Function at 0x900c30c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x44
mov eax, 0x90a81cf
call fcn.09004436
mov esi, ecx
mov dword [ebp - 0x50], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0904a0e0
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x30], eax
mov al, byte [ebp + 0x1c]
mov byte [esi + 0x34], al
mov al, byte [ebp + 0x20]
mov byte [esi + 0x35], al
mov al, byte [ebp + 0x24]
mov byte [esi + 0x36], al
lea eax, [esi + 0x50]
push eax
mov dword [esi], vtable.ACETransform.0
mov word [esi + 0x4c], 0x100
mov byte [esi + 0x4e], 1
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, dword [esi + 0x2c]
mov edi, 0x37434c52
mov dword [ebp - 0x10], 0x35636c72
mov edx, 0x4731354b
mov dword [ebp - 0x14], 0x61626364
mov eax, 0x67386b30
mov dword [ebp - 0x18], 0x32636c72
mov ebx, 0x36434c52
mov dword [ebp - 0x1c], 0x36636c72
mov dword [ebp - 0x20], 0x41636c72
mov dword [ebp - 0x24], 0x39636c72
mov dword [ebp - 0x28], 0x38636c72
mov dword [ebp - 0x2c], 0x37636c72
mov dword [ebp - 0x30], 0x42636c72
mov dword [ebp - 0x34], 0x46636c72
mov dword [ebp - 0x38], 0x45636c72
mov dword [ebp - 0x3c], 0x44636c72
mov dword [ebp - 0x40], 0x636d796b
mov dword [ebp - 0x44], 0x43636c72
mov dword [ebp - 0x48], 0x70616263
mov dword [ebp - 0x4c], 0x70726762
mov dword [ebp - 0x50], 0x706c6162
cmp ecx, 0x42434c52
jg 0x900c4f4
je 0x900c4e2
cmp ecx, ebx
jg 0x900c482
je 0x900c473
test ecx, ecx
je 0x900c469
cmp ecx, 0x32434c52
je 0x900c457
cmp ecx, 0x33434c52
je 0x900c5a9
cmp ecx, 0x34434c52
je 0x900c445
cmp ecx, 0x35434c52
jne 0x900c5a4
cmp byte [esi + 0x36], 0
cmovne ecx, dword [ebp - 0x10]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x41424344
cmovne ecx, dword [ebp - 0x14]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x32434c52
cmovne ecx, dword [ebp - 0x18]
jmp 0x900c5db
mov ecx, 0x6e756c6c
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, ebx
cmovne ecx, dword [ebp - 0x1c]
jmp 0x900c5db
cmp ecx, edi
je 0x900c4d3
cmp ecx, 0x38434c52
je 0x900c4c1
cmp ecx, 0x39434c52
je 0x900c4af
cmp ecx, 0x41434c52
jne 0x900c5a4
cmp byte [esi + 0x36], 0
cmovne ecx, dword [ebp - 0x20]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x39434c52
cmovne ecx, dword [ebp - 0x24]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x38434c52
cmovne ecx, dword [ebp - 0x28]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x2c]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x42434c52
cmovne ecx, dword [ebp - 0x30]
jmp 0x900c5db
cmp ecx, 0x47524159
jg 0x900c584
je 0x900c579
cmp ecx, 0x43434c52
je 0x900c56a
cmp ecx, 0x434d594b
je 0x900c55b
cmp ecx, 0x44434c52
je 0x900c549
cmp ecx, 0x45434c52
je 0x900c537
cmp ecx, 0x46434c52
jne 0x900c5a4
cmp byte [esi + 0x36], 0
cmovne ecx, dword [ebp - 0x34]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x45434c52
cmovne ecx, dword [ebp - 0x38]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x44434c52
cmovne ecx, dword [ebp - 0x3c]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x434d594b
cmovne ecx, dword [ebp - 0x40]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x43434c52
cmovne ecx, dword [ebp - 0x44]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, edx
cmovne ecx, eax
jmp 0x900c5db
cmp ecx, 0x4c616220
je 0x900c5ce
cmp ecx, 0x52474220
je 0x900c5bf
cmp ecx, 0x58595a20
je 0x900c5b8
cmp ecx, 0x59436272
je 0x900c5a9
or ecx, 0xffffffff
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x70414243
cmovne ecx, dword [ebp - 0x48]
jmp 0x900c5db
mov ecx, 0x5058595a
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x50524742
cmovne ecx, dword [ebp - 0x4c]
jmp 0x900c5db
cmp byte [esi + 0x36], 0
mov ecx, 0x504c4142
cmovne ecx, dword [ebp - 0x50]
mov dword [esi + 0x38], ecx
or dword [esi + 0x3c], 0xffffffff
or dword [esi + 0x40], 0xffffffff
cmp dword [esi + 0x28], 1
je 0x900c780
mov ecx, dword [esi + 0x30]
cmp ecx, 0x43434c52
jg 0x900c6d5
mov eax, 0x43434c52
cmp ecx, eax
je 0x900c6cb
cmp ecx, edi
jg 0x900c67b
je 0x900c66f
mov eax, 0x32434c52
cmp ecx, eax
je 0x900c665
cmp ecx, 0x33434c52
je 0x900c750
cmp ecx, 0x34434c52
je 0x900c656
mov eax, 0x35434c52
cmp ecx, eax
je 0x900c64c
cmp ecx, ebx
jne 0x900c74b
mov eax, ebx
mov ecx, 0x36636c72
jmp 0x900c779
mov ecx, 0x35636c72
jmp 0x900c779
mov eax, 0x41424344
mov ecx, 0x61626364
jmp 0x900c779
mov ecx, 0x32636c72
jmp 0x900c779
mov eax, edi
mov ecx, 0x37636c72
jmp 0x900c779
mov eax, 0x38434c52
cmp ecx, eax
je 0x900c6c1
mov eax, 0x39434c52
cmp ecx, eax
je 0x900c6b7
mov eax, 0x41434c52
cmp ecx, eax
je 0x900c6ad
mov eax, 0x42434c52
cmp ecx, eax
jne 0x900c74b
mov ecx, 0x42636c72
jmp 0x900c779
mov ecx, 0x41636c72
jmp 0x900c779
mov ecx, 0x39636c72
jmp 0x900c779
mov ecx, 0x38636c72
jmp 0x900c779
mov ecx, 0x43636c72
jmp 0x900c779
mov ebx, 0x47524159
cmp ecx, ebx
jg 0x900c72b
je 0x900c720
mov eax, 0x434d594b
cmp ecx, eax
je 0x900c719
mov eax, 0x44434c52
cmp ecx, eax
je 0x900c712
mov eax, 0x45434c52
cmp ecx, eax
je 0x900c70b
mov eax, 0x46434c52
cmp ecx, eax
jne 0x900c74b
mov ecx, 0x46636c72
jmp 0x900c779
mov ecx, 0x45636c72
jmp 0x900c779
mov ecx, 0x44636c72
jmp 0x900c779
mov ecx, 0x636d796b
jmp 0x900c779
cmp byte [esi + 0x36], 0
cmovne edx, eax
mov eax, edx
jmp 0x900c780
cmp ecx, 0x4c616220
je 0x900c76f
cmp ecx, 0x52474220
je 0x900c763
cmp ecx, 0x58595a20
je 0x900c75c
cmp ecx, 0x59436272
je 0x900c750
or eax, 0xffffffff
jmp 0x900c780
mov eax, 0x70414243
mov ecx, 0x70616263
jmp 0x900c779
mov eax, 0x5058595a
jmp 0x900c780
mov eax, 0x50524742
mov ecx, 0x70726762
jmp 0x900c779
mov eax, 0x504c4142
mov ecx, 0x706c6162
cmp byte [esi + 0x36], 0
cmovne eax, ecx
mov dword [esi + 0x44], eax
mov eax, esi
or dword [esi + 0x48], 0xffffffff
call fcn.09002b42
ret 0x20