Function at 0x1000df00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x106b8
call fcn.1007e4b0
mov eax, dword [0x100b0380]
xor eax, ebp
mov dword [ebp - 0x3c], eax
push ebx
push esi
push edi
mov byte [ebp - 0x10698], 0x48
mov byte [ebp - 0x10697], 0x89
mov byte [ebp - 0x10696], 0x4c
mov byte [ebp - 0x10695], 0x24
mov byte [ebp - 0x10694], 8
mov byte [ebp - 0x10693], 0x48
mov byte [ebp - 0x10692], 0x81
mov byte [ebp - 0x10691], 0xec
mov byte [ebp - 0x10690], 0x98
mov byte [ebp - 0x1068f], 0
mov byte [ebp - 0x1068e], 0
mov byte [ebp - 0x1068d], 0
mov byte [ebp - 0x1068c], 0x48
mov byte [ebp - 0x1068b], 0xc7
mov byte [ebp - 0x1068a], 0x44
mov byte [ebp - 0x10689], 0x24
mov byte [ebp - 0x10688], 0x40
mov byte [ebp - 0x10687], 0
mov byte [ebp - 0x10686], 0
mov byte [ebp - 0x10685], 0
mov byte [ebp - 0x10684], 0
mov byte [ebp - 0x10683], 0x48
mov byte [ebp - 0x10682], 0xc7
mov byte [ebp - 0x10681], 0x84
mov byte [ebp - 0x10680], 0x24
mov byte [ebp - 0x1067f], 0x80
mov byte [ebp - 0x1067e], 0
mov byte [ebp - 0x1067d], 0
mov byte [ebp - 0x1067c], 0
mov byte [ebp - 0x1067b], 0
mov byte [ebp - 0x1067a], 0
mov byte [ebp - 0x10679], 0
mov byte [ebp - 0x10678], 0
mov byte [ebp - 0x10677], 0x48
mov byte [ebp - 0x10676], 0xc7
mov byte [ebp - 0x10675], 0x44
mov byte [ebp - 0x10674], 0x24
mov byte [ebp - 0x10673], 0x28
mov byte [ebp - 0x10672], 0
mov byte [ebp - 0x10671], 0
mov byte [ebp - 0x10670], 0
mov byte [ebp - 0x1066f], 0
mov byte [ebp - 0x1066e], 0x48
mov byte [ebp - 0x1066d], 0xc7
mov byte [ebp - 0x1066c], 0x44
mov byte [ebp - 0x1066b], 0x24
mov byte [ebp - 0x1066a], 0x50
mov byte [ebp - 0x10669], 0
mov byte [ebp - 0x10668], 0
mov byte [ebp - 0x10667], 0
mov byte [ebp - 0x10666], 0
mov byte [ebp - 0x10665], 0x48
mov byte [ebp - 0x10664], 0xc7
mov byte [ebp - 0x10663], 0x44
mov byte [ebp - 0x10662], 0x24
mov byte [ebp - 0x10661], 0x70
mov byte [ebp - 0x10660], 0
mov byte [ebp - 0x1065f], 0
mov byte [ebp - 0x1065e], 0
mov byte [ebp - 0x1065d], 0
mov byte [ebp - 0x1065c], 0x48
mov byte [ebp - 0x1065b], 0xc7
mov byte [ebp - 0x1065a], 0x44
mov byte [ebp - 0x10659], 0x24
mov byte [ebp - 0x10658], 0x38
mov byte [ebp - 0x10657], 0
mov byte [ebp - 0x10656], 0
mov byte [ebp - 0x10655], 0
mov byte [ebp - 0x10654], 0
mov byte [ebp - 0x10653], 0x65
mov byte [ebp - 0x10652], 0x48
mov byte [ebp - 0x10651], 0x8b
mov byte [ebp - 0x10650], 4
mov byte [ebp - 0x1064f], 0x25
mov byte [ebp - 0x1064e], 0x30
mov byte [ebp - 0x1064d], 0
mov byte [ebp - 0x1064c], 0
mov byte [ebp - 0x1064b], 0
mov byte [ebp - 0x1064a], 0x48
mov byte [ebp - 0x10649], 0x8b
mov byte [ebp - 0x10648], 0x40
mov byte [ebp - 0x10647], 0x60
mov byte [ebp - 0x10646], 0x48
mov byte [ebp - 0x10645], 0x89
mov byte [ebp - 0x10644], 0x44
mov byte [ebp - 0x10643], 0x24
mov byte [ebp - 0x10642], 0x40
mov byte [ebp - 0x10641], 0x48
mov byte [ebp - 0x10640], 0x8b
mov byte [ebp - 0x1063f], 0x44
mov byte [ebp - 0x1063e], 0x24
mov byte [ebp - 0x1063d], 0x40
mov byte [ebp - 0x1063c], 0x48
mov byte [ebp - 0x1063b], 0x8b
mov byte [ebp - 0x1063a], 0x40
mov byte [ebp - 0x10639], 0x18
mov byte [ebp - 0x10638], 0x48
mov byte [ebp - 0x10637], 0x89
mov byte [ebp - 0x10636], 0x84
mov byte [ebp - 0x10635], 0x24
mov byte [ebp - 0x10634], 0x80
mov byte [ebp - 0x10633], 0
mov byte [ebp - 0x10632], 0
mov byte [ebp - 0x10631], 0
mov byte [ebp - 0x10630], 0x48
mov byte [ebp - 0x1062f], 0x8b
mov byte [ebp - 0x1062e], 0x84
mov byte [ebp - 0x1062d], 0x24
mov byte [ebp - 0x1062c], 0x80
mov byte [ebp - 0x1062b], 0
mov byte [ebp - 0x1062a], 0
mov byte [ebp - 0x10629], 0
mov byte [ebp - 0x10628], 0x48
mov byte [ebp - 0x10627], 0x8b
mov byte [ebp - 0x10626], 0x40
mov byte [ebp - 0x10625], 0x30
mov byte [ebp - 0x10624], 0x48
mov byte [ebp - 0x10623], 0x83
mov byte [ebp - 0x10622], 0xe8
mov byte [ebp - 0x10621], 0x20
mov byte [ebp - 0x10620], 0x48
mov byte [ebp - 0x1061f], 0x89
mov byte [ebp - 0x1061e], 0x44
mov byte [ebp - 0x1061d], 0x24
mov byte [ebp - 0x1061c], 0x28
mov byte [ebp - 0x1061b], 0x48
mov byte [ebp - 0x1061a], 0x8b
mov byte [ebp - 0x10619], 0x44
mov byte [ebp - 0x10618], 0x24
mov byte [ebp - 0x10617], 0x28
mov byte [ebp - 0x10616], 0x48
mov byte [ebp - 0x10615], 0x8b
mov byte [ebp - 0x10614], 0x40
mov byte [ebp - 0x10613], 0x30
mov byte [ebp - 0x10612], 0x48
mov byte [ebp - 0x10611], 0x89
mov byte [ebp - 0x10610], 0x44
mov byte [ebp - 0x1060f], 0x24
mov byte [ebp - 0x1060e], 0x50
mov byte [ebp - 0x1060d], 0x48
mov byte [ebp - 0x1060c], 0x8b
mov byte [ebp - 0x1060b], 0x44
mov byte [ebp - 0x1060a], 0x24
mov byte [ebp - 0x10609], 0x28
mov byte [ebp - 0x10608], 0x48
mov byte [ebp - 0x10607], 0x8b
mov byte [ebp - 0x10606], 0x40
mov byte [ebp - 0x10605], 0x60
mov byte [ebp - 0x10604], 0x48
mov byte [ebp - 0x10603], 0x89
mov byte [ebp - 0x10602], 0x44
mov byte [ebp - 0x10601], 0x24
mov byte [ebp - 0x10600], 0x70
mov byte [ebp - 0x105ff], 0x48
mov byte [ebp - 0x105fe], 0x8b
mov byte [ebp - 0x105fd], 0x44
mov byte [ebp - 0x105fc], 0x24
mov byte [ebp - 0x105fb], 0x70
mov byte [ebp - 0x105fa], 0xf
mov byte [ebp - 0x105f9], 0xb7
mov byte [ebp - 0x105f8], 0x40
mov byte [ebp - 0x105f7], 0xc
mov byte [ebp - 0x105f6], 0x83
mov byte [ebp - 0x105f5], 0xf8
mov byte [ebp - 0x105f4], 0x33
mov byte [ebp - 0x105f3], 0x74
mov byte [ebp - 0x105f2], 0x30
mov byte [ebp - 0x105f1], 0x48
mov byte [ebp - 0x105f0], 0x8b
mov byte [ebp - 0x105ef], 0x44
mov byte [ebp - 0x105ee], 0x24
mov byte [ebp - 0x105ed], 0x28
mov byte [ebp - 0x105ec], 0x48
mov byte [ebp - 0x105eb], 0x8b
mov byte [ebp - 0x105ea], 0x40
mov byte [ebp - 0x105e9], 0x20
mov byte [ebp - 0x105e8], 0x48
mov byte [ebp - 0x105e7], 0x83
mov byte [ebp - 0x105e6], 0xe8
mov byte [ebp - 0x105e5], 0x20
mov byte [ebp - 0x105e4], 0x48
mov byte [ebp - 0x105e3], 0x89
mov byte [ebp - 0x105e2], 0x44
mov byte [ebp - 0x105e1], 0x24
mov byte [ebp - 0x105e0], 0x28
mov byte [ebp - 0x105df], 0x48
mov byte [ebp - 0x105de], 0x8b
mov byte [ebp - 0x105dd], 0x44
mov byte [ebp - 0x105dc], 0x24
mov byte [ebp - 0x105db], 0x28
mov byte [ebp - 0x105da], 0x48
mov byte [ebp - 0x105d9], 0x8b
mov byte [ebp - 0x105d8], 0x40
mov byte [ebp - 0x105d7], 0x30
mov byte [ebp - 0x105d6], 0x48
mov byte [ebp - 0x105d5], 0x89
mov byte [ebp - 0x105d4], 0x44
mov byte [ebp - 0x105d3], 0x24
mov byte [ebp - 0x105d2], 0x50
mov byte [ebp - 0x105d1], 0x48
mov byte [ebp - 0x105d0], 0x8b
mov byte [ebp - 0x105cf], 0x44
mov byte [ebp - 0x105ce], 0x24
mov byte [ebp - 0x105cd], 0x28
mov byte [ebp - 0x105cc], 0x48
mov byte [ebp - 0x105cb], 0x8b
mov byte [ebp - 0x105ca], 0x40
mov byte [ebp - 0x105c9], 0x60
mov byte [ebp - 0x105c8], 0x48
mov byte [ebp - 0x105c7], 0x89
mov byte [ebp - 0x105c6], 0x44
mov byte [ebp - 0x105c5], 0x24
mov byte [ebp - 0x105c4], 0x70
mov byte [ebp - 0x105c3], 0xeb
mov byte [ebp - 0x105c2], 0xc2
mov byte [ebp - 0x105c1], 0x48
mov byte [ebp - 0x105c0], 0x8b
mov byte [ebp - 0x105bf], 0x44
mov byte [ebp - 0x105be], 0x24
mov byte [ebp - 0x105bd], 0x50
mov byte [ebp - 0x105bc], 0x48
mov byte [ebp - 0x105bb], 0x89
mov byte [ebp - 0x105ba], 0x44
mov byte [ebp - 0x105b9], 0x24
mov byte [ebp - 0x105b8], 0x38
mov byte [ebp - 0x105b7], 0x48
mov byte [ebp - 0x105b6], 0xc7
mov byte [ebp - 0x105b5], 0x44
mov byte [ebp - 0x105b4], 0x24
mov byte [ebp - 0x105b3], 0x48
mov byte [ebp - 0x105b2], 0
mov byte [ebp - 0x105b1], 0
mov byte [ebp - 0x105b0], 0
mov byte [ebp - 0x105af], 0
mov byte [ebp - 0x105ae], 0x48
mov byte [ebp - 0x105ad], 0xc7
mov byte [ebp - 0x105ac], 0x44
mov byte [ebp - 0x105ab], 0x24
mov byte [ebp - 0x105aa], 0x68
mov byte [ebp - 0x105a9], 0
mov byte [ebp - 0x105a8], 0
mov byte [ebp - 0x105a7], 0
mov byte [ebp - 0x105a6], 0
mov byte [ebp - 0x105a5], 0x48
mov byte [ebp - 0x105a4], 0xc7
mov byte [ebp - 0x105a3], 0x44
mov byte [ebp - 0x105a2], 0x24
mov byte [ebp - 0x105a1], 0x60
mov byte [ebp - 0x105a0], 0
mov byte [ebp - 0x1059f], 0
mov byte [ebp - 0x1059e], 0
mov byte [ebp - 0x1059d], 0
mov byte [ebp - 0x1059c], 0xc7
mov byte [ebp - 0x1059b], 0x44
mov byte [ebp - 0x1059a], 0x24
mov byte [ebp - 0x10599], 0x24
mov byte [ebp - 0x10598], 0
mov byte [ebp - 0x10597], 0
mov byte [ebp - 0x10596], 0
mov byte [ebp - 0x10595], 0
mov byte [ebp - 0x10594], 0x33
mov byte [ebp - 0x10593], 0xc0
mov byte [ebp - 0x10592], 0x66
mov byte [ebp - 0x10591], 0x89
mov byte [ebp - 0x10590], 0x44
mov byte [ebp - 0x1058f], 0x24
mov byte [ebp - 0x1058e], 0x20
mov byte [ebp - 0x1058d], 0x48
mov byte [ebp - 0x1058c], 0xc7
mov byte [ebp - 0x1058b], 0x44
mov byte [ebp - 0x1058a], 0x24
mov byte [ebp - 0x10589], 0x78
mov byte [ebp - 0x10588], 0
mov byte [ebp - 0x10587], 0
mov byte [ebp - 0x10586], 0
mov byte [ebp - 0x10585], 0
mov byte [ebp - 0x10584], 0x48
mov byte [ebp - 0x10583], 0xc7
mov byte [ebp - 0x10582], 0x44
mov byte [ebp - 0x10581], 0x24
mov byte [ebp - 0x10580], 0x30
mov byte [ebp - 0x1057f], 0
mov byte [ebp - 0x1057e], 0
mov byte [ebp - 0x1057d], 0
mov byte [ebp - 0x1057c], 0
mov byte [ebp - 0x1057b], 0x48
mov byte [ebp - 0x1057a], 0xc7
mov byte [ebp - 0x10579], 0x44
mov byte [ebp - 0x10578], 0x24
mov byte [ebp - 0x10577], 0x58
mov byte [ebp - 0x10576], 0
mov byte [ebp - 0x10575], 0
mov byte [ebp - 0x10574], 0
mov byte [ebp - 0x10573], 0
mov byte [ebp - 0x10572], 0x48
mov byte [ebp - 0x10571], 0x8b
mov byte [ebp - 0x10570], 0x44
mov byte [ebp - 0x1056f], 0x24
mov byte [ebp - 0x1056e], 0x38
mov byte [ebp - 0x1056d], 0x48
mov byte [ebp - 0x1056c], 0x89
mov byte [ebp - 0x1056b], 0x44
mov byte [ebp - 0x1056a], 0x24
