Function at 0x1000b26c
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
cmp dword [esp + 0x6c], 0
mov eax, 0xc85df091
lea esi, [esp + 0x48]
lea ebx, [esp + 4]
mov dword [esp + 0x40], ecx
sete byte [esp + 0x1a]
cmp dword [esp + 0x70], 0
sete byte [esp + 0x1b]
cmp eax, 0xf0cf31f4
jg 0x1000b2d3
cmp eax, 0xd646b452
jg 0x1000b310
cmp eax, 0xc177be4d
jle 0x1000b40c
cmp eax, 0xc560f965
je 0x1000b557
cmp eax, 0xc85df091
je 0x1000b59e
cmp eax, 0xc177be4e
jne 0x1000b298
jmp 0x1000ba60
cmp eax, 0x457d0445
jg 0x1000b395
cmp eax, 0x2b18b463
jg 0x1000b492
cmp eax, 0xf0cf31f5
je 0x1000b5cd
cmp eax, 0x1fa8e332
jne 0x1000b298
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x20]
cmp dword [eax], 0
mov eax, 0x7891cd70
jmp 0x1000b932
cmp eax, 0xea67ae18
jg 0x1000b4bc
cmp eax, 0xd646b453
je 0x1000b5df
cmp eax, 0xe85a1f80
jne 0x1000b298
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x18]
mov edx, 0x5885b3b2
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
movzx eax, byte [eax]
mov dword [esp], ecx
lea ecx, [esp + 0x16]
mov dword [esp + 4], 0x4e0050
mov dword [esp + 8], 0x570051
mov word [esp + 0xc], 4
cmp edx, 0x4d61b95f
je 0x1000b5f8
cmp edx, 0x5885b3b2
jne 0x1000b367
mov word [ecx], 0
add ecx, 2
mov edx, 0x5885b3b2
mov edi, 0x4d61b95f
cmp ecx, dword [esp]
cmove edx, edi
jmp 0x1000b367
cmp eax, 0x5ab7c631
jg 0x1000b4ef
cmp eax, 0x457d0446
je 0x1000b689
cmp eax, 0x541891d8
jne 0x1000b298
lea eax, [esp + 0x10]
mov ecx, 0x47c7a77e
mov dword [esp + 4], 0x77706856
mov dword [esp + 8], 0x416a6471
mov word [esp + 0xc], 0x6c7a
mov byte [esp + 0xe], 0x6f
mov dword [esp], eax
lea eax, [esp + 0xf]
cmp ecx, 0x86774c74
je 0x1000b6a4
cmp ecx, 0x47c7a77e
jne 0x1000b3e2
mov byte [eax], 0
inc eax
mov ecx, 0x47c7a77e
mov edx, 0x86774c74
cmp eax, dword [esp]
cmove ecx, edx
jmp 0x1000b3e2
cmp eax, 0x8c01319b
je 0x1000b70c
cmp eax, 0x985031c9
jne 0x1000b298
mov dword [esp + 0x30], esi
mov ecx, esi
mov eax, dword [esp + 0x30]
call fcn.10004a38
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x14]
mov edx, 0x1c7a0659
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
movzx eax, byte [eax]
mov dword [esp], ecx
lea ecx, [esp + 0x12]
mov dword [esp + 4], 0x440047
mov dword [esp + 8], 0x30056
mov dword [esp + 0x44], eax
cmp edx, 0x50396287
je 0x1000b71d
cmp edx, 0x1c7a0659
jne 0x1000b464
mov word [ecx], 0
add ecx, 2
mov edx, 0x1c7a0659
mov eax, 0x50396287
cmp ecx, dword [esp]
cmove edx, eax
jmp 0x1000b464
cmp eax, 0x2b18b464
je 0x1000b7a8
cmp eax, 0x3118811c
jne 0x1000b298
mov dword [0x100a41e4], 4
mov eax, 0x2b18b464
jmp 0x1000b298
cmp eax, 0xea67ae19
je 0x1000b7bf
cmp eax, 0xec16d6f3
jne 0x1000b298
mov ecx, esi
call fcn.10004df6
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov eax, 0xc177be4e
mov dword [esp + 0x24], ecx
jmp 0x1000b298
cmp eax, 0x5ab7c632
je 0x1000b7d0
cmp eax, 0x7891cd70
jne 0x1000b298
lea eax, [esp + 0x11]
mov ecx, 0x7371f918
mov dword [esp + 4], 0x77706856
mov dword [esp + 8], 0x466a6471
mov dword [esp + 0xc], 0x68656564
mov dword [esp], eax
lea eax, [esp + 0x10]
cmp ecx, 0x741a295e
je 0x1000b7df
cmp ecx, 0x7371f918
jne 0x1000b52d
mov byte [eax], 0
inc eax
mov ecx, 0x7371f918
mov edx, 0x741a295e
cmp eax, dword [esp]
cmove ecx, edx
jmp 0x1000b52d
lea eax, [esp + 0xa]
mov ecx, 0x8cdfbb6a
mov dword [esp + 4], 0x66676d53
mov byte [esp + 8], 0x74
mov dword [esp], eax
lea eax, [esp + 9]
cmp ecx, 0xfbaae490
je 0x1000b847
cmp ecx, 0x8cdfbb6a
jne 0x1000b574
mov byte [eax], 0
inc eax
mov ecx, 0x8cdfbb6a
mov edx, 0xfbaae490
cmp eax, dword [esp]
cmove ecx, edx
jmp 0x1000b574
mov cl, byte [esp + 0x1a]
mov al, byte [esp + 0x1b]
mov ebp, 0xea67ae19
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x985031c9
cmovne eax, ebp
test cl, cl
mov ecx, 0x985031c9
cmove eax, ecx
test dl, dl
cmovne eax, ebp
jmp 0x1000b298
mov eax, 0xec16d6f3
mov dword [esp + 0x2c], 0
jmp 0x1000b298
cmp dword [0x100a41e4], 4
mov eax, 0xc560f965
mov ecx, 0x2b18b464
cmove eax, ecx
jmp 0x1000b298
xor ecx, ecx
mov edx, 0xfd17f532
cmp edx, 0xa39c7494
je 0x1000b633
cmp edx, 0x1b6a8941
je 0x1000b8a2
cmp edx, 0xfd17f532
jne 0x1000b5ff
mov dword [esp], ecx
mov edi, 0xa39c7494
mov edx, dword [esp]
cmp edx, 9
mov edx, 0x1b6a8941
cmovb edx, edi
jmp 0x1000b5ff
mov ecx, dword [esp]
mov ebx, 0x1780
mov ebp, 0x78c4
mov edi, 0xffff873b
movzx edx, word [esp + ecx*2 + 4]
mov esi, edx
and edx, 0xffffe87f
not esi
and esi, ebx
or edx, esi
mov esi, dword [esp]
add esi, ebx
mov ebx, edx
and edx, edi
not ebx
and ebx, ebp
or edx, ebx
mov ebx, esi
and esi, edi
not ebx
and ebx, ebp
or esi, ebx
lea ebx, [esp + 4]
xor esi, edx
mov word [esp + ecx*2 + 4], si
lea esi, [esp + 0x48]
mov ecx, dword [esp]
inc ecx
jmp 0x1000b5fa
mov dword [esp + 0x3c], edi
mov eax, 0xd646b453
mov ecx, 0x3118811c
cmp dword [esp + 0x3c], 0
cmovg eax, ecx
jmp 0x1000b298
xor eax, eax
mov ecx, 0x4365cb22
cmp ecx, 0x389d28ca
je 0x1000b6df
cmp ecx, 0x78c8d1d2
je 0x1000b8f2
cmp ecx, 0x4365cb22
jne 0x1000b6ab
mov dword [esp], eax
mov edx, 0x389d28ca
mov ecx, dword [esp]
cmp ecx, 0xb
mov ecx, 0x78c8d1d2
cmovb ecx, edx
jmp 0x1000b6ab
mov ecx, dword [esp]
mov dl, byte [esp + ecx + 4]
mov eax, dword [esp]
mov dh, dl
and dl, 3
not dh
and dh, 0xfc
or dl, dh
mov dh, al
and al, 3
not dh
and dh, 0xfc
or al, dh
xor al, dl
mov byte [esp + ecx + 4], al
mov eax, dword [esp]
inc eax
jmp 0x1000b6a6
xor ecx, ecx
mov eax, 0xec16d6f3
inc ecx
mov dword [esp + 0x2c], ecx
jmp 0x1000b298
xor ecx, ecx
mov edx, 0x10189c38
cmp edx, 0x9406f4f9
je 0x1000b758
cmp edx, 0x5d2a8085
je 0x1000b915
cmp edx, 0x10189c38
jne 0x1000b724
mov dword [esp], ecx
mov eax, 0x9406f4f9
mov edx, dword [esp]
cmp edx, 7
mov edx, 0x5d2a8085
cmovb edx, eax
jmp 0x1000b724
mov ecx, dword [esp]
mov eax, 0x1780
lea esi, [esp + 0x48]
movzx edx, word [esp + ecx*2 + 4]
mov ebx, dword [esp]
mov ebp, edx
and edx, 0xffffcdbc
add ebx, eax
not ebp
and ebp, 0x3243
or edx, ebp
mov ebp, edx
xor edx, 0xffffda3c
and edx, ebx
xor ebp, 0x25c3
not ebx
and ebx, ebp
or ebx, edx
mov word [esp + ecx*2 + 4], bx
lea ebx, [esp + 4]
mov ecx, dword [esp]
inc ecx
jmp 0x1000b71f
cmp dword [esp + 0x1c], 0
mov eax, 0x541891d8
mov ecx, 0xf0cf31f5
cmove eax, ecx
jmp 0x1000b298
xor ecx, ecx
mov eax, 0xc177be4e
inc ecx
mov dword [esp + 0x24], ecx
jmp 0x1000b298
mov edi, dword [esp + 0x38]
mov eax, 0x457d0446
inc edi
jmp 0x1000b298
xor eax, eax
mov ecx, 0x23aa364b
cmp ecx, 0xade85fba
je 0x1000b81a
cmp ecx, 0xfdcc9849
je 0x1000b93f
cmp ecx, 0x23aa364b
jne 0x1000b7e6
mov dword [esp], eax
mov edx, 0xade85fba
mov ecx, dword [esp]
cmp ecx, 0xc
mov ecx, 0xfdcc9849
cmovb ecx, edx
jmp 0x1000b7e6
mov ecx, dword [esp]
mov dl, byte [esp + ecx + 4]
mov eax, dword [esp]
mov dh, dl
and dl, 0xe9
not dh
and dh, 0x16
or dl, dh
mov dh, al
and al, 0xe9
not dh
and dh, 0x16
or al, dh
xor al, dl
mov byte [esp + ecx + 4], al
mov eax, dword [esp]
inc eax
jmp 0x1000b7e1
xor eax, eax
mov ecx, 0x7c2d5bf
cmp ecx, 0x5184c5c5
je 0x1000b882
cmp ecx, 0x422e8ab0
je 0x1000b9a5
cmp ecx, 0x7c2d5bf
jne 0x1000b84e
mov dword [esp], eax
mov edx, 0x5184c5c5
mov ecx, dword [esp]
cmp ecx, 5
mov ecx, 0x422e8ab0
cmovb ecx, edx
jmp 0x1000b84e
mov ecx, dword [esp]
mov dl, byte [esp + ecx + 4]
mov eax, dword [esp]
mov dh, dl
not dh
and dh, al
not al
and al, dl
or al, dh
mov byte [esp + ecx + 4], al
mov eax, dword [esp]
inc eax
jmp 0x1000b849
mov word [esp + 0x16], 0
mov ecx, dword [esp + 0x1c]
sub esp, 0x1c
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 4], ebx
mov dword [esp + 0x18], edx
mov dword [esp], eax
call fcn.1000bd14
mov edi, dword [esp + 0x38]
test eax, eax
mov eax, 0x5ab7c632
mov ecx, 0x457d0446
cmove eax, ecx
jmp 0x1000b298
mov ecx, ebx
mov byte [esp + 0xf], 0
call fcn.100068cd
push 0x8000
push 0
push dword [esp + 0x24]
call eax
mov eax, 0xf0cf31f5
jmp 0x1000b298
mov word [esp + 0x12], 0
push esi
push dword [esp + 0x48]
push ebx
push dword [esp + 0x78]
call fcn.1000ba6e
test eax, eax
mov eax, 0x1fa8e332
mov ecx, 0x8c01319b
cmove eax, ecx
jmp 0x1000b298
mov ecx, ebx
mov byte [esp + 0x10], 0
call fcn.100068cd
mov ecx, dword [esp + 0x20]
push 4
push 0x1000
push dword [ecx]
push 0
call eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xb]
mov ecx, 0xfcaac6fa
mov dword [esp + 4], 0x606f646d
mov word [esp + 8], 0x7c74
mov dword [esp], eax
lea eax, [esp + 0xa]
cmp ecx, 0xece48a4b
je 0x1000b9cb
cmp ecx, 0xfcaac6fa
jne 0x1000b97f
mov byte [eax], 0
inc eax
mov ecx, 0xfcaac6fa
mov edx, 0xece48a4b
cmp eax, dword [esp]
cmove ecx, edx
jmp 0x1000b97f
mov ecx, ebx
mov byte [esp + 9], 0
call fcn.100068cd
push dword [0x100a3010]
call eax
mov ecx, dword [esp + 0x3c]
mov eax, 0xe85a1f80
mov dword [esp + 0x28], ecx
jmp 0x1000b298
xor eax, eax
mov ecx, 0x52d4eb05
cmp ecx, 0x84a55528
je 0x1000ba2f
cmp ecx, 0xac4cf4e0
je 0x1000ba02
cmp ecx, 0x52d4eb05
jne 0x1000b9d2
mov dword [esp], eax
mov edx, 0xac4cf4e0
mov ecx, dword [esp]
cmp ecx, 6
mov ecx, 0x84a55528
cmovb ecx, edx
jmp 0x1000b9d2
mov ecx, dword [esp]
mov dl, byte [esp + ecx + 4]
mov eax, dword [esp]
mov dh, dl
and dl, 0xa
not dh
and dh, 0xf5
or dl, dh
mov dh, al
and al, 0xa
not dh
and dh, 0xf5
or al, dh
xor al, dl
mov byte [esp + ecx + 4], al
mov eax, dword [esp]
inc eax
jmp 0x1000b9cd
mov ecx, ebx
mov byte [esp + 0xa], 0
call fcn.100068cd
mov ecx, dword [esp + 0x20]
push dword [ecx]
push dword [esp + 0x50]
push dword [esp + 0x24]
call eax
add esp, 0xc
mov eax, 0xe85a1f80
mov dword [esp + 0x28], 0
jmp 0x1000b298
mov eax, dword [esp + 0x24]
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret 8