Function at 0x10001edd
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0xa8
push 0xffffffffffffffff
push 0x1003037b
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1003ae40]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x1003b810], 0
jne 0x100024e6
cmp dword [0x1006ebd8], 0
je 0x100024e6
cmp dword [0x1006ebdc], 0
jbe 0x100024e6
xor ebx, ebx
mov dword [ebp - 0x2c], 1
push ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], ebx
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x24], ebx
push eax
mov dword [ebp - 0x20], ebx
call sub.gdiplus.dll_GdiplusStartup
xorps xmm0, xmm0
mov dword [ebp - 0x5c], ebx
push 0xf
push 0xb2b65704
movlpd qword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x60], 0x30
call fcn.10001370
pop ecx
call eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp + 0x6c]
mov eax, dword [0x1003ba1c]
mov dword [ebp - 0x58], 0x10002509
mov dword [ebp - 0x4c], eax
call fcn.10017c8a
movaps xmm0, xmmword [0x10031700]
push 0x4e
pop eax
mov byte [ebp + 0x6c], al
movsx eax, al
push eax
mov dword [ebp - 4], ebx
movups xmmword [ebp + 0x94], xmm0
call fcn.10013ee4
pop ecx
push 8
mov dword [ebp - 0x10], eax
mov esi, ebx
pop edi
push esi
lea eax, [ebp - 0x10]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 0x70], eax
inc esi
cmp esi, edi
jl 0x10001fc7
push 0xf
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x94]
push eax
lea ecx, [ebp + 0x6c]
call fcn.10017c8d
mov dword [ebp + 0x90], eax
movsx eax, byte [ebp + 0x6c]
push eax
mov dword [ebp - 4], 1
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x14], eax
mov esi, ebx
push esi
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 0x70], eax
inc esi
cmp esi, edi
jl 0x10002011
lea ecx, [ebp + 0x6c]
call fcn.10017d71
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x90]
lea ecx, [ebp + 0x6c]
call fcn.10017d04
mov ecx, eax
test ecx, ecx
jne 0x1000204e
mov ecx, ebx
jmp 0x1000205f
mov edx, ebx
mov al, byte [ebp + 0x6c]
xor byte [ecx + edx], al
inc edx
cmp edx, 0xf
jb 0x10002050
mov byte [ecx + 0xf], bl
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], ecx
lea ecx, [ebp + 0x6c]
call sym.supertestlib.dll_DirectXSetupShowEULA
lea ecx, [ebp + 0x70]
call fcn.10017c8a
mov al, 0x4d
mov dword [ebp - 4], 2
mov byte [ebp + 0x70], al
movsx eax, al
push eax
mov dword [ebp + 0x98], 0x2923243a
mov dword [ebp + 0x9c], 0x29633a22
mov word [ebp + 0xa0], 0x2121
mov byte [ebp + 0xa2], bl
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x14], eax
mov esi, ebx
push esi
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 0x74], eax
inc esi
cmp esi, edi
jl 0x100020b4
push 0xa
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x98]
push eax
lea ecx, [ebp + 0x70]
call fcn.10017c8d
mov dword [ebp + 0x94], eax
movsx eax, byte [ebp + 0x70]
push eax
mov dword [ebp - 4], 3
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x10], eax
mov esi, ebx
push esi
lea eax, [ebp - 0x10]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 0x74], eax
inc esi
cmp esi, edi
jl 0x100020fe
lea ecx, [ebp + 0x70]
call fcn.10017d71
push eax
lea eax, [ebp + 0x74]
push eax
push dword [ebp + 0x94]
lea ecx, [ebp + 0x70]
call fcn.10017d04
mov edx, eax
test edx, edx
jne 0x1000213b
mov edx, ebx
jmp 0x1000214c
mov ecx, ebx
mov al, byte [ebp + 0x70]
xor byte [ecx + edx], al
inc ecx
cmp ecx, 0xa
jb 0x1000213d
mov byte [edx + 0xa], bl
push 0x80
push edx
push 0xaf362212
call fcn.10001370
pop ecx
call eax
push eax
push 0x4d34b779
call fcn.10001370
pop ecx
call eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x70]
mov dword [ebp - 0x48], eax
call sym.supertestlib.dll_DirectXSetupShowEULA
lea ecx, [ebp + 0x70]
call fcn.10017c8a
push 0x4e
pop eax
mov byte [ebp + 0x70], al
movsx eax, al
push eax
mov dword [ebp - 4], 4
mov dword [ebp + 0x98], 0x2a202739
mov dword [ebp + 0x9c], 0x2a603921
mov word [ebp + 0xa0], 0x2222
mov byte [ebp + 0xa2], bl
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x14], eax
mov esi, ebx
push esi
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 0x74], eax
inc esi
cmp esi, edi
jl 0x100021c3
push 0xa
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x98]
push eax
lea ecx, [ebp + 0x70]
call fcn.10017c8d
mov dword [ebp + 0x94], eax
movsx eax, byte [ebp + 0x70]
push eax
