Function at 0x1000aaa0
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x74
push 0xffffffffffffffff
push 0x10032878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdc0
mov dword [ebp], ecx
mov dword [ebp + 0x20], 0
mov dword [ebp - 0x274], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp + 0x34], eax
mov byte [ebp + 0x73], 0
lea eax, [ebp - 0x274]
push eax
mov ecx, dword [ebp + 0x34]
push ecx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1000b01f
lea edx, [ebp - 0x274]
push edx
mov eax, dword [ebp + 0x34]
push eax
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x1000b01f
mov ecx, dword [ebp - 0x26c]
push ecx
push 0
push 0x400
call fcn.10014c40
add esp, 0xc
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x24], 0x184
mov edx, 2
shl edx, 0
mov eax, 0x65
mov word [ebp + edx + 4], ax
mov ecx, 2
shl ecx, 2
mov edx, 0x65
mov word [ebp + ecx + 4], dx
mov eax, 2
shl eax, 3
mov ecx, 0x2e
mov word [ebp + eax + 4], cx
mov edx, 2
imul eax, edx, 6
mov ecx, 0x33
mov word [ebp + eax + 4], cx
mov edx, 2
imul eax, edx, 0xa
mov ecx, 0x6c
mov word [ebp + eax + 4], cx
mov edx, 2
imul eax, edx, 0xb
mov ecx, 0x6c
mov word [ebp + eax + 4], cx
mov edx, 2
shl edx, 1
mov eax, 0x72
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 0xc
xor eax, eax
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 5
mov eax, 0x6c
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 7
mov eax, 0x32
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x4b
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 3
mov eax, 0x6e
mov word [ebp + edx + 4], ax
mov ecx, 2
imul edx, ecx, 9
mov eax, 0x64
mov word [ebp + edx + 4], ax
lea ecx, [ebp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp + 0x6c], eax
cmp dword [ebp + 0x68], 0
je 0x1000b01a
mov byte [ebp + 0x73], 0
cmp dword [ebp + 0x6c], 0
je 0x1000afc9
push str.QueryFullProcessImageNameW
mov edx, dword [ebp + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x30], eax
cmp dword [ebp + 0x30], 0
je 0x1000aed5
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x57c]
push ecx
push 0
mov edx, dword [ebp + 0x68]
push edx
call dword [ebp + 0x30]
test eax, eax
je 0x1000aed0
lea eax, [ebp - 0x57c]
push eax
lea ecx, [ebp - 0x24]
call fcn.10004940
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x7c]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.10001440
add esp, 8
movzx eax, al
test eax, eax
je 0x1000acb2
mov byte [ebp + 0x73], 1
jmp 0x1000aec1
mov ecx, dword [ebp - 0x26c]
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x44], 0
mov dword [ebp - 0x9a4], 0x428
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax + 0x48], 0
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx + 0x48], 0x69
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx + 0x48], 0x75
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax + 0x48], 0x33
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx + 0x48], 0x73
mov eax, 1
shl eax, 3
mov byte [ebp + eax + 0x48], 0x46
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx + 0x48], 0x72
mov eax, 1
shl eax, 2
mov byte [ebp + eax + 0x48], 0x6c
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx + 0x48], 0x4d
mov eax, 1
shl eax, 1
mov byte [ebp + eax + 0x48], 0x64
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx + 0x48], 0x74
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx + 0x48], 0x32
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax + 0x48], 0x65
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx + 0x48], 0x6f
mov edx, 1
shl edx, 1
mov byte [ebp + edx + 0x58], 0x64
mov eax, 1
shl eax, 0
mov byte [ebp + eax + 0x58], 0x6f
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx + 0x58], 0x4d
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx + 0x58], 0
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax + 0x58], 0x65
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx + 0x58], 0x6c
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax + 0x58], 0x32
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx + 0x58], 0x33
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx + 0x58], 0x75
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax + 0x58], 0x65
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx + 0x58], 0x78
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx + 0x58], 0x74
mov edx, 1
shl edx, 3
mov byte [ebp + edx + 0x58], 0x4e
lea eax, [ebp + 0x48]
push eax
mov ecx, dword [ebp + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x2c], eax
lea edx, [ebp + 0x58]
push edx
mov eax, dword [ebp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x28], eax
cmp dword [ebp + 0x2c], 0
je 0x1000aeb5
cmp dword [ebp + 0x28], 0
je 0x1000aeb5
lea ecx, [ebp - 0x9a4]
push ecx
mov edx, dword [ebp + 0x40]
push edx
call dword [ebp + 0x2c]
mov dword [ebp + 0x44], eax
cmp dword [ebp + 0x44], 0
je 0x1000aeb5
lea eax, [ebp - 0x784]
push eax
lea ecx, [ebp - 0x24]
call fcn.10006a70
mov ecx, dword [ebp + 0x7c]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.10001440
add esp, 8
movzx eax, al
test eax, eax
je 0x1000aea2
mov byte [ebp + 0x73], 1
jmp 0x1000aeb5
lea ecx, [ebp - 0x9a4]
push ecx
mov edx, dword [ebp + 0x40]
push edx
call dword [ebp + 0x28]
mov dword [ebp + 0x44], eax
jmp 0x1000ae70
mov eax, dword [ebp + 0x40]
push eax
call fcn.10013a80
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.10006270
jmp 0x1000afbf
mov ecx, dword [ebp + 0x24]
push ecx
lea edx, [ebp - 0x57c]
push edx
mov eax, dword [ebp + 0x68]
push eax
call dword [0x1005ce90]
test eax, eax
je 0x1000afbf
lea ecx, [ebp - 0x57c]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.10004940
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x7c]
push edx
lea eax, [ebp - 0x3c]
push eax
call fcn.10001440
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1000af28
mov byte [ebp + 0x73], 1
jmp 0x1000afb0
mov edx, dword [ebp - 0x26c]
push edx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], 0
mov dword [ebp - 0xdcc], 0x428
lea eax, [ebp - 0xdcc]
push eax
mov ecx, dword [ebp + 0x38]
push ecx
call sub.KERNEL32.dll_Module32FirstW
mov dword [ebp + 0x3c], eax
cmp dword [ebp + 0x3c], 0
je 0x1000afa4
lea edx, [ebp - 0xbac]
push edx
lea ecx, [ebp - 0x3c]
call fcn.10006a70
mov eax, dword [ebp + 0x7c]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.10001440
add esp, 8
movzx edx, al
test edx, edx
je 0x1000af8f
mov byte [ebp + 0x73], 1
jmp 0x1000afa4
lea eax, [ebp - 0xdcc]
push eax
mov ecx, dword [ebp + 0x38]
push ecx
call sub.KERNEL32.dll_Module32NextW
mov dword [ebp + 0x3c], eax
jmp 0x1000af5d
mov edx, dword [ebp + 0x38]
push edx
call fcn.10013a80
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10006270
mov eax, dword [ebp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx ecx, byte [ebp + 0x73]
test ecx, ecx
je 0x1000b00e
lea ecx, [ebp - 0x48]
call fcn.10004a20
mov dword [ebp - 4], 2
push 0
mov edx, dword [ebp - 0x26c]
push edx
push 0
push 1
call fcn.10014c40
add esp, 0xc
push eax
call dword [0x1005ce48]
mov dword [ebp + 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10006310
mov eax, dword [ebp + 0x68]
push eax
call fcn.10013a80
add esp, 4
jmp 0x1000ab00
mov ecx, dword [ebp + 0x34]
push ecx
call fcn.10013a80
add esp, 4
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add ebp, 0x74
mov esp, ebp
pop ebp
ret 4