Function at 0x1000d020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf04
mov eax, dword [0x100891f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
mov dword [ebp - 0xefc], ebx
test ebx, ebx
jne 0x1000d143
push 1
push eax
push eax
call dword [sym.imp.USER32.dll_MonitorFromPoint]
test eax, eax
je 0x1000d130
lea ecx, [ebp - 0xef0]
mov dword [ebp - 0xef0], 0x68
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x1000d130
mov eax, dword [ebp - 0xee0]
xor edi, edi
mov ebx, dword [ebp - 0xee4]
sub eax, dword [ebp - 0xee8]
sub ebx, dword [ebp - 0xeec]
push 5
mov dword [ebp - 0xef4], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x1000d130
cmp edi, 0x3e8
jge 0x1000d130
lea eax, [ebp - 0xe88]
mov dword [ebp - 0xe88], 0x3c
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowInfo]
test eax, eax
je 0x1000d120
mov eax, dword [ebp - 0xe64]
test eax, 0x10000000
je 0x1000d120
test eax, 0x20000000
jne 0x1000d120
test byte [ebp - 0xe60], 8
je 0x1000d120
cmp dword [ebp - 0xe84], 0
jne 0x1000d120
cmp dword [ebp - 0xe80], 0
jne 0x1000d120
cmp dword [ebp - 0xe7c], ebx
jne 0x1000d120
mov eax, dword [ebp - 0xef4]
cmp dword [ebp - 0xe78], eax
je 0x1000d6ae
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
inc edi
test esi, esi
jne 0x1000d0b3
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100264cc
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x1000d130
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0xef8]
push eax
push ebx
mov dword [ebp - 0xef8], 0
call esi
mov edi, dword [ebp - 0xef8]
cmp edi, 4
jae 0x1000d181
mov dword [ebp - 0xef8], 0
jmp 0x1000d4c7
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, ebx
je 0x1000d130
lea ecx, [ebp - 0xef4]
mov dword [ebp - 0xef4], 0
push ecx
push eax
call esi
cmp dword [ebp - 0xef4], edi
je 0x1000d130
mov eax, dword [ebp - 0xef8]
cmp eax, 4
jbe 0x1000d4c7
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000d4c7
push 0x104
lea eax, [ebp - 0xe3c]
push eax
push 0
push edi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x1000d1ed
mov esi, 1
jmp 0x1000d241
mov eax, dword [0x1008c2f8]
mov dword [ebp - 0xef4], 0x104
test eax, eax
jne 0x1000d22c
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1000d213
xor esi, esi
jmp 0x1000d241
push 0x1006e3ec
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1008c2f8], eax
test eax, eax
jne 0x1000d22c
xor esi, esi
jmp 0x1000d241
lea ecx, [ebp - 0xef4]
push ecx
lea ecx, [ebp - 0xe3c]
push ecx
push 0
push edi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1000d4c1
lea eax, [ebp - 0xe3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xef4], eax
test eax, eax
je 0x1000d4c1
push 0x1f0
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc34], 0x780065
push 0
push eax
mov dword [ebp - 0xc30], 0x6c0070
mov dword [ebp - 0xc2c], 0x72006f
mov dword [ebp - 0xc28], 0x720065
mov dword [ebp - 0xc24], 0x65002e
mov dword [ebp - 0xc20], 0x650078
call fcn.10043b10
push 0x1f2
lea eax, [ebp - 0xa16]
mov dword [ebp - 0xa2c], 0x610074
mov ecx, 0x65
mov dword [ebp - 0xa28], 0x6b0073
push 0
push eax
mov dword [ebp - 0xa24], 0x67006d
mov dword [ebp - 0xa20], 0x2e0072
mov dword [ebp - 0xa1c], 0x780065
mov word [ebp - 0xa18], cx
call fcn.10043b10
push 0x1e0
lea eax, [ebp - 0x7fc]
mov dword [ebp - 0x824], 0x360033
push 0
push eax
mov dword [ebp - 0x820], 0x440030
mov dword [ebp - 0x81c], 0x730065
mov dword [ebp - 0x818], 0x74006b
mov dword [ebp - 0x814], 0x70006f
mov dword [ebp - 0x810], 0x69004c
mov dword [ebp - 0x80c], 0x650074
mov dword [ebp - 0x808], 0x340036
mov dword [ebp - 0x804], 0x65002e
mov dword [ebp - 0x800], 0x650078
call fcn.10043b10
push 0x1e4
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0x61c], 0x360033
push 0
push eax
mov dword [ebp - 0x618], 0x440030
mov dword [ebp - 0x614], 0x730065
mov dword [ebp - 0x610], 0x74006b
mov dword [ebp - 0x60c], 0x70006f
mov dword [ebp - 0x608], 0x69004c
mov dword [ebp - 0x604], 0x650074
mov dword [ebp - 0x600], 0x65002e
mov dword [ebp - 0x5fc], 0x650078
call fcn.10043b10
push 0x1f0
lea eax, [ebp - 0x3fc]
mov dword [ebp - 0x414], 0x360033
push 0
push eax
mov dword [ebp - 0x410], 0x770030
mov dword [ebp - 0x40c], 0x730070
mov dword [ebp - 0x408], 0x760072
mov dword [ebp - 0x404], 0x65002e
mov dword [ebp - 0x400], 0x650078
call fcn.10043b10
push 0x1f2
lea eax, [ebp - 0x1f6]
mov dword [ebp - 0x20c], 0x690062
mov ecx, 0x65
mov dword [ebp - 0x208], 0x640072
push 0
push eax
mov dword [ebp - 0x204], 0x720073
mov dword [ebp - 0x200], 0x2e0076
mov dword [ebp - 0x1fc], 0x780065
mov word [ebp - 0x1f8], cx
call fcn.10043b10
add esp, 0x48
lea edi, [ebp - 0xc34]
xor esi, esi
nop word [eax + eax]
push dword [ebp - 0xef4]
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1000d130
inc esi
add edi, 0x208
cmp esi, 6
jl 0x1000d4a0
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0xf00]
push eax
lea eax, [ebp - 0xef4]
push eax
call fcn.1000dc30
add esp, 8
test eax, eax
je 0x1000d130
xorps xmm0, xmm0
mov dword [ebp - 0xf04], 0
movlpd qword [ebp - 0xe44], xmm0
push dword [ebp - 0xe40]
push dword [ebp - 0xe44]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, dword [ebp - 0xf00]
test eax, eax
je 0x1000d524
lea eax, [ebp - 0xf04]
push eax
push ebx
call esi
test eax, eax
jne 0x1000d564
lea eax, [ebp - 0xe4c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
mov eax, dword [ebp - 0xef4]
je 0x1000d56a
cmp dword [ebp - 0xe4c], 0
jne 0x1000d56a
cmp dword [ebp - 0xe48], 0
jne 0x1000d56a
cmp dword [ebp - 0xe44], eax
jne 0x1000d56a
cmp dword [ebp - 0xe40], edi
je 0x1000d6ae
jmp 0x1000d56a
mov eax, dword [ebp - 0xef4]
push dword [ebp - 0xef8]
lea ebx, [eax - 5]
mov eax, ebx
lea esi, [edi - 5]
shl eax, 4
sub eax, ebx
cdq
and edx, 0xf
lea edi, [edx + eax]
lea eax, [ebp - 0xefc]
sar edi, 4
push eax
push 0
push edi
call fcn.1000db80
add esp, 0x10
test eax, eax
jne 0x1000d5bd
push dword [ebp - 0xef8]
lea eax, [ebp - 0xefc]
push eax
push 0
push edi
call fcn.1000db80
add esp, 0x10
test eax, eax
je 0x1000d130
push dword [ebp - 0xef8]
mov eax, esi
lea ecx, [ebp - 0xefc]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push ecx
push eax
push ebx
mov dword [ebp - 0xf00], eax
call fcn.1000db80
add esp, 0x10
test eax, eax
jne 0x1000d618
push dword [ebp - 0xef8]
mov eax, esi
lea ecx, [ebp - 0xefc]
shl eax, 4
sub eax, esi
cdq
and edx, 0xf
add eax, edx
push ecx
sar eax, 4
push eax
push ebx
call fcn.1000db80
add esp, 0x10
test eax, eax
je 0x1000d130
push dword [ebp - 0xef8]
mov eax, ebx
lea ecx, [ebp - 0xefc]
cdq
and edx, 0xf
push ecx
add eax, edx
sar eax, 4
push esi
push eax
call fcn.1000db80
add esp, 0x10
test eax, eax
jne 0x1000d65d
push dword [ebp - 0xef8]
lea eax, [ebp - 0xefc]
push eax
push esi
push edi
call fcn.1000db80
add esp, 0x10
test eax, eax
je 0x1000d130
push dword [ebp - 0xef8]
lea eax, [ebp - 0xefc]
push eax
push dword [ebp - 0xf00]
push 0
call fcn.1000db80
add esp, 0x10
test eax, eax
jne 0x1000d6ae
push dword [ebp - 0xef8]
mov eax, esi
lea ecx, [ebp - 0xefc]
shl eax, 4
sub eax, esi
cdq
and edx, 0xf
add eax, edx
push ecx
sar eax, 4
push eax
push 0
call fcn.1000db80
add esp, 0x10
test eax, eax
je 0x1000d130
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100264cc
mov esp, ebp
pop ebp
ret