Function at 0x100015cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [0x1006110c], eax
mov ecx, dword [ebp + 0x14]
mov dword [0x10061108], ecx
mov edx, dword [ebp + 0x10]
mov dword [0x10061110], edx
call fcn.10006238
mov dword [0x100289e0], eax
cmp dword [0x100289e0], 0
jne 0x10001607
jmp 0x10001db0
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f4]
cmp ecx, 4
jne 0x1000161d
jmp 0x1000182c
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f4]
cmp eax, 3
jne 0x10001634
jmp 0x10001b3f
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f4]
cmp edx, 2
jne 0x1000164b
jmp 0x100017bc
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f4]
cmp ecx, 1
jne 0x1000165e
jmp 0x10001674
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f4]
test eax, eax
jne 0x10001674
jmp 0x10001db0
push 0x250
push 0xffffffffffffffff
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [0x100289e0]
add edx, 4
push edx
mov eax, dword [0x100289e0]
push eax
call fcn.10002bf8
add esp, 0x14
push 0x124
mov ecx, dword [0x100289e0]
add ecx, 0x250
push ecx
mov edx, dword [ebp - 0xc]
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [0x100289e0]
cmp dword [eax + 0x186ec], 0
je 0x10001d91
mov ecx, dword [0x100289e0]
mov edx, dword [ecx + 0x186ec]
sub edx, 1
mov eax, dword [0x100289e0]
mov dword [eax + 0x186ec], edx
mov ecx, dword [0x100289e0]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x10001731
push 0x124
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x250
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [0x100289e0]
add eax, 4
push eax
mov ecx, dword [0x100289e0]
push ecx
call fcn.10002fa8
add esp, 0xc
jmp 0x10001736
jmp 0x10001d91
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f2]
cmp eax, 1
jne 0x10001768
mov ecx, dword [0x100289e0]
add ecx, 0x250
push ecx
push 0
push 0xc
mov edx, dword [0x100089ac]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100017bc
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f2]
cmp ecx, 2
jne 0x100017bc
push 0x10008064
call fcn.100060cf
push 0x100089b0
call fcn.100060cf
push 0x100089b4
call fcn.100060cf
mov edx, dword [0x100289e0]
add edx, 0x250
push edx
call fcn.100060cf
mov eax, dword [0x100289e0]
mov word [eax + 0x186f4], 2
jmp 0x10001dd4
mov ecx, dword [0x100289e0]
add ecx, 0x186e4
push ecx
push 0x20019
push 0
mov edx, dword [0x100289e0]
add edx, 0x250
push edx
mov eax, dword [0x100289e0]
mov ecx, dword [eax + 0x186e0]
push ecx
call fcn.10005d1b
add esp, 0x14
test eax, eax
je 0x100017fa
jmp 0x100016b6
mov edx, dword [0x100289e0]
mov dword [edx + 0x186e8], 0xffffffff
mov eax, dword [0x100289e0]
cmp dword [eax + 0x186fc], 0
jne 0x1000182c
mov ecx, dword [0x100289e0]
cmp dword [ecx + 0x18700], 0
jne 0x1000182c
jmp 0x10001b3f
mov edx, dword [0x100289e0]
mov eax, dword [edx + 0x186e8]
add eax, 1
mov ecx, dword [0x100289e0]
mov dword [ecx + 0x186e8], eax
mov edx, dword [0x100289e0]
mov byte [edx + 0x86de], 0
mov dword [ebp - 0x18], 0x124
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x86de
push ecx
lea edx, [ebp - 4]
push edx
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x6e0
push ecx
mov edx, dword [0x100289e0]
mov eax, dword [edx + 0x186e8]
push eax
mov ecx, dword [0x100289e0]
mov edx, dword [ecx + 0x186e4]
push edx
call fcn.10005dd3
add esp, 0x20
test eax, eax
jne 0x10001b2f
mov eax, dword [0x100289e0]
cmp dword [eax + 0x186fc], 0
je 0x100019ab
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f6]
test edx, edx
je 0x10001980
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f6]
cmp ecx, 1
jne 0x1000190b
mov edx, dword [0x100289e0]
add edx, 8
push edx
mov eax, dword [0x100289e0]
add eax, 0x6e0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10001980
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f6]
cmp edx, 2
jne 0x10001945
push 0
push 0
push 1
mov eax, dword [0x100289e0]
add eax, 8
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x6e0
push ecx
call fcn.10002b24
add esp, 0x14
test eax, eax
jne 0x10001980
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f6]
cmp eax, 3
jne 0x100019ab
push 0
push 0
push 0
mov ecx, dword [0x100289e0]
add ecx, 8
push ecx
mov edx, dword [0x100289e0]
add edx, 0x6e0
push edx
call fcn.10002b24
add esp, 0x14
test eax, eax
je 0x100019ab
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f0]
cmp ecx, 0xffffffff
je 0x10001ab3
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f0]
cmp eax, dword [ebp - 4]
je 0x10001ab3
mov ecx, dword [0x100289e0]
cmp dword [ecx + 0x18700], 0
je 0x10001b2a
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f6]
test eax, eax
je 0x10001a90
cmp dword [ebp - 4], 1
je 0x100019e3
cmp dword [ebp - 4], 2
jne 0x10001b2a
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f6]
cmp edx, 1
jne 0x10001a15
mov eax, dword [0x100289e0]
add eax, 8
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x86de
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10001a90
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f6]
cmp eax, 2
jne 0x10001a50
push 0
push 0
push 1
mov ecx, dword [0x8b5589e0]
push ebp
mov ebp, esp
or byte [edi + 0x5e], bl
or al, 0xc3
add cl, byte [ecx - 0x7403dbbc]
inc esp
and al, 0xf8
sub esp, 4
ret
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10001b22
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10001b33
or byte [ebx], al
sar dword [ecx], 1
push esp
add edx, ecx
cmp dword [esp + 0xc], edx
and al, 0xc
jb 0x10001b3d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10001b18
xor eax, eax
pop edi
pop esi
ret
invalid
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [di - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10001ac0
call 0x9d2876a1
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid