Function at 0x1000b585
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1011e00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10120372], 0
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x18], eax
je 0x1000b804
mov eax, dword [0x1011e178]
mov ecx, dword [0x10120374]
dec eax
cmp eax, 3
ja case.default.0x1000b546
jmp dword [eax*4 + 0x1000b818]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1000b57d
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1000b57d
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1000b57d
mov al, byte [ebp - 0x19]
test al, al
je 0x1000b804
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1000b804
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1000b804
cmp dword [0x10120420], 0
je 0x1000b804
mov edx, dword [ebx + 0x20]
mov cl, 0x12
mov dword [ebp - 0x14], 0x767d7f12
xor eax, eax
mov dword [ebp - 0x10], 0x3d617e77
mov dword [ebp - 0xc], 0x6b737e62
mov word [ebp - 8], 0x6077
mov byte [ebp - 6], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xd
jae 0x1000b5f1
mov cl, byte [ebp - 0x14]
jmp 0x1000b5e2
lea eax, [ebp - 0x13]
mov byte [ebp - 6], 0
push eax
lea eax, [edx + 4]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ecx, dword [0x10120320]
add esp, 8
mov esi, eax
mov edx, dword [ecx]
push dword [ebx + 0x34]
call dword [edx + 0xc]
mov edi, eax
test esi, esi
je 0x1000b804
test edi, edi
je 0x1000b804
mov eax, dword [0x10120334]
test eax, eax
jne 0x1000b662
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jle 0x1000b804
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
mov eax, dword [eax + 0x24]
call eax
test al, al
jne 0x1000b804
mov eax, dword [0x10120420]
mov dword [ebp - 0x20], eax
cmp edi, eax
je 0x1000b804
mov ecx, dword [0x101202f4]
test ecx, ecx
jne 0x1000b6d5
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100e9
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov ecx, eax
mov eax, dword [0x10120420]
mov dword [0x101202f4], ecx
mov dword [ebp - 0x20], eax
add edi, ecx
test ecx, ecx
jne 0x1000b70f
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100e9
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov ecx, eax
mov dword [0x101202f4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edi]
cmp eax, dword [ecx + edx]
jne 0x1000b726
cmp byte [0x10120371], 0
je 0x1000b804
cmp byte [0x10120361], 0
je 0x1000b75f
push dword [0x1011f8b0]
mov edx, dword [0x10120364]
mov cl, 1
call fcn.100058f0
mov edi, dword [ebp - 0x28]
add esp, 4
mov esi, dword [ebp - 0x24]
mov ecx, dword [0x10120478]
push dword [ebp - 0x18]
push ebx
push edi
push esi
call dword [0x1012046c]
jmp 0x1000b765
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
cmp byte [0x10120360], 0
je 0x1000b79c
push dword [0x1011f8a8]
mov dl, byte [0x10120358]
mov cl, 1
push dword [0x1012036c]
call fcn.10005a20
mov ecx, dword [0x10120478]
add esp, 8
push dword [ebp - 0x18]
push ebx
push edi
push esi
call dword [0x1012046c]
cmp byte [0x1012035a], 0
je 0x1000b7cd
push dword [0x1011f8bc]
mov edx, dword [0x10120368]
xor cl, cl
call fcn.100058f0
mov ecx, dword [0x10120478]
add esp, 4
push dword [ebp - 0x18]
push ebx
push edi
push esi
call dword [0x1012046c]
cmp byte [0x10120359], 0
je 0x1000b804
push dword [0x1011f8ac]
mov dl, byte [0x10120370]
xor cl, cl
push dword [0x1012035c]
call fcn.10005a20
mov ecx, dword [0x10120478]
add esp, 8
push dword [ebp - 0x18]
push ebx
push edi
push esi
call dword [0x1012046c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f238c
mov esp, ebp
pop ebp
ret 0x10