Function at 0x10002bfe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x14
mov eax, 0x1003db9d
call fcn.1003d77e
mov dword [ebp - 0x10], 1
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x10042857
call fcn.10003d99
xor edx, edx
mov dword [ebp - 4], edx
mov edi, dword [0x10057860]
mov dword [ebp - 0x10], 1
test edi, edi
je case.default.0x10002b9a
cmp byte [0x100578dc], dl
je 0x10002a94
mov ecx, 0x10b8134
call fcn.1000d24b
mov ebx, eax
test ebx, ebx
je 0x10002a92
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002a92
push 4
add ebx, 0x6e4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor edx, edx
test eax, eax
jne 0x10002a94
mov ax, word [ebx]
mov word [edi + 0x3e], ax
jmp 0x10002a94
xor edx, edx
movzx eax, word [edi + 0x3e]
mov ecx, 0xc9
cmp eax, ecx
ja 0x10002b85
je case.0x10002b9a.205
sub eax, 0x65
cmp eax, 0xb
ja case.default.0x10002b9a
movzx eax, byte [eax + 0x10002c7b]
jmp dword [eax*4 + 0x10002c6b]
mov cl, 0x79
mov dword [ebp - 0x20], 0x48494879
mov dword [ebp - 0x1c], 0xb180e54
mov eax, edx
mov dword [ebp - 0x18], 0xb16100b
mov byte [ebp - 0x14], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x10002af0
mov cl, byte [ebp - 0x20]
jmp 0x10002ae1
mov byte [ebp - 0x14], dl
jmp 0x10002c54
mov cl, 0x63
mov dword [ebp - 0x20], 0x51535263
mov dword [ebp - 0x1c], 0x40c114e
mov eax, edx
mov word [ebp - 0x18], 0x616
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002b22
mov cl, byte [ebp - 0x20]
jmp 0x10002b13
mov byte [ebp - 0x16], dl
jmp 0x10002c54
mov cl, 0x1b
mov dword [ebp - 0x20], 0x282b2a1b
mov dword [ebp - 0x1c], 0x7c7a7636
mov eax, edx
mov word [ebp - 0x18], 0x7e
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 8
jae 0x10002b51
mov cl, byte [ebp - 0x20]
jmp 0x10002b42
mov byte [ebp - 0x17], dl
jmp 0x10002c54
mov cl, 0x50
mov dword [ebp - 0x20], 0x64606150
mov dword [ebp - 0x1c], 0x3922207d
mov eax, edx
mov dword [ebp - 0x18], 0x242335
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xa
jae 0x10002c51
mov cl, byte [ebp - 0x20]
jmp 0x10002b72
sub eax, 0xca
cmp eax, 0xa
ja case.default.0x10002b9a
movzx eax, byte [eax + 0x10002c97]
jmp dword [eax*4 + 0x10002c87]
mov cl, 0x73
mov dword [ebp - 0x20], 0x42434173
mov dword [ebp - 0x1c], 0x112045e
mov eax, edx
mov dword [ebp - 0x18], 0x11c1a01
mov byte [ebp - 0x14], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x10002af0
mov cl, byte [ebp - 0x20]
jmp 0x10002bbd
mov cl, 0x59
mov dword [ebp - 0x20], 0x6b696b59
mov dword [ebp - 0x1c], 0x3e362b74
mov eax, edx
mov word [ebp - 0x18], 0x3c2c
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002b22
mov cl, byte [ebp - 0x20]
jmp 0x10002beb
mov cl, 0x56
mov dword [ebp - 0x20], 0x65666456
mov dword [ebp - 0x1c], 0x31373b7b
mov eax, edx
mov word [ebp - 0x18], 0x33
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 8
jae 0x10002b51
mov cl, byte [ebp - 0x20]
jmp 0x10002c16
mov cl, 0xf
mov dword [ebp - 0x20], 0x3b3f3d0f
mov dword [ebp - 0x1c], 0x667d7f22
mov eax, edx
mov dword [ebp - 0x18], 0x7b7c6a
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xa
jae 0x10002c51
mov cl, byte [ebp - 0x20]
jmp 0x10002c42
mov byte [ebp - 0x15], dl
lea eax, [ebp - 0x1f]
mov ecx, esi
push eax
call fcn.10003b49
mov eax, esi
call fcn.1003d75b
ret 4