Function at 0x1000b655
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1011f00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10122712], 0
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x18], eax
je 0x1000b8d4
mov eax, dword [0x1011f178]
mov ecx, dword [0x10122714]
dec eax
cmp eax, 3
ja case.default.0x1000b616
jmp dword [eax*4 + 0x1000b8e8]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x1000b64d
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1000b64d
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sete al
jmp 0x1000b64d
mov al, byte [ebp - 0x19]
test al, al
je 0x1000b8d4
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1000b8d4
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1000b8d4
cmp dword [0x101227d4], 0
je 0x1000b8d4
mov edx, dword [ebx + 0x20]
mov cl, 0x23
mov dword [ebp - 0x14], 0x474c4e23
xor eax, eax
mov dword [ebp - 0x10], 0xc504f46
mov dword [ebp - 0xc], 0x5a424f53
mov word [ebp - 8], 0x5146
mov byte [ebp - 6], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xd
jae 0x1000b6c1
mov cl, byte [ebp - 0x14]
jmp 0x1000b6b2
lea eax, [ebp - 0x13]
mov byte [ebp - 6], 0
push eax
lea eax, [edx + 4]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ecx, dword [0x101226c0]
add esp, 8
mov esi, eax
mov edx, dword [ecx]
push dword [ebx + 0x34]
call dword [edx + 0xc]
mov edi, eax
test esi, esi
je 0x1000b8d4
test edi, edi
je 0x1000b8d4
mov eax, dword [0x101226d4]
test eax, eax
jne 0x1000b732
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jle 0x1000b8d4
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
mov eax, dword [eax + 0x24]
call eax
test al, al
jne 0x1000b8d4
mov eax, dword [0x101227d4]
mov dword [ebp - 0x20], eax
cmp edi, eax
je 0x1000b8d4
mov ecx, dword [0x10122694]
test ecx, ecx
jne 0x1000b7a5
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110049
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, eax
mov eax, dword [0x101227d4]
mov dword [0x10122694], ecx
mov dword [ebp - 0x20], eax
add edi, ecx
test ecx, ecx
jne 0x1000b7df
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110049
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov ecx, eax
mov dword [0x10122694], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edi]
cmp eax, dword [ecx + edx]
jne 0x1000b7f6
cmp byte [0x10122711], 0
je 0x1000b8d4
cmp byte [0x10122701], 0
je 0x1000b82f
push dword [0x10121c80]
mov edx, dword [0x10122704]
mov cl, 1
call fcn.100059c0
mov edi, dword [ebp - 0x28]
add esp, 4
mov esi, dword [ebp - 0x24]
mov ecx, dword [0x10158068]
push dword [ebp - 0x18]
push ebx
push edi
push esi
call dword [0x1015805c]
jmp 0x1000b835
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
cmp byte [0x10122700], 0
je 0x1000b86c
push dword [0x10121c78]
mov dl, byte [0x101226f8]
mov cl, 1
push dword [0x1012270c]
call fcn.10005af0
mov ecx, dword [0x10158068]
add esp, 8
push dword [ebp - 0x18]
push ebx
push edi
push esi
call dword [0x1015805c]
cmp byte [0x101226fa], 0
je 0x1000b89d
push dword [0x10121c8c]
mov edx, dword [0x10122708]
xor cl, cl
call fcn.100059c0
mov ecx, dword [0x10158068]
add esp, 4
push dword [ebp - 0x18]
push ebx
push edi
push esi
call dword [0x1015805c]
cmp byte [0x101226f9], 0
je 0x1000b8d4
push dword [0x10121c7c]
mov dl, byte [0x10122710]
xor cl, cl
push dword [0x101226fc]
call fcn.10005af0
mov ecx, dword [0x10158068]
add esp, 8
push dword [ebp - 0x18]
push ebx
push edi
push esi
call dword [0x1015805c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f1854
mov esp, ebp
pop ebp
ret 0x10