Function at 0x10001a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x100c8d89
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100ef07c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor edi, edi
push edi
mov ecx, 0x100f26e0
mov dword [esp + 0x10], 0x100f26e0
call sub.mfc90u.dll_CWinApp::CWinApp
mov dword [esp + 0x18], edi
push 0x100f278c
mov dword [0x100f2784], 0x100cc068
mov dword [0x100f2788], 0x100cc084
call fcn.10015870
mov byte [esp + 0x18], 1
push 0x100f27a4
mov dword [0x100f26e0], 0x100cc0bc
mov dword [0x100f2784], 0x100cc180
mov dword [0x100f2788], 0x100cc19c
call fcn.100a9da0
push 0x100f28d0
mov byte [esp + 0x1c], 2
call fcn.100a6310
mov dword [0x100f28d0], 0x100e0744
mov dword [0x100f2978], edi
mov dword [0x100f297c], edi
mov dword [0x100f2980], edi
mov dword [0x100f2984], edi
mov dword [0x100f2910], 2
push 0x100f2988
mov byte [esp + 0x1c], 3
call fcn.100a6310
mov esi, vtable.CDLLCreateObjectEngine.0
mov dword [0x100f2988], esi
mov dword [0x100f2a30], edi
mov dword [0x100f2a34], edi
mov dword [0x100f2a38], edi
push 0x100f2a3c
mov byte [esp + 0x1c], 4
call fcn.10010040
push 0x100f2a7c
mov byte [esp + 0x1c], 5
call fcn.100a6310
mov dword [0x100f2a7c], esi
mov dword [0x100f2b24], edi
mov dword [0x100f2b28], edi
mov dword [0x100f2b2c], edi
mov byte [esp + 0x18], 6
push 0x100f2b34
mov dword [0x100f2b30], edi
call fcn.100011a0
push 0x100f2b54
mov byte [esp + 0x1c], 7
call fcn.1000bb00
push 0x100f2b90
mov byte [esp + 0x1c], 8
call fcn.1001c2d0
mov byte [esp + 0x18], 9
push 0x100f2ba0
mov dword [0x100f2b9c], edi
call fcn.100011a0
push 0x100f2bc0
mov byte [esp + 0x1c], 0xa
call fcn.10008dd0
push 0x100f2be0
mov byte [esp + 0x1c], 0xb
call fcn.100011a0
mov ecx, 0x100f2c00
mov byte [esp + 0x18], 0xc
call fcn.10092740
mov byte [esp + 0x18], 0xd
mov ecx, 0x100f2c44
call fcn.10092740
push 0x100f2c88
mov byte [esp + 0x1c], 0xe
call fcn.10092a10
push 0x100f2cfc
mov byte [esp + 0x1c], 0xf
call fcn.10092a10
push 0x100f2d78
mov byte [esp + 0x1c], 0x10
call fcn.1009cad0
push 0x100f2e3c
mov byte [esp + 0x1c], 0x11
call fcn.1009ce80
push 0x100f2f48
mov byte [esp + 0x1c], 0x12
call fcn.1009d4d0
push 0x100f30b4
mov byte [esp + 0x1c], 0x13
call fcn.1009dc90
push 0x100f3158
mov byte [esp + 0x1c], 0x14
call fcn.1009e110
push 0x100f3368
mov byte [esp + 0x1c], 0x15
call fcn.100ada50
mov dword [0x100f3368], 0x100e0c74
push 0x100f33e8
mov byte [esp + 0x1c], 0x16
call fcn.100ada50
mov dword [0x100f33e8], 0x100e0ca4
push 0x100f3468
mov byte [esp + 0x1c], 0x17
call fcn.100ada50
mov dword [0x100f3468], 0x100e0cd4
push 0x100f34e8
mov byte [esp + 0x1c], 0x18
call fcn.100af650
push 0x100f35c8
mov byte [esp + 0x1c], 0x19
call fcn.100ada50
mov dword [0x100f35c8], 0x100e0d34
mov dword [0x100f3648], edi
mov byte [esp + 0x18], 0x1a
mov dword [0x100f364c], edi
mov dword [0x100f3650], 0xffffffff
mov dword [0x100f3654], edi
push 0x100f365c
mov dword [0x100f3658], edi
call fcn.100203e0
push str.NtQuerySystemInformation
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f364c], eax
push 0x100f3674
mov byte [esp + 0x1c], 0x1b
call fcn.100a0090
push 0x100f3694
mov byte [esp + 0x1c], 0x1c
call fcn.100011a0
mov ecx, 0x100f36b4
call dword [0x100ca800]
mov dword [0x100f36b8], edi
push 0x100f36bc
mov byte [esp + 0x1c], 0x1e
call fcn.100203e0
push 0x100f36d4
mov byte [esp + 0x1c], 0x1f
call fcn.100a0090
push 1
xor eax, eax
mov esi, 0x100f3708
mov byte [esp + 0x1c], 0x20
call fcn.100a4ab0
push 2
mov eax, str.TrustList.dat
mov esi, 0x100f3740
mov byte [esp + 0x1c], 0x21
call fcn.100a4ab0
push 0x100f3778
mov byte [esp + 0x1c], 0x22
call fcn.100a59d0
push 0x100f37ec
mov byte [esp + 0x1c], 0x23
call fcn.100a59d0
push 0x100f3860
mov byte [esp + 0x1c], 0x24
call fcn.100a59d0
mov byte [esp + 0x18], 0x25
push 0x100f38d8
mov dword [0x100f38d4], 0x100dd92c
call fcn.100203e0
mov dword [0x100f38f0], edi
mov dword [0x100f38f8], edi
mov dword [0x100f38fc], edi
mov dword [0x100f3900], edi
mov dword [0x100f3904], edi
mov dword [0x100f3908], edi
mov dword [0x100f390c], edi
mov dword [0x100f3910], edi
mov dword [0x100f3914], edi
mov dword [0x100f3918], edi
mov dword [0x100f391c], edi
mov byte [esp + 0x18], 0x27
mov eax, 0x10006d50
xor ecx, ecx
push 0x100f3938
mov dword [0x100f3928], eax
mov dword [0x100f392c], ecx
mov dword [0x100f3930], 0x100f26e0
call fcn.100011a0
xor ecx, ecx
mov eax, 0x10007ef0
mov dword [0x100f398c], ecx
mov dword [0x100f3958], edi
mov ecx, 0x100f399c
mov dword [0x100f395c], edi
mov dword [0x100f3960], edi
mov dword [0x100f3964], edi
mov dword [0x100f3968], edi
mov dword [0x100f396c], edi
mov dword [0x100f3970], edi
mov dword [0x100f3974], edi
mov dword [0x100f3978], edi
mov dword [0x100f397c], edi
mov dword [0x100f3988], eax
mov dword [0x100f3990], 0x100f26e0
mov dword [0x100f3998], edi
call dword [0x100ca800]
mov dword [0x100f36f4], edi
mov dword [0x100f36f8], edi
mov dword [0x100f36fc], edi
mov dword [0x100f3700], edi
mov dword [0x100f3704], edi
mov eax, 0x100f26e0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret