Function at 0x1006df31
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0x17e7
mov eax, 0x1788
mov word [ebp - 0x3c], ax
push ebx
mov ebx, ecx
lea ecx, [eax + 3]
add eax, 0xfffffffa
mov word [ebp - 0x3a], cx
mov word [ebp - 0x38], ax
lea eax, [ecx + 0x49]
mov word [ebp - 0x36], ax
inc eax
mov word [ebp - 0x34], ax
lea eax, [ecx + 0x3e]
mov word [ebp - 0x32], ax
add eax, 0xffffffba
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x2e], cx
xor edx, edx
mov word [ebp - 0x2c], cx
mov word [ebp - 0x2a], ax
mov ax, word [ebp - 0x3c]
mov ax, word [ebp + edx*2 - 0x3c]
movzx ecx, ax
movzx eax, word [ebp - 0x40]
xor ecx, eax
mov word [ebp + edx*2 - 0x3c], cx
inc edx
cmp edx, 9
jb 0x1006df90
xor eax, eax
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10007e9f
test eax, eax
js 0x1006e12b
mov dword [ebp - 0x18], 0x34
mov eax, dword [ebp - 0x18]
xor eax, 0x43
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
inc al
xor eax, 0x6f
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x18]
add al, 2
xor eax, 0x49
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x18]
add al, 3
xor eax, 0x6e
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x18]
add al, 4
xor eax, 0x69
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x18]
add al, 5
xor eax, 0x74
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x18]
add al, 6
xor eax, 0x69
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x18]
add al, 7
xor eax, 0x61
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x18]
add al, 8
xor eax, 0x6c
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x18]
add al, 9
xor eax, 0x69
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x18]
add al, 0xa
xor eax, 0x7a
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x18]
add al, 0xb
xor eax, 0x65
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x18]
add al, 0xc
xor eax, 0x45
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x18]
add al, 0xd
mov byte [ebp - 6], 0
xor eax, 0x78
xor edx, edx
mov byte [ebp - 7], al
mov al, byte [ebp - 0x14]
mov al, byte [ebp + edx - 0x14]
mov ecx, dword [ebp - 0x18]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x14], cl
inc edx
cmp edx, 0xe
jb 0x1006e06c
xor edx, edx
mov byte [ebp - 6], dl
mov ecx, edx
mov byte [ebp - 0x28], 0x49
mov byte [ebp - 0x27], 0x75
mov byte [ebp - 0x26], 0x5b
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x7a
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x67
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x80
mov byte [ebp - 0x1b], 0x6b
mov byte [ebp - 0x1a], dl
mov al, byte [ebp - 0x28]
mov al, byte [ebp + ecx - 0x28]
movsx eax, al
sub eax, 6
mov byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 0xe
jb 0x1006e0c9
push esi
push edi
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x14]
push edx
push edx
push ecx
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebx + 0xc]
push eax
push edi
call fcn.100294bb
mov esi, eax
add esp, 0x1c
test esi, esi
js 0x1006e113
push 0
push 0
call dword [ebx + 8]
test eax, eax
jns 0x1006e11e
mov esi, 0xe0010001
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x1006e129
mov dword [ebx + 4], edi
xor eax, eax
mov dword [ebx], 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret