Function at 0x1001fdc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf04
mov eax, dword [0x100d5688]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
mov dword [ebp - 0xefc], ebx
test ebx, ebx
jne 0x1001fee3
push 1
push eax
push eax
call dword [sym.imp.USER32.dll_MonitorFromPoint]
test eax, eax
je 0x1001fed0
lea ecx, [ebp - 0xef0]
mov dword [ebp - 0xef0], 0x68
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x1001fed0
mov eax, dword [ebp - 0xee0]
xor edi, edi
mov ebx, dword [ebp - 0xee4]
sub eax, dword [ebp - 0xee8]
sub ebx, dword [ebp - 0xeec]
push 5
mov dword [ebp - 0xef4], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x1001fed0
cmp edi, 0x3e8
jge 0x1001fed0
lea eax, [ebp - 0xe88]
mov dword [ebp - 0xe88], 0x3c
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowInfo]
test eax, eax
je 0x1001fec0
mov eax, dword [ebp - 0xe64]
test eax, 0x10000000
je 0x1001fec0
test eax, 0x20000000
jne 0x1001fec0
test byte [ebp - 0xe60], 8
je 0x1001fec0
cmp dword [ebp - 0xe84], 0
jne 0x1001fec0
cmp dword [ebp - 0xe80], 0
jne 0x1001fec0
cmp dword [ebp - 0xe7c], ebx
jne 0x1001fec0
mov eax, dword [ebp - 0xef4]
cmp dword [ebp - 0xe78], eax
je 0x1002044e
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
inc edi
test esi, esi
jne 0x1001fe53
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005f06c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x1001fed0
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0xef8]
push eax
push ebx
mov dword [ebp - 0xef8], 0
call esi
mov edi, dword [ebp - 0xef8]
cmp edi, 4
jae 0x1001ff21
mov dword [ebp - 0xef8], 0
jmp 0x10020267
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, ebx
je 0x1001fed0
lea ecx, [ebp - 0xef4]
mov dword [ebp - 0xef4], 0
push ecx
push eax
call esi
cmp dword [ebp - 0xef4], edi
je 0x1001fed0
mov eax, dword [ebp - 0xef8]
cmp eax, 4
jbe 0x10020267
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10020267
push 0x104
lea eax, [ebp - 0xe3c]
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1001ff8d
mov esi, 1
jmp 0x1001ffe1
mov eax, dword [0x100d8aa8]
mov dword [ebp - 0xef4], 0x104
test eax, eax
jne 0x1001ffcc
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1001ffb3
xor esi, esi
jmp 0x1001ffe1
push str.QueryFullProcessImageNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100d8aa8], eax
test eax, eax
jne 0x1001ffcc
xor esi, esi
jmp 0x1001ffe1
lea ecx, [ebp - 0xef4]
push ecx
lea ecx, [ebp - 0xe3c]
push ecx
push 0
push edi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10020261
lea eax, [ebp - 0xe3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xef4], eax
test eax, eax
je 0x10020261
push 0x1f0
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc34], 0x780065
push 0
push eax
mov dword [ebp - 0xc30], 0x6c0070
mov dword [ebp - 0xc2c], 0x72006f
mov dword [ebp - 0xc28], 0x720065
mov dword [ebp - 0xc24], 0x65002e
mov dword [ebp - 0xc20], 0x650078
call fcn.1007f220
push 0x1f2
lea eax, [ebp - 0xa16]
mov dword [ebp - 0xa2c], 0x610074
mov ecx, 0x65
mov dword [ebp - 0xa28], 0x6b0073
push 0
push eax
mov dword [ebp - 0xa24], 0x67006d
mov dword [ebp - 0xa20], 0x2e0072
mov dword [ebp - 0xa1c], 0x780065
mov word [ebp - 0xa18], cx
call fcn.1007f220
push 0x1e0
lea eax, [ebp - 0x7fc]
mov dword [ebp - 0x824], 0x360033
push 0
push eax
mov dword [ebp - 0x820], 0x440030
mov dword [ebp - 0x81c], 0x730065
mov dword [ebp - 0x818], 0x74006b
mov dword [ebp - 0x814], 0x70006f
mov dword [ebp - 0x810], 0x69004c
mov dword [ebp - 0x80c], 0x650074
mov dword [ebp - 0x808], 0x340036
mov dword [ebp - 0x804], 0x65002e
mov dword [ebp - 0x800], 0x650078
call fcn.1007f220
push 0x1e4
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0x61c], 0x360033
push 0
push eax
mov dword [ebp - 0x618], 0x440030
mov dword [ebp - 0x614], 0x730065
mov dword [ebp - 0x610], 0x74006b
mov dword [ebp - 0x60c], 0x70006f
mov dword [ebp - 0x608], 0x69004c
mov dword [ebp - 0x604], 0x650074
mov dword [ebp - 0x600], 0x65002e
mov dword [ebp - 0x5fc], 0x650078
call fcn.1007f220
push 0x1f0
lea eax, [ebp - 0x3fc]
mov dword [ebp - 0x414], 0x360033
push 0
push eax
mov dword [ebp - 0x410], 0x770030
mov dword [ebp - 0x40c], 0x730070
mov dword [ebp - 0x408], 0x760072
mov dword [ebp - 0x404], 0x65002e
mov dword [ebp - 0x400], 0x650078
call fcn.1007f220
push 0x1f2
lea eax, [ebp - 0x1f6]
mov dword [ebp - 0x20c], 0x690062
mov ecx, 0x65
mov dword [ebp - 0x208], 0x640072
push 0
push eax
mov dword [ebp - 0x204], 0x720073
mov dword [ebp - 0x200], 0x2e0076
mov dword [ebp - 0x1fc], 0x780065
mov word [ebp - 0x1f8], cx
call fcn.1007f220
add esp, 0x48
lea edi, [ebp - 0xc34]
xor esi, esi
nop word [eax + eax]
push dword [ebp - 0xef4]
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1001fed0
inc esi
add edi, 0x208
cmp esi, 6
jl 0x10020240
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0xf00]
push eax
lea eax, [ebp - 0xef4]
push eax
call fcn.100206e0
add esp, 8
test eax, eax
je 0x1001fed0
xorps xmm0, xmm0
mov dword [ebp - 0xf04], 0
movlpd qword [ebp - 0xe44], xmm0
push dword [ebp - 0xe40]
push dword [ebp - 0xe44]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, dword [ebp - 0xf00]
test eax, eax
je 0x100202c4
lea eax, [ebp - 0xf04]
push eax
push ebx
call esi
test eax, eax
jne 0x10020304
lea eax, [ebp - 0xe4c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
mov eax, dword [ebp - 0xef4]
je 0x1002030a
cmp dword [ebp - 0xe4c], 0
jne 0x1002030a
cmp dword [ebp - 0xe48], 0
jne 0x1002030a
cmp dword [ebp - 0xe44], eax
jne 0x1002030a
cmp dword [ebp - 0xe40], edi
je 0x1002044e
jmp 0x1002030a
mov eax, dword [ebp - 0xef4]
push dword [ebp - 0xef8]
lea ebx, [eax - 5]
mov eax, ebx
lea esi, [edi - 5]
shl eax, 4
sub eax, ebx
cdq
and edx, 0xf
lea edi, [edx + eax]
lea eax, [ebp - 0xefc]
sar edi, 4
push eax
push 0
push edi
call fcn.10020670
add esp, 0x10
test eax, eax
jne 0x1002035d
push dword [ebp - 0xef8]
lea eax, [ebp - 0xefc]
push eax
push 0
push edi
call fcn.10020670
add esp, 0x10
test eax, eax
je 0x1001fed0
push dword [ebp - 0xef8]
mov eax, esi
lea ecx, [ebp - 0xefc]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push ecx
push eax
push ebx
mov dword [ebp - 0xf00], eax
call fcn.10020670
add esp, 0x10
test eax, eax
jne 0x100203b8
push dword [ebp - 0xef8]
mov eax, esi
lea ecx, [ebp - 0xefc]
shl eax, 4
sub eax, esi
cdq
and edx, 0xf
add eax, edx
push ecx
sar eax, 4
push eax
push ebx
call fcn.10020670
add esp, 0x10
test eax, eax
je 0x1001fed0
push dword [ebp - 0xef8]
mov eax, ebx
lea ecx, [ebp - 0xefc]
cdq
and edx, 0xf
push ecx
add eax, edx
sar eax, 4
push esi
push eax
call fcn.10020670
add esp, 0x10
test eax, eax
jne 0x100203fd
push dword [ebp - 0xef8]
lea eax, [ebp - 0xefc]
push eax
push esi
push edi
call fcn.10020670
add esp, 0x10
test eax, eax
je 0x1001fed0
push dword [ebp - 0xef8]
lea eax, [ebp - 0xefc]
push eax
push dword [ebp - 0xf00]
push 0
call fcn.10020670
add esp, 0x10
test eax, eax
jne 0x1002044e
push dword [ebp - 0xef8]
mov eax, esi
lea ecx, [ebp - 0xefc]
shl eax, 4
sub eax, esi
cdq
and edx, 0xf
add eax, edx
push ecx
sar eax, 4
push eax
push 0
call fcn.10020670
add esp, 0x10
test eax, eax
je 0x1001fed0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005f06c
mov esp, ebp
pop ebp
ret