Function at 0x1001b340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1001b0a2
jmp 0x1001b09d
call fcn.1001b0a4
jae 0x1001b09d
add esp, 4
jmp 0x1001b0a9
dec dword [esp]
jno 0x1001b0ae
jns 0x1001b099
jp 0x1001b0b2
add esp, 4
popf
jmp 0x1001b0b9
clc
jae 0x1001b0be
mov dl, 0x37
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b0d7
jne 0x1001b0d7
aaa
jl 0x1001b0dc
jmp 0x1001b0de
je 0x1001b0d9
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001b0f8
jne 0x1001b0f7
call 0x9305a17f
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001b106
jne 0x1001b106
call 0xba636d1
invalid
mov dword [ebp - 0x45c], 0
pushf
push 0xa
jae 0x1001b11d
jmp 0x1001b118
call 0x1001b11f
jae 0x1001b118
add esp, 4
jmp 0x1001b124
dec dword [esp]
jno 0x1001b129
jns 0x1001b114
jp 0x1001b12d
add esp, 4
popf
jmp 0x1001b134
clc
jae 0x1001b139
push es
invalid
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b152
jne 0x1001b152
invalid
jl 0x1001b157
jmp 0x1001b159
je 0x1001b154
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001b173
jne 0x1001b172
call 0x9305a1fa
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001b181
jne 0x1001b181
call 0xbaa3712
invalid
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x441]
call fcn.10088e50
test eax, eax
jne 0x1001b1a6
mov dword [ebp - 0x45c], 1
jmp 0x1001c473
jl 0x1001b1ab
jmp 0x1001b1ad
je 0x1001b1a8
xor eax, eax
test eax, eax
je 0x1001b1b6
jne 0x1001b1b5
call 0x9305a23d
rol byte [ebx + eax*4], 0xf0
add eax, 0xce0273f8
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x1001b1c4
into
fdiv qword [ebx + eax + 0x75]
add esp, ebx
je 0x1001b1c9
jne 0x1001b1c9
fsub qword [esi - 0x64]
pushf
push 0xa
jae 0x1001b1d6
jmp 0x1001b1d1
call 0x1001b1d8
jae 0x1001b1d1
add esp, 4
jmp 0x1001b1dd
dec dword [esp]
jno 0x1001b1e2
jns 0x1001b1cd
jp 0x1001b1e6
add esp, 4
popf
jmp 0x1001b1ed
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b206
jne 0x1001b206
call 0x1fc1e55a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10025ff0
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x1001b23a
mov dword [ebp - 0x45c], 0x3e7
jmp 0x1001c473
mov ecx, dword [0x101034a0]
mov edx, dword [ebp - 0x480]
mov dword [ecx], edx
pushf
push 0xa
jae 0x1001b255
jmp 0x1001b250
call 0x1001b257
jae 0x1001b250
add esp, 4
jmp 0x1001b25c
dec dword [esp]
jno 0x1001b261
jns 0x1001b24c
jp 0x1001b265
add esp, 4
popf
jmp 0x1001b26c
clc
jae 0x1001b271
inc ebx
mov ebx, 0xf2815250
nop
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x358
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b28a
jne 0x1001b28a
mov ebx, 0x3eb037c
mov ebx, 0x3350fb74
ror byte [edi], 0x9b
rcl byte [edx + 0x33], 0xd0
jl 0x1001b28f
jmp 0x1001b291
je 0x1001b28c
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001b2ab
jne 0x1001b2aa
call 0x9305a332
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001b2b9
jne 0x1001b2b9
call 0xb38768cc
sti
invalid
movzx eax, byte [ebp - 0x45d]
push eax
push 0x100d1af8
lea ecx, [ebp - 0x5c8]
call fcn.100273b0
mov ecx, eax
call fcn.1000d310
push eax
call fcn.10024430
add esp, 4
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
jne 0x1001b2ff
mov dword [ebp - 0x45c], 2
jmp 0x1001c473
mov ecx, dword [0x101034a0]
mov edx, dword [ebp - 0x484]
mov dword [ecx + 8], edx
jl 0x1001b313
jmp 0x1001b315
je 0x1001b310
xor eax, eax
test eax, eax
je 0x1001b31e
jne 0x1001b31d
call 0x9305a3a5
rol byte [ebx + eax*4], 0xf0
add eax, 0x8a0273f8
add byte [ebx + eax + 0x75], dh
add dword [eax], eax
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x1001b32c
mov al, byte [eax]
je 0x1001b331
jne 0x1001b331
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x1001b33e
jmp 0x1001b339
call 0x1001b340
jae 0x1001b339
add esp, 4
jmp 0x1001b345
dec dword [esp]
jno 0x1001b34a
jns 0x1001b335
jp 0x1001b34e
add esp, 4
popf
jmp 0x1001b355
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b36e
jne 0x1001b36e
call 0x1fc1e6c2
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov dword [ebp - 0x474], 0
call fcn.10023fb0
movzx eax, al
test eax, eax
je 0x1001b3db
movzx ecx, byte [ebp - 0x45e]
push ecx
push str.kernelbase.dll
lea ecx, [ebp - 0x608]
call fcn.10027710
mov ecx, eax
call fcn.10027540
push eax
call fcn.10024430
add esp, 4
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
jne 0x1001b3db
mov dword [ebp - 0x45c], 3
jmp 0x1001c473
mov edx, dword [0x101034a0]
mov eax, dword [ebp - 0x474]
mov dword [edx + 4], eax
pushf
push 0xa
jae 0x1001b3f7
jmp 0x1001b3f2
call 0x1001b3f9
jae 0x1001b3f2
add esp, 4
jmp 0x1001b3fe
dec dword [esp]
jno 0x1001b403
