Function at 0x10002b9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x30
mov eax, 0x100778c0
call fcn.10040a5d
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor ebx, ebx
push 0x1008ae93
mov dword [ebp - 0x3c], ebx
call fcn.10004181
mov dword [ebp - 4], ebx
mov esi, dword [0x100a6048]
test esi, esi
je case.0x10002b65.113
cmp byte [0x100a610a], bl
je 0x10002b4e
mov ecx, 0x10b8134
call fcn.10010043
mov ebx, eax
test ebx, ebx
je 0x10002b4c
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002b4c
push 4
add ebx, 0x6e4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002b4c
mov ax, word [ebx]
mov word [esi + 0x3e], ax
xor ebx, ebx
movzx eax, word [esi + 0x3e]
add eax, 0xffffff9b
cmp eax, 0x6f
ja case.0x10002b65.113
movzx eax, byte [eax + 0x10002d47]
jmp dword [eax*4 + 0x10002d23]
mov cl, 0x6a
mov dword [ebp - 0x38], 0x5b5a5b6a
mov dword [ebp - 0x34], 0x180b1d47
mov eax, ebx
mov dword [ebp - 0x30], 0x18050318
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10002b97
mov cl, byte [ebp - 0x38]
jmp 0x10002b88
mov byte [ebp - 0x2c], bl
jmp 0x10002cdf
mov cl, 0x51
mov dword [ebp - 0x38], 0x63616051
mov dword [ebp - 0x34], 0x363e237c
mov eax, ebx
mov word [ebp - 0x30], 0x3424
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10002bc9
mov cl, byte [ebp - 0x38]
jmp 0x10002bba
mov byte [ebp - 0x2e], bl
jmp 0x10002cdf
mov cl, 0x64
mov dword [ebp - 0x38], 0x57545564
mov dword [ebp - 0x34], 0x3050949
mov eax, ebx
mov word [ebp - 0x30], 1
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10002bf8
mov cl, byte [ebp - 0x38]
jmp 0x10002be9
mov byte [ebp - 0x2f], bl
jmp 0x10002cdf
mov cl, 0x21
mov dword [ebp - 0x38], 0x15111021
mov dword [ebp - 0x34], 0x4853510c
mov eax, ebx
mov dword [ebp - 0x30], 0x555244
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xa
jae 0x10002cdc
mov cl, byte [ebp - 0x38]
jmp 0x10002c19
mov cl, 0x58
mov dword [ebp - 0x38], 0x69686a58
mov dword [ebp - 0x34], 0x2a392f75
mov eax, ebx
mov dword [ebp - 0x30], 0x2a37312a
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10002b97
mov cl, byte [ebp - 0x38]
jmp 0x10002c48
mov cl, 0x26
mov dword [ebp - 0x38], 0x14161426
mov dword [ebp - 0x34], 0x4149540b
mov eax, ebx
mov word [ebp - 0x30], 0x4353
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10002bc9
mov cl, byte [ebp - 0x38]
jmp 0x10002c76
mov cl, 0x60
mov dword [ebp - 0x38], 0x53505260
mov dword [ebp - 0x34], 0x7010d4d
mov eax, ebx
mov word [ebp - 0x30], 5
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 8
jae 0x10002bf8
mov cl, byte [ebp - 0x38]
jmp 0x10002ca1
mov cl, 0x51
mov dword [ebp - 0x38], 0x65616351
mov dword [ebp - 0x34], 0x3823217c
mov eax, ebx
mov dword [ebp - 0x30], 0x252234
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xa
jae 0x10002cdc
mov cl, byte [ebp - 0x38]
jmp 0x10002ccd
mov byte [ebp - 0x2d], bl
lea eax, [ebp - 0x37]
push eax
call fcn.10004164
pop ecx
push eax
lea eax, [ebp - 0x37]
push eax
lea ecx, [ebp - 0x28]
call fcn.100040eb
lea eax, [ebp - 0x28]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov ecx, edi
push eax
mov byte [edi], bl
call fcn.10003bd0
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10004036
mov eax, edi
call fcn.10040a07
ret 4