Function at 0x100c5e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0xb4
mov ecx, dword [ebp + 0x7c]
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x70]
push esi
mov dword [ecx], eax
cmp word [ebx], ax
push edi
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x20], eax
je 0x100c67b
mov edi, dword [sym.imp.KERNEL32.dll_CompareStringW]
push 3
push 0x100582c
push 3
push ebx
push 1
mov esi, 0x400
push esi
call edi
cmp eax, 2
je 0x100c660
push 3
push 0x10054bc
push 3
push ebx
push 1
push esi
call edi
cmp eax, 2
je 0x100c660
jmp 0x100c647
cmp ax, 0x2c
je 0x100c655
inc ebx
inc ebx
mov dword [ebp + 0x70], ebx
mov ax, word [ebx]
test ax, ax
jne 0x100c63c
cmp ax, 0x2c
jne 0x100c65a
inc ebx
inc ebx
mov dword [ebp + 0x70], ebx
cmp word [ebx], 0
jne 0x100c60d
cmp word [ebx], 0
jne 0x100c683
cmp dword [ebp + 0x60], 0
je 0x100c67b
cmp dword [ebp + 0x60], 0xffffffff
je 0x100c67b
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x57
pop eax
jmp 0x100c9e7
push ebx
push 0x10057c0
push 4
mov esi, 0x10100e0
push esi
call fcn.0100cfc0
add esp, 0x10
push 3
push 0x10054bc
push 3
push ebx
push 1
push 0x400
call edi
cmp eax, 2
jne 0x100c6b8
mov dword [ebp + 0x20], 1
and dword [ebp + 0x5c], 0
cmp dword [ebp + 0x74], 0
jne 0x100c713
lea eax, [ebp + 0x5c]
push eax
push ebx
call fcn.0100c479
mov edi, eax
test edi, edi
je 0x100c70e
push edi
push 0x1005740
push 2
push esi
call fcn.0100cfc0
add esp, 0x10
cmp dword [ebp + 0x5c], 0
je 0x100c6f2
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0x60], 0
je 0x100c707
cmp dword [ebp + 0x60], 0xffffffff
je 0x100c707
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x100c9e7
mov edi, dword [ebp + 0x5c]
jmp 0x100c716
mov edi, dword [ebp + 0x74]
push edi
push 0x10056c8
push 4
push esi
mov dword [ebp + 0x24], edi
call fcn.0100cfc0
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
call edi
push ebx
mov dword [ebp + 0x74], eax
call edi
mov ecx, dword [ebp + 0x74]
add ecx, eax
push 0x10056b4
mov dword [ebp + 0x74], ecx
call edi
mov ecx, dword [ebp + 0x74]
add ecx, eax
add esp, 0x1c
lea eax, [ecx + ecx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp + 0x74], edi
jne 0x100c7ab
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push 0x10053a8
push 2
push esi
call fcn.0100cfc0
add esp, 0x10
call edi
cmp dword [ebp + 0x5c], ebx
mov esi, eax
je 0x100c790
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0x60], ebx
je 0x100c7a4
cmp dword [ebp + 0x60], 0xffffffff
je 0x100c7a4
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x100c9e7
push 0x10056b4
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [ebp + 0x24]
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
call edi
push 0x1005300
push dword [ebp + 0x74]
call edi
push dword [ebp + 0x70]
push dword [ebp + 0x74]
call edi
push dword [ebp + 0x74]
push 0x1005650
push 4
push esi
call fcn.0100cfc0
add esp, 0x30
lea eax, [ebp + 0x60]
push eax
push 2
pop edi
push edi
push edi
push ebx
push 0xc
