Function at 0x1002d210
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [0x100f7040]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0x56457024
mov dword [esp + 0x38], edi
mov dl, 0x24
mov dword [esp + 0x14], 0x6b504143
xor ecx, ecx
mov word [esp + 0x18], 0x414a
mov byte [esp + 0x1a], 0
nop dword [eax]
xor byte [esp + ecx + 0x11], dl
inc ecx
cmp ecx, 9
jae 0x1002d260
mov dl, byte [esp + 0x10]
jmp 0x1002d250
xorps xmm0, xmm0
mov byte [esp + 0x1a], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d290
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [edi]
mov dword [esp + 0x3c], edi
je 0x1002d328
test edi, edi
je 0x1002d328
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002d328
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x40], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002d328
cmp esi, dword [edi + 0xc4]
jne 0x1002d2e3
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002d30f
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002d2f5
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002d32a
mov edi, dword [esp + 0x3c]
cmp esi, dword [edi + 0xc4]
jne 0x1002d320
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x40]
jne 0x1002d2d6
xor edi, edi
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x44]
mov dword [esi + 4], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
add esp, 8
mov dword [esp + 0x10], 0x585e592a
mov dl, 0x2a
mov dword [esp + 0x14], 0x474b6475
mov dword [esp + 0x18], 0x4f44654f
xor ecx, ecx
mov byte [esp + 0x1c], 0
xor byte [esp + ecx + 0x11], dl
inc ecx
cmp ecx, 0xb
jae 0x1002d382
mov dl, byte [esp + 0x10]
jmp 0x1002d372
xorps xmm0, xmm0
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d3b0
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x40], edi
je 0x1002d451
test edi, edi
je 0x1002d451
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002d451
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002d44d
cmp esi, dword [edi + 0xc4]
jne 0x1002d404
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002d434
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002d416
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002d810
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002d445
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002d3f7
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 8], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
movaps xmm0, xmmword [0x100eef50]
add esp, 8
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 0
xor ecx, ecx
nop dword [eax]
mov al, byte [esp + ecx + 0x11]
xor al, byte [esp + 0x10]
mov byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0xf
jb 0x1002d490
xorps xmm0, xmm0
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d4d0
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x40], edi
je 0x1002d571
test edi, edi
je 0x1002d571
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002d571
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002d56d
cmp esi, dword [edi + 0xc4]
jne 0x1002d524
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002d554
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002d536
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002d819
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002d565
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002d517
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0xc], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
movaps xmm0, xmmword [0x100ee450]
add esp, 8
movups xmmword [esp + 0x10], xmm0
mov word [esp + 0x20], 3
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x11]
xor al, byte [esp + 0x10]
mov byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0x10
jb 0x1002d5b0
xorps xmm0, xmm0
mov byte [esp + 0x21], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d5f0
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x40], edi
je 0x1002d691
test edi, edi
je 0x1002d691
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002d691
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002d68d
cmp esi, dword [edi + 0xc4]
jne 0x1002d644
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002d674
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002d656
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002d822
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002d685
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002d637
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x10], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
movaps xmm0, xmmword [0x100ef2e0]
add esp, 8
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0x716d6a6b
xor ecx, ecx
mov byte [esp + 0x24], 0
mov al, byte [esp + ecx + 0x11]
xor al, byte [esp + 0x10]
mov byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0x13
jb 0x1002d6d1
xorps xmm0, xmm0
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d710
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x40], edi
je 0x1002d7ba
test edi, edi
je 0x1002d7ba
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002d7ba
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002d7b6
nop dword [eax + eax]
cmp esi, dword [edi + 0xc4]
jne 0x1002d76d
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002d79d
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002d77f
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002d82b
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002d7ae
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002d760
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x14], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
add esp, 8
mov dword [esp + 0x10], 0x65764317
mov dl, 0x17
mov dword [esp + 0x14], 0x43637270
mov word [esp + 0x18], 0x7860
xor ecx, ecx
mov byte [esp + 0x1a], 0
nop
xor byte [esp + ecx + 0x11], dl
inc ecx
cmp ecx, 9
jae 0x1002d831
mov dl, byte [esp + 0x10]
jmp 0x1002d800
mov esi, dword [esp + 0x38]
jmp 0x1002d453
mov esi, dword [esp + 0x38]
jmp 0x1002d573
mov esi, dword [esp + 0x38]
jmp 0x1002d693
mov esi, dword [esp + 0x38]
jmp 0x1002d7bc
xorps xmm0, xmm0
mov byte [esp + 0x1a], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d860
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi]
mov dword [esp + 0x40], edi
je 0x1002d8fc
test edi, edi
je 0x1002d8fc
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002d8fc
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002d8f8
cmp esi, dword [edi + 0xc4]
jne 0x1002d8b3
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002d8df
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002d8c5
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002d952
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002d8f0
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002d8a6
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x18], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
add esp, 8
mov dword [esp + 0x10], 0x20262152
mov dl, 0x52
mov dword [esp + 0x14], 0x3f331c0d
mov dword [esp + 0x18], 0x3d250637
xor ecx, ecx
mov byte [esp + 0x1c], 0
xor byte [esp + ecx + 0x11], dl
inc ecx
cmp ecx, 0xb
jae 0x1002d958
mov dl, byte [esp + 0x10]
jmp 0x1002d942
mov esi, dword [esp + 0x38]
jmp 0x1002d8fe
xorps xmm0, xmm0
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d984
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 0x18]
mov dword [esp + 0x40], edi
je 0x1002da2d
test edi, edi
je 0x1002da2d
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002da2d
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002da29
cmp esi, dword [edi + 0xc4]
jne 0x1002d9e0
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002da10
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002d9f2
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002de00
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002da21
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002d9d3
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x1c], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
movaps xmm0, xmmword [0x100eec40]
add esp, 8
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [esp + ecx + 0x11]
xor al, byte [esp + 0x10]
mov byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0xf
jb 0x1002da70
xorps xmm0, xmm0
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002dab0
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 0x18]
mov dword [esp + 0x40], edi
je 0x1002db5a
test edi, edi
je 0x1002db5a
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002db5a
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002db56
nop dword [eax + eax]
cmp esi, dword [edi + 0xc4]
jne 0x1002db0d
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002db3d
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002db1f
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002de09
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002db4e
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002db00
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x20], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
movaps xmm0, xmmword [0x100ee610]
add esp, 8
movups xmmword [esp + 0x10], xmm0
mov word [esp + 0x20], 0x12
xor ecx, ecx
mov al, byte [esp + ecx + 0x11]
xor al, byte [esp + 0x10]
mov byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0x10
jb 0x1002db94
xorps xmm0, xmm0
mov byte [esp + 0x21], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002dbd2
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 0x18]
mov dword [esp + 0x40], edi
je 0x1002dc7b
test edi, edi
je 0x1002dc7b
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002dc7b
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002dc77
cmp esi, dword [edi + 0xc4]
jne 0x1002dc2e
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002dc5e
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002dc40
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002de12
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002dc6f
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002dc21
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x24], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
movaps xmm0, xmmword [0x100ee4e0]
add esp, 8
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0x31f1819
xor ecx, ecx
mov byte [esp + 0x24], 0
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x11]
xor al, byte [esp + 0x10]
mov byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0x13
jb 0x1002dcc0
xorps xmm0, xmm0
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002dd00
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 0x18]
mov dword [esp + 0x40], edi
je 0x1002ddaa
test edi, edi
je 0x1002ddaa
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002ddaa
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002dda6
nop
cmp esi, dword [edi + 0xc4]
jne 0x1002dd5d
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002dd8d
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002dd6f
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002de1b
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002dd9e
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002dd50
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x28], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
add esp, 8
mov dword [esp + 0x10], 0x64774216
mov dl, 0x16
mov dword [esp + 0x14], 0x45627371
mov word [esp + 0x18], 0x7b77
xor ecx, ecx
mov byte [esp + 0x1a], 0
nop
xor byte [esp + ecx + 0x11], dl
inc ecx
cmp ecx, 9
jae 0x1002de21
mov dl, byte [esp + 0x10]
jmp 0x1002ddf0
mov esi, dword [esp + 0x38]
jmp 0x1002da2f
mov esi, dword [esp + 0x38]
jmp 0x1002db5c
mov esi, dword [esp + 0x38]
jmp 0x1002dc7d
mov esi, dword [esp + 0x38]
jmp 0x1002ddac
xorps xmm0, xmm0
mov byte [esp + 0x1a], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002de50
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi]
mov dword [esp + 0x40], edi
je 0x1002def6
test edi, edi
je 0x1002def6
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002def6
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002def2
nop word [eax + eax]
cmp esi, dword [edi + 0xc4]
jne 0x1002dead
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002ded9
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002debf
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002df50
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002deea
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002dea0
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x2c], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
add esp, 8
mov dword [esp + 0x10], 0x66606714
mov dl, 0x14
mov dword [esp + 0x14], 0x79755a4b
mov dword [esp + 0x18], 0x79754771
xor ecx, ecx
mov byte [esp + 0x1c], 0
nop dword [eax]
xor byte [esp + ecx + 0x11], dl
inc ecx
cmp ecx, 0xb
jae 0x1002df56
mov dl, byte [esp + 0x10]
jmp 0x1002df40
mov esi, dword [esp + 0x38]
jmp 0x1002def8
xorps xmm0, xmm0
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002df82
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 0x2c]
mov dword [esp + 0x40], edi
je 0x1002e02b
test edi, edi
je 0x1002e02b
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002e02b
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002e027
cmp esi, dword [edi + 0xc4]
jne 0x1002dfde
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002e00e
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002dff0
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002e27b
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002e01f
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002dfd1
mov esi, dword [esp + 0x38]
xor edi, edi
lea ecx, [esp + 0x44]
mov dword [esi + 0x30], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
movaps xmm0, xmmword [0x100ee710]
add esp, 8
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 0
xor ecx, ecx
mov al, byte [esp + ecx + 0x11]
xor al, byte [esp + 0x10]
mov byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0xf
jb 0x1002e063
xorps xmm0, xmm0
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x11]
mov dword [esp + 0x44], 0
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x58], 0
lea edx, [ecx + 1]
mov dword [esp + 0x5c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002e0a1
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.10003370
cmp dword [esp + 0x58], 0
mov edi, dword [esi + 0x2c]
mov dword [esp + 0x40], edi
je 0x1002e142
test edi, edi
je 0x1002e142
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002e142
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x3c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1002e142
cmp esi, dword [edi + 0xc4]
jne 0x1002e0fd
call fcn.1008fe40
mov edi, dword [esi + 8]
test edi, edi
je 0x1002e129
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1002e10f
mov ecx, dword [ecx]
cmp dword [esp + 0x5c], 0xf
lea eax, [esp + 0x48]
cmova eax, dword [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1002e144
mov edi, dword [esp + 0x40]
cmp esi, dword [edi + 0xc4]
jne 0x1002e13a
call fcn.1008fe40
mov esi, dword [esi]
cmp esi, dword [esp + 0x3c]
jne 0x1002e0f0
xor edi, edi
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x44]
mov dword [eax + 0x34], edi
call fcn.10002f50
mov eax, dword [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], 0
call fcn.10089370
mov edi, dword [esp + 0x40]
add esp, 8
mov esi, dword [edi + 0x18]
test esi, esi
je 0x1002e18c
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002e18c
push eax
mov ecx, esi
call dword [0x100ec604]
mov esi, dword [edi + 0x2c]
test esi, esi
je 0x1002e1a9
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002e1a9
push eax
mov ecx, esi
call dword [0x100ec604]
mov esi, dword [edi]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
test esi, esi
je 0x1002e204
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002e204
mov eax, dword [esi + 0xdc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xe0]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xe4]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xe8]
mov dword [esp + 0x1c], eax
mov esi, dword [edi + 4]
xor edi, edi
movaps xmm0, xmmword [esp + 0x10]
movaps xmmword [esp + 0x60], xmm0
test esi, esi
je 0x1002e22a
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002e22a
mov edi, dword [esi + 0xe8]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x6c], edi
mov esi, dword [eax]
test esi, esi
je 0x1002e252
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002e252
lea eax, [esp + 0x60]
mov ecx, esi
push eax
call dword [0x100ec5ec]
mov esi, dword [0x100ec6bc]
mov ecx, 0xd78d54
call fcn.1001e520
mov ecx, dword [eax + 0x350]
call esi
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
xor ecx, esp
call fcn.100892c0
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x38]
jmp 0x1002e02d