Function at 0x10056acf
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push 0x368
mov eax, 0x100f33fb
call fcn.100cca34
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x348], eax
call fcn.1000cae4
test eax, eax
je 0x10056c50
call fcn.1000cae4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
je 0x10056c50
call fcn.1000cae4
mov dword [ebp - 0x2a4], 0x46
mov edi, eax
mov byte [ebp - 0x2a0], 0x3d
xor eax, eax
mov byte [ebp - 0x29f], 5
mov byte [ebp - 0x29e], 3
mov byte [ebp - 0x29d], 0x74
mov byte [ebp - 0x29c], al
mov byte [ebp - 0x29b], 0x71
mov byte [ebp - 0x29a], 0x7f
mov byte [ebp - 0x299], 0x7e
mov byte [ebp - 0x298], 2
mov byte [ebp - 0x297], 0x6b
mov byte [ebp - 0x296], 0x77
mov byte [ebp - 0x295], 0x70
mov byte [ebp - 0x294], 2
push 0x73
pop ecx
mov byte [ebp - 0x293], cl
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 0x292], 0x6b
mov byte [ebp - 0x291], 0x72
mov byte [ebp - 0x290], 2
mov byte [ebp - 0x28f], 0x75
mov byte [ebp - 0x28e], 0x71
mov byte [ebp - 0x28d], 0x6b
mov byte [ebp - 0x28c], 4
mov byte [ebp - 0x28b], 0x71
mov byte [ebp - 0x28a], 0x75
mov byte [ebp - 0x289], 4
mov byte [ebp - 0x288], 0x6b
mov byte [ebp - 0x287], 0x77
mov byte [ebp - 0x286], 0x75
mov byte [ebp - 0x285], 3
mov byte [ebp - 0x284], 0x7f
mov byte [ebp - 0x283], 5
mov byte [ebp - 0x282], 7
mov byte [ebp - 0x281], 0x72
mov byte [ebp - 0x280], al
mov byte [ebp - 0x27f], 0x72
mov byte [ebp - 0x27e], 3
mov byte [ebp - 0x27d], 5
mov byte [ebp - 0x27c], 0x72
mov byte [ebp - 0x27b], 0x3b
mov byte [ebp - 0x27a], al
mov al, byte [ebp - 0x2a0]
mov esi, dword [edi]
call fcn.100583e1
push eax
push edi
call dword [esi + 0x1c]
pop ecx
pop ecx
mov eax, dword [0x10201ab4]
push 0x6d
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 4]
mov eax, 0x82
mov word [ebp - 0x338], ax
add edi, 4
pop eax
mov word [ebp - 0x336], ax
push 0x76
pop eax
mov word [ebp - 0x334], ax
push 0x73
pop eax
mov word [ebp - 0x332], ax
push 0x79
pop eax
mov word [ebp - 0x330], ax
push 0x44
pop ecx
mov word [ebp - 0x32e], cx
mov word [ebp - 0x32c], cx
push 0x2a
pop ecx
mov word [ebp - 0x32a], cx
push 0x5a
pop ecx
mov word [ebp - 0x328], cx
push 0x7c
pop ecx
mov word [ebp - 0x326], cx
push 0x6c
pop ecx
mov word [ebp - 0x324], ax
push 0x6f
pop edx
mov word [ebp - 0x322], cx
push 0x2a
mov word [ebp - 0x320], dx
pop esi
mov word [ebp - 0x31e], si
push 0x57
pop esi
mov word [ebp - 0x31c], si
mov word [ebp - 0x31a], ax
add eax, 0xb
mov word [ebp - 0x318], ax
mov word [ebp - 0x316], ax
push 0x73
pop eax
mov word [ebp - 0x314], ax
push 0x2a
pop esi
mov word [ebp - 0x312], dx
push 0x42
mov word [ebp - 0x310], si
pop eax
mov word [ebp - 0x30e], ax
push 0x43
pop eax
mov word [ebp - 0x30c], ax
xor eax, eax
mov word [ebp - 0x30a], cx
lea ecx, [ebp - 0x338]
mov word [ebp - 0x308], ax
mov ax, word [ebp - 0x338]
mov esi, dword [edi]
call fcn.100583c8
push eax
push edi
call dword [esi + 8]
mov edi, dword [ebp + 0x18]
lea eax, [ebp - 0x344]
lea esi, [edi + edi]
push esi
push eax
call fcn.1003d0de
add esp, 0x10
and dword [ebp - 4], 0
push edi
mov eax, dword [0x101ef2d0]
call dword [eax + 0x124]
cmp eax, esi
jbe 0x10056d94
mov esi, 0xe001000b
jmp 0x1005818c
mov eax, dword [0x101ef2d0]
push edi
push dword [ebp - 0x348]
push dword [ebp - 0x344]
call dword [eax + 0x1f0]
and dword [ebp - 0x354], 0
mov edi, eax
and dword [ebp - 0x350], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x354]
push eax
push 0xf017
push dword [0x101ef2d0]
call fcn.1000244b
mov esi, eax
add esp, 0xc
test esi, esi
js 0x10058179
xor eax, eax
mov dword [ebp - 0x110], 0x74b81cb2
mov dword [ebp - 0x90], eax
lea edx, [ebp - 0x370]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x354]
push edx
mov dword [ebp - 0x10c], 0xb83ef501
lea edx, [ebp - 0x34c]
mov dword [ebp - 0x108], 0xd588e744
mov dword [ebp - 0x104], 0x13a71952
mov dword [ebp - 0x100], 0x9a53a5e5
mov dword [ebp - 0xfc], 0xbf957822
mov dword [ebp - 0xf8], 0x423abc
mov dword [ebp - 0xf4], 0x2c05eba6
mov dword [ebp - 0xf0], 0x6842df72
mov dword [ebp - 0xec], 0x9d955aa9
mov dword [ebp - 0xe8], 0x6f0b09a8
mov dword [ebp - 0xe4], 0xae8819a5
mov dword [ebp - 0xe0], 0xc621beed
mov dword [ebp - 0xdc], 0x4bc4e8ae
mov dword [ebp - 0xd8], 0x353f5483
mov dword [ebp - 0xd4], 0x630c4d3c
mov dword [ebp - 0xd0], 0xa6c23ee0
mov dword [ebp - 0xcc], 0x2252d5f1
mov dword [ebp - 0xc8], 0x11937d86
mov dword [ebp - 0xc4], 0x8814a365
mov dword [ebp - 0xc0], 0xe315da63
mov dword [ebp - 0xbc], 0x2153fc90
mov dword [ebp - 0xb8], 0xe00ce97b
mov dword [ebp - 0xb4], 0x76a4eaeb
mov dword [ebp - 0xb0], 0x5e6cf754
mov dword [ebp - 0xac], 0x1e2c6b23
mov dword [ebp - 0xa8], 0x25f086fc
mov dword [ebp - 0xa4], 0x9c24ff83
mov dword [ebp - 0xa0], 0x5c011e91
mov dword [ebp - 0x9c], 0x42349ac1
mov dword [ebp - 0x98], 0x78995db5
mov dword [ebp - 0x94], 0xb3d6c340
mov dword [ebp - 0x14], 0x1000100
mov dword [ebp - 0x36c], edi
mov dword [ebp - 0x364], 0x100
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
js 0x10058179
xor eax, eax
lea ecx, [ebp - 0x35c]
mov byte [ebp - 0x348], al
push dword [ebp - 0x348]
mov dword [ebp - 0x35c], eax
push dword [ebp - 0x34c]
mov dword [ebp - 0x358], eax
call fcn.1005366d
mov byte [ebp - 4], 2
and dword [ebp - 0x340], 0
and dword [ebp - 0x33c], 0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x340]
push eax
push 0xf062
push dword [0x101ef2d0]
call fcn.1000244b
mov esi, eax
add esp, 0xc
test esi, esi
js 0x10058153
mov eax, dword [ebp - 0x340]
push 0x10053c7a
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov dword [ebp - 0x20c], 8
lea ecx, [ebp - 0x20c]
mov eax, dword [ebp - 0x20c]
xor eax, 0x5f
mov byte [ebp - 0x208], al
mov eax, dword [ebp - 0x20c]
inc al
xor eax, 0x55
mov byte [ebp - 0x207], al
mov eax, dword [ebp - 0x20c]
add al, 2
xor eax, 0x7a
mov byte [ebp - 0x206], al
mov eax, dword [ebp - 0x20c]
add al, 3
mov byte [ebp - 0x204], 0
xor eax, 0x62
mov byte [ebp - 0x205], al
mov al, byte [ebp - 0x208]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10055661
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x148], 0x69
lea ecx, [ebp - 0x148]
mov byte [ebp - 0x147], 0x4b
mov byte [ebp - 0x146], 0x5e
mov byte [ebp - 0x145], 0x79
mov byte [ebp - 0x144], 0
mov al, byte [ebp - 0x148]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.100583b1
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10053917
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x218], 0x5b
lea ecx, [ebp - 0x218]
mov eax, dword [ebp - 0x218]
xor eax, 0x5f
mov byte [ebp - 0x214], al
mov eax, dword [ebp - 0x218]
inc al
xor eax, 0x4a
mov byte [ebp - 0x213], al
mov eax, dword [ebp - 0x218]
add al, 2
xor eax, 0x68
mov byte [ebp - 0x212], al
mov eax, dword [ebp - 0x218]
add al, 3
mov byte [ebp - 0x210], 0
xor eax, 0x33
mov byte [ebp - 0x211], al
mov al, byte [ebp - 0x214]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x100563bb
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x128], 0x66
mov byte [ebp - 0x127], 0x71
lea ecx, [ebp - 0x128]
mov byte [ebp - 0x126], 0x6b
mov byte [ebp - 0x125], 0x3d
mov byte [ebp - 0x124], 0
mov al, byte [ebp - 0x128]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.100582b6
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x1005470a
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x2ec], 0xc
lea ecx, [ebp - 0x2ec]
mov byte [ebp - 0x2e8], 0x53
mov byte [ebp - 0x2e7], 0x59
mov byte [ebp - 0x2e6], 0x7a
mov byte [ebp - 0x2e5], 0x6e
mov al, byte [ebp - 0x2e8]
mov edi, dword [ebp - 0x340]
mov byte [ebp - 0x2e4], 0
mov esi, dword [edi]
call fcn.10049784
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10054411
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x158], 0x6c
lea ecx, [ebp - 0x158]
mov byte [ebp - 0x157], 0x44
mov byte [ebp - 0x156], 0x86
mov byte [ebp - 0x155], 0x43
mov byte [ebp - 0x154], 0
mov al, byte [ebp - 0x158]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.10058312
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x100564db
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x2b0], 0x38
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 0x2ac], 0x67
mov byte [ebp - 0x2ab], 0x5c
mov byte [ebp - 0x2aa], 0x53
mov byte [ebp - 0x2a9], 0x60
mov al, byte [ebp - 0x2ac]
mov edi, dword [ebp - 0x340]
mov byte [ebp - 0x2a8], 0
mov esi, dword [edi]
call fcn.10049784
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10054a06
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x1b8], 0x36
mov eax, dword [ebp - 0x1b8]
xor eax, 0x5f
mov byte [ebp - 0x1b4], al
mov eax, dword [ebp - 0x1b8]
inc al
xor eax, 0x43
mov byte [ebp - 0x1b3], al
mov eax, dword [ebp - 0x1b8]
add al, 2
xor eax, 0x42
mov byte [ebp - 0x1b2], al
mov eax, dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1b8]
add al, 3
mov byte [ebp - 0x1b0], 0
xor eax, 0x71
mov byte [ebp - 0x1b1], al
mov al, byte [ebp - 0x1b4]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10053db2
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x1d0], 0x60
lea ecx, [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
xor eax, 0x5f
mov byte [ebp - 0x1cc], al
mov eax, dword [ebp - 0x1d0]
inc al
xor eax, 0x48
mov byte [ebp - 0x1cb], al
mov eax, dword [ebp - 0x1d0]
add al, 2
xor eax, 0x4d
mov byte [ebp - 0x1ca], al
mov eax, dword [ebp - 0x1d0]
add al, 3
mov byte [ebp - 0x1c8], 0
xor eax, 0x30
mov byte [ebp - 0x1c9], al
mov al, byte [ebp - 0x1cc]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10056662
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x1f4], 0x6c
mov eax, dword [ebp - 0x1f4]
xor eax, 0x5f
mov byte [ebp - 0x1f0], al
mov eax, dword [ebp - 0x1f4]
inc al
xor eax, 0x7a
