Function at 0x1000d9f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bedd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
lea ecx, [esi + 8]
mov dword [ebp - 0x24], esi
call fcn.1000e810
lea ecx, [esi + 0x1508]
call fcn.1000e6d0
lea edi, [esi + 0x185c]
mov ecx, edi
call fcn.10041960
mov dword [esi + 0x18f8], 0
mov dword [esi + 0x18f4], 0
mov dword [esi + 0x18fc], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x1904], 0
mov dword [esi + 0x1900], 0
mov dword [esi + 0x1908], 0
mov dword [esi + 0x1910], 0
mov dword [esi + 0x190c], 0
mov dword [esi + 0x1914], 0
mov dword [esi + 0x191c], 0
mov dword [esi + 0x1918], 0
mov dword [esi + 0x1920], 0
mov dword [esi + 0x1960], 0
mov dword [esi + 0x195c], 0
mov dword [esi + 0x1980], 0
mov dword [esi + 0x197c], 0
mov dword [esi + 0x1984], 0
mov dword [esi + 0x198c], 0
mov dword [esi + 0x1988], 0
mov dword [esi + 0x1990], 0
mov dword [esi + 0x1998], 0
mov dword [esi + 0x1994], 0
mov dword [esi + 0x199c], 0
mov dword [esi + 0x19a4], 0
mov dword [esi + 0x19a0], 0
mov dword [esi + 0x19a8], 0
mov dword [esi + 0x19b0], 0
mov dword [esi + 0x19ac], 0
mov dword [esi + 0x19b4], 0
mov dword [esi + 0x1a04], 0xff7fffff
mov dword [esi + 0x19d0], 0
mov dword [esi + 0x19cc], 0
mov dword [esi + 0x19c8], 0
mov dword [esi + 0x19c4], 0
mov dword [esi + 0x19c0], 0
mov dword [esi + 0x19bc], 0
mov dword [esi + 0x19b8], 0
mov dword [esi + 0x19e4], 0
mov dword [esi + 0x19e8], 0
mov dword [esi + 0x19dc], 0
mov dword [esi + 0x19e0], 0
mov dword [esi + 0x19d4], 0
mov dword [esi + 0x19d8], 0
mov dword [esi + 0x19ec], 0
mov dword [esi + 0x19f0], 0
mov byte [esi + 0x19f4], 0
mov dword [esi + 0x19f8], 0x7f7fffff
mov dword [esi + 0x19fc], 0x7f7fffff
mov dword [esi + 0x1a00], 0xff7fffff
mov dword [esi + 0x1a04], 0xff7fffff
mov dword [esi + 0x1a08], 0
mov dword [esi + 0x1a0c], 0
mov dword [esi + 0x1a10], 0x7f7fffff
mov dword [esi + 0x1a14], 0
mov dword [esi + 0x1a18], 0
mov dword [esi + 0x1a4c], 0x7f7fffff
mov dword [esi + 0x1a50], 0x7f7fffff
mov dword [esi + 0x1a54], 0xff7fffff
mov dword [esi + 0x1a58], 0xff7fffff
mov dword [esi + 0x1a8c], 0x7f7fffff
mov dword [esi + 0x1a90], 0x7f7fffff
mov dword [esi + 0x1a94], 0xff7fffff
mov dword [esi + 0x1a98], 0xff7fffff
mov dword [esi + 0x1ad4], 0xff7fffff
mov dword [esi + 0x1ab4], 0
mov dword [esi + 0x1ab8], 0
mov dword [esi + 0x1ac4], 0x7f7fffff
mov dword [esi + 0x1ac0], 0x7f7fffff
mov dword [esi + 0x1abc], 0x7f7fffff
mov dword [esi + 0x1ac8], 0x7f7fffff
mov dword [esi + 0x1acc], 0x7f7fffff
mov dword [esi + 0x1ad0], 0xff7fffff
mov dword [esi + 0x1ad4], 0xff7fffff
mov dword [esi + 0x1af8], 0xff7fffff
mov dword [esi + 0x1ad8], 0
mov dword [esi + 0x1adc], 0
mov dword [esi + 0x1ae8], 0x7f7fffff
mov dword [esi + 0x1ae4], 0x7f7fffff
mov dword [esi + 0x1ae0], 0x7f7fffff
mov dword [esi + 0x1aec], 0x7f7fffff
mov dword [esi + 0x1af0], 0x7f7fffff
mov dword [esi + 0x1af4], 0xff7fffff
mov dword [esi + 0x1af8], 0xff7fffff
mov dword [esi + 0x1b1c], 0xff7fffff
mov dword [esi + 0x1afc], 0
mov dword [esi + 0x1b00], 0
mov dword [esi + 0x1b0c], 0x7f7fffff
mov dword [esi + 0x1b08], 0x7f7fffff
mov dword [esi + 0x1b04], 0x7f7fffff
mov dword [esi + 0x1b10], 0x7f7fffff
mov dword [esi + 0x1b14], 0x7f7fffff
mov dword [esi + 0x1b18], 0xff7fffff
mov dword [esi + 0x1b1c], 0xff7fffff
mov byte [esi + 0x1b20], 0
mov dword [esi + 0x1b24], 0
mov dword [esi + 0x1b2c], 0
mov dword [esi + 0x1b30], 0
mov dword [esi + 0x1b28], 0
mov dword [esi + 0x1b3c], 0
mov dword [esi + 0x1b40], 0
mov dword [esi + 0x1b34], 0
mov dword [esi + 0x1b38], 0
push 0x1000bef0
push 0x1002f7f0
push 2
lea eax, [esi + 0x1b44]
mov byte [ebp - 4], 9
push 0xc
push eax
mov dword [ebp - 0x28], eax
call fcn.1004a087
lea ecx, [esi + 0x1b60]
mov byte [ebp - 4], 0xa
push 0
call fcn.1000d710
mov dword [esi + 0x1bf0], 0
xorps xmm0, xmm0
mov dword [esi + 0x1bec], 0
mov dword [esi + 0x1be4], 0
mov dword [esi + 0x1be8], 0
movups xmmword [esi + 0x1bf8], xmm0
movups xmmword [esi + 0x1c08], xmm0
mov word [esi + 0x1c18], 0
mov dword [esi + 0x1bf4], 0xffffffff
mov byte [esi + 0x1c1a], 0
mov dword [esi + 0x1c1c], 0x7f7fffff
mov dword [esi + 0x1c20], 0x7f7fffff
mov dword [esi + 0x1c24], 0xff7fffff
mov dword [esi + 0x1c28], 0xff7fffff
mov dword [esi + 0x1c48], 0
mov dword [esi + 0x1c44], 0
mov dword [esi + 0x1c4c], 0
lea eax, [esi + 0x1c58]
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
push 0xe64
push 0
push eax
mov dword [eax + 0x1c], 0
mov dword [eax + 0x24], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esi + 0x2abc]
mov byte [ebp - 4], 0xd
call fcn.10045b50
mov dword [esi + 0x2b28], 0
mov dword [esi + 0x2b24], 0
mov dword [esi + 0x2b20], 0
mov dword [esi + 0x2b1c], 0
mov dword [esi + 0x2b3c], 0
mov dword [esi + 0x2b38], 0
mov dword [esi + 0x2b48], 0
mov dword [esi + 0x2b44], 0
mov dword [esi + 0x2b4c], 0
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x2b68]
mov dword [esi + 0x2b54], 0
mov dword [esi + 0x2b50], 0
mov dword [esi + 0x2b5c], 0
mov dword [esi + 0x2b58], 0
call fcn.1000d670
mov dword [esi + 0x2b78], 0
mov dword [esi + 0x2b74], 0
mov dword [esi + 0x2b7c], 0
mov dword [esi + 0x2b84], 0
mov dword [esi + 0x2b80], 0
mov dword [esi + 0x2b88], 0
lea ecx, [esi + 0x2b94]
mov byte [ebp - 4], 0x12
call fcn.1000d670
inc dword [0x100da7c0]
push 0x5c
mov word [esi], 0x100
mov dword [esi + 0x1850], 0
mov dword [esi + 0x1858], 0
mov dword [esi + 0x1854], 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x24], eax
test eax, eax
je 0x1000e136
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x54], 0
mov byte [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x58], 0xffffffff
jmp 0x1000e138
xor eax, eax
mov dword [esi + 0x94], eax
xorps xmm0, xmm0
movsd qword [esi + 0x18e0], xmm0
xor ecx, ecx
mov dword [esi + 0x18e8], 0
mov dword [esi + 0x18f0], 0xffffffff
mov dword [esi + 0x18ec], 0xffffffff
mov dword [esi + 0x1924], 0
mov dword [esi + 0x1928], 0
mov dword [esi + 0x192c], 0
mov dword [esi + 0x1930], 0
mov dword [esi + 0x1934], 0
mov byte [esi + 0x1938], 0
mov dword [esi + 0x193c], 0
mov dword [esi + 0x1940], 0
mov dword [esi + 0x1944], 0
mov dword [esi + 0x1948], 0
mov dword [esi + 0x194c], 0
mov dword [esi + 0x1950], 0
mov word [esi + 0x1954], 0
mov dword [esi + 0x1958], 0
mov dword [esi + 0x195c], 0xbf800000
mov dword [esi + 0x1960], 0xbf800000
mov dword [esi + 0x1968], 0
mov dword [esi + 0x1964], 0
mov dword [esi + 0x196c], 0
mov dword [esi + 0x1970], 0
mov dword [esi + 0x1974], 0
mov dword [esi + 0x1978], 0
mov byte [esi + 0x1a1c], 0
mov dword [esi + 0x1a20], 0
mov dword [esi + 0x1a24], 0
mov dword [esi + 0x1a38], 0
mov dword [esi + 0x1a34], 0
mov dword [esi + 0x1a30], 0
mov dword [esi + 0x1a2c], 0
mov dword [esi + 0x1a28], 0
mov dword [esi + 0x1a44], 0
mov dword [esi + 0x1a40], 0
mov dword [esi + 0x1a3c], 0
mov dword [esi + 0x1a48], 0
mov dword [esi + 0x1a4c], 0x7f7fffff
mov dword [esi + 0x1a50], 0x7f7fffff
mov dword [esi + 0x1a54], 0xff7fffff
mov dword [esi + 0x1a58], 0xff7fffff
mov dword [esi + 0x1a5c], 0
mov dword [esi + 0x1a68], 0
mov dword [esi + 0x1a64], 0
mov dword [esi + 0x1a60], 0
mov dword [esi + 0x1a70], 0
mov dword [esi + 0x1a6c], 0
mov byte [esi + 0x1a74], 0
mov dword [esi + 0x1a78], 0
mov dword [esi + 0x1a7c], 0x7fffffff
mov dword [esi + 0x1a80], 0x10000
mov word [esi + 0x1a84], 0
mov byte [esi + 0x1a86], 0
mov dword [esi + 0x1a88], 0
mov word [esi + 0x1a9c], 0
mov dword [esi + 0x1aa0], 0
mov dword [esi + 0x1aa4], 0
mov dword [esi + 0x1ab0], 0xffffffff
mov dword [esi + 0x1aac], 0xffffffff
mov dword [esi + 0x1aa8], 0xffffffff
mov dword [esi + 0x1b5c], 0
mov dword [esi + 0x1b88], edi
mov dword [ebp - 0x1c], 0x69513e3f
mov dword [ebp - 0x18], 0x424e5345
mov word [ebp - 0x14], 0x5d
mov byte [ebp - 0x12], 1
nop dword [eax]
lea eax, [ecx + 0x1c]
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 9
jb 0x1000e3c0
mov dword [esi + 0x1bd4], 0
lea eax, [ebp - 0x1c]
mov dword [esi + 0x1b8c], eax
xorps xmm0, xmm0
mov word [esi + 0x1bd8], 0
lea eax, [esi + 0x2ba8]
mov dword [esi + 0x1bdc], 0
mov dword [esi + 0x1be0], 0xffffffff
mov dword [esi + 0x1c2c], 0
mov dword [esi + 0x1c30], 0
mov dword [esi + 0x1c34], 0
mov dword [esi + 0x1c38], 0
mov dword [esi + 0x1c3c], 0
mov dword [esi + 0x1c40], 0xffffffff
movq qword [esi + 0x1c50], xmm0
mov dword [esi + 0x2b14], 0
mov dword [esi + 0x2b18], 0x2900000
mov byte [esi + 0x2b2c], 0
mov dword [esi + 0x2b30], 0
mov dword [esi + 0x2b34], 0x3c23d70a
mov dword [esi + 0x2b38], 0
mov dword [esi + 0x2b3c], 0
mov dword [esi + 0x2b40], 0
mov dword [esi + 0x2b58], 0x7f7fffff
mov dword [esi + 0x2b5c], 0x7f7fffff
mov dword [esi + 0x2b50], 0x7f7fffff
mov dword [esi + 0x2b54], 0x7f7fffff
mov byte [esi + 0x2b60], 0
mov dword [esi + 0x2b64], 0
mov byte [esi + 0x2b8c], 0
push 0x1e0
mov dword [esi + 0x2b90], 0
push 0
mov dword [esi + 0x2ba0], 0
push eax
mov dword [esi + 0x2ba4], 2
call sub.VCRUNTIME140.dll_memset
mov dword [esi + 0x2d88], 0
lea ecx, [esi + 0x2d9c]
mov dword [esi + 0x2d8c], 0
push 0xc01
mov dword [esi + 0x2d98], 0xffffffff
push 0
mov dword [esi + 0x2d94], 0xffffffff
push ecx
mov dword [esi + 0x2d90], 0xffffffff
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049b00
mov esp, ebp
pop ebp
ret 4