Function at 0x1006a060
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
mov esi, ecx
mov dword [esp + 0x28], esi
mov byte [esp + 0x10], 0xd
mov dl, 0x79
xor dl, byte [esp + 0x10]
mov al, 0x6f
xor al, byte [esp + 0x10]
mov dh, 0x61
mov byte [esp + 0x11], al
mov ah, 0x63
mov byte [esp + 0x12], dl
xorps xmm0, xmm0
mov dl, byte [esp + 0x10]
mov byte [esp + 0x27], 0x62
xor ah, dl
mov al, byte [esp + 0x27]
xor dh, dl
xor al, dl
mov byte [esp + 0xe], 0x7e
mov byte [esp + 0x17], al
mov al, byte [esp + 0xe]
mov byte [esp + 0xc], 0x68
xor al, dl
mov byte [esp + 0x1a], 0
mov cl, 0x52
mov byte [esp + 0x18], al
mov al, byte [esp + 0xc]
mov ch, 0x6e
xor cl, dl
mov byte [esp + 0x16], dh
xor ch, dl
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], ch
xor al, dl
lea ecx, [esp + 0x11]
mov byte [esp + 0x13], ah
lea edx, [ecx + 1]
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006a104
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x5c], edi
je 0x1006a1a6
test edi, edi
je 0x1006a1a6
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006a1a6
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x2c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1006a1a2
nop word [eax + eax]
cmp esi, dword [edi + 0xc4]
jne 0x1006a15d
call fcn.1008abff
mov edi, dword [esi + 8]
test edi, edi
je 0x1006a189
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1006a16f
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006a1d9
mov edi, dword [esp + 0x5c]
cmp esi, dword [edi + 0xc4]
jne 0x1006a19a
call fcn.1008abff
mov esi, dword [esi]
cmp esi, dword [esp + 0x2c]
jne 0x1006a150
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 4], edi
cmp ecx, 0xf
jbe 0x1006a1e9
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006a1df
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae7c
jmp 0x1006a1df
mov esi, dword [esp + 0x28]
jmp 0x1006a1a8
push ecx
push edx
call fcn.100859f6
add esp, 8
mov dl, 0x5c
mov dword [esp + 0x10], 0x3538395c
mov dword [esp + 0x14], 0x392f0328
xor ecx, ecx
mov dword [esp + 0x18], 0x343f2e3d
mov byte [esp + 0x1c], 0
nop word [eax + eax]
lea eax, [esp + 0x11]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x1006a223
mov dl, byte [esp + 0x10]
jmp 0x1006a210
xorps xmm0, xmm0
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0x11]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006a247
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
mov ecx, dword [esi]
lea edx, [esp + 0x30]
call fcn.1001c410
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x10], eax
cmp ecx, 0xf
jbe 0x1006a2a3
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006a299
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae81
push ecx
push edx
call fcn.100859f6
add esp, 8
mov byte [esp + 0x10], 0x5b
mov cl, 0x2f
xor cl, byte [esp + 0x10]
mov al, 0x39
xor al, byte [esp + 0x10]
mov ch, 0x28
mov byte [esp + 0x11], al
mov dl, 0x35
mov byte [esp + 0x12], cl
mov dh, 0x3e
mov cl, byte [esp + 0x10]
mov ah, 4
mov byte [esp + 0xc], 0x3a
xor dl, cl
mov al, byte [esp + 0xc]
xor ch, cl
xor al, cl
mov byte [esp + 0xe], 0x29
mov byte [esp + 0x17], al
xor dh, cl
mov al, byte [esp + 0xe]
xor ah, cl
xor al, cl
mov byte [esp + 0x27], 0x38
mov byte [esp + 0x18], al
xorps xmm0, xmm0
mov al, byte [esp + 0x27]
xor al, cl
mov byte [esp + 0xd], 0x33
mov byte [esp + 0x19], al
mov al, byte [esp + 0xd]
xor al, cl
mov byte [esp + 0x15], ch
lea ecx, [esp + 0x11]
mov byte [esp + 0x1b], 0
mov byte [esp + 0x13], dl
mov byte [esp + 0x16], dh
lea edx, [ecx + 1]
mov byte [esp + 0x14], ah
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006a345
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x2c], edi
je 0x1006a3e6
test edi, edi
je 0x1006a3e6
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006a3e6
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x5c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1006a3e2
nop dword [eax + eax]
cmp esi, dword [edi + 0xc4]
jne 0x1006a39d
call fcn.1008abff
mov edi, dword [esi + 8]
test edi, edi
je 0x1006a3c9
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1006a3af
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006a419
mov edi, dword [esp + 0x2c]
cmp esi, dword [edi + 0xc4]
jne 0x1006a3da
call fcn.1008abff
mov esi, dword [esi]
cmp esi, dword [esp + 0x5c]
jne 0x1006a390
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 8], edi
cmp ecx, 0xf
jbe 0x1006a429
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006a41f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae86
jmp 0x1006a41f
mov esi, dword [esp + 0x28]
jmp 0x1006a3e8
push ecx
push edx
call fcn.100859f6
add esp, 8
movaps xmm0, xmmword [str.H_:__]
xor ecx, ecx
movups xmmword [esp + 0x10], xmm0
mov al, byte [esp + 0x10]
xor byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0xe
jb 0x1006a437
xorps xmm0, xmm0
mov byte [esp + 0x1f], 0
lea ecx, [esp + 0x11]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006a470
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x2c], edi
je 0x1006a50c
test edi, edi
je 0x1006a50c
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006a50c
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x5c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1006a508
cmp esi, dword [edi + 0xc4]
jne 0x1006a4c3
call fcn.1008abff
mov edi, dword [esi + 8]
test edi, edi
je 0x1006a4ef
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1006a4d5
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006a53f
mov edi, dword [esp + 0x2c]
cmp esi, dword [edi + 0xc4]
jne 0x1006a500
call fcn.1008abff
mov esi, dword [esi]
cmp esi, dword [esp + 0x5c]
jne 0x1006a4b6
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x14], edi
cmp ecx, 0xf
jbe 0x1006a54f
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006a545
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae8b
jmp 0x1006a545
mov esi, dword [esp + 0x28]
jmp 0x1006a50e
push ecx
push edx
call fcn.100859f6
add esp, 8
xor al, al
mov byte [esp + 0x27], al
movzx esi, al
mov cl, 0x69
mov byte [esp + 0x10], 6
mov al, 0x4b
xor al, byte [esp + 0x10]
mov dl, 0x68
xor cl, byte [esp + 0x10]
mov ch, 0x72
mov byte [esp + 0x11], al
mov dh, 0x63
mov byte [esp + 0x12], cl
mov ah, 0x75
mov cl, byte [esp + 0x10]
xorps xmm0, xmm0
mov byte [esp + 0xd], 0x74
xor dl, cl
mov al, byte [esp + 0xd]
xor dh, cl
xor al, cl
mov byte [esp + 0xc], 0x59
mov byte [esp + 0x17], al
xor ah, cl
mov al, byte [esp + 0xc]
xor ch, cl
xor al, cl
mov byte [esp + 0xe], 0x23
mov byte [esp + 0x18], al
mov al, byte [esp + 0xe]
xor al, cl
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x19], al
mov al, byte [esp + 0xf]
xor al, cl
mov byte [esp + 0x13], dl
push esi
sub esp, 0x18
mov byte [esp + 0x32], dh
mov edx, esp
mov byte [esp + 0x31], ch
lea ecx, [esp + 0x2d]
mov byte [esp + 0x37], 0
mov byte [esp + 0x30], ah
lea edi, [ecx + 1]
mov byte [esp + 0x36], al
movups xmmword [edx], xmm0
mov byte [esp + 0x37], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006a600
sub ecx, edi
lea eax, [esp + 0x2d]
push ecx
push eax
mov ecx, edx
call fcn.10002620
lea eax, [esp + 0x4c]
push eax
call fcn.10005dd0
mov edi, dword [esp + 0x48]
add esp, 0x20
mov edx, eax
mov ecx, dword [edi]
call fcn.1001c410
mov ecx, dword [esp + 0x44]
mov dword [edi + esi*4 + 0x18], eax
cmp ecx, 0xf
jbe 0x1006a66a
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006a660
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae7c
push ecx
push edx
call fcn.100859f6
add esp, 8
mov al, byte [esp + 0x27]
inc al
mov byte [esp + 0x27], al
cmp al, 5
jb 0x1006a555
mov byte [esp + 0x10], 0x31
mov cl, 0x45
xor cl, byte [esp + 0x10]
mov al, 0x53
xor al, byte [esp + 0x10]
mov ch, 0x55
mov byte [esp + 0x11], al
mov dl, 0x5f
mov byte [esp + 0x12], cl
mov dh, 0x43
mov cl, byte [esp + 0x10]
mov ah, 0x6e
mov byte [esp + 0xf], 0x5e
xor dl, cl
mov al, byte [esp + 0xf]
xor ch, cl
xor al, cl
mov byte [esp + 0xd], 0x41
xor dh, cl
mov byte [esp + 0x17], al
mov al, byte [esp + 0xd]
xor ah, cl
xor al, cl
mov byte [esp + 0x15], ch
xorps xmm0, xmm0
mov byte [esp + 0x19], 0
lea ecx, [esp + 0x11]
mov byte [esp + 0x13], dl
mov byte [esp + 0x16], dh
lea edx, [ecx + 1]
mov byte [esp + 0x14], ah
mov byte [esp + 0x18], al
mov byte [esp + 0x19], 0
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006a700
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
mov ecx, dword [edi]
lea edx, [esp + 0x30]
call fcn.1001c410
mov ecx, dword [esp + 0x44]
mov dword [edi + 0xc], eax
cmp ecx, 0xf
jbe 0x1006a75c
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006a752
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae90
push ecx
push edx
call fcn.100859f6
add esp, 8
movaps xmm0, xmmword [0x100bf4d0]
xor ecx, ecx
movups xmmword [esp + 0x10], xmm0
mov word [esp + 0x20], 0x2f
mov al, byte [esp + 0x10]
xor byte [esp + ecx + 0x11], al
inc ecx
cmp ecx, 0x10
jb 0x1006a771
xorps xmm0, xmm0
mov byte [esp + 0x21], 0
lea ecx, [esp + 0x11]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006a7a3
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
cmp dword [esp + 0x40], 0
mov edi, dword [edi]
mov dword [esp + 0x2c], edi
je 0x1006a842
test edi, edi
je 0x1006a842
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006a842
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x5c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1006a842
nop dword [eax]
cmp esi, dword [edi + 0xc4]
jne 0x1006a7fd
call fcn.1008abff
mov edi, dword [esi + 8]
test edi, edi
je 0x1006a829
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1006a80f
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006a844
mov edi, dword [esp + 0x2c]
cmp esi, dword [edi + 0xc4]
jne 0x1006a83a
call fcn.1008abff
mov esi, dword [esi]
cmp esi, dword [esp + 0x5c]
jne 0x1006a7f0
xor edi, edi
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x2c], edi
cmp ecx, 0xf
jbe 0x1006a881
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006a877
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae95
push ecx
push edx
call fcn.100859f6
add esp, 8
mov al, 3
mov byte [esp + 0x10], 0x77
mov dl, al
mov byte [esp + 0xf], 1
xor al, byte [esp + 0x10]
mov cl, 0xf
xor cl, byte [esp + 0x10]
mov dh, 0x12
mov byte [esp + 0x11], al
mov ch, 0x1b
mov al, byte [esp + 0xf]
mov ah, 0x28
mov byte [esp + 0x12], cl
xorps xmm0, xmm0
mov cl, byte [esp + 0x10]
xor al, cl
mov byte [esp + 0xd], dh
mov byte [esp + 0x17], al
xor dl, cl
mov al, byte [esp + 0xd]
xor dh, cl
xor al, cl
mov byte [esp + 0xc], ch
xor ch, cl
mov byte [esp + 0x18], al
mov al, byte [esp + 0xc]
xor ah, cl
xor al, cl
mov byte [esp + 0x15], ch
lea ecx, [esp + 0x11]
mov byte [esp + 0x1a], 0
mov byte [esp + 0x13], dl
mov byte [esp + 0x16], dh
lea edx, [ecx + 1]
mov byte [esp + 0x14], ah
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006a912
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x2c], edi
je 0x1006a9ae
test edi, edi
je 0x1006a9ae
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006a9ae
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x5c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1006a9aa
cmp esi, dword [edi + 0xc4]
jne 0x1006a965
call fcn.1008abff
mov edi, dword [esi + 8]
test edi, edi
je 0x1006a991
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1006a977
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006a9e1
mov edi, dword [esp + 0x2c]
cmp esi, dword [edi + 0xc4]
jne 0x1006a9a2
call fcn.1008abff
mov esi, dword [esi]
cmp esi, dword [esp + 0x5c]
jne 0x1006a958
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x30], edi
cmp ecx, 0xf
jbe 0x1006a9f1
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006a9e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae9a
jmp 0x1006a9e7
mov esi, dword [esp + 0x28]
jmp 0x1006a9b0
push ecx
push edx
call fcn.100859f6
add esp, 8
mov al, 8
mov byte [esp + 0x10], 0x7c
mov dl, al
mov byte [esp + 0xf], 0x11
xor al, byte [esp + 0x10]
mov cl, 4
xor cl, byte [esp + 0x10]
mov dh, 0x1d
mov byte [esp + 0x11], al
mov ch, 0x18
mov al, byte [esp + 0xf]
mov ah, 0x23
mov byte [esp + 0x12], cl
xorps xmm0, xmm0
mov cl, byte [esp + 0x10]
xor al, cl
mov byte [esp + 0xd], dh
mov byte [esp + 0x17], al
xor dl, cl
mov al, byte [esp + 0xd]
xor ch, cl
xor al, cl
mov byte [esp + 0xc], 0x1b
mov byte [esp + 0x18], al
xor dh, cl
mov al, byte [esp + 0xc]
xor ah, cl
xor al, cl
mov byte [esp + 0xe], 0x19
mov byte [esp + 0x19], al
mov al, byte [esp + 0xe]
xor al, cl
mov byte [esp + 0x15], ch
lea ecx, [esp + 0x11]
mov byte [esp + 0x1b], 0
mov byte [esp + 0x13], dl
mov byte [esp + 0x16], dh
lea edx, [ecx + 1]
mov byte [esp + 0x14], ah
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006aa92
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x2c], edi
je 0x1006ab2e
test edi, edi
je 0x1006ab2e
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006ab2e
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x5c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1006ab2a
cmp esi, dword [edi + 0xc4]
jne 0x1006aae5
call fcn.1008abff
mov edi, dword [esi + 8]
test edi, edi
je 0x1006ab11
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1006aaf7
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006ab61
mov edi, dword [esp + 0x2c]
cmp esi, dword [edi + 0xc4]
jne 0x1006ab22
call fcn.1008abff
mov esi, dword [esi]
cmp esi, dword [esp + 0x5c]
jne 0x1006aad8
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x34], edi
cmp ecx, 0xf
jbe 0x1006ab71
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006ab67
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006ae9f
jmp 0x1006ab67
mov esi, dword [esp + 0x28]
jmp 0x1006ab30
push ecx
push edx
call fcn.100859f6
add esp, 8
mov dl, 0xa
mov dword [esp + 0x10], 0x7e727e0a
mov dword [esp + 0x14], 0x6c6f6e55
xor ecx, ecx
mov dword [esp + 0x18], 0x6f79646f
mov byte [esp + 0x1c], 0
lea eax, [esp + 0x11]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x1006aba5
mov dl, byte [esp + 0x10]
jmp 0x1006ab92
xorps xmm0, xmm0
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0x11]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006abd0
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x2c], edi
je 0x1006ac6c
