Function at 0x100014ad
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
mov dword [ebp - 0x10], 0x1014097d
mov cl, 0x7d
mov dword [ebp - 0xc], 0x9183a18
mov dword [ebp - 8], 0x18101429
mov eax, edx
mov byte [ebp - 4], dl
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x100014e0
mov cl, byte [ebp - 0x10]
jmp 0x100014d1
mov byte [ebp - 4], dl
mov cl, 0xe
mov dword [ebp - 0x20], 0x7c6b650e
mov eax, edx
mov dword [ebp - 0x1c], 0x3d626b60
mov dword [ebp - 0x18], 0x626a203c
mov word [ebp - 0x14], 0x62
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001511
mov cl, byte [ebp - 0x20]
jmp 0x10001502
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x13], dl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0xf]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10008f02
cmp al, 0xe9
jne 0x1000153c
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret

Function at 0x1000153e
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
mov dword [ebp - 0x20], 0x66775512
mov cl, 0x12
mov dword [ebp - 0x1c], 0x79717b46
mov dword [ebp - 0x18], 0x7c677d51
mov eax, edx
mov word [ebp - 0x14], 0x66
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001574
mov cl, byte [ebp - 0x20]
jmp 0x10001565
mov byte [ebp - 0x13], dl
mov cl, 0x2b
mov dword [ebp - 0x10], 0x594e402b
mov eax, edx
mov dword [ebp - 0xc], 0x18474e45
mov dword [ebp - 8], 0x474f0519
mov word [ebp - 4], 0x47
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x100015a5
mov cl, byte [ebp - 0x10]
jmp 0x10001596
lea eax, [ebp - 0xf]
mov byte [ebp - 3], dl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10008f02
cmp al, 0xe9
jne 0x100015d0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret

Function at 0x100015d2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003e040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10037da0]
push ebx
xor ebx, ebx
movups xmmword [ebp - 0x28], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0xe
jb 0x100015f2
mov byte [ebp - 0x19], bl
mov cl, 0x1e
mov dword [ebp - 0x18], 0x4c5b551e
mov eax, ebx
mov dword [ebp - 0x14], 0x2d525b50
mov dword [ebp - 0x10], 0x727a302c
mov word [ebp - 0xc], 0x72
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001630
mov cl, byte [ebp - 0x18]
jmp 0x10001621
lea eax, [ebp - 0x17]
mov byte [ebp - 0xb], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x27]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop ebx
call fcn.1002ebd4
leave
ret