Function at 0x1009dcb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [0x101ce2f4]
xor eax, esp
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
mov dword [esp + 0x68], ecx
call fcn.1011b1ee
add esp, 4
mov esi, eax
test edi, edi
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1009dcfb
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.1011717a
mov esp, ebp
pop ebp
ret
mov edi, 1
nop
mov dword [esp + 0xc], 0
mov edi, edi
lea edx, [esp + 0xc]
push edx
push esi
call fcn.10069c20
add esp, 8
mov dword [esp + 0x60], eax
mov eax, eax
mov bh, bh
mov eax, dword [esp + 0xc]
push 0
push 0
push eax
push 0
push 0x400
call fcn.10069630
add esp, 0x14
mov esi, eax
xchg ebx, eax
xchg ebx, eax
test esi, esi
jne 0x1009de13
mov cl, 0x6c
mov al, 0x65
mov dl, 0x64
mov byte [esp + 0x74], 0x6b
mov byte [esp + 0x75], al
mov byte [esp + 0x76], 0x72
mov byte [esp + 0x77], 0x6e
mov byte [esp + 0x78], al
mov byte [esp + 0x79], cl
mov byte [esp + 0x7a], 0x33
mov byte [esp + 0x7b], 0x32
mov byte [esp + 0x7c], 0x2e
mov byte [esp + 0x7d], dl
mov byte [esp + 0x7e], cl
mov byte [esp + 0x7f], cl
mov byte [esp + 0x80], 0
test eax, eax
mov byte [esp + 0x68], 0x4f
mov byte [esp + 0x69], 0x70
mov byte [esp + 0x6a], al
mov byte [esp + 0x6b], 0x6e
mov byte [esp + 0x6c], 0x54
mov byte [esp + 0x6d], 0x68
mov byte [esp + 0x6e], 0x72
mov byte [esp + 0x6f], al
mov byte [esp + 0x70], 0x61
mov byte [esp + 0x71], dl
mov byte [esp + 0x72], 0
test dh, dh
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x78]
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
mov eax, eax
test esi, esi
je 0x1009dce8
call fcn.10041000
mov edi, eax
test ch, ch
mov eax, dword [esp + 0x60]
push eax
push 0
push 0x40
call esi
mov esi, eax
mov ebp, ebp
push edi
call fcn.100410c0
add esp, 4
mov ah, ah
test esi, esi
je 0x1009dce8
xor edi, edi
test ebx, ebx
fldz
fstp qword [esp + 0x20]
test ch, ch
test cl, cl
test edi, edi
je 0x1009de3e
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcessTimes]
jmp 0x1009de59
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_GetThreadTimes]
test bl, bl
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.DLL_FileTimeToSystemTime]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x44]
push eax
call edi
push esi
call fcn.1004d3f0
add esp, 4
mov ch, ch
test eax, 0x3728
fldz
fstp qword [esp + 0x10]
test ch, ch
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x54]
push eax
call edi
fld qword [esp + 0x10]
fsub qword [esp + 0x20]
mov ecx, dword [esp + 0x64]
fstp qword [ecx]
mov esi, esi
mov ecx, dword [esp + 0x84]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1011717a
mov esp, ebp
pop ebp
ret