mov dword [ebp - 4], 5
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x10], eax
mov esi, ebx
push esi
lea eax, [ebp - 0x10]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 0x74], eax
inc esi
cmp esi, edi
jl 0x1000220d
lea ecx, [ebp + 0x70]
call fcn.10017d71
push eax
lea eax, [ebp + 0x74]
push eax
push dword [ebp + 0x94]
lea ecx, [ebp + 0x70]
call fcn.10017d04
mov ecx, eax
test ecx, ecx
jne 0x1000224a
mov ecx, ebx
jmp 0x1000225b
mov edx, ebx
mov al, byte [ebp + 0x70]
xor byte [edx + ecx], al
inc edx
cmp edx, 0xa
jb 0x1000224c
mov byte [ecx + 0xa], bl
push 0x80
push ecx
push 0xaf362212
call fcn.10001370
pop ecx
call eax
push eax
push 0x4d34b779
call fcn.10001370
pop ecx
call eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x70]
mov dword [ebp - 0x34], eax
call sym.supertestlib.dll_DirectXSetupShowEULA
lea eax, [ebp - 0x60]
push eax
push 0x40695eae
call fcn.10001370
pop ecx
call eax
test ax, ax
je 0x100024e6
lea ecx, [ebp + 0x38]
call fcn.10017c8a
mov al, 0x4f
mov dword [ebp - 4], 6
mov byte [ebp + 0x38], al
movsx eax, al
push eax
mov dword [ebp + 0x60], 0x2a212603
mov dword [ebp + 0x64], 0x6f2a282e
mov word [ebp + 0x68], 0x606
mov byte [ebp + 0x6a], bl
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x14], eax
mov esi, ebx
push esi
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 0x3c], eax
inc esi
cmp esi, edi
jl 0x100022df
push 0xa
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x60]
push eax
lea ecx, [ebp + 0x38]
call fcn.10017c8d
mov dword [ebp + 0x5c], eax
lea ecx, [ebp]
mov dword [ebp - 4], 7
call fcn.10017c8a
movaps xmm0, xmmword [str.FXQPydAxrUzwee]
mov al, 0x16
mov byte [ebp], al
movsx eax, al
push eax
mov byte [ebp - 4], 8
movups xmmword [ebp + 0x28], xmm0
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x10], eax
mov esi, ebx
push esi
lea eax, [ebp - 0x10]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 4], eax
inc esi
cmp esi, 8
jl 0x1000233e
push 0xf
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp]
call fcn.10017c8d
mov dword [ebp + 0x24], eax
movsx eax, byte [ebp + 0x38]
push eax
mov byte [ebp - 4], 9
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x18], eax
mov esi, ebx
push esi
lea eax, [ebp - 0x18]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + esi*4 + 0x3c], eax
inc esi
cmp esi, 8
jl 0x10002380
lea ecx, [ebp + 0x38]
call fcn.10017d71
push eax
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x38]
call fcn.10017d04
mov esi, eax
test esi, esi
jne 0x100023bb
mov esi, ebx
jmp 0x100023cc
mov ecx, ebx
mov al, byte [ebp + 0x38]
xor byte [esi + ecx], al
inc ecx
cmp ecx, 0xa
jb 0x100023bd
mov byte [esi + 0xa], bl
movsx eax, byte [ebp]
push eax
call fcn.10013ee4
pop ecx
mov dword [ebp - 0x1c], eax
mov edi, ebx
push edi
lea eax, [ebp - 0x1c]
push 4
push eax
call fcn.10017bd1
add esp, 0xc
mov dword [ebp + edi*4 + 4], eax
inc edi
cmp edi, 8
jl 0x100023dc
lea ecx, [ebp]
call fcn.10017d71
push eax
lea eax, [ebp + 4]
push eax
push dword [ebp + 0x24]
lea ecx, [ebp]
call fcn.10017d04
mov ecx, eax
test ecx, ecx
jne 0x10002417
mov ecx, ebx
jmp 0x10002428
mov edx, ebx
mov al, byte [ebp]
xor byte [edx + ecx], al
inc edx
cmp edx, 0xf
jb 0x10002419
mov byte [ecx + 0xf], bl
push ebx
push dword [0x1003ba1c]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x80000000
push esi
push ecx
push 0x80008
push 0x6746fd55
call fcn.10001370
pop ecx
call eax
lea ecx, [ebp]
mov esi, eax
call sym.supertestlib.dll_DirectXSetupShowEULA
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x38]
call sym.supertestlib.dll_DirectXSetupShowEULA
push 5
push esi
push 0x4a86d0a4
call fcn.10001370
pop ecx
call eax
mov edi, 0xfa
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x297bf370
call fcn.10001370
pop ecx
call eax
test eax, eax
je 0x100024b5
lea eax, [ebp - 0x7c]
push eax
push 0x6b1b91f8
call fcn.10001370
pop ecx
call eax
lea eax, [ebp - 0x7c]
push eax
push 0x4ac932cb
call fcn.10001370
pop ecx
call eax
push 0xa
push 0x3cb320c7
call fcn.10001370
pop ecx
call eax
sub edi, 1
jne 0x10002479
push ebx
push esi
push 0x4a86d0a4
call fcn.10001370
pop ecx
call eax
push esi
push 0x39a6deb3
call fcn.10001370
pop ecx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa4]
xor ecx, ebp
call fcn.100181bd
add ebp, 0xa8
leave
ret