mov byte [ebp - 0x10569], 0x48
mov byte [ebp - 0x10568], 0x48
mov byte [ebp - 0x10567], 0x8b
mov byte [ebp - 0x10566], 0x44
mov byte [ebp - 0x10565], 0x24
mov byte [ebp - 0x10564], 0x48
mov byte [ebp - 0x10563], 0x48
mov byte [ebp - 0x10562], 0x63
mov byte [ebp - 0x10561], 0x48
mov byte [ebp - 0x10560], 0x3c
mov byte [ebp - 0x1055f], 0x48
mov byte [ebp - 0x1055e], 0x8b
mov byte [ebp - 0x1055d], 0x44
mov byte [ebp - 0x1055c], 0x24
mov byte [ebp - 0x1055b], 0x48
mov byte [ebp - 0x1055a], 0x48
mov byte [ebp - 0x10559], 3
mov byte [ebp - 0x10558], 0xc1
mov byte [ebp - 0x10557], 0x48
mov byte [ebp - 0x10556], 0x89
mov byte [ebp - 0x10555], 0x44
mov byte [ebp - 0x10554], 0x24
mov byte [ebp - 0x10553], 0x68
mov byte [ebp - 0x10552], 0x48
mov byte [ebp - 0x10551], 0x8b
mov byte [ebp - 0x10550], 0x44
mov byte [ebp - 0x1054f], 0x24
mov byte [ebp - 0x1054e], 0x68
mov byte [ebp - 0x1054d], 0x8b
mov byte [ebp - 0x1054c], 0x88
mov byte [ebp - 0x1054b], 0x88
mov byte [ebp - 0x1054a], 0
mov byte [ebp - 0x10549], 0
mov byte [ebp - 0x10548], 0
mov byte [ebp - 0x10547], 0x48
mov byte [ebp - 0x10546], 0x8b
mov byte [ebp - 0x10545], 0x44
mov byte [ebp - 0x10544], 0x24
mov byte [ebp - 0x10543], 0x38
mov byte [ebp - 0x10542], 0x48
mov byte [ebp - 0x10541], 3
mov byte [ebp - 0x10540], 0xc1
mov byte [ebp - 0x1053f], 0x48
mov byte [ebp - 0x1053e], 0x89
mov byte [ebp - 0x1053d], 0x44
mov byte [ebp - 0x1053c], 0x24
mov byte [ebp - 0x1053b], 0x60
mov byte [ebp - 0x1053a], 0x33
mov byte [ebp - 0x10539], 0xc0
mov byte [ebp - 0x10538], 0x83
mov byte [ebp - 0x10537], 0xf8
mov byte [ebp - 0x10536], 1
mov byte [ebp - 0x10535], 0x74
mov byte [ebp - 0x10534], 0x6a
mov byte [ebp - 0x10533], 0x48
mov byte [ebp - 0x10532], 0x8b
mov byte [ebp - 0x10531], 0x44
mov byte [ebp - 0x10530], 0x24
mov byte [ebp - 0x1052f], 0x60
mov byte [ebp - 0x1052e], 0x8b
mov byte [ebp - 0x1052d], 0x40
mov byte [ebp - 0x1052c], 0x20
mov byte [ebp - 0x1052b], 0x48
mov byte [ebp - 0x1052a], 0x8b
mov byte [ebp - 0x10529], 0x4c
mov byte [ebp - 0x10528], 0x24
mov byte [ebp - 0x10527], 0x38
mov byte [ebp - 0x10526], 0x48
mov byte [ebp - 0x10525], 3
mov byte [ebp - 0x10524], 0xc8
mov byte [ebp - 0x10523], 0x8b
mov byte [ebp - 0x10522], 0x44
mov byte [ebp - 0x10521], 0x24
mov byte [ebp - 0x10520], 0x24
mov byte [ebp - 0x1051f], 0x8b
mov byte [ebp - 0x1051e], 0xc
mov byte [ebp - 0x1051d], 0x81
mov byte [ebp - 0x1051c], 0x48
mov byte [ebp - 0x1051b], 0x8b
mov byte [ebp - 0x1051a], 0x44
mov byte [ebp - 0x10519], 0x24
mov byte [ebp - 0x10518], 0x38
mov byte [ebp - 0x10517], 0x48
mov byte [ebp - 0x10516], 3
mov byte [ebp - 0x10515], 0xc1
mov byte [ebp - 0x10514], 0x48
mov byte [ebp - 0x10513], 0x89
mov byte [ebp - 0x10512], 0x44
mov byte [ebp - 0x10511], 0x24
mov byte [ebp - 0x10510], 0x78
mov byte [ebp - 0x1050f], 0x8b
mov byte [ebp - 0x1050e], 0x44
mov byte [ebp - 0x1050d], 0x24
mov byte [ebp - 0x1050c], 0x24
mov byte [ebp - 0x1050b], 0x83
mov byte [ebp - 0x1050a], 0xc0
mov byte [ebp - 0x10509], 1
mov byte [ebp - 0x10508], 0x89
mov byte [ebp - 0x10507], 0x44
mov byte [ebp - 0x10506], 0x24
mov byte [ebp - 0x10505], 0x24
mov byte [ebp - 0x10504], 0x48
mov byte [ebp - 0x10503], 0x8b
mov byte [ebp - 0x10502], 0x44
mov byte [ebp - 0x10501], 0x24
mov byte [ebp - 0x10500], 0x78
mov byte [ebp - 0x104ff], 0xf
mov byte [ebp - 0x104fe], 0xbe
mov byte [ebp - 0x104fd], 0
mov byte [ebp - 0x104fc], 0x83
mov byte [ebp - 0x104fb], 0xf8
mov byte [ebp - 0x104fa], 0x4c
mov byte [ebp - 0x104f9], 0x75
mov byte [ebp - 0x104f8], 0x2c
mov byte [ebp - 0x104f7], 0x48
mov byte [ebp - 0x104f6], 0x8b
mov byte [ebp - 0x104f5], 0x44
mov byte [ebp - 0x104f4], 0x24
mov byte [ebp - 0x104f3], 0x78
mov byte [ebp - 0x104f2], 0xf
mov byte [ebp - 0x104f1], 0xbe
mov byte [ebp - 0x104f0], 0x40
mov byte [ebp - 0x104ef], 4
mov byte [ebp - 0x104ee], 0x83
mov byte [ebp - 0x104ed], 0xf8
mov byte [ebp - 0x104ec], 0x4c
mov byte [ebp - 0x104eb], 0x75
mov byte [ebp - 0x104ea], 0x1e
mov byte [ebp - 0x104e9], 0x48
mov byte [ebp - 0x104e8], 0x8b
mov byte [ebp - 0x104e7], 0x44
mov byte [ebp - 0x104e6], 0x24
mov byte [ebp - 0x104e5], 0x78
mov byte [ebp - 0x104e4], 0xf
mov byte [ebp - 0x104e3], 0xbe
mov byte [ebp - 0x104e2], 0x40
mov byte [ebp - 0x104e1], 0xa
mov byte [ebp - 0x104e0], 0x83
mov byte [ebp - 0x104df], 0xf8
mov byte [ebp - 0x104de], 0x79
mov byte [ebp - 0x104dd], 0x75
mov byte [ebp - 0x104dc], 0x10
mov byte [ebp - 0x104db], 0x48
mov byte [ebp - 0x104da], 0x8b
mov byte [ebp - 0x104d9], 0x44
mov byte [ebp - 0x104d8], 0x24
mov byte [ebp - 0x104d7], 0x78
mov byte [ebp - 0x104d6], 0xf
mov byte [ebp - 0x104d5], 0xbe
mov byte [ebp - 0x104d4], 0x40
mov byte [ebp - 0x104d3], 0xb
mov byte [ebp - 0x104d2], 0x83
mov byte [ebp - 0x104d1], 0xf8
mov byte [ebp - 0x104d0], 0x57
mov byte [ebp - 0x104cf], 0x75
mov byte [ebp - 0x104ce], 2
mov byte [ebp - 0x104cd], 0xeb
mov byte [ebp - 0x104cc], 2
mov byte [ebp - 0x104cb], 0xeb
mov byte [ebp - 0x104ca], 0x8f
mov byte [ebp - 0x104c9], 0x48
mov byte [ebp - 0x104c8], 0x8b
mov byte [ebp - 0x104c7], 0x44
mov byte [ebp - 0x104c6], 0x24
mov byte [ebp - 0x104c5], 0x60
mov byte [ebp - 0x104c4], 0x8b
mov byte [ebp - 0x104c3], 0x40
mov byte [ebp - 0x104c2], 0x24
mov byte [ebp - 0x104c1], 0x48
mov byte [ebp - 0x104c0], 0x8b
mov byte [ebp - 0x104bf], 0x4c
mov byte [ebp - 0x104be], 0x24
mov byte [ebp - 0x104bd], 0x38
mov byte [ebp - 0x104bc], 0x48
mov byte [ebp - 0x104bb], 3
mov byte [ebp - 0x104ba], 0xc8
mov byte [ebp - 0x104b9], 0x8b
mov byte [ebp - 0x104b8], 0x44
mov byte [ebp - 0x104b7], 0x24
mov byte [ebp - 0x104b6], 0x24
mov byte [ebp - 0x104b5], 0x83
mov byte [ebp - 0x104b4], 0xe8
mov byte [ebp - 0x104b3], 1
mov byte [ebp - 0x104b2], 0x8b
mov byte [ebp - 0x104b1], 0xc0
mov byte [ebp - 0x104b0], 0xf
mov byte [ebp - 0x104af], 0xb7
mov byte [ebp - 0x104ae], 4
mov byte [ebp - 0x104ad], 0x41
mov byte [ebp - 0x104ac], 0x66
mov byte [ebp - 0x104ab], 0x89
mov byte [ebp - 0x104aa], 0x44
mov byte [ebp - 0x104a9], 0x24
mov byte [ebp - 0x104a8], 0x20
mov byte [ebp - 0x104a7], 0x48
mov byte [ebp - 0x104a6], 0x8b
mov byte [ebp - 0x104a5], 0x44
mov byte [ebp - 0x104a4], 0x24
mov byte [ebp - 0x104a3], 0x60
mov byte [ebp - 0x104a2], 0x8b
mov byte [ebp - 0x104a1], 0x40
mov byte [ebp - 0x104a0], 0x1c
mov byte [ebp - 0x1049f], 0x48
mov byte [ebp - 0x1049e], 0x8b
mov byte [ebp - 0x1049d], 0x4c
mov byte [ebp - 0x1049c], 0x24
mov byte [ebp - 0x1049b], 0x38
mov byte [ebp - 0x1049a], 0x48
mov byte [ebp - 0x10499], 3
mov byte [ebp - 0x10498], 0xc8
mov byte [ebp - 0x10497], 0xf
mov byte [ebp - 0x10496], 0xb7
mov byte [ebp - 0x10495], 0x44
mov byte [ebp - 0x10494], 0x24
mov byte [ebp - 0x10493], 0x20
mov byte [ebp - 0x10492], 0x8b
mov byte [ebp - 0x10491], 0xc
mov byte [ebp - 0x10490], 0x81
mov byte [ebp - 0x1048f], 0x48
mov byte [ebp - 0x1048e], 0x8b
mov byte [ebp - 0x1048d], 0x44
mov byte [ebp - 0x1048c], 0x24
mov byte [ebp - 0x1048b], 0x38
mov byte [ebp - 0x1048a], 0x48
mov byte [ebp - 0x10489], 3
mov byte [ebp - 0x10488], 0xc1
mov byte [ebp - 0x10487], 0x48
mov byte [ebp - 0x10486], 0x89
mov byte [ebp - 0x10485], 0x44
mov byte [ebp - 0x10484], 0x24
mov byte [ebp - 0x10483], 0x30
mov byte [ebp - 0x10482], 0x48
mov byte [ebp - 0x10481], 0x83
mov byte [ebp - 0x10480], 0x7c
mov byte [ebp - 0x1047f], 0x24
mov byte [ebp - 0x1047e], 0x30
mov byte [ebp - 0x1047d], 0
mov byte [ebp - 0x1047c], 0x74
mov byte [ebp - 0x1047b], 0x17
mov byte [ebp - 0x1047a], 0x48
mov byte [ebp - 0x10479], 0x83
mov byte [ebp - 0x10478], 0xbc
mov byte [ebp - 0x10477], 0x24
mov byte [ebp - 0x10476], 0xa0
mov byte [ebp - 0x10475], 0
mov byte [ebp - 0x10474], 0
mov byte [ebp - 0x10473], 0
mov byte [ebp - 0x10472], 0
mov byte [ebp - 0x10471], 0x74
mov byte [ebp - 0x10470], 0xc
mov byte [ebp - 0x1046f], 0x48
mov byte [ebp - 0x1046e], 0x8b
mov byte [ebp - 0x1046d], 0x8c
mov byte [ebp - 0x1046c], 0x24
mov byte [ebp - 0x1046b], 0xa0
mov byte [ebp - 0x1046a], 0
mov byte [ebp - 0x10469], 0
mov byte [ebp - 0x10468], 0
mov byte [ebp - 0x10467], 0xff
mov byte [ebp - 0x10466], 0x54
mov byte [ebp - 0x10465], 0x24
mov byte [ebp - 0x10464], 0x30
mov byte [ebp - 0x10463], 0x48
mov byte [ebp - 0x10462], 0x81
mov byte [ebp - 0x10461], 0xc4
mov byte [ebp - 0x10460], 0x98
mov byte [ebp - 0x1045f], 0
mov byte [ebp - 0x1045e], 0
mov byte [ebp - 0x1045d], 0
mov byte [ebp - 0x1045c], 0xc3
mov byte [ebp - 0x1045b], 0xcc
mov byte [ebp - 0x1045a], 0xcc
mov byte [ebp - 0x10459], 0xcc
mov byte [ebp - 0x10458], 0xcc
push 4
call fcn.10079b72
add esp, 4
mov dword [ebp - 0x14], eax
push 4
call fcn.10079b72
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1044c], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
call fcn.10079c4e
cdq
mov ecx, 0x65
idiv ecx
add edx, 2
mov eax, dword [ebp - 0x14]
mov dword [eax], edx
call fcn.10079c4e
cdq
mov ecx, 0x65
idiv ecx
add edx, 0x200
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
push 0x400
push 0
lea ecx, [ebp - 0x10448]
push ecx
call fcn.1007dcf0
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x1000ef85
mov edx, dword [ebp + 0xc]
push edx
mov ecx, 0x200
lea edx, [ebp - 0x10448]
call fcn.10014050
mov eax, dword [ebp + 8]
push eax
push 0
push 0x3a
mov eax, 0x100e39ac
call fcn.10057630
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1000efbf
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10079c70
add esp, 4
mov edx, dword [ebp - 0x28]
push edx
call fcn.10079c70
add esp, 4
xor eax, eax
jmp 0x1000f52a
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x106a0], 0
mov dword [ebp - 0x1069c], 0
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0
jne 0x1000effd
mov eax, dword [ebp + 8]
push eax
call fcn.10003360
add esp, 4
mov dword [ebp - 0x24], eax
push 4
push eax
push ebp
mov eax, dword [ebp - 0x14]
sub esp, 0xa
mov eax, dword [eax]
cmp eax, 0x6c344b
jne 0x1000f066
push ebx
call ebx
push esi
push edi
mov esi, edx
xor edi, edi
mov ebx, ecx
cmp esi, edi
mov ecx, dword [esi + 4]
mov ecx, dword fs:[0x124]
mov esi, edx
xor ecx, ecx
rdtsc
mov cl, byte [eax + ebx]
mov edi, dword [edi]
mov ebx, dword [edi + eax*4]
mov edx, dword [ebp + 0x3c]
mov dword [ecx + 0x134], edx
mov edx, dword [edi + ecx + 8]
mov eax, dword [ebp + 4]
push edx
push eax
push dword fs:[0x30]
call edi
cmp ebp, esp
pop ecx
pop edx
pop eax
ret 8
add esp, 0xe
pop eax
add esp, 4
mov ecx, dword [ebp - 0x24]
push ecx
push 0
push 0x1a
mov eax, 0x100e39b0
call fcn.10057630
mov dword [ebp - 0x10044], eax
cmp dword [ebp - 0x10044], 0
jne 0x1000f0bb
mov edx, dword [ebp - 0x18]
push edx
mov eax, 0x100e38d8
call fcn.10057600
mov eax, dword [ebp - 0x14]
push eax
call fcn.10079c70
add esp, 4
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.10079c70
add esp, 4
xor eax, eax
jmp 0x1000f52a
mov dword [ebp - 0x10], 0x10000
mov dword [ebp - 4], 0
push 0x10000
push 0
lea edx, [ebp - 0x10040]
push edx
call fcn.1007dcf0
add esp, 0xc
mov ecx, pe_nt_image_headers32
lea esi, [ebp - 0x10448]
lea edi, [ebp - 0x10040]
rep movsd dword es:[edi], dword [esi]
push str._ZwQuneryAttributesFile
push 0x1009e95c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x50
call fcn.10079b72
add esp, 4
mov dword [ebp - 0x20], eax
push 0x50
call fcn.10079b72
add esp, 4
mov dword [ebp - 0x30], eax
push ebx
mov ebx, dword [ebp - 0xc]
cmp ebx, 0
je 0x1000f1a3
add ebx, 8
mov dword [ebp - 0x1044c], ebx
imul ebx, dword [ebp - 0x1044c]
mov ebx, dword [ebp - 0x20]
push ebx
mov ebx, dword [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0xc]
call ebx
push 0x1000f1a3
ret
mov ebx, dword [ebp - 0x20]
cmp ebx, 0x80000000
jne 0x1000f204
pop ebx
mov eax, dword [ebp - 0x20]
push eax
call fcn.10079c70
add esp, 4
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.10079c70
add esp, 4
push 4
push 0x3000
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.1005bee0
add esp, 0x18
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x38]
or ecx, dword [ebp - 0x34]
je 0x1000f2bc
push edx
mov edx, edx
xor edx, edx
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0x200
jne 0x1000f22c
mov ebx, 0x1000f1ae
push ebx
ret
pop edx
push 0x10000
lea edx, [ebp - 0x10040]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x18]
push edx
lea edi, [ebp - 4]
call fcn.1005c0b0
add esp, 0x14
mov dword [ebp - 0x106a4], eax
cmp dword [ebp - 0x106a4], 0
jne 0x1000f2ba
push 0x8000
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.1005bfd0
add esp, 0x14
mov ecx, dword [ebp - 0x18]
push ecx
mov eax, 0x100e38d8
call fcn.10057600
mov edx, dword [ebp - 0x10044]
push edx
mov eax, 0x100e38d8
call fcn.10057600
mov eax, dword [ebp - 0x14]
push eax
call fcn.10079c70
add esp, 4
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.10079c70
add esp, 4
xor eax, eax
jmp 0x1000f52a
jmp 0x1000f2fa
mov edx, dword [ebp - 0x18]
push edx
mov eax, 0x100e38d8
call fcn.10057600
mov eax, dword [ebp - 0x10044]
push eax
mov eax, 0x100e38d8
call fcn.10057600
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10079c70
add esp, 4
mov edx, dword [ebp - 0x28]
push edx
call fcn.10079c70
add esp, 4
xor eax, eax
jmp 0x1000f52a
push 0x40
push 0x3000
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1005bee0
add esp, 0x18
mov dword [ebp - 0x106a0], eax
mov dword [ebp - 0x1069c], edx
mov edx, dword [ebp - 0x106a0]
or edx, dword [ebp - 0x1069c]
je 0x1000f3eb
push 0x241
lea eax, [ebp - 0x10698]
push eax
mov ecx, dword [ebp - 0x1069c]
push ecx
mov edx, dword [ebp - 0x106a0]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea edi, [ebp - 4]
call fcn.1005c0b0
add esp, 0x14
mov dword [ebp - 0x106a8], eax
cmp dword [ebp - 0x106a8], 0
jne 0x1000f3e9
push 0x8000
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1005bfd0
add esp, 0x14
push 0x8000
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1069c]
push eax
mov ecx, dword [ebp - 0x106a0]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.1005bfd0
add esp, 0x14
mov eax, dword [ebp - 0x18]
push eax
mov eax, 0x100e38d8
call fcn.10057600
mov ecx, dword [ebp - 0x10044]
push ecx
mov eax, 0x100e38d8
call fcn.10057600
mov edx, dword [ebp - 0x14]
push edx
call fcn.10079c70
add esp, 4
mov eax, dword [ebp - 0x28]
push eax
call fcn.10079c70
add esp, 4
xor eax, eax
jmp 0x1000f52a
jmp 0x1000f446
push 0x8000
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1005bfd0
add esp, 0x14
mov edx, dword [ebp - 0x18]
push edx
mov eax, 0x100e38d8
call fcn.10057600
mov eax, dword [ebp - 0x10044]
push eax
mov eax, 0x100e38d8
call fcn.10057600
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10079c70
add esp, 4
mov edx, dword [ebp - 0x28]
push edx
call fcn.10079c70
add esp, 4
xor eax, eax
jmp 0x1000f52a
mov eax, dword [ebp - 0x10044]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x1069c]
push eax
mov ecx, dword [ebp - 0x106a0]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.10004270
add esp, 0x18
test eax, eax
jne 0x1000f4ee
push 0x8000
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.1005bfd0
add esp, 0x14
push 0x8000
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x1069c]
push edx
mov eax, dword [ebp - 0x106a0]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1005bfd0
add esp, 0x14
mov edx, dword [ebp - 0x18]
push edx
mov eax, 0x100e38d8
call fcn.10057600
mov eax, dword [ebp - 0x10044]
push eax
mov eax, 0x100e38d8
call fcn.10057600
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10079c70
add esp, 4
mov edx, dword [ebp - 0x28]
push edx
call fcn.10079c70
add esp, 4
xor eax, eax
jmp 0x1000f52a
mov eax, dword [ebp - 0x18]
push eax
mov eax, 0x100e38d8
call fcn.10057600
mov ecx, dword [ebp - 0x10044]
push ecx
mov eax, 0x100e38d8
call fcn.10057600
mov edx, dword [ebp - 0x14]
push edx
call fcn.10079c70
add esp, 4
mov eax, dword [ebp - 0x28]
push eax
call fcn.10079c70
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.10079a05
mov esp, ebp
pop ebp
ret