Function at 0x1003af60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x1004e44c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
xor bl, bl
mov dword [ebp - 0x314], 0x22c
call dword [0x1006fa98]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003b306
lea eax, [ebp - 0x314]
push eax
push esi
call dword [0x1006fa94]
cmp eax, 1
jne 0x1003b2ff
push edi
mov edi, 0x65
lea ecx, [eax + 0x77]
jmp 0x1003afc0
mov eax, 0x72
mov word [ebp - 0xa2], ax
lea eax, [ebp - 0x2f0]
push eax
mov word [ebp - 0x98], cx
lea eax, [ebp - 0xac]
mov ecx, 0x67
push eax
mov dword [ebp - 0xac], 0x760061
mov dword [ebp - 0x96], edi
mov dword [ebp - 0xa0], 0x780076
mov dword [ebp - 0xa6], 0x730063
mov dword [ebp - 0x9c], 0x65002e
mov word [ebp - 0xa8], cx
call dword [0x1006fa90]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
mov eax, 0x78
mov word [ebp - 0x66], ax
mov eax, 0x6d
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x74], 0x650067
mov dword [ebp - 0x78], 0x760061
mov dword [ebp - 0x6e], 0x780063
mov dword [ebp - 0x6a], 0x65002e
call dword [0x1006fa90]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
mov eax, 0x61
mov word [ebp - 0xdc], ax
mov word [ebp - 0xe8], ax
lea eax, [ebp - 0x2f0]
mov ecx, 0x6e
push eax
mov word [ebp - 0xd6], cx
lea eax, [ebp - 0xe8]
mov ecx, 0x69
push eax
mov dword [ebp - 0xd0], 0x780065
mov dword [ebp - 0xe6], 0x670076
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xe0], 0x730064
mov dword [ebp - 0xd4], 0x2e0074
mov dword [ebp - 0xda], 0x650067
mov word [ebp - 0xe2], cx
call dword [0x1006fa90]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 0x6e0067
mov dword [ebp - 0x20], 0x650078
mov dword [ebp - 0x30], 0x760061
mov dword [ebp - 0x28], 0x780073
mov dword [ebp - 0x24], 0x65002e
call dword [0x1006fa90]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
mov eax, 0x73
mov dword [ebp - 0x38], 0x650078
mov dword [ebp - 0x44], 0x720067
mov dword [ebp - 0x48], 0x760061
mov dword [ebp - 0x3e], 0x2e0078
mov word [ebp - 0x40], ax
xor eax, eax
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x3a], di
call dword [0x1006fa90]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x90], 0x760061
mov dword [ebp - 0x84], 0x2e0078
mov dword [ebp - 0x80], 0x780065
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x8c], 0x730067
mov dword [ebp - 0x88], 0x630076
call dword [0x1006fa90]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0x760061
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], 0x2e0069
mov dword [ebp - 0x14], 0x750067
mov dword [ebp - 0xc], 0x780065
call dword [0x1006fa90]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
mov eax, 0x78
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], 0x760061
mov dword [ebp - 0x4e], edi
mov dword [ebp - 0x54], 0x65002e
mov dword [ebp - 0x58], 0x780069
mov dword [ebp - 0x5c], 0x750067
call dword [0x1006fa90]
add esp, 0x40
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
mov eax, 0x63
mov word [ebp - 0xba], ax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0xc8]
mov ecx, 0x64
push eax
mov dword [ebp - 0xc8], 0x760061
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xb8], 0x2e0078
mov dword [ebp - 0xbe], 0x760073
mov dword [ebp - 0xc4], 0x770067
mov word [ebp - 0xc0], cx
mov dword [ebp - 0xb4], 0x780065
call dword [0x1006fa90]
add esp, 8
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
lea eax, [ebp - 0x314]
push eax
push esi
call dword [0x1006fa8c]
mov ecx, 0x78
cmp eax, 1
je 0x1003afc0
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.100084c3
mov esp, ebp
pop ebp
ret