mov byte [ebp - 0x1ef], al
mov eax, dword [ebp - 0x1f4]
add al, 2
xor eax, 0x45
mov byte [ebp - 0x1ee], al
mov eax, dword [ebp - 0x1f4]
push 0x73
add al, 3
mov byte [ebp - 0x1ec], 0
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 0x1ed], al
mov al, byte [ebp - 0x1f0]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x100567ae
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x224], 0x45
mov eax, dword [ebp - 0x224]
xor eax, 0x5f
mov byte [ebp - 0x220], al
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x224]
inc al
xor eax, 0x39
mov byte [ebp - 0x21f], al
mov eax, dword [ebp - 0x224]
add al, 2
xor eax, 0x4c
mov byte [ebp - 0x21e], al
mov eax, dword [ebp - 0x224]
add al, 3
mov byte [ebp - 0x21c], 0
xor eax, 0x42
mov byte [ebp - 0x21d], al
mov al, byte [ebp - 0x220]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x1005529a
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x160], 0x65
lea ecx, [ebp - 0x160]
mov byte [ebp - 0x15f], 0x3f
mov byte [ebp - 0x15e], 0x5c
mov byte [ebp - 0x15d], 0x6e
mov byte [ebp - 0x15c], 0
mov al, byte [ebp - 0x160]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1005839a
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10054bff
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x230], 0x38
lea ecx, [ebp - 0x230]
mov eax, dword [ebp - 0x230]
xor eax, 0x5f
mov byte [ebp - 0x22c], al
mov eax, dword [ebp - 0x230]
inc al
xor eax, 0x43
mov byte [ebp - 0x22b], al
mov eax, dword [ebp - 0x230]
add al, 2
xor eax, 0x52
mov byte [ebp - 0x22a], al
mov eax, dword [ebp - 0x230]
add al, 3
mov byte [ebp - 0x228], 0
xor eax, 0x55
mov byte [ebp - 0x229], al
mov al, byte [ebp - 0x22c]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10053ed9
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x168], 0x61
lea ecx, [ebp - 0x168]
mov byte [ebp - 0x167], 0x49
mov byte [ebp - 0x166], 0x56
mov byte [ebp - 0x165], 0x44
mov byte [ebp - 0x164], 0
mov al, byte [ebp - 0x168]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.10058288
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10054090
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x23c], 0x6e
lea ecx, [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
xor eax, 0x5f
mov byte [ebp - 0x238], al
mov eax, dword [ebp - 0x23c]
inc al
xor eax, 0x74
mov byte [ebp - 0x237], al
mov eax, dword [ebp - 0x23c]
add al, 2
xor eax, 0x33
mov byte [ebp - 0x236], al
mov eax, dword [ebp - 0x23c]
add al, 3
mov byte [ebp - 0x234], 0
xor eax, 0x41
mov byte [ebp - 0x235], al
mov al, byte [ebp - 0x238]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10055780
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x170], 0x6c
lea ecx, [ebp - 0x170]
mov byte [ebp - 0x16f], 0x50
mov byte [ebp - 0x16e], 0x5d
mov byte [ebp - 0x16d], 0x53
mov byte [ebp - 0x16c], 0
mov al, byte [ebp - 0x170]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.10058312
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x100536e7
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x248], 0x18
lea ecx, [ebp - 0x248]
mov eax, dword [ebp - 0x248]
xor eax, 0x5f
mov byte [ebp - 0x244], al
mov eax, dword [ebp - 0x248]
inc al
xor eax, 0x47
mov byte [ebp - 0x243], al
mov eax, dword [ebp - 0x248]
add al, 2
xor eax, 0x38
mov byte [ebp - 0x242], al
mov eax, dword [ebp - 0x248]
add al, 3
mov byte [ebp - 0x240], 0
xor eax, 0x46
mov byte [ebp - 0x241], al
mov al, byte [ebp - 0x244]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x1005381e
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x254], 0x15
lea ecx, [ebp - 0x254]
mov eax, dword [ebp - 0x254]
xor eax, 0x5f
mov byte [ebp - 0x250], al
mov eax, dword [ebp - 0x254]
inc al
xor eax, 0x66
mov byte [ebp - 0x24f], al
mov eax, dword [ebp - 0x254]
add al, 2
xor eax, 0x34
mov byte [ebp - 0x24e], al
mov eax, dword [ebp - 0x254]
add al, 3
mov byte [ebp - 0x24c], 0
xor eax, 0x4b
mov byte [ebp - 0x24d], al
mov al, byte [ebp - 0x250]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10055445
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x178], 0x67
lea ecx, [ebp - 0x178]
mov byte [ebp - 0x177], 0x80
mov byte [ebp - 0x176], 0x56
mov byte [ebp - 0x175], 0x40
mov byte [ebp - 0x174], 0
mov al, byte [ebp - 0x178]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.100582cd
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10053db5
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x150], 0x67
lea ecx, [ebp - 0x150]
push 0x57
pop eax
mov byte [ebp - 0x14f], al
mov byte [ebp - 0x14e], 0x80
mov byte [ebp - 0x14d], 0x6a
mov byte [ebp - 0x14c], 0
mov al, byte [ebp - 0x150]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.100582cd
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x100542d7
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x1c4], 0x5a
mov eax, dword [ebp - 0x1c4]
xor eax, 0x5f
mov byte [ebp - 0x1c0], al
mov eax, dword [ebp - 0x1c4]
inc al
xor eax, 0x36
mov byte [ebp - 0x1bf], al
mov eax, dword [ebp - 0x1c4]
add al, 2
xor eax, 0x4c
mov byte [ebp - 0x1be], al
mov eax, dword [ebp - 0x1c4]
add al, 3
xor eax, 0x4a
mov byte [ebp - 0x1bd], al
lea ecx, [ebp - 0x1c4]
mov al, byte [ebp - 0x1c0]
mov edi, dword [ebp - 0x340]
mov byte [ebp - 0x1bc], 0
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10056923
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x26c], 0x12
lea ecx, [ebp - 0x26c]
mov eax, dword [ebp - 0x26c]
xor eax, 0x5f
mov byte [ebp - 0x268], al
mov eax, dword [ebp - 0x26c]
inc al
xor eax, 0x76
mov byte [ebp - 0x267], al
mov eax, dword [ebp - 0x26c]
add al, 2
xor eax, 0x65
mov byte [ebp - 0x266], al
mov eax, dword [ebp - 0x26c]
add al, 3
mov byte [ebp - 0x264], 0
xor eax, 0x54
mov byte [ebp - 0x265], al
mov al, byte [ebp - 0x268]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x1005605b
push edi
call dword [eax + 0x20]
push 0x57
pop eax
mov dword [ebp - 0x2bc], eax
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 0x2b8], 8
mov byte [ebp - 0x2b7], 0x38
mov byte [ebp - 0x2b6], 0x21
mov byte [ebp - 0x2b5], 2
mov al, byte [ebp - 0x2b8]
mov edi, dword [ebp - 0x340]
mov byte [ebp - 0x2b4], 0
mov esi, dword [edi]
call fcn.10049784
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x1005619f
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x180], 0x6c
lea ecx, [ebp - 0x180]
mov byte [ebp - 0x17f], 0x7c
mov byte [ebp - 0x17e], 0x7d
mov byte [ebp - 0x17d], 0x7b
mov byte [ebp - 0x17c], 0
mov al, byte [ebp - 0x180]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.10058312
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10055cf5
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x278], 0x25
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x278]
xor eax, 0x5f
mov byte [ebp - 0x274], al
mov eax, dword [ebp - 0x278]
inc al
xor eax, 0x62
mov byte [ebp - 0x273], al
mov eax, dword [ebp - 0x278]
add al, 2
xor eax, 0x7a
mov byte [ebp - 0x272], al
mov eax, dword [ebp - 0x278]
add al, 3
mov byte [ebp - 0x270], 0
xor eax, 0x68
mov byte [ebp - 0x271], al
mov al, byte [ebp - 0x274]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10055e23
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x188], 0x6c
lea ecx, [ebp - 0x188]
mov byte [ebp - 0x187], 0x5f
mov byte [ebp - 0x186], 0x79
mov byte [ebp - 0x185], 0x82
mov byte [ebp - 0x184], 0
mov al, byte [ebp - 0x188]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.10058312
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10055a91
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x1ac], 0x47
mov eax, dword [ebp - 0x1ac]
xor eax, 0x5f
mov byte [ebp - 0x1a8], al
mov eax, dword [ebp - 0x1ac]
inc al
xor eax, 0x65
mov byte [ebp - 0x1a7], al
mov eax, dword [ebp - 0x1ac]
add al, 2
xor eax, 0x66
mov byte [ebp - 0x1a6], al
mov eax, dword [ebp - 0x1ac]
push 0x57
add al, 3
mov byte [ebp - 0x1a4], 0
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 0x1a5], al
mov al, byte [ebp - 0x1a8]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10053a51
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x190], 0x61
mov byte [ebp - 0x18f], 0x69
mov byte [ebp - 0x18e], 0x76
mov byte [ebp - 0x18d], 0x4c
mov byte [ebp - 0x18c], 0
mov al, byte [ebp - 0x190]
lea ecx, [ebp - 0x190]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.10058288
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x1005450a
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x260], 0x28
lea ecx, [ebp - 0x260]
mov eax, dword [ebp - 0x260]
xor eax, 0x5f
mov byte [ebp - 0x25c], al
mov eax, dword [ebp - 0x260]
inc al
xor eax, 0x47
mov byte [ebp - 0x25b], al
mov eax, dword [ebp - 0x260]
add al, 2
xor eax, 0x43
mov byte [ebp - 0x25a], al
mov eax, dword [ebp - 0x260]
add al, 3
mov byte [ebp - 0x258], 0
xor eax, 0x74
mov byte [ebp - 0x259], al
mov al, byte [ebp - 0x25c]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x1005460a
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x130], 0x6a
lea ecx, [ebp - 0x130]
mov byte [ebp - 0x12f], 0x51
mov byte [ebp - 0x12e], 0x7b
mov byte [ebp - 0x12d], 0x80
mov byte [ebp - 0x12c], 0
mov al, byte [ebp - 0x130]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1005829f
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x1005588d
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x138], 0x61
lea ecx, [ebp - 0x138]
mov byte [ebp - 0x137], 0x4a
mov byte [ebp - 0x136], 0x69
mov byte [ebp - 0x135], 0x50
mov byte [ebp - 0x134], 0
mov al, byte [ebp - 0x138]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.10058288
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10054803
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x200], 0xa
mov eax, dword [ebp - 0x200]
xor eax, 0x5f
mov byte [ebp - 0x1fc], al
mov eax, dword [ebp - 0x200]
inc al
xor eax, 0x6a
mov byte [ebp - 0x1fb], al
mov eax, dword [ebp - 0x200]
add al, 2
push 0x57
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x200]
mov byte [ebp - 0x1fa], al
mov eax, dword [ebp - 0x200]
add al, 3
mov byte [ebp - 0x1f8], 0
xor eax, 0x30
mov byte [ebp - 0x1f9], al
mov al, byte [ebp - 0x1fc]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x100549e9
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x2c8], 0x66
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 0x2c4], 0x39
mov byte [ebp - 0x2c3], 2
mov byte [ebp - 0x2c2], 0x2b
mov byte [ebp - 0x2c1], 0x13
mov al, byte [ebp - 0x2c4]
mov edi, dword [ebp - 0x340]
mov byte [ebp - 0x2c0], 0
mov esi, dword [edi]
call fcn.10049784
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10054aff
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x2d4], 0x49
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 0x2d0], 0x16
mov byte [ebp - 0x2cf], 0x79
push 0x2a
pop eax
mov byte [ebp - 0x2ce], al
mov byte [ebp - 0x2cd], 0x2b
mov al, byte [ebp - 0x2d0]
mov edi, dword [ebp - 0x340]
mov byte [ebp - 0x2cc], 0
mov esi, dword [edi]
call fcn.10049784
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10053db2
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x1e8], 0xb
mov eax, dword [ebp - 0x1e8]
xor eax, 0x5f
mov byte [ebp - 0x1e4], al
mov eax, dword [ebp - 0x1e8]
inc al
xor eax, 0x41
mov byte [ebp - 0x1e3], al
mov eax, dword [ebp - 0x1e8]
add al, 2
xor eax, 0x46
mov byte [ebp - 0x1e2], al
mov eax, dword [ebp - 0x1e8]
push 0x73
add al, 3
pop ecx
xor eax, ecx
mov byte [ebp - 0x1e1], al
mov al, byte [ebp - 0x1e4]
lea ecx, [ebp - 0x1e8]
mov edi, dword [ebp - 0x340]
mov byte [ebp - 0x1e0], 0
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10053db2
push edi
call dword [eax + 0x20]
mov dword [ebp - 0x1dc], 0x10
lea ecx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1dc]
xor eax, 0x5f
mov byte [ebp - 0x1d8], al
mov eax, dword [ebp - 0x1dc]
inc al
xor eax, 0x39
mov byte [ebp - 0x1d7], al
mov eax, dword [ebp - 0x1dc]
add al, 2
xor eax, 0x78
mov byte [ebp - 0x1d6], al
mov eax, dword [ebp - 0x1dc]
add al, 3
mov byte [ebp - 0x1d4], 0
xor eax, 0x74
mov byte [ebp - 0x1d5], al
mov al, byte [ebp - 0x1d8]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.1003984e
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [edi]
push 0x10053eae
push edi
call dword [eax + 0x20]
mov byte [ebp - 0x140], 0x62
lea ecx, [ebp - 0x140]
mov byte [ebp - 0x13f], 0x45
mov byte [ebp - 0x13e], 0x76
mov byte [ebp - 0x13d], 0x48
mov byte [ebp - 0x13c], 0
mov al, byte [ebp - 0x140]
mov edi, dword [ebp - 0x340]
mov esi, dword [edi]
call fcn.100582e4
push eax
push edi
call dword [esi + 0x64]
mov eax, dword [ebp - 0x34c]
mov esi, dword [edi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push eax
mov eax, dword [ebp - 0x34c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push eax
push edi
call dword [esi + 0x34]
mov esi, eax
test esi, esi
js 0x10058153
mov dword [ebp - 0x2e0], 9
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 0x2dc], 0x56
mov byte [ebp - 0x2db], 0x31
mov byte [ebp - 0x2da], 0x7c
mov byte [ebp - 0x2d9], 0x47
mov al, byte [ebp - 0x2dc]
mov edi, dword [ebp - 0x340]
mov byte [ebp - 0x2d8], 0
mov esi, dword [edi]
call fcn.10049784
push eax
push edi
call dword [esi + 0x60]
xor eax, eax
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x2f0], 0xf
mov byte [ebp - 0x304], al
mov byte [ebp - 4], 4
mov eax, dword [0x10201ab4]
mov eax, dword [eax + 0xa8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x184]
and dword [ebp - 0x2f4], 0
lea ecx, [ebp - 0x304]
cmp dword [ebp - 0x2f0], 0x10
cmovae ecx, dword [ebp - 0x304]
lea esi, [eax + 0x874]
lea eax, [ebp - 0x304]
push eax
push esi
mov byte [ecx], 0
call fcn.100ddd9c
pop ecx
lea eax, [esi + eax*2]
push eax
lea eax, [ebp - 0x374]
push esi
push eax
call fcn.1004b06e
mov eax, dword [edi]
lea ecx, [ebp - 0x304]
add esp, 0x10
cmp dword [ebp - 0x2f0], 0x10
cmovae ecx, dword [ebp - 0x304]
push ecx
push edi
call dword [eax + 0x28]
xor eax, eax
lea edi, [ebp - 0x120]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1000cc24
mov dword [ebp - 0x1a0], 0x7a
mov edi, eax
mov ecx, dword [ebp - 0x1a0]
xor ecx, 0x78
mov byte [ebp - 0x19c], cl
mov ecx, dword [ebp - 0x1a0]
inc cl
xor ecx, 0x63
mov byte [ebp - 0x19b], cl
mov ecx, dword [ebp - 0x1a0]
add cl, 2
xor ecx, 0x6c
mov byte [ebp - 0x19a], cl
mov eax, dword [ebp - 0x1a0]
add al, 3
xor eax, 0x69
mov byte [ebp - 0x199], al
mov eax, dword [ebp - 0x1a0]
add al, 4
xor eax, 0x6f
mov byte [ebp - 0x198], al
mov eax, dword [ebp - 0x1a0]
add al, 5
lea ecx, [ebp - 0x1a0]
xor eax, 0x2e
mov byte [ebp - 0x197], al
mov eax, dword [ebp - 0x1a0]
add al, 6
xor eax, 0x78
mov byte [ebp - 0x196], al
mov eax, dword [ebp - 0x1a0]
add al, 7
xor eax, 0x65
mov byte [ebp - 0x195], al
mov eax, dword [ebp - 0x1a0]
add al, 8
mov byte [ebp - 0x193], 0
xor eax, 0x6d
mov byte [ebp - 0x194], al
mov al, byte [ebp - 0x19c]
mov esi, dword [edi]
lea eax, [ebp - 0x120]
push eax
call fcn.10058231
push eax
push edi
call dword [esi + 0x20]
mov edi, dword [ebp - 0x340]
lea ecx, [ebp - 0x120]
push 0x10
push ecx
push edi
mov eax, dword [edi]
call dword [eax + 0x14]
push dword [ebp - 0x360]
mov eax, dword [edi]
push edi
call dword [eax + 0x28]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push eax
push edi
call dword [esi + 0x10]
mov eax, dword [edi]
push 1
push 4
push edi
call dword [eax + 0x48]
mov esi, eax
test esi, esi
js 0x10058144
push dword [ebp + 0xc]
push 0
push ebx
call fcn.100cea50
mov eax, dword [edi]
add esp, 0xc
mov esi, dword [0x101ef2d0]
push 0xffffffffffffffff
push edi
call dword [eax + 0x24]
push eax
push dword [ebp + 0xc]
push ebx
call dword [esi + 0x5cc]
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0x5c]
xor esi, esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x304]
call fcn.1000b2a6
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x33c]
test ecx, ecx
je 0x10058166
call fcn.10002bb1
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x358]
test ecx, ecx
je 0x10058179
call fcn.10002bb1
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x350]
test ecx, ecx
je 0x1005818c
call fcn.10002bb1
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x344], 0
je 0x100581a5
push dword [ebp - 0x344]
call fcn.100ccb15
pop ecx
mov eax, esi
call fcn.100cc9de
ret