jns 0x1001b3ee
jp 0x1001b407
add esp, 4
popf
jmp 0x1001b40e
clc
jae 0x1001b413
jnp 0x1001b41e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b42c
add byte [eax], 0
add byte [eax + 3], bl
ret 0x585a
jne 0x1001b42c
or edi, dword [ebx + eax - 0x15]
add ecx, dword [ebx]
jl 0x1001b431
jmp 0x1001b433
je 0x1001b42e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001b44d
jne 0x1001b44c
call 0x9305a4d4
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001b45b
jne 0x1001b45b
call 0xb18f6a6e
sti
invalid
movzx ecx, byte [ebp - 0x45f]
push ecx
push 0x100d1b18
lea ecx, [ebp - 0x500]
call 0x100278e0
mov ecx, eax
call fcn.10015600
push eax
call fcn.10024430
add esp, 4
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0
jne 0x1001b4a1
mov dword [ebp - 0x45c], 4
jmp 0x1001c473
mov edx, dword [0x101034a0]
mov eax, dword [ebp - 0x488]
mov dword [edx + 0xc], eax
pushf
push 0xa
jae 0x1001b4bd
jmp 0x1001b4b8
call 0x1001b4bf
jae 0x1001b4b8
add esp, 4
jmp 0x1001b4c4
dec dword [esp]
jno 0x1001b4c9
jns 0x1001b4b4
jp 0x1001b4cd
add esp, 4
popf
jmp 0x1001b4d4
clc
jae 0x1001b4d9
popfd
jns 0x1001b52a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b4f2
jne 0x1001b4f2
jns 0x1001b56f
jl 0x1001b4f7
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x1001b4f9
je 0x1001b4f4
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001b513
jne 0x1001b512
call 0x9305a59a
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001b521
jne 0x1001b521
call 0xb08f6b34
sti
invalid
movzx ecx, byte [ebp - 0x460]
push ecx
push str.user32.dll
lea ecx, [ebp - 0x53c]
call fcn.10027a10
mov ecx, eax
call fcn.10014c60
push eax
call fcn.10024430
add esp, 4
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0
jne 0x1001b567
and al, 0x1b
or eax, 0xc48d8d10
cli
invalid
mov dword [ebp - 0x45c], 5
jmp 0x1001c473
mov edx, dword [0x101034a0]
mov eax, dword [ebp - 0x48c]
mov dword [edx + 0x10], eax
pushf
adc byte [ebx - 0x48b7b], cl
dec dword [ecx - 0x6399efbe]
je 0x1001b56c
invalid
push 0xa
jae 0x1001b583
jmp 0x1001b57e
call 0x1001b585
jae 0x1001b57e
add esp, 4
jmp 0x1001b58a
dec dword [esp]
jno 0x1001b58f
jns 0x1001b57a
jp 0x1001b593
add esp, 4
popf
jmp 0x1001b59a
clc
jae 0x1001b59f
adc bl, byte [eax + 0x50]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b5b8
jne 0x1001b5b8
pop eax
jl 0x1001b5bd
jmp 0x1001b5bf
je 0x1001b5ba
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001b5d9
jne 0x1001b5d8
call 0x9305a660
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001b5e7
jne 0x1001b5e7
call 0xb8a3bb2
invalid
mov dword [ebp - 0x478], 0
mov ecx, dword [0x10103368]
call fcn.10008d00
cmp eax, 0x76f
jne 0x1001b626
call fcn.100257b0
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jne 0x1001b626
mov dword [ebp - 0x45c], 6
jmp 0x1001c473
mov ecx, dword [0x101034a0]
mov edx, dword [ebp - 0x478]
mov dword [ecx + 0x18], edx
jl 0x1001b63a
jmp 0x1001b63c
je 0x1001b637
xor eax, eax
test eax, eax
je 0x1001b645
jne 0x1001b644
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x1001b653
mov byte [ebp - 0x40], 0x57
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x6e
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x3b], 0x77
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], 0x20
mov byte [ebp - 0x38], 0x6d
mov byte [ebp - 0x37], 0x6f
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x6c
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x20
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x6e
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x69
mov byte [ebp - 0x2c], 0x6c
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x7a
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x74
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x20
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x21
mov byte [ebp - 0x1d], 0x20
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x64
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x3a
mov byte [ebp - 0x17], 0x20
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0
mov eax, dword [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x40]
push ecx
push 0x2000
lea edx, [ebp - 0x440]
push edx
call fcn.1009dec0
add esp, 0x10
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100d19fe
push 0
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x448]
call fcn.10011500
nop
mov dword [ebp - 0x4d8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44c]
call fcn.100096d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x448]
call fcn.100114e0
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret