Function at 0x1000efb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x74
push 0xffffffffffffffff
push 0x1003a1e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdcc
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0x20], 0
mov dword [ebp - 0x280], 0x22c
push 0
push 2
call fcn.10018cb0
add esp, 8
mov dword [ebp + 0x30], eax
mov byte [ebp + 0x73], 0
lea eax, [ebp - 0x280]
push eax
mov ecx, dword [ebp + 0x30]
push ecx
call fcn.1001a930
add esp, 8
cmp eax, 1
jne 0x1000f595
lea edx, [ebp - 0x280]
push edx
mov eax, dword [ebp + 0x30]
push eax
call fcn.1001aa50
add esp, 8
cmp eax, 1
jne 0x1000f595
mov ecx, dword [ebp - 0x278]
push ecx
push 0
push 0x400
call fcn.1001a600
add esp, 0xc
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x24], 0x184
mov edx, 2
shl edx, 0
mov eax, 0x65
mov word [ebp + edx + 4], ax
mov ecx, 2
shl ecx, 2
mov edx, 0x65
mov word [ebp + ecx + 4], dx
mov eax, 2
shl eax, 3
mov ecx, 0x2e
mov word [ebp + eax + 4], cx
mov edx, 2
imul eax, edx, 6
mov ecx, 0x33
mov word [ebp + eax + 4], cx
mov edx, 2
imul eax, edx, 0xa
mov ecx, 0x6c
mov word [ebp + eax + 4], cx
mov edx, 2
imul eax, edx, 0xb
mov ecx, 0x6c
mov word [ebp + eax + 4], cx
mov edx, 2
shl edx, 1
mov eax, 0x72
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 0xc
xor eax, eax
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 5
mov eax, 0x6c
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 7
mov eax, 0x32
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x4b
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 3
mov eax, 0x6e
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 9
mov eax, 0x64
mov word [ebp + edx + 4], ax
lea ecx, [ebp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp + 0x38], eax
cmp dword [ebp + 0x68], 0
je 0x1000f590
mov byte [ebp + 0x73], 0
cmp dword [ebp + 0x38], 0
je 0x1000f515
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax + 0x4c], 0x75
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx + 0x4c], 0x63
mov eax, 1
shl eax, 4
mov byte [ebp + eax + 0x4c], 0x49
mov ecx, 1
imul edx, ecx, 0x16
mov byte [ebp + edx + 0x4c], 0x61
mov eax, 1
imul ecx, eax, 0x17
mov byte [ebp + ecx + 0x4c], 0x6d
mov edx, 1
shl edx, 1
mov byte [ebp + edx + 0x4c], 0x65
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx + 0x4c], 0x61
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax + 0x4c], 0x51
mov ecx, 1
imul edx, ecx, 0x14
mov byte [ebp + edx + 0x4c], 0x65
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx + 0x4c], 0x65
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax + 0x4c], 0x50
mov ecx, 1
imul edx, ecx, 0x15
mov byte [ebp + edx + 0x4c], 0x4e
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx + 0x4c], 0x72
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax + 0x4c], 0x46
mov ecx, 1
imul edx, ecx, 0x1a
mov byte [ebp + edx + 0x4c], 0
mov eax, 1
shl eax, 2
mov byte [ebp + eax + 0x4c], 0x79
mov ecx, 1
imul edx, ecx, 0x13
mov byte [ebp + edx + 0x4c], 0x67
mov eax, 1
shl eax, 3
mov byte [ebp + eax + 0x4c], 0x6c
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx + 0x4c], 0x6c
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx + 0x4c], 0x6d
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax + 0x4c], 0x6f
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx + 0x4c], 0x73
mov eax, 1
shl eax, 0
mov byte [ebp + eax + 0x4c], 0x75
mov ecx, 1
imul edx, ecx, 0x18
mov byte [ebp + edx + 0x4c], 0x65
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx + 0x4c], 0x73
mov edx, 1
imul eax, edx, 0x19
mov byte [ebp + eax + 0x4c], 0x57
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx + 0x4c], 0x72
lea eax, [ebp + 0x4c]
push eax
mov ecx, dword [ebp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x2c], eax
cmp dword [ebp + 0x2c], 0
je 0x1000f3f9
lea edx, [ebp + 0x24]
push edx
lea eax, [ebp - 0x588]
push eax
push 0
mov ecx, dword [ebp + 0x68]
push ecx
mov edx, dword [ebp + 0x2c]
mov dword [ebp + 0x28], edx
mov ecx, dword [ebp + 0x28]
call dword [0x1003b1ac]
call dword [ebp + 0x28]
test eax, eax
je 0x1000f3f4
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0x30]
call fcn.10005940
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x7c]
push ecx
lea ecx, [ebp - 0x30]
call fcn.10011ce0
mov byte [ebp + 0x72], al
movzx edx, byte [ebp + 0x72]
test edx, edx
je 0x1000f337
mov byte [ebp + 0x73], 1
jmp 0x1000f3de
mov eax, dword [ebp - 0x278]
push eax
push 8
call fcn.10018cb0
add esp, 8
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x48], 0
mov dword [ebp - 0x9b0], 0x428
lea ecx, [ebp - 0x9b0]
push ecx
mov edx, dword [ebp + 0x44]
push edx
call fcn.1001a310
add esp, 8
mov dword [ebp + 0x48], eax
cmp dword [ebp + 0x48], 0
je 0x1000f3d2
lea eax, [ebp - 0x790]
push eax
call fcn.10023620
add esp, 4
mov dword [ebp], eax
mov ecx, dword [ebp]
push ecx
lea edx, [ebp - 0x790]
push edx
lea ecx, [ebp - 0x30]
call fcn.10013a70
mov eax, dword [ebp + 0x7c]
push eax
lea ecx, [ebp - 0x30]
call fcn.10011ce0
mov byte [ebp + 0x71], al
movzx ecx, byte [ebp + 0x71]
test ecx, ecx
je 0x1000f3ba
mov byte [ebp + 0x73], 1
jmp 0x1000f3d2
lea edx, [ebp - 0x9b0]
push edx
mov eax, dword [ebp + 0x44]
push eax
call fcn.1001a420
add esp, 8
mov dword [ebp + 0x48], eax
jmp 0x1000f372
mov ecx, dword [ebp + 0x44]
push ecx
call fcn.10018350
add esp, 4
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.100132b0
mov dword [ebp - 4], 0xffffffff
jmp 0x1000f50b
mov edx, dword [ebp + 0x24]
push edx
lea eax, [ebp - 0x588]
push eax
mov ecx, dword [ebp + 0x68]
push ecx
call fcn.10019ad0
add esp, 0xc
test eax, eax
je 0x1000f50b
lea edx, [ebp - 0x588]
push edx
lea ecx, [ebp - 0x48]
call fcn.10005940
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0x7c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10011ce0
mov byte [ebp + 0x70], al
movzx ecx, byte [ebp + 0x70]
test ecx, ecx
je 0x1000f44e
mov byte [ebp + 0x73], 1
jmp 0x1000f4f5
mov edx, dword [ebp - 0x278]
push edx
push 8
call fcn.10018cb0
add esp, 8
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x40], 0
mov dword [ebp - 0xdd8], 0x428
lea eax, [ebp - 0xdd8]
push eax
mov ecx, dword [ebp + 0x3c]
push ecx
call fcn.1001a310
add esp, 8
mov dword [ebp + 0x40], eax
cmp dword [ebp + 0x40], 0
je 0x1000f4e9
lea edx, [ebp - 0xbb8]
push edx
call fcn.10023620
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0xbb8]
push ecx
lea ecx, [ebp - 0x48]
call fcn.10013a70
mov edx, dword [ebp + 0x7c]
push edx
lea ecx, [ebp - 0x48]
call fcn.10011ce0
mov byte [ebp + 0x6f], al
movzx eax, byte [ebp + 0x6f]
test eax, eax
je 0x1000f4d1
mov byte [ebp + 0x73], 1
jmp 0x1000f4e9
lea ecx, [ebp - 0xdd8]
push ecx
mov edx, dword [ebp + 0x3c]
push edx
call fcn.1001a420
add esp, 8
mov dword [ebp + 0x40], eax
jmp 0x1000f489
mov eax, dword [ebp + 0x3c]
push eax
call fcn.10018350
add esp, 4
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.100132b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx edx, byte [ebp + 0x73]
test edx, edx
je 0x1000f584
lea eax, [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0x34], ecx
mov edx, dword [ebp + 0x34]
mov dword [edx], 0
mov eax, dword [ebp + 0x34]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 0x34]
mov dword [ecx + 8], 0
mov dword [ebp - 4], 4
push 0
mov edx, dword [ebp - 0x278]
push edx
push 0
push 1
call fcn.1001a600
add esp, 0xc
push eax
call fcn.1001b2d0
add esp, 8
mov dword [ebp + 0x20], eax
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x54]
call fcn.10013070
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x68]
push eax
call fcn.10018350
add esp, 4
jmp 0x1000f016
mov ecx, dword [ebp + 0x30]
push ecx
call fcn.10018350
add esp, 4
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add ebp, 0x74
mov esp, ebp
pop ebp
ret 4