Function at 0x100037f0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov byte [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x1f], 0x29
mov byte [ebp - 0x1e], 0x32
mov byte [ebp - 0x1d], 0x6d
mov byte [ebp - 0x1c], 0x32
mov byte [ebp - 0x1b], 0x10
mov byte [ebp - 0x1a], 0x32
mov byte [ebp - 0x19], 0x71
mov byte [ebp - 0x18], 0x32
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x14], 0x32
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x2c
mov byte [ebp - 0x10], 0x32
mov byte [ebp - 0xf], 0xe
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x26
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0xa], 0x32
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x32
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x32
mov al, byte [ebp - 0x1f]
call fcn.10005680
mov eax, dword fs:[0x30]
mov edi, 3
mov esi, dword [eax + 0xc]
lea ecx, [edi - 1]
mov dword [ebp - 4], 0x6a00d6
lea ebx, [edi + 2]
mov eax, dword [ebp - 4]
cdq
idiv edi
mov eax, dword [ebp - 4]
test edx, edx
je 0x100038cd
add eax, ecx
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x100038ae
dec eax
or eax, 0xfffffffc
inc eax
jne 0x100039a1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x100038c6
dec eax
or eax, 0xfffffffc
inc eax
je 0x100038b4
jmp 0x100039a1
and eax, 0x80000001
jns 0x100038d9
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003905
mov eax, ecx
sub eax, esi
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
jne 0x100039a1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
je 0x100038f3
jmp 0x100039a1
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003914
dec eax
or eax, 0xfffffffc
inc eax
je 0x1000395b
mov ecx, dword [ebp - 4]
lea eax, [esi + 3]
add ecx, 2
imul ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003934
dec eax
or eax, 0xfffffffe
inc eax
jne 0x1000399c
mov eax, dword [ebp - 4]
cdq
idiv ebx
test edx, edx
je 0x10003945
dec dword [ebp - 4]
jmp 0x10003948
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003957
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003936
jmp 0x1000399c
mov eax, dword [ebp - 4]
cdq
idiv ebx
test edx, edx
je 0x100039a1
mov eax, dword [ebp - 4]
lea ecx, [esi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
jne 0x1000399c
nop
mov eax, dword [ebp - 4]
cdq
idiv ebx
test edx, edx
je 0x1000398f
inc dword [ebp - 4]
jmp 0x10003992
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
je 0x10003980
mov ecx, 2
mov ebx, dword [esi + 0x10]
mov dword [ebp - 4], 0x6a00d6
mov eax, dword [ebp - 4]
cdq
idiv edi
mov eax, dword [ebp - 4]
test edx, edx
je 0x10003a44
add eax, 2
add eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x100039d3
dec eax
or eax, 0xfffffffc
inc eax
jne 0x100039e9
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x100039e7
dec eax
or eax, 0xfffffffc
inc eax
je 0x100039d5
mov ecx, edi
mov edi, 5
mov esi, dword [ebx + 0x10]
mov dword [ebp - 4], 0x6a00d6
mov eax, dword [ebp - 4]
cdq
idiv ecx
mov eax, dword [ebp - 4]
test edx, edx
je 0x10003b31
add eax, 2
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003a22
dec eax
or eax, 0xfffffffc
inc eax
jne 0x10003a38
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003a36
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003a24
mov esi, 5
mov edi, ebx
jmp 0x10003c39
and eax, 0x80000001
jns 0x10003a50
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003a78
sub ecx, ebx
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, edi
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
jne 0x100039eb
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003a66
jmp 0x100039eb
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003a87
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003adf
mov ecx, dword [ebp - 4]
lea eax, [ebx + 3]
add ecx, 2
imul ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003aa7
dec eax
or eax, 0xfffffffe
inc eax
jne 0x100039e9
mov edi, 5
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
je 0x10003ac1
dec dword [ebp - 4]
jmp 0x10003ac4
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003ad3
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003ab2
mov ecx, 3
jmp 0x100039f0
mov eax, dword [ebp - 4]
mov edi, 5
cdq
idiv edi
test edx, edx
je 0x10003ad5
mov eax, dword [ebp - 4]
lea ecx, [ebx + 0x17]
add eax, 0xb
cdq
idiv ecx
mov ecx, 3
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
jne 0x100039f0
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
je 0x10003b1f
inc dword [ebp - 4]
jmp 0x10003b22
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003b10
jmp 0x100039f0
and eax, 0x80000001
jns 0x10003b3d
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003b79
mov eax, 2
sub eax, esi
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
jne 0x10003a38
nop word [eax + eax]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003b60
mov esi, 5
mov edi, ebx
jmp 0x10003c39
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003b88
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003bdc
mov ecx, dword [ebp - 4]
lea eax, [esi + 3]
add ecx, 2
imul ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003ba8
dec eax
or eax, 0xfffffffe
inc eax
mov esi, 5
jne 0x10003bd3
nop
mov eax, dword [ebp - 4]
cdq
idiv esi
test edx, edx
je 0x10003bbf
dec dword [ebp - 4]
jmp 0x10003bc2
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003bd1
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003bb0
mov ecx, 3
mov edi, ebx
jmp 0x10003c39
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
je 0x10003a38
mov eax, dword [ebp - 4]
lea ecx, [esi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov ecx, 3
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
jne 0x10003a38
mov esi, 5
mov eax, dword [ebp - 4]
cdq
idiv esi
test edx, edx
je 0x10003c20
inc dword [ebp - 4]
jmp 0x10003c23
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003c11
mov edi, ebx
jmp 0x10003c39
mov ecx, 3
lea esi, [ecx + 2]
mov edi, dword [edi]
mov dword [ebp - 4], 0x6a00d6
mov eax, dword [ebp - 4]
cdq
idiv ecx
mov eax, dword [ebp - 4]
test edx, edx
je 0x10003c89
add eax, 2
add eax, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003c66
dec eax
or eax, 0xfffffffc
inc eax
jne 0x10003d1c
nop dword [eax]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003c82
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003c70
jmp 0x10003d1c
and eax, 0x80000001
jns 0x10003c95
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003cbf
mov eax, 2
sub eax, edi
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
jne 0x10003d1c
nop
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003cb0
jmp 0x10003d1c
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003cce
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003d79
mov ecx, dword [ebp - 4]
lea eax, [edi + 3]
add ecx, 2
imul ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003cf2
dec eax
or eax, 0xfffffffe
inc eax
jne 0x10003d17
mov eax, dword [ebp - 4]
cdq
idiv esi
test edx, edx
je 0x10003d03
dec dword [ebp - 4]
jmp 0x10003d06
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003d15
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003cf4
mov ecx, 3
mov esi, dword [edi + 0x18]
test esi, esi
je 0x10003ec1
mov dword [ebp - 4], 0x6a00d6
mov eax, dword [ebp - 4]
cdq
idiv ecx
mov eax, dword [ebp - 4]
test edx, edx
je 0x10003dc6
add eax, 2
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003d56
dec eax
or eax, 0xfffffffc
inc eax
jne 0x10003eb3
nop dword [eax]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003d72
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003d60
jmp 0x10003eb3
mov eax, dword [ebp - 4]
cdq
idiv esi
test edx, edx
je 0x10003d1c
mov eax, dword [ebp - 4]
lea ecx, [edi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov ecx, 3
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
jne 0x10003d1c
mov eax, dword [ebp - 4]
cdq
idiv esi
test edx, edx
je 0x10003db4
inc dword [ebp - 4]
jmp 0x10003db7
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003da5
jmp 0x10003d1c
and eax, 0x80000001
jns 0x10003dd2
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003e02
mov eax, 2
sub eax, esi
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
jne 0x10003eb3
nop
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003df0
jmp 0x10003eb3
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003e11
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003e65
mov ecx, dword [ebp - 4]
lea eax, [esi + 3]
add ecx, 2
imul ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003e31
dec eax
or eax, 0xfffffffe
inc eax
jne 0x10003eb3
mov esi, 5
nop dword [eax]
mov eax, dword [ebp - 4]
cdq
idiv esi
test edx, edx
je 0x10003e4f
dec dword [ebp - 4]
jmp 0x10003e52
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003e61
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003e40
jmp 0x10003eb3
mov eax, dword [ebp - 4]
mov ecx, 5
cdq
idiv ecx
test edx, edx
je 0x10003eb3
mov eax, dword [ebp - 4]
lea ecx, [esi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov ecx, 3
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
jne 0x10003eb3
mov esi, 5
mov eax, dword [ebp - 4]
cdq
idiv esi
test edx, edx
je 0x10003ea6
inc dword [ebp - 4]
jmp 0x10003ea9
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003e97
mov ecx, edi
call fcn.100034d0
cmp eax, 0x3a35d2db
je 0x10003ec9
cmp ebx, edi
jne 0x10003c31
mov esi, dword [edi + 0x18]
mov edi, 3
mov dword [ebp - 4], 0x6a00d6
mov eax, dword [ebp - 4]
cdq
idiv edi
mov eax, dword [ebp - 4]
test edx, edx
je 0x10003f1f
add eax, 2
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003efc
dec eax
or eax, 0xfffffffc
inc eax
jne 0x1000400c
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003f14
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003f02
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and eax, 0x80000001
jns 0x10003f2b
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003f5e
mov eax, 2
sub eax, esi
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
jne 0x1000400c
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
je 0x10003f48
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x10003f6d
dec eax
or eax, 0xfffffffc
inc eax
je 0x10003fc4
mov ecx, dword [ebp - 4]
lea eax, [esi + 3]
add ecx, 2
imul ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003f8d
dec eax
or eax, 0xfffffffe
inc eax
jne 0x1000400c
mov ecx, 5
mov eax, dword [ebp - 4]
cdq
idiv ecx
test edx, edx
je 0x10003fa7
dec dword [ebp - 4]
jmp 0x10003faa
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x10003fb9
dec eax
or eax, 0xfffffffe
inc eax
je 0x10003f98
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ebx, 5
cdq
idiv ebx
test edx, edx
je 0x1000400c
mov eax, dword [ebp - 4]
lea ecx, [esi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
jne 0x1000400c
nop dword [eax]
mov eax, dword [ebp - 4]
cdq
idiv ebx
test edx, edx
je 0x10003fff
inc dword [ebp - 4]
jmp 0x10004002
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cdq
idiv edi
test edx, edx
je 0x10003ff0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret