], eax
jne 0x1000e415
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000e415
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0xc]
push eax
push ecx
call esi
push eax
call edi
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6a
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], 0x57
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0
push ecx
mov ecx, 0x920d8908
add ecx, edx
sbb ecx, esp
sbb ecx, esi
pop ecx
lea edx, [ebp - 0x28]
lea eax, [ebp - 0xc]
push edx
push eax
call esi
push eax
call edi
test eax, eax
mov dword [ebp - 0x30], eax
jne 0x1000e477
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000e477
lea edx, [ebp - 0x28]
lea eax, [ebp - 0xc]
push edx
push eax
call esi
push eax
call edi
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6a
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], 0x46
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0
push edi
mov edi, 0xa15f1fe0
mov edi, 0xbbe742c
nop
pop edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0xc]
push ecx
push edx
call esi
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x1000e4df
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000e59b
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0xc]
push ecx
push edx
call esi
push eax
call edi
mov ebx, eax
test ebx, ebx
je 0x1000e59b
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x1000e59b
lea eax, [ebp - 0x4e98]
push eax
call dword [ebp - 0x2c]
push ecx
mov ecx, 0xfdfe0207
sbb ecx, edx
sbb ecx, esp
add ecx, esi
nop
pop ecx
test eax, eax
jne 0x1000e58f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov dword [ebp - 0x4e90], eax
neg edx
mov dword [ebp - 0x4e8c], edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x4e94], edx
lea edx, [eax + eax*2 + 3]
and edx, 0xfffffffc
lea edi, [eax + eax*2]
mov dword [ebp - 0x4e6c], eax
mov eax, dword [ebp + 0x1c]
sub edx, edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x4e48], eax
mov dword [ebp - 0x4e88], edx
mov edx, dword [edi]
mov dword [ebp - 0x4e68], ecx
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x4e98]
push 9
push eax
mov dword [ebp - 0x4e74], ecx
mov dword [ebp - 0x4e70], edx
call esi
lea ecx, [ebp - 0x4e98]
mov esi, eax
push ecx
call ebx
test esi, esi
jne 0x1000e58f
mov edx, dword [ebp - 0x4e70]
mov al, 1
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
sbb edx, esp
sbb edx, eax
add edx, esp
sbb edx, eax
sbb edx, esp
pop edx
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret