Function at 0x100014d0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x1000f040]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x1c0], 0xa106
mov byte [ebp - 0x160], 0
push 0x103
push 0
lea eax, [ebp - 0x15f]
push eax
call fcn.100022b0
add esp, 0xc
mov cx, word [ebp - 0x1c0]
sar cx, 0xb
mov word [ebp - 0x1c0], cx
mov dword [ebp - 0x24], 0
mov dx, word [ebp - 0x1c0]
sar dx, 3
mov word [ebp - 0x1c0], dx
movsx eax, word [ebp - 0x1c0]
imul eax, eax, 0xf635
mov word [ebp - 0x1c0], ax
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0x13aa
idiv ecx
mov word [ebp - 0x1c0], ax
mov dx, word [ebp - 0x1c0]
sar dx, 1
mov word [ebp - 0x1c0], dx
movsx eax, word [ebp - 0x1c0]
add eax, 0x1fde
mov word [ebp - 0x1c0], ax
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0x723c
idiv ecx
mov word [ebp - 0x1c0], ax
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0x6b
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
and ecx, 0x1817
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0x65
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
imul ecx, ecx, 0x9939
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0x72
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
imul ecx, ecx, 0x21db
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0x6e
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
xor ecx, 0x26bc
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0x65
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
add ecx, 0xec53
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0x6c
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
sub ecx, 0x2044
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0x33
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
xor ecx, 0xe4ad
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0x32
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
sub ecx, 0x635c
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x3c], 0
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
or ecx, 0xcaae
mov word [ebp - 0x1c0], cx
movsx edx, word [ebp - 0x1c0]
or edx, 0x88cf
mov word [ebp - 0x1c0], dx
movsx eax, word [ebp - 0x1c0]
imul eax, eax, 0x4197
mov word [ebp - 0x1c0], ax
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x4d
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x4e
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x6d
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x41
mov byte [ebp - 0xa], 0
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0x6a27
idiv ecx
mov word [ebp - 0x1c0], ax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c8], eax
movsx ecx, word [ebp - 0x1c0]
xor ecx, 0x3938
mov word [ebp - 0x1c0], cx
mov dx, word [ebp - 0x1c0]
sar dx, 0xb
mov word [ebp - 0x1c0], dx
push 0x104
lea eax, [ebp - 0x160]
push eax
push 0
call dword [ebp - 0x1c8]
movsx ecx, word [ebp - 0x1c0]
add ecx, 0x4b55
mov word [ebp - 0x1c0], cx
movsx edx, word [ebp - 0x1c0]
and edx, 0xbb0d
mov word [ebp - 0x1c0], dx
push 0x5c
lea eax, [ebp - 0x160]
push eax
call fcn.10002290
add esp, 8
mov dword [ebp - 4], eax
movsx ecx, word [ebp - 0x1c0]
imul ecx, ecx, 0x6940
mov word [ebp - 0x1c0], cx
cmp dword [ebp - 4], 0
je 0x10001832
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov ax, word [ebp - 0x1c0]
sar ax, 2
mov word [ebp - 0x1c0], ax
mov byte [ebp - 0x4c], 0x5c
mov byte [ebp - 0x4b], 0x73
mov byte [ebp - 0x4a], 0x6d
mov byte [ebp - 0x49], 0x61
mov byte [ebp - 0x48], 0x64
mov byte [ebp - 0x47], 0x61
mov byte [ebp - 0x46], 0x76
mov byte [ebp - 0x45], 0x75
mov byte [ebp - 0x44], 0x70
mov byte [ebp - 0x43], 0x64
mov byte [ebp - 0x42], 0x61
mov byte [ebp - 0x41], 0x74
mov byte [ebp - 0x40], 0x65
mov byte [ebp - 0x3f], 0
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0x75b0
idiv ecx
mov word [ebp - 0x1c0], ax
mov byte [ebp - 0x30], 0
xor edx, edx
mov dword [ebp - 0x2f], edx
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0xef61
idiv ecx
mov word [ebp - 0x1c0], ax
mov dword [ebp - 0x24], 0
movsx edx, word [ebp - 0x1c0]
and edx, 0xa6e2
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x30], 0x2e
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
movsx edx, word [ebp - 0x1c0]
xor edx, 0x28b1
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x30], 0x64
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov dx, word [ebp - 0x1c0]
sar dx, 0xc
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x30], 0x61
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
movsx edx, word [ebp - 0x1c0]
and edx, 0x255b
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x30], 0x74
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
movsx edx, word [ebp - 0x1c0]
and edx, 0xd878
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x30], 0
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
movsx edx, word [ebp - 0x1c0]
xor edx, 0x12ad
mov word [ebp - 0x1c0], dx
mov byte [ebp - 0x1a8], 0
push 0x3f
push 0
lea eax, [ebp - 0x1a7]
push eax
call fcn.100022b0
add esp, 0xc
movsx ecx, word [ebp - 0x1c0]
add ecx, 0x3d68
mov word [ebp - 0x1c0], cx
lea edx, [ebp - 0x4c]
push edx
call fcn.10002960
add esp, 4
mov dword [ebp - 0x168], eax
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0xfb91
idiv ecx
mov word [ebp - 0x1c0], ax
mov edx, dword [ebp - 0x168]
push edx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.10002830
add esp, 0xc
movsx edx, word [ebp - 0x1c0]
imul edx, edx, 0xe25
mov word [ebp - 0x1c0], dx
push 4
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.100026f0
add esp, 0xc
movsx edx, word [ebp - 0x1c0]
and edx, 0xce51
mov word [ebp - 0x1c0], dx
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movsx edx, word [ebp - 0x1c0]
imul edx, edx, 0xeae2
mov word [ebp - 0x1c0], dx
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0x1c88
idiv ecx
mov word [ebp - 0x1c0], ax
mov dword [ebp - 0x164], 0
movsx edx, word [ebp - 0x1c0]
sub edx, 0x2148
mov word [ebp - 0x1c0], dx
mov dword [ebp - 0x20], 0
movsx eax, word [ebp - 0x1c0]
add eax, 0x9162
mov word [ebp - 0x1c0], ax
mov dword [ebp - 0x54], 0
movsx ecx, word [ebp - 0x1c0]
sub ecx, 0x983a
mov word [ebp - 0x1c0], cx
movsx edx, word [ebp - 0x1c0]
and edx, 0x5a1f
mov word [ebp - 0x1c0], dx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x160]
push edx
call fcn.100012a0
add esp, 0xc
movsx eax, word [ebp - 0x1c0]
imul eax, eax, 0x640b
mov word [ebp - 0x1c0], ax
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0xfcc2
idiv ecx
mov word [ebp - 0x1c0], ax
cmp dword [ebp - 0x54], 0
ja 0x10001b25
push 0
call fcn.1000266e
movsx edx, word [ebp - 0x1c0]
and edx, 0x1ec9
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
movsx ecx, word [ebp - 0x1c0]
sub ecx, 0x591d
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x28]
push edx
call fcn.10002960
add esp, 4
mov dword [ebp - 0x50], eax
movsx eax, word [ebp - 0x1c0]
xor eax, 0x60dc
mov word [ebp - 0x1c0], ax
movsx ecx, word [ebp - 0x1c0]
sub ecx, 0xcffb
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x50]
sub edx, 1
mov dword [ebp - 0x54], edx
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0xf5e8
idiv ecx
mov word [ebp - 0x1c0], ax
movsx edx, word [ebp - 0x1c0]
imul edx, edx, 0xccae
mov word [ebp - 0x1c0], dx
movsx eax, word [ebp - 0x1c0]
xor eax, 0xa9e7
mov word [ebp - 0x1c0], ax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x20]
lea eax, [edx + ecx + 1]
mov dword [ebp - 0x20], eax
movsx ecx, word [ebp - 0x1c0]
add ecx, 0x2cbc
mov word [ebp - 0x1c0], cx
movsx edx, word [ebp - 0x1c0]
add edx, 0xca7f
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0x54]
add eax, 1
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x164], eax
movsx ecx, word [ebp - 0x1c0]
add ecx, 0x41e1
mov word [ebp - 0x1c0], cx
movsx edx, word [ebp - 0x1c0]
xor edx, 0xb8a3
mov word [ebp - 0x1c0], dx
mov dword [ebp - 0x1cc], 0
jmp 0x10001c4b
mov eax, dword [ebp - 0x1cc]
add eax, 1
mov dword [ebp - 0x1cc], eax
mov ecx, dword [ebp - 0x1cc]
cmp ecx, dword [ebp - 0x54]
jae 0x10001cc9
mov edx, dword [ebp - 0x164]
add edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1cc]
mov cl, byte [eax]
mov byte [edx], cl
mov dx, word [ebp - 0x1c0]
sar dx, 6
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0x164]
add eax, dword [ebp - 0x1cc]
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x1cc]
xor edx, edx
div dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
movsx edx, byte [eax + edx]
xor ecx, edx
mov eax, dword [ebp - 0x164]
add eax, dword [ebp - 0x1cc]
mov byte [eax], cl
mov cx, word [ebp - 0x1c0]
sar cx, 3
mov word [ebp - 0x1c0], cx
jmp 0x10001c3c
push 0x63
call fcn.10001430
add esp, 4
movsx edx, word [ebp - 0x1c0]
xor edx, 0x7b28
mov word [ebp - 0x1c0], dx
mov ax, word [ebp - 0x1c0]
sar ax, 0xd
mov word [ebp - 0x1c0], ax
movsx ecx, word [ebp - 0x1c0]
imul ecx, ecx, 0x7931
mov word [ebp - 0x1c0], cx
movsx edx, word [ebp - 0x1c0]
add edx, 0x2829
mov word [ebp - 0x1c0], dx
mov ax, word [ebp - 0x1c0]
sar ax, 6
mov word [ebp - 0x1c0], ax
mov byte [ebp - 0x1b8], 0
xor ecx, ecx
mov dword [ebp - 0x1b7], ecx
mov dword [ebp - 0x1b3], ecx
mov dword [ebp - 0x1af], ecx
mov word [ebp - 0x1ab], cx
movsx edx, word [ebp - 0x1c0]
xor edx, 0x3e50
mov word [ebp - 0x1c0], dx
mov dword [ebp - 0x24], 0
movsx eax, word [ebp - 0x1c0]
and eax, 0xd676
mov word [ebp - 0x1c0], ax
mov ecx, dword [ebp - 0x24]
mov byte [ebp + ecx - 0x1b8], 0x56
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
movsx eax, word [ebp - 0x1c0]
or eax, 0x4a13
mov word [ebp - 0x1c0], ax
mov ecx, dword [ebp - 0x24]
mov byte [ebp + ecx - 0x1b8], 0x69
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0x63b4
idiv ecx
mov word [ebp - 0x1c0], ax
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x72
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0xe7f9
idiv ecx
mov word [ebp - 0x1c0], ax
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x74
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
xor ecx, 0xf5e
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x75
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
add ecx, 0x3a22
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x61
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
add ecx, 0xba51
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x6c
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
imul ecx, ecx, 0xebcc
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x50
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
add ecx, 0xd4c5
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x72
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0xc14b
idiv ecx
mov word [ebp - 0x1c0], ax
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x6f
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
xor ecx, 0xcab7
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x74
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
or ecx, 0x900f
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x65
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
xor ecx, 0x9eb4
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x63
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
movsx ecx, word [ebp - 0x1c0]
and ecx, 0xbb0a
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0x74
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov cx, word [ebp - 0x1c0]
sar cx, 7
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x1b8], 0
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov cx, word [ebp - 0x1c0]
sar cx, 8
mov word [ebp - 0x1c0], cx
movsx edx, word [ebp - 0x1c0]
and edx, 0xdfd3
mov word [ebp - 0x1c0], dx
movsx eax, word [ebp - 0x1c0]
imul eax, eax, 0x1cdc
mov word [ebp - 0x1c0], ax
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1bc], eax
movsx eax, word [ebp - 0x1c0]
add eax, 0xaadb
mov word [ebp - 0x1c0], ax
movsx ecx, word [ebp - 0x1c0]
or ecx, 0x67d4
mov word [ebp - 0x1c0], cx
lea edx, [ebp - 0x1c4]
push edx
push 0x40
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x164]
push ecx
call dword [ebp - 0x1bc]
movsx edx, word [ebp - 0x1c0]
or edx, 0xc8ef
mov word [ebp - 0x1c0], dx
movsx eax, word [ebp - 0x1c0]
and eax, 0xdc2
mov word [ebp - 0x1c0], ax
movsx ecx, word [ebp - 0x1c0]
xor ecx, 0xf911
mov word [ebp - 0x1c0], cx
movsx eax, word [ebp - 0x1c0]
cdq
mov ecx, 0xbb3b
idiv ecx
mov word [ebp - 0x1c0], ax
mov eax, dword [ebp - 0x164]
jmp 0x100020d0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100029eb
mov esp, ebp
pop ebp
ret