Function at 0x1000c790
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053a00
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0x1c], 0x3b9ace00
jne 0x1000ce39
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1000c7db
mov byte [ebp - 0x4d], 0
cmp esi, 1
jne 0x1000c7df
mov byte [ebp - 0x4d], 1
mov ecx, esi
mov eax, esi
shr ecx, 4
mov ebx, esi
and ecx, 0xffffff01
shr eax, 1
mov dword [ebp - 0x54], ecx
and eax, 0xffffff01
mov ecx, esi
mov dword [ebp - 0x5c], eax
shr ecx, 5
mov eax, esi
and ecx, 0xffffff01
shr eax, 2
mov dword [ebp - 0x60], ecx
and eax, 0xffffff01
mov ecx, esi
mov dword [ebp - 0x6c], eax
shr ecx, 6
mov eax, esi
and ecx, 0xffffff01
shr ebx, 9
mov dword [ebp - 0x58], ecx
and bl, 1
mov ecx, esi
shr eax, 3
shr ecx, 7
and ecx, 0xffffff01
mov dword [ebp - 0x64], ecx
mov ecx, esi
shr ecx, 8
and ecx, 0xffffff01
mov dword [ebp - 0x70], ecx
mov ecx, esi
shr ecx, 0xa
and ecx, 0xffffff01
mov dword [ebp - 0x74], ecx
mov ecx, esi
shr ecx, 0xb
and ecx, 0xffffff01
mov dword [ebp - 0x68], ecx
mov ecx, esi
shr ecx, 0xc
and ecx, 0xffffff01
mov dword [ebp - 0x78], ecx
and al, 1
je 0x1000c9a8
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
imul eax, dword [ebp + 0x18]
or eax, 0x3b9ace00
cmp dword [ebp + 0x14], eax
jne 0x1000c9b1
mov eax, dword [0x1005fb08]
mov byte [0x100611b5], 1
mov dword [0x100611b0], eax
call esi
mov dword [0x100611dc], eax
call fcn.1000ce60
lea eax, [ebp - 0x20]
mov dword [ebp - 0x4c], 0x72657375
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x48], 0x642e3233
push eax
mov word [ebp - 0x44], 0x6c6c
mov byte [ebp - 0x42], 0
mov dword [ebp - 0x20], 0x4b746547
mov dword [ebp - 0x1c], 0x74537965
mov dword [ebp - 0x18], 0x657461
call fcn.1000a920
add esp, 8
mov dword [0x10061e94], eax
mov dword [section..SYNC], 0
mov byte [0x1005fb05], 1
push 0xfffffffffffffffe
call sym.efff.dll_Ordinal_2
push 0x104
push 0
push 0x10061888
mov byte [0x10061883], 0
mov dword [0x10061cf8], 0
mov dword [0x10061d80], 0
call fcn.10012c40
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0xc
push 0x104
push 0x10061888
push 0
call esi
push 0x104
push 0
push 0x10061008
call fcn.10012c40
add esp, 0xc
push 0x104
push 0x10061008
push dword [0x100611b0]
call esi
call fcn.1001c67b
push 0x64
push 0
push 0x10061608
call fcn.10012c40
push 0x1f4
push 0
push 0x10061670
call fcn.10012c40
add esp, 0x18
mov eax, 1
jmp 0x1000ce3b
cmp byte [0x100611b5], 0
jne 0x1000c9bb
mov eax, 1
jmp 0x1000ce3b
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
cmp eax, dword [0x100611dc]
jne 0x1000ce39
test bl, bl
je 0x1000c9f9
push edx
mov edx, 0xef5cca3b
xor edx, esp
sbb edx, esp
mov edx, 0xfa55b110
nop
pop edx
cmp dword [ebp + 0x14], 1
mov eax, 1
sete byte [0x100614fe]
jmp 0x1000ce3b
cmp byte [ebp - 0x54], 0
je 0x1000ca2e
mov esi, dword [ebp + 0x14]
xor esi, 0x3b9ace00
call edi
cmp esi, eax
je 0x1000c9b1
push esi
call fcn.10008920
add esp, 4
test eax, eax
mov eax, 1
je 0x1000ce3b
mov byte [0x100611b6], al
jmp 0x1000ce3b
cmp byte [ebp - 0x60], 0
je 0x1000ca63
call edi
mov ebx, dword [ebp + 0x18]
mov ecx, ebx
xor ecx, 0x3b9ace00
cmp ecx, eax
jne 0x1000ca66
push ebx
sbb ebx, esp
sbb ebx, edx
add ebx, eax
sbb ebx, esi
or ebx, ebp
nop
pop ebx
mov byte [0x100611b7], 1
mov eax, 1
jmp 0x1000ce3b
mov ebx, dword [ebp + 0x18]
cmp byte [ebp - 0x58], 0
je 0x1000ca8e
call edi
mov edx, dword [ebp + 0x14]
mov ecx, edx
xor ecx, 0x3b9ace00
cmp ecx, eax
jne 0x1000ca91
mov byte [0x100611bc], 1
mov eax, 1
jmp 0x1000ce3b
mov edx, dword [ebp + 0x14]
cmp byte [ebp - 0x5c], 0
je 0x1000caa7
mov dword [0x100611e0], edx
mov eax, 1
jmp 0x1000ce3b
cmp byte [ebp - 0x6c], 0
je 0x1000cad9
push ecx
mov ecx, 0xd38a43fd
mov ecx, 0x600dbb6c
add ecx, esp
nop
pop ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
or eax, dword [ebp + 0x18]
mov dword [0x10061ac0], eax
mov eax, 1
mov dword [0x10061ac4], ecx
jmp 0x1000ce3b
cmp byte [ebp - 0x64], 0
je 0x1000cc5c
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0
push eax
push 0x10061888
mov byte [ebp - 0x4d], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x20], 0x612f3c3e
mov dword [ebp - 0x1c], 0x6d657373
mov dword [ebp - 0x18], 0x3e796c62
mov dword [ebp - 4], 2
mov word [ebp - 0x5c], 0x6272
mov byte [ebp - 0x5a], 0
call fcn.100318c8
mov ebx, eax
add esp, 8
mov dword [ebp - 0x60], ebx
test ebx, ebx
je 0x1000ce39
push 2
push 0
push ebx
call fcn.10031f97
push ebx
call fcn.100325bf
push 0
push 0
push ebx
mov edi, eax
call fcn.10031f97
push edi
call fcn.10010ed5
mov esi, eax
add esp, 0x20
mov dword [ebp - 0x54], esi
test esi, esi
je 0x1000ce39
push ebx
push edi
push 1
push esi
call fcn.10031b20
add esp, 0x10
cmp eax, edi
jne 0x1000ce39
mov ecx, esi
inc ecx
cmp byte [ecx], 0x3e
jne 0x1000cba7
cmp byte [ecx + 1], 0x3c
jne 0x1000cba7
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
cmp eax, dword [edx]
jne 0x1000cba7
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x1000cba7
mov eax, dword [ecx + 8]
cmp eax, dword [edx + 8]
je 0x1000cbb2
lea eax, [edi - 0xc]
add eax, esi
cmp ecx, eax
jb 0x1000cb82
jmp 0x1000cbb5
add ecx, 0xd
dec ecx
lea eax, [edi - 4]
mov edx, ecx
add eax, esi
sub edx, esi
mov dword [ebp - 0x64], edx
cmp ecx, eax
jae 0x1000cbe3
push 0
lea eax, [edx + 1]
push eax
push ebx
call fcn.10031f97
push ebx
push 1
lea eax, [ebp - 0x58]
push 4
push eax
call fcn.10031b20
add esp, 0x1c
lea eax, [ebp - 0x54]
push eax
call fcn.100022c0
push 0
push 0
push ebx
call fcn.10031f97
add esp, 0x10
push eax
mov eax, 0x708caaca
mov eax, 0x8294a8be
nop
pop eax
mov ebx, dword [ebp - 0x64]
test ebx, ebx
jle 0x1000cc2d
mov esi, dword [ebp - 0x60]
push esi
push 1
lea eax, [ebp - 0x4d]
push 1
push eax
call fcn.10031b20
movzx eax, byte [ebp - 0x4d]
add esp, 0x10
sub dword [ebp - 0x58], eax
sub ebx, 1
jne 0x1000cc10
lea eax, [ebp - 0x60]
push eax
call fcn.1000bd20
mov eax, dword [ebp - 0x58]
add esp, 4
jmp 0x1000ce3b
cmp byte [ebp - 0x4d], 0
je 0x1000ccef
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
cmp eax, edi
mov dword [0x1006110c], edx
sbb eax, eax
mov dword [0x10061110], ebx
neg eax
mov dword [0x100611c4], eax
xor eax, eax
cmp eax, ecx
sbb eax, eax
and esi, 1
neg eax
mov dword [0x100611cc], esi
mov dword [0x100611c0], eax
test edx, edx
je 0x1000ccb2
movzx eax, byte [0x100611b6]
xor edx, edx
test ebx, ebx
cmove eax, edx
mov byte [0x100611b6], al
test edi, edi
jne 0x1000ccce
test ecx, ecx
jne 0x1000ccce
test esi, esi
jne 0x1000ccce
mov dword [0x100611c8], esi
call fcn.10005170
jmp 0x1000ce3b
cmp dword [section..SYNC], 0
mov dword [0x100611c8], 1
jne 0x1000c9b1
call fcn.100052b0
jmp 0x1000ce3b
cmp byte [ebp - 0x70], 0
je 0x1000cd15
mov dword [0x100611e4], edx
push eax
mov eax, 0x293f5771
mov eax, 0x5965f203
xor eax, eax
sbb eax, edx
pop eax
mov eax, 1
jmp 0x1000ce3b
cmp byte [ebp - 0x74], 0
je 0x1000cd35
push ebx
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000d000
add esp, 0x10
mov eax, 1
jmp 0x1000ce3b
cmp byte [ebp - 0x68], 0
je 0x1000ce23
cmp edx, 1
jne 0x1000ce17
cmp dword [0x10061ee0], 0
jne 0x1000c9b1
mov dword [ebp - 0x40], 0x61657243
mov dword [ebp - 0x3c], 0x68546574
mov dword [ebp - 0x38], 0x64616572
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x6e72654b
mov dword [ebp - 0x2c], 0x32336c65
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], 0
push ebp
mov ebp, 0xf8f57475
mov ebp, 0x26190e05
sbb ebp, eax
and ebp, ebp
nop
pop ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x1000cdd6
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000cdd6
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push eax
call edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x68], 0
push ebx
mov ebx, 0xd7287ace
mov ebx, 0xe42b73bd
sbb ebx, esi
sbb ebx, edx
pop ebx
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x1000c9b1
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0x1000b220
push 0
push 0
call eax
mov dword [0x10061ee0], eax
mov eax, 1
jmp 0x1000ce3b
call fcn.1000d750
mov eax, 1
jmp 0x1000ce3b
cmp byte [ebp - 0x78], 0
mov eax, 1
je 0x1000ce3b
cmp edx, eax
sete byte [0x10061e9d]
jmp 0x1000ce3b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret 0x18