test edi, edi
je 0x1006ac6c
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006ac6c
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x5c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1006ac68
cmp esi, dword [edi + 0xc4]
jne 0x1006ac23
call fcn.1008abff
mov edi, dword [esi + 8]
test edi, edi
je 0x1006ac4f
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1006ac35
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006ac9f
mov edi, dword [esp + 0x2c]
cmp esi, dword [edi + 0xc4]
jne 0x1006ac60
call fcn.1008abff
mov esi, dword [esi]
cmp esi, dword [esp + 0x5c]
jne 0x1006ac16
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x38], edi
cmp ecx, 0xf
jbe 0x1006acaf
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006aca5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006aea4
jmp 0x1006aca5
mov esi, dword [esp + 0x28]
jmp 0x1006ac6e
push ecx
push edx
call fcn.100859f6
add esp, 8
mov al, 0x6e
mov byte [esp + 0x10], 0x1a
mov dl, al
mov byte [esp + 0xc], al
xor al, byte [esp + 0x10]
mov cl, 0x62
xor cl, byte [esp + 0x10]
mov ch, 0x72
mov byte [esp + 0x11], al
mov dh, 0x7f
mov byte [esp + 0x12], cl
mov ah, 0x45
mov cl, byte [esp + 0x10]
xorps xmm0, xmm0
mov byte [esp + 0xf], 0x7b
xor dl, cl
mov al, byte [esp + 0xf]
xor dh, cl
xor al, cl
mov byte [esp + 0xd], 0x76
mov byte [esp + 0x17], al
xor ah, cl
mov al, byte [esp + 0xd]
xor al, cl
mov byte [esp + 0xe], ch
mov byte [esp + 0x18], al
xor ch, cl
mov al, byte [esp + 0xc]
xor al, cl
mov byte [esp + 0x15], ch
mov byte [esp + 0x19], al
mov al, byte [esp + 0xe]
xor al, cl
mov byte [esp + 0x1b], 0
lea ecx, [esp + 0x11]
mov byte [esp + 0x13], dl
mov byte [esp + 0x16], dh
lea edx, [ecx + 1]
mov byte [esp + 0x14], ah
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006ad50
sub ecx, edx
lea eax, [esp + 0x11]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002620
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x2c], edi
je 0x1006adec
test edi, edi
je 0x1006adec
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006adec
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x5c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1006ade8
cmp esi, dword [edi + 0xc4]
jne 0x1006ada3
call fcn.1008abff
mov edi, dword [esi + 8]
test edi, edi
je 0x1006adcf
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x1006adb5
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1006ae1f
mov edi, dword [esp + 0x2c]
cmp esi, dword [edi + 0xc4]
jne 0x1006ade0
call fcn.1008abff
mov esi, dword [esi]
cmp esi, dword [esp + 0x5c]
jne 0x1006ad96
mov esi, dword [esp + 0x28]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x3c], edi
cmp ecx, 0xf
jbe 0x1006ae2f
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006ae25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006aea9
jmp 0x1006ae25
mov esi, dword [esp + 0x28]
jmp 0x1006adee
push ecx
push edx
call fcn.100859f6
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x1006ae51
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006ae51
lea ecx, [esi + 0xd4]
call fcn.1001cb40
mov esi, eax
jmp 0x1006ae53
xor esi, esi
mov edi, dword [esp + 0x28]
mov edi, dword [edi]
test edi, edi
je 0x1006ae76
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006ae76
or esi, 0x28
mov ecx, edi
push esi
call dword [0x100bd610]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1008ac0f
call fcn.1008ac0f
call fcn.1008ac0f
call fcn.1008ac0f
call fcn.1008ac0f
call fcn.1008ac0f
call fcn.1008ac0f
call fcn.1008ac0f
call fcn.1008ac0f
call fcn.1008ac0f
int3