Function at 0x100bd518
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x6d
pop eax
mov word [ebp - 0x4c], ax
xor ebx, ebx
push 0x67
pop ecx
push 0x74
pop eax
mov word [ebp - 0x4a], cx
mov word [ebp - 0x48], ax
push 0x70
pop eax
mov word [ebp - 0x46], ax
mov word [ebp - 0x44], cx
push 0x6e
pop ecx
push 0x35
mov word [ebp - 0x42], cx
pop eax
mov word [ebp - 0x40], ax
push 0x34
pop eax
mov word [ebp - 0x3e], ax
push 0x30
pop eax
mov word [ebp - 0x3c], ax
push 0x66
pop eax
mov word [ebp - 0x3a], ax
xor eax, eax
mov word [ebp - 0x38], cx
mov word [ebp - 0x36], cx
mov ecx, ebx
mov word [ebp - 0x34], ax
mov ax, word [ebp - 0x4c]
mov ax, word [ebp + ecx*2 - 0x4c]
movzx eax, ax
add eax, 0xfffffffe
mov word [ebp + ecx*2 - 0x4c], ax
inc ecx
cmp ecx, 0xc
jb 0x100bd586
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100bd748
mov dword [ebp - 0x30], 0xb
mov edx, ebx
mov byte [ebp - 0x2c], 0x5d
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x79
mov byte [ebp - 0x29], 0x62
mov byte [ebp - 0x28], 0x6d
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x5d
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x79
mov byte [ebp - 0x23], 0x78
mov byte [ebp - 0x22], 0x62
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x42
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x6d
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x4a
mov al, byte [ebp - 0x2c]
mov byte [ebp - 0x1a], bl
mov al, byte [ebp + edx - 0x2c]
movsx ecx, byte [ebp - 0x30]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x2c], al
inc edx
cmp edx, 0x12
jb 0x100bd607
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x2c]
push eax
push esi
mov byte [ebp - 0x1a], bl
call edi
mov byte [ebp - 0x18], 0x5a
mov ecx, ebx
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x57
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x68
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x51
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x77
mov byte [ebp - 6], 0x6f
mov dword [ebp - 0xec], eax
mov byte [ebp - 5], bl
mov al, byte [ebp - 0x18]
mov al, byte [ebp + ecx - 0x18]
movsx eax, al
sub eax, 4
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0x13
jb 0x100bd689
lea eax, [ebp - 0x18]
push eax
push esi
call edi
mov edi, eax
cmp dword [ebp - 0xec], ebx
je 0x100bd740
test edi, edi
je 0x100bd740
push 0x80
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xe8], 0x9c
push ebx
push eax
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
call fcn.100e19a0
add esp, 0xc
mov dword [ebp - 0x52], ebx
xor eax, eax
mov word [ebp - 0x4e], bx
mov word [ebp - 0x54], ax
inc eax
push eax
push 0x20
push eax
push eax
push eax
push 2
push ebx
push ebx
call edi
push edx
push eax
call edi
push edx
push eax
call edi
push edx
push eax
push 0x23
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xe4], 6
xor ecx, ecx
mov dword [ebp - 0xe0], 3
push eax
mov word [ebp - 0x54], cx
call dword [ebp - 0xec]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret