Function at 0x10026fd0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address
Get process heap flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b292a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x9ec
mov eax, dword [0x100e30c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xe0], 0
push 0xc
lea ecx, [ebp - 0x3c]
call fcn.100075e0
lea ecx, [ebp - 0xd5]
call fcn.10004cb0
mov dword [ebp - 0xe4], eax
mov byte [ebp - 0xd4], 0x69
mov byte [ebp - 0xd3], 0x65
mov byte [ebp - 0xd2], 0x78
mov byte [ebp - 0xd1], 0x6c
mov byte [ebp - 0xd0], 0x79
mov byte [ebp - 0xcf], 0x77
mov byte [ebp - 0xce], 0x78
mov byte [ebp - 0xcd], 0x6c
mov byte [ebp - 0xcc], 0x77
mov byte [ebp - 0xcb], 0x63
mov byte [ebp - 0xca], 0x75
mov byte [ebp - 0xc9], 0x73
mov byte [ebp - 0xc8], 0x75
mov byte [ebp - 0xc7], 0x77
mov byte [ebp - 0xc6], 0x6e
mov byte [ebp - 0xc5], 0x63
mov byte [ebp - 0xc4], 0
lea eax, [ebp - 0xc3]
push eax
lea ecx, [ebp - 0xd4]
push ecx
lea ecx, [ebp - 0x168]
call fcn.10005b90
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x128]
push eax
lea ecx, [ebp - 0x3c]
call fcn.10017ae0
mov dword [ebp - 4], 0
push 0x800
push 0
lea ecx, [ebp - 0x9f8]
push ecx
call fcn.1008b830
add esp, 0xc
lea edx, [ebp - 0x9c]
push edx
call fcn.1001f5e0
add esp, 4
mov byte [ebp - 4], 1
push 0x18
lea ecx, [ebp - 0x30]
call fcn.100075e0
push 0
lea ecx, [ebp - 0x30]
call fcn.10030a90
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x140], esp
lea eax, [ebp - 0x9c]
push eax
call fcn.10030c30
mov dword [ebp - 0x144], eax
mov byte [ebp - 4], 3
push 0x100d361c
lea ecx, [ebp - 0x30]
call fcn.10032e50
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.10031150
nop
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0x180]
push edx
call fcn.10026470
add esp, 8
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xec], eax
mov byte [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x148], esp
mov edx, dword [ebp - 0xec]
push edx
call fcn.10030c30
mov dword [ebp - 0x14c], eax
mov byte [ebp - 4], 5
push str.action
lea ecx, [ebp - 0x30]
call fcn.10032e50
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.10031150
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x180]
call fcn.10004710
nop
mov eax, dword [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x198]
push ecx
call fcn.10009a90
add esp, 8
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xf0]
mov dword [ebp - 0xf4], edx
mov byte [ebp - 4], 6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x150], esp
mov eax, dword [ebp - 0xf4]
push eax
call fcn.10030c30
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 7
push str.insname
lea ecx, [ebp - 0x30]
call fcn.10032e50
mov byte [ebp - 4], 6
mov ecx, eax
call fcn.10031150
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x198]
call fcn.10004710
nop
mov ecx, dword [ebp - 0xc0]
add ecx, 0x18
push ecx
lea edx, [ebp - 0x1b0]
push edx
call fcn.10009a90
add esp, 8
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 4], 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x158], esp
mov edx, dword [ebp - 0xfc]
push edx
call fcn.10030c30
mov dword [ebp - 0x15c], eax
mov byte [ebp - 4], 9
push str.insdate
lea ecx, [ebp - 0x30]
call fcn.10032e50
mov byte [ebp - 4], 8
mov ecx, eax
call fcn.10031150
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1b0]
call fcn.10004710
nop
mov eax, dword [ebp - 0xc0]
add eax, 0x30
push eax
lea ecx, [ebp - 0x1c8]
push ecx
call fcn.10009a90
add esp, 8
mov dword [ebp - 0x100], eax
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x104], edx
mov byte [ebp - 4], 0xa
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x160], esp
mov eax, dword [ebp - 0x104]
push eax
call fcn.10030c30
mov dword [ebp - 0x12c], eax
mov byte [ebp - 4], 0xb
push str.version
lea ecx, [ebp - 0x30]
call fcn.10032e50
mov byte [ebp - 4], 0xa
mov ecx, eax
call fcn.10031150
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c8]
call fcn.10004710
nop
lea ecx, [ebp - 0xbc]
call fcn.10036310
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x84]
push edx
lea ecx, [ebp - 0xbc]
call fcn.10036370
mov byte [ebp - 4], 0xd
push 1
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x130], esp
push 0
lea ecx, [ebp - 0x3c]
call fcn.1000a4f0
push eax
mov ecx, esi
call fcn.10004790
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 0xe
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x138], esp
lea eax, [ebp - 0x84]
push eax
call fcn.1000c060
lea ecx, [ebp - 0x1e0]
push ecx
mov byte [ebp - 4], 0xd
call fcn.10003d00
add esp, 0x38
mov dword [ebp - 0x108], eax
mov edx, dword [ebp - 0x108]
mov dword [ebp - 0x10c], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.10009660
add esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1e0]
call fcn.10004710
nop
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x6c]
call fcn.100045f0
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xdc], eax
push 0
mov edx, dword [ebp - 0xdc]
push edx
lea ecx, [ebp - 0x54]
call fcn.10027580
mov byte [ebp - 4], 0x12
push 0
lea ecx, [ebp - 0x54]
call fcn.1000ba30
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x6c]
call fcn.100045f0
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x114]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
push str._afg__para
mov eax, dword [ebp - 0xc0]
add eax, 0x48
push eax
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.10010490
add esp, 0xc
mov dword [ebp - 0x118], eax
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x11c], edx
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebx + 8]
push edx
call fcn.10010560
add esp, 0xc
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0xe0]
or eax, 1
mov dword [ebp - 0xe0], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1f8]
call fcn.1000bb50
nop
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x54]
call fcn.1000bb50
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6c]
call fcn.10004710
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x84]
call fcn.10004710
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbc]
call fcn.10023380
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.10031020
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.10004710
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.1000a590
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1008702a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8