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x100c825
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055d0
push edi
push esi
mov dword [ebp + 0x70], eax
call fcn.0100cfc0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x10
jmp 0x100c9c1
lea eax, [ebp + 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push 7
push 9
push dword [ebp + 0x74]
mov dword [ebp + 0x58], ebx
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x100c9a1
cmp dword [ebp + 0x20], ebx
mov dword [ebp + 0x10], 0xbf967aa5
mov word [ebp + 0x14], 0xde6
mov word [ebp + 0x16], 0x11d0
mov byte [ebp + 0x18], 0xa2
mov byte [ebp + 0x19], 0x85
mov byte [ebp + 0x1a], bl
mov byte [ebp + 0x1b], 0xaa
mov byte [ebp + 0x1c], bl
mov byte [ebp + 0x1d], 0x30
mov byte [ebp + 0x1e], 0x49
mov byte [ebp + 0x1f], 0xe2
mov dword [ebp + 0x48], 0x19195a5b
mov word [ebp + 0x4c], 0x6da0
mov word [ebp + 0x4e], 0x11d0
mov byte [ebp + 0x50], 0xaf
mov byte [ebp + 0x51], 0xd3
mov byte [ebp + 0x52], bl
mov byte [ebp + 0x53], 0xc0
mov byte [ebp + 0x54], 0x4f
mov byte [ebp + 0x55], 0xd9
mov byte [ebp + 0x56], 0x30
mov byte [ebp + 0x57], 0xc9
mov dword [ebp + 0x28], 0xb7b1b3dd
mov word [ebp + 0x2c], 0xab09
mov word [ebp + 0x2e], 0x4242
mov byte [ebp + 0x30], 0x9e
mov byte [ebp + 0x31], 0x30
mov byte [ebp + 0x32], 0x99
mov byte [ebp + 0x33], 0x80
mov byte [ebp + 0x34], 0xe5
mov byte [ebp + 0x35], 0xd3
mov byte [ebp + 0x36], 0x22
mov byte [ebp + 0x37], 0xf7
mov dword [ebp + 0x38], 0xb7b1b3de
mov word [ebp + 0x3c], 0xab09
mov word [ebp + 0x3e], 0x4242
mov byte [ebp + 0x40], 0x9e
mov byte [ebp + 0x41], 0x30
mov byte [ebp + 0x42], 0x99
mov byte [ebp + 0x43], 0x80
mov byte [ebp + 0x44], 0xe5
mov byte [ebp + 0x45], 0xd3
mov byte [ebp + 0x46], 0x22
mov byte [ebp + 0x47], 0xf7
mov word [ebp], bx
mov word [ebp + 2], bx
lea eax, [ebp + 0x48]
jne 0x100c924
lea eax, [ebp + 0x10]
cmp dword [ebp + 0x78], ebx
mov dword [ebp + 4], eax
mov word [ebp + 8], 1
mov word [ebp + 0xa], bx
lea eax, [ebp + 0x38]
jne 0x100c93c
lea eax, [ebp + 0x28]
push dword [ebp + 0x7c]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp]
push eax
push 0x100
push dword [ebp + 0x60]
mov dword [ebp - 0x10], 0x20094
push ebx
push dword [ebp + 0x58]
mov dword [ebp - 0xc], 0x20028
mov dword [ebp - 8], 0x20004
mov dword [ebp - 4], 0xf01ff
mov dword [ebp + 0x6c], 0x40
call dword [sym.imp.ADVAPI32.dll_AccessCheckByType]
test eax, eax
jne 0x100c9b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebp + 0x70], eax
push 0x1005550
jmp 0x100c9a7
push eax
push 0x10054c8
push edi
push esi
call fcn.0100cfc0
add esp, 0x10
cmp dword [ebp + 0x58], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x100c9c1
push dword [ebp + 0x58]
call esi
push dword [ebp + 0x74]
call esi
cmp dword [ebp + 0x5c], ebx
je 0x100c9d0
push dword [ebp + 0x5c]
call esi
cmp dword [ebp + 0x60], ebx
je 0x100c9e4
cmp dword [ebp + 0x60], 0xffffffff
je 0x100c9e4
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x70]
pop edi
pop esi
pop ebx
add ebp, 0x64
leave
ret 0x14