Function at 0x1002bb20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
push esi
mov esi, ecx
mov dword [esp + 0x10], 0x4192c6b
push edi
mov dword [esp + 0x28], esi
mov dl, 0x6b
mov dword [esp + 0x18], 0x27341b1e
xor ecx, ecx
mov dword [esp + 0x1c], 0x5220c04
mov byte [esp + 0x20], 0
lea eax, [esp + 0x15]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x1002bb65
mov dl, byte [esp + 0x14]
jmp 0x1002bb52
xorps xmm0, xmm0
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x15]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bb90
sub ecx, edx
lea eax, [esp + 0x15]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002540
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x2c], edi
je 0x1002bc2c
test edi, edi
je 0x1002bc2c
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002bc2c
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x14], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002bc28
cmp esi, dword [edi + 0xc4]
jne 0x1002bbe3
call fcn.10084bcf
mov edi, dword [esi + 8]
test edi, edi
je 0x1002bc0f
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002bbf5
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002bc5f
mov edi, dword [esp + 0x2c]
cmp esi, dword [edi + 0xc4]
jne 0x1002bc20
call fcn.10084bcf
mov esi, dword [esi]
cmp esi, dword [esp + 0x14]
jne 0x1002bbd6
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 4], edi
cmp ecx, 0xf
jbe 0x1002bc6f
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002bc65
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c21b
jmp 0x1002bc65
mov esi, dword [esp + 0x28]
jmp 0x1002bc2e
push ecx
push edx
call fcn.1007fa46
add esp, 8
mov byte [esp + 0x14], 0x6c
mov al, 0x29
xor al, byte [esp + 0x14]
mov cl, 8
mov byte [esp + 0x15], al
mov dl, 5
mov al, byte [esp + 0x14]
mov ch, 0x33
mov dh, 0x25
mov byte [esp + 0x27], 0x28
xor cl, al
mov byte [esp + 0x1c], 0
xor dl, al
mov byte [esp + 0x16], cl
xor ch, al
mov byte [esp + 0x17], dl
xor dh, al
mov byte [esp + 0x19], ch
mov ah, 0x18
mov byte [esp + 0x1a], dh
xor ah, al
mov byte [esp + 0x1c], 0
mov al, byte [esp + 0x27]
lea ecx, [esp + 0x15]
xor al, byte [esp + 0x14]
lea edx, [ecx + 1]
xorps xmm0, xmm0
mov byte [esp + 0x18], ah
mov byte [esp + 0x1b], al
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bce4
sub ecx, edx
lea eax, [esp + 0x15]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002540
cmp dword [esp + 0x40], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x14], edi
je 0x1002bd86
test edi, edi
je 0x1002bd86
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002bd86
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x2c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002bd82
nop dword [eax + eax]
cmp esi, dword [edi + 0xc4]
jne 0x1002bd3d
call fcn.10084bcf
mov edi, dword [esi + 8]
test edi, edi
je 0x1002bd69
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002bd4f
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002bdb9
mov edi, dword [esp + 0x14]
cmp esi, dword [edi + 0xc4]
jne 0x1002bd7a
call fcn.10084bcf
mov esi, dword [esi]
cmp esi, dword [esp + 0x2c]
jne 0x1002bd30
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 8], edi
cmp ecx, 0xf
jbe 0x1002bdc9
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002bdbf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c220
jmp 0x1002bdbf
mov esi, dword [esp + 0x28]
jmp 0x1002bd88
push ecx
push edx
call fcn.1007fa46
add esp, 8
mov byte [esp + 0x14], 0x36
mov al, 0x73
xor al, byte [esp + 0x14]
mov cl, 0x52
mov byte [esp + 0x15], al
mov dl, 0x5f
mov al, byte [esp + 0x14]
mov ch, 0x69
mov dh, 0x66
mov byte [esp + 0x27], 0x61
xor cl, al
mov byte [esp + 0x1c], 0
xor dl, al
mov byte [esp + 0x16], cl
xor ch, al
mov byte [esp + 0x17], dl
xor dh, al
mov byte [esp + 0x19], ch
mov ah, 0x42
mov byte [esp + 0x1a], dh
xor ah, al
mov byte [esp + 0x1c], 0
mov al, byte [esp + 0x27]
lea ecx, [esp + 0x15]
xor al, byte [esp + 0x14]
lea edx, [ecx + 1]
xorps xmm0, xmm0
mov byte [esp + 0x18], ah
mov byte [esp + 0x1b], al
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002be40
sub ecx, edx
lea eax, [esp + 0x15]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002540
cmp dword [esp + 0x40], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x14], edi
je 0x1002bedd
test edi, edi
je 0x1002bedd
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002bedd
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x2c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002bed9
cmp esi, dword [edi + 0xc4]
jne 0x1002be94
call fcn.10084bcf
mov edi, dword [esi + 8]
test edi, edi
je 0x1002bec0
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002bea6
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002bf10
mov edi, dword [esp + 0x14]
cmp esi, dword [edi + 0xc4]
jne 0x1002bed1
call fcn.10084bcf
mov esi, dword [esi]
cmp esi, dword [esp + 0x2c]
jne 0x1002be87
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 0xc], edi
cmp ecx, 0xf
jbe 0x1002bf20
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002bf16
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c225
jmp 0x1002bf16
mov esi, dword [esp + 0x28]
jmp 0x1002bedf
push ecx
push edx
call fcn.1007fa46
add esp, 8
mov byte [esp + 0x14], 0xf
mov al, 0x6d
xor al, byte [esp + 0x14]
mov cl, 0x7b
mov ch, 0x60
mov byte [esp + 0x15], al
mov al, byte [esp + 0x14]
mov dl, 0x61
xor cl, al
mov byte [esp + 0x1b], 0
xor ch, al
mov byte [esp + 0x16], cl
mov ah, 0x50
mov byte [esp + 0x19], ch
mov dh, 0x64
mov byte [esp + 0x1b], 0
xor dl, al
mov dword [esp + 0x40], 0
xor ah, al
mov byte [esp + 0x17], dl
xor dh, al
mov byte [esp + 0x18], ah
xorps xmm0, xmm0
mov byte [esp + 0x1a], dh
lea ecx, [esp + 0x15]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x44], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bf84
sub ecx, edx
lea eax, [esp + 0x15]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002540
cmp dword [esp + 0x40], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x14], edi
je 0x1002c026
test edi, edi
je 0x1002c026
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c026
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x2c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002c022
nop dword [eax + eax]
cmp esi, dword [edi + 0xc4]
jne 0x1002bfdd
call fcn.10084bcf
mov edi, dword [esi + 8]
test edi, edi
je 0x1002c009
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002bfef
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002c059
mov edi, dword [esp + 0x14]
cmp esi, dword [edi + 0xc4]
jne 0x1002c01a
call fcn.10084bcf
mov esi, dword [esi]
cmp esi, dword [esp + 0x2c]
jne 0x1002bfd0
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x10], edi
cmp ecx, 0xf
jbe 0x1002c069
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002c05f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c22a
jmp 0x1002c05f
mov esi, dword [esp + 0x28]
jmp 0x1002c028
push ecx
push edx
call fcn.1007fa46
add esp, 8
mov dl, 0x33
mov dword [esp + 0x14], 0x5d475133
mov dword [esp + 0x18], 0x5e56416c
xor ecx, ecx
mov dword [esp + 0x1c], 0x56515e56
mov word [esp + 0x20], 0x41
nop dword [eax]
lea eax, [esp + 0x15]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x1002c0a3
mov dl, byte [esp + 0x14]
jmp 0x1002c090
xorps xmm0, xmm0
mov byte [esp + 0x21], 0
lea ecx, [esp + 0x15]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c0c7
sub ecx, edx
lea eax, [esp + 0x15]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002540
cmp dword [esp + 0x40], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x14], edi
je 0x1002c166
test edi, edi
je 0x1002c166
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c166
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x2c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002c162
nop
cmp esi, dword [edi + 0xc4]
jne 0x1002c11d
call fcn.10084bcf
mov edi, dword [esi + 8]
test edi, edi
je 0x1002c149
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002c12f
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002c199
mov edi, dword [esp + 0x14]
cmp esi, dword [edi + 0xc4]
jne 0x1002c15a
call fcn.10084bcf
mov esi, dword [esi]
cmp esi, dword [esp + 0x2c]
jne 0x1002c110
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x14], edi
cmp ecx, 0xf
jbe 0x1002c1a9
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002c19f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002c22f
jmp 0x1002c19f
mov esi, dword [esp + 0x28]
jmp 0x1002c168
push ecx
push edx
call fcn.1007fa46
add esp, 8
cmp dword [0x100b8fe4], 0
je 0x1002c215
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002c1d3
mov eax, dword [0x100b8fa0]
dec eax
cmp eax, 0x14
ja 0x1002c1d3
push 1
mov edx, 0x100b8f90
call fcn.10017e20
add esp, 4
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1002c1f4
mov eax, dword [0x100b8fb8]
dec eax
cmp eax, 0x2f
ja 0x1002c1f4
push 0
mov edx, 0x100b8fa8
call fcn.10017e20
add esp, 4
mov esi, dword [esi + 0x14]
test esi, esi
je 0x1002c215
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002c215
lea ecx, [esi + 0xd0]
mov dl, 3
call fcn.100183d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10084bdf
call fcn.10084bdf
call fcn.10084bdf
call fcn.10084bdf
call fcn.10084bdf
int3