Function at 0x1004dce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov al, 0xf3
push ebx
mov byte [esp + 0x10], al
mov byte [esp + 0x12], al
mov al, byte [0x10197b94]
push ebp
push esi
push edi
test al, 1
mov byte [esp + 0x20], 0
mov byte [esp + 0x21], 0x44
mov byte [esp + 0x22], 0x58
mov byte [esp + 0x23], 0x34
mov byte [esp + 0x24], 0xb2
mov byte [esp + 0x25], 0x16
mov byte [esp + 0x26], 0xed
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0xdd
mov byte [esp + 0x29], 0x6a
mov byte [esp + 0x2a], 0x9f
mov byte [esp + 0x2b], 0xa7
mov byte [esp + 0x14], 0x6b
mov byte [esp + 0x15], 0x21
mov byte [esp + 0x16], 0x2a
mov byte [esp + 0x17], 0x5a
mov byte [esp + 0x18], 0xd7
mov byte [esp + 0x19], 0x7a
mov byte [esp + 0x1a], 0xde
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1d], 0xe
mov byte [esp + 0x1f], 0xcb
jne 0x1004ddf5
mov bl, al
push 0xd
or bl, 1
mov byte [0x10197b94], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10197b98], eax
xor edi, edi
mov bl, byte [esp + edi + 0x14]
movsx eax, byte [esp + edi + 0x20]
movsx esi, bl
test esi, esi
jne 0x1004dd9d
mov esi, 8
cdq
idiv esi
mov ecx, edx
test ecx, ecx
je 0x1004ddc8
mov eax, ecx
cdq
mov ebp, eax
mov eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebp
jge 0x1004ddbd
lea esi, [ebp + 0xc]
mov eax, ecx
cdq
idiv esi
mov ecx, eax
test ecx, ecx
jne 0x1004ddbd
mov al, byte [esp + edi + 0x20]
xor bl, al
mov eax, dword [0x10197b98]
or bl, cl
mov byte [edi + eax], bl
inc edi
cmp edi, 0xc
jb 0x1004dd88
mov ecx, dword [0x10197b98]
push 0x1004df30
mov byte [ecx + 0xc], 0
call fcn.1013c36b
add esp, 4
mov al, byte [0x10197b9c]
mov edx, dword [0x10197b98]
test al, 1
mov dword [esp + 0x10], edx
mov byte [esp + 0x14], 0x77
mov byte [esp + 0x15], 0x15
mov byte [esp + 0x16], 0x2f
mov byte [esp + 0x17], 0x99
mov byte [esp + 0x18], 0x3d
mov byte [esp + 0x19], 0xf1
mov byte [esp + 0x1a], 0x31
mov byte [esp + 0x1b], 0xd5
mov byte [esp + 0x1c], 0xe0
mov byte [esp + 0x20], 0x20
mov byte [esp + 0x21], 0x67
mov byte [esp + 0x22], 0x46
mov byte [esp + 0x23], 0xed
mov byte [esp + 0x24], 0x58
mov byte [esp + 0x25], 0xb7
mov byte [esp + 0x26], 0x58
mov byte [esp + 0x27], 0xb9
mov byte [esp + 0x28], 0x85
jne 0x1004deef
mov bl, al
push 0xa
or bl, 1
mov byte [0x10197b9c], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10197ba0], eax
xor edi, edi
mov bl, byte [esp + edi + 0x20]
movsx eax, byte [esp + edi + 0x14]
movsx esi, bl
test esi, esi
jne 0x1004de97
mov esi, 8
cdq
idiv esi
mov ecx, edx
test ecx, ecx
je 0x1004dec2
mov eax, ecx
cdq
mov ebp, eax
mov eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebp
jge 0x1004deb7
lea esi, [ebp + 0xc]
mov eax, ecx
cdq
idiv esi
mov ecx, eax
test ecx, ecx
jne 0x1004deb7
mov al, byte [esp + edi + 0x14]
xor bl, al
mov eax, dword [0x10197ba0]
or bl, cl
mov byte [edi + eax], bl
inc edi
cmp edi, 9
jb 0x1004de82
mov ecx, dword [0x10197ba0]
push 0x1004df40
mov byte [ecx + 9], 0
call fcn.1013c36b
add esp, 4
mov edx, dword [esp + 0x10]
mov esi, dword [0x10197ba0]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret