Function at 0x10002f60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100127e1
push eax
mov eax, 0x2338
mov dword fs:[0], esp
call fcn.10012250
push ebx
mov ebx, ecx
xor edx, edx
push esi
push edi
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x90], 3
mov dword [ebp - 0x88], edx
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], edx
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], 0x55
mov byte [ebp - 0x1e], 0x48
mov byte [ebp - 0x1d], 0x54
mov byte [ebp - 0x1c], 0x4e
mov byte [ebp - 0x1b], 0x59
mov byte [ebp - 0x1a], 0x5a
mov byte [ebp - 0x19], 0x59
mov byte [ebp - 0x18], 0x4e
xor eax, eax
mov cl, byte [ebp + eax - 0x20]
xor cl, 0x3c
mov byte [ebp + eax - 0x124], cl
inc eax
cmp eax, 9
jl 0x10002fdc
lea edx, [ebp - 0x124]
push 0xffffffffffffffff
push edx
mov byte [ebp + eax - 0x124], 0
call fcn.10002550
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
mov eax, dword [ebx + 0x364]
lea edx, [ebp - 0x90]
push edx
push edi
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 1
call dword [ecx + 0x8c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov byte [ebp - 4], 0
call esi
mov eax, dword [ebp - 0x88]
test eax, eax
mov dword [ebp - 0x24], eax
jne 0x10003048
mov dword [ebp - 0x28], eax
jmp 0x100030b9
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10012250
mov ecx, dword [ebp - 0x24]
mov eax, esp
push 0
push edi
push ecx
push eax
call fcn.10003780
test eax, eax
mov dword [ebp - 0x28], eax
je 0x100030b9
mov edi, dword [ebp - 0x28]
mov eax, str.close
mov dl, byte [edi]
mov cl, dl
cmp dl, byte [eax]
jne 0x100030a1
test cl, cl
je 0x1000309d
mov dl, byte [edi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x100030a1
add edi, 2
add eax, 2
test cl, cl
jne 0x1000307d
xor eax, eax
jmp 0x100030a6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100030b9
mov eax, dword [ebx + 0x364]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov word [ebp - 0xb0], 3
mov dword [ebp - 0xa8], 0
push 0xffffffffffffffff
push 0x100162a8
call fcn.10002550
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
mov eax, dword [ebx + 0x364]
lea ecx, [ebp - 0xb0]
push ecx
push edi
mov edx, dword [eax]
push eax
mov byte [ebp - 4], 3
call dword [edx + 0x8c]
push edi
call esi
mov word [ebp - 0xa0], 3
mov dword [ebp - 0x98], 0
push 0xffffffffffffffff
push str.kid1
call fcn.10002550
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
mov eax, dword [ebx + 0x364]
lea ecx, [ebp - 0xa0]
push ecx
push edi
mov edx, dword [eax]
push eax
mov byte [ebp - 4], 5
call dword [edx + 0x8c]
push edi
call esi
mov word [ebp - 0x80], 3
mov dword [ebp - 0x78], 0
push 0xffffffffffffffff
push 0x1001629c
call fcn.10002550
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
mov eax, dword [ebx + 0x364]
lea ecx, [ebp - 0x80]
push ecx
push edi
mov edx, dword [eax]
push eax
mov byte [ebp - 4], 7
call dword [edx + 0x8c]
push edi
mov byte [ebp - 4], 6
call esi
mov eax, dword [ebp - 0xa8]
test eax, eax
mov esi, eax
jne 0x10003199
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edi, edi
jmp 0x100031cd
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10012250
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
mov byte [edi], 0
call esi
mov ebx, dword [ebp - 0x14]
push edi
call dword [sym.imp.MSVCRT.dll_atoi]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x98]
add esp, 4
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x100031eb
xor edi, edi
jmp 0x1000321c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10012250
mov edx, dword [ebp - 0x24]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call esi
mov ebx, dword [ebp - 0x14]
push edi
call dword [sym.imp.MSVCRT.dll_atoi]
mov edi, eax
mov eax, dword [ebp - 0x78]
add esp, 4
mov dword [ebp - 0x10], edi
test eax, eax
mov dword [ebp - 0x24], eax
jne 0x10003239
xor esi, esi
jmp 0x1000326f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10012250
mov eax, dword [ebp - 0x24]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
mov byte [edi], 0
call esi
mov ebx, dword [ebp - 0x14]
mov esi, edi
mov edi, dword [ebp - 0x10]
cmp edi, 0xffffffff
je 0x100032a7
add ebx, 0x18
mov ecx, ebx
call fcn.10009370
push eax
mov ecx, ebx
call fcn.100092b0
push eax
push esi
mov ecx, ebx
call fcn.10009270
mov ecx, dword [ebp - 0x30]
push eax
push 0
push ecx
push edi
mov ecx, ebx
call fcn.10009260
push eax
lea ecx, [ebp - 0x24]
call fcn.1000b5a0
push 0x10016298
lea ecx, [ebp - 0x50]
mov word [ebp - 0x50], 0
call fcn.100037b0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
push 0xffffffffffffffff
push str.kid1
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
call fcn.10002550
mov edi, eax
mov dword [ebp - 0x24], edi
mov ecx, dword [ebp - 0x14]
sub esp, 8
mov byte [ebp - 4], 9
mov eax, dword [ecx + 0x364]
mov ecx, esp
push edi
push eax
mov edx, dword [eax]
mov dword [ecx], ebx
mov dword [ecx + 4], esi
mov esi, dword [ebp - 0x38]
mov dword [ecx + 8], esi
mov esi, dword [ebp - 0x34]
mov dword [ecx + 0xc], esi
call dword [edx + 0x88]
push edi
mov byte [ebp - 4], 8
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [ebp - 0x28]
xor ebx, ebx
cmp edi, ebx
je 0x1000337a
mov esi, str.none
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10003349
test cl, cl
je 0x10003345
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10003349
add eax, 2
add esi, 2
test cl, cl
jne 0x10003325
xor eax, eax
jmp 0x1000334e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x100033be
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push 1
push eax
push ecx
push ebx
mov ecx, esi
call fcn.10006540
test al, al
jne 0x1000337a
mov eax, dword [esi + 0x364]
push eax
mov edx, dword [eax]
call dword [edx + 0x80]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x50]
push ecx
call esi
lea edx, [ebp - 0x80]
push edx
call esi
lea eax, [ebp - 0xa0]
push eax
call esi
lea ecx, [ebp - 0xb0]
push ecx
call esi
lea edx, [ebp - 0x90]
push edx
call esi
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x2350]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 5
jbe 0x1000337a
push str.close
lea ecx, [ebp - 0x60]
mov word [ebp - 0x60], bx
call fcn.100037b0
mov word [ebp - 0x40], 3
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x60]
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], 0x55
mov byte [ebp - 0x1e], 0x48
mov byte [ebp - 0x1d], 0x54
mov byte [ebp - 0x1c], 0x4e
mov byte [ebp - 0x1b], 0x59
mov byte [ebp - 0x1a], 0x5a
mov byte [ebp - 0x19], 0x59
mov byte [ebp - 0x18], 0x4e
mov dword [ebp - 0xb4], ecx
xor eax, eax
mov dl, byte [ebp + eax - 0x20]
xor dl, 0x3c
mov byte [ebp + eax - 0x124], dl
inc eax
cmp eax, 9
jl 0x10003425
mov byte [ebp + eax - 0x124], 0
lea eax, [ebp - 0x124]
push 0xffffffffffffffff
push eax
call fcn.10002550
mov edi, eax
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x14]
sub esp, 8
mov byte [ebp - 4], 0xc
mov eax, dword [ecx + 0x364]
mov ecx, esp
push edi
push eax
mov edx, dword [eax]
mov dword [ecx], ebx
mov dword [ecx + 4], esi
mov esi, dword [ebp - 0xb8]
mov dword [ecx + 8], esi
mov esi, dword [ebp - 0xb4]
mov dword [ecx + 0xc], esi
call dword [edx + 0x88]
push edi
mov byte [ebp - 4], 0xb
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dl, byte [ebp - 0x29]
sub esp, 0x10
mov ebx, esp
mov dword [ebp - 0x10], esp
push 0
mov ecx, ebx
mov byte [ebx], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov esi, dword [ebp - 0x28]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov edi, ecx
mov ecx, ebx
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x100034ec
mov eax, dword [ebx + 4]
mov ecx, edi
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.10002d10
mov word [ebp - 0x70], 3
mov dword [ebp - 0x68], 0
push 0xffffffffffffffff
push 0x1001628c
call fcn.10002550
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x364]
lea ecx, [ebp - 0x70]
push ecx
push edi
mov edx, dword [eax]
push eax
mov byte [ebp - 4], 0xe
call dword [edx + 0x8c]
push edi
mov byte [ebp - 4], 0xd
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 8
lea edx, [ebp - 0x70]
push 0
lea eax, [ebp - 0x70]
push edx
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov eax, dword [ebp - 0x68]
test eax, eax
mov esi, eax
je 0x100035f5
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10012250
mov ebx, esp
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push esi
push 0
push 0
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test ebx, ebx
je 0x100035f5
mov esi, str.false
mov edi, ebx
mov cl, byte [edi]
mov dl, byte [esi]
mov al, cl
cmp cl, dl
jne 0x100035bb
test al, al
je 0x100035b7
mov dl, byte [edi + 1]
mov cl, byte [esi + 1]
mov al, dl
cmp dl, cl
jne 0x100035bb
add edi, 2
add esi, 2
test al, al
jne 0x10003593
xor eax, eax
jmp 0x100035c0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100035f5
mov al, byte [0x100171bc]
mov ecx, 0xff
mov byte [ebp - 0xf40], al
xor eax, eax
lea edi, [ebp - 0xf3f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x340]
push ecx
mov ecx, dword [ebp - 0x14]
push ebx
stosb byte es:[edi], al
call fcn.10006980
test al, al
jne 0x10003637
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [ebp - 0x70]
push edx
call esi
lea eax, [ebp - 0x40]
push eax
call esi
lea ecx, [ebp - 0x60]
push ecx
call esi
lea edx, [ebp - 0x50]
push edx
call esi
lea eax, [ebp - 0x80]
push eax
call esi
lea ecx, [ebp - 0xa0]
push ecx
call esi
lea edx, [ebp - 0xb0]
push edx
call esi
lea eax, [ebp - 0x90]
push eax
jmp 0x100033a5
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x740]
lea edx, [ebp - 0x740]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x31a]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10016280
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x740]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebx, dword [sym.imp.MSVCRT.dll_strncpy]
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x100036b1
lea eax, [ebp - 0x740]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
lea edx, [ebp - 0x740]
push eax
lea eax, [ebp - 0xb40]
push edx
push eax
call ebx
add esp, 0xc
jmp 0x100036da
lea edi, [ebp - 0x740]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xb40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000375d
lea ecx, [ebp - 0x324]
lea edx, [ebp - 0xb40]
push ecx
mov ecx, dword [ebp - 0x28]
push edx
lea eax, [ebp - 0xf40]
push 0x400
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.1000d010
test eax, eax
je 0x1000375d
mov ecx, 0x501
xor eax, eax
lea edi, [ebp - 0x2344]
lea edx, [ebp - 0xf40]
rep stosd dword es:[edi], eax
push 0x400
lea eax, [ebp - 0x2340]
push edx
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x2344]
mov dword [ebp - 0x2344], 1
push 0xffffffffffffffff
push 0x100171bc
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.10007ac0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [ebp - 0x70]
push edx
call esi
lea eax, [ebp - 0x40]
push eax
call esi
lea ecx, [ebp - 0x60]
push ecx
call esi
jmp 0x10003380