Function at 0x10026d42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x1009700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x1009d548], eax
mov eax, dword [ebp + 0x10]
mov dword [0x1009d554], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1009d54c], eax
push 0x400
push 0
lea eax, [ebp - 0x45c]
push eax
call fcn.10009f50
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
call fcn.1002ec1f
pop ecx
lea eax, [ebp - 0x45c]
push eax
call fcn.10032139
pop ecx
test eax, eax
jne 0x10026da6
jmp 0x1002737b
lea eax, [ebp - 0x45c]
push eax
call fcn.10030528
pop ecx
push eax
lea ecx, [ebp - 0x47c]
call fcn.10002aaa
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x53
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x77
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x68
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x70
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x69
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x2e
xor eax, eax
inc eax
imul eax, eax, 0xb
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0xc
jae 0x10026e38
jmp 0x10026e3d
call fcn.1000814a
mov eax, dword [ebp - 0x4a0]
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x10], 0x6c
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x48c], eax
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x48c], 0
je 0x10026fce
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x5c], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x5c], 0x74
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x5c], 0x76
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x5c], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x5c], 0x78
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x5c], 0x65
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x5c], 0x52
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x5c], 0x73
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x5c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x14
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0x15
jae 0x10026efc
jmp 0x10026f01
call fcn.1000814a
mov eax, dword [ebp - 0x4a4]
mov byte [ebp + eax - 0x5c], 0
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x5c], 0x41
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x5c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x5c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x5c], 0x45
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x5c], 0x69
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x5c], 0x50
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x5c], 0x74
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x5c], 0x68
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x5c], 0x65
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x5c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x5c], 0x6e
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x48c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0
je 0x10026fc2
lea ecx, [ebp - 0x47c]
call fcn.10002be3
push eax
call dword [ebp - 0x488]
push 0xffffffffffffffff
lea ecx, [ebp - 0x47c]
call fcn.10002b2e
push dword [ebp - 0x48c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x33
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x70
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x41
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x2e
xor eax, eax
inc eax
imul eax, eax, 0xc
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0xd
jae 0x10027032
jmp 0x10027037
call fcn.1000814a
mov eax, dword [ebp - 0x4a8]
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x76
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x32
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x64
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x61
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x490], eax
and dword [ebp - 0x498], 0
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x490], 0
je 0x10027270
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x30], 0x72
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x30], 0x74
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x30], 0x53
xor eax, eax
inc eax
imul eax, eax, 0xd
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0xe
jae 0x100270db
jmp 0x100270e0
call fcn.1000814a
mov eax, dword [ebp - 0x4ac]
mov byte [ebp + eax - 0x30], 0
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x30], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x30], 0x41
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x30], 0x76
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x30], 0x61
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x30], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x30], 0x65
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x30], 0x53
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x30], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0x63
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x30], 0x74
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x490]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x498], eax
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x44], 0x72
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x44], 0x53
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x44], 0x51
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x44], 0x63
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x44], 0x79
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x44], 0x75
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x44], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x44], 0x53
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x44], 0x73
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x44], 0x72
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x44], 0x76
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x44], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x44], 0x61
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x44], 0x69
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x44], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x12
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 0x13
jae 0x10027229
jmp 0x1002722e
call fcn.1000814a
mov eax, dword [ebp - 0x4b0]
mov byte [ebp + eax - 0x44], 0
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x44], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x44], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x44], 0x74
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x490]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x498], 0
je 0x10027282
cmp dword [ebp - 0x494], 0
jne 0x10027292
lea ecx, [ebp - 0x47c]
call fcn.100023c1
jmp 0x1002737b
push 0xf003f
push 0
push 0
call fcn.10031c2f
add esp, 0xc
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
jne 0x100272c2
lea ecx, [ebp - 0x47c]
call fcn.100023c1
jmp 0x1002737b
push 0x14
lea ecx, [ebp - 0x47c]
call fcn.100024db
push eax
push dword [ebp - 0x49c]
call fcn.10032a81
add esp, 0xc
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
je 0x10027364
lea eax, [ebp - 0x478]
push eax
push dword [ebp - 0x484]
call dword [ebp - 0x494]
test eax, eax
je 0x10027358
cmp dword [ebp - 0x474], 1
jne 0x10027358
and dword [ebp - 0x480], 0
jmp 0x10027323
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 4
jge 0x10027358
mov eax, dword [ebp - 0x480]
inc eax
imul eax, eax, 0x1388
push eax
call fcn.100310dc
pop ecx
push 0
push 0
push dword [ebp - 0x484]
call dword [ebp - 0x498]
test eax, eax
je 0x10027356
jmp 0x10027358
jmp 0x10027316
push dword [ebp - 0x484]
call fcn.100325f4
pop ecx
push dword [ebp - 0x49c]
call fcn.100325f4
pop ecx
lea ecx, [ebp - 0x47c]
call fcn.100023c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007e30
leave
ret