Function at 0x10001390
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x10009008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ecx]
push esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0x4c], 0x4e52454b
mov dword [ebp - 0x48], 0x32334c45
mov dword [ebp - 0x44], 0x6c6c642e
mov byte [ebp - 0x40], 0
cmp dword [ebx + 0x84], 0
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x74], esi
jbe 0x100016a1
push edi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x61427349
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x38], 0x61655264
push eax
mov dword [ebp - 0x34], 0x72745064
mov byte [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebx, dword [ebx + 0x80]
add ebx, esi
mov dword [ebp - 0xa0], eax
push 0x14
push ebx
mov dword [ebp - 0x84], ebx
call eax
test eax, eax
jne 0x1000168b
mov ecx, dword [0x100096a8]
mov eax, dword fs:[0x2c]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x9c], eax
nop dword [eax]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x1000168b
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x10001678
test eax, eax
je 0x10001678
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x14], 0x4e52454b
mov dword [ebp - 0x10], 0x32334c45
mov dword [ebp - 0xc], 0x6c6c642e
mov eax, dword [ecx + 0xc]
mov byte [ebp - 8], 0
mov dword [ebp - 0x5c], 0x50746547
mov dword [ebp - 0x58], 0x65636f72
lea esi, [eax*4 + 4]
mov dword [ebp - 0x54], 0x65487373
mov eax, dword [ecx + 8]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x50], 0x7061
push eax
mov byte [ebp - 0x4e], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], 0x70616548
push eax
mov dword [ebp - 0x28], 0x6c416552
mov dword [ebp - 0x24], 0x636f6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call edi
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], 0x70616548
push eax
mov dword [ebp - 0x1c], 0x6f6c6c41
mov word [ebp - 0x18], 0x63
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call edi
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x88]
push esi
test eax, eax
je 0x1000154b
push eax
push 0
call dword [ebp - 0x78]
push eax
call dword [ebp - 0x8c]
jmp 0x10001557
push 0
call dword [ebp - 0x78]
push eax
call dword [ebp - 0x90]
mov esi, dword [ebp - 0x7c]
mov edx, eax
mov dword [esi + 8], edx
test edx, edx
je 0x10001678
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x80]
mov dword [edx + eax*4], ecx
inc dword [esi + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x1000157c
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 0x74]
mov esi, dword [ebx + 0x10]
add esi, edx
lea ebx, [eax + edx]
mov eax, dword [ebx]
test eax, eax
je 0x10001654
jns 0x100015a1
movzx eax, ax
push eax
push ecx
call edi
mov dword [esi], eax
jmp 0x10001638
lea edi, [edx + 2]
add edi, eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmm0, xmmword [str.GetModuleFileNam]
mov dword [esi], eax
lea eax, [ebp - 0x70]
push edi
push eax
movups xmmword [ebp - 0x70], xmm0
mov word [ebp - 0x60], 0x4165
mov byte [ebp - 0x5e], 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10001632
mov ecx, dword [ebp - 0x94]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [ebp - 0x98]
mov dword [eax], esi
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [0x100096d8]
cmp eax, dword [ecx + 4]
jle 0x1000162b
push 0x100096d8
call fcn.100047f9
add esp, 4
cmp dword [0x100096d8], 0xffffffff
jne 0x1000162b
push 0x100096d8
mov dword [0x100096dc], 0x100016c0
call fcn.100047af
add esp, 4
mov eax, dword [0x100096dc]
mov dword [esi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esi], 0
je 0x10001678
mov eax, dword [ebx + 4]
add ebx, 4
mov ecx, dword [ebp - 0x80]
add esi, 4
mov edx, dword [ebp - 0x74]
test eax, eax
jne 0x10001591
mov ebx, dword [ebp - 0x84]
add ebx, 0x14
push 0x14
push ebx
mov dword [ebp - 0x84], ebx
call dword [ebp - 0xa0]
test eax, eax
jne 0x1000168b
mov esi, dword [ebp - 0x74]
jmp 0x10001450
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004657
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004657
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.10004657
mov esp, ebp
pop ebp
ret