Function at 0x1001eeb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x5c8
mov eax, 0x100658cd
call fcn.1004adf3
mov esi, ecx
lea eax, [ebp - 0x260]
push eax
call fcn.10002ede
xor ebx, ebx
lea ecx, [ebp - 0x260]
mov dword [ebp - 4], ebx
call fcn.1001baad
neg al
lea ecx, [ebp - 0x260]
push ebx
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x5b9], al
xor eax, eax
inc eax
push eax
call fcn.10003109
cmp byte [ebp - 0x5b9], bl
je 0x1001ef10
xor al, al
jmp 0x1001fa14
lea eax, [ebp - 0x2d8]
mov ecx, esi
push eax
call fcn.1000314f
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push ebx
inc edi
push eax
mov dword [ebp - 4], edi
call fcn.1004ac10
add esp, 0xc
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x2c4], 8
lea eax, [ebp - 0x2d8]
cmovae eax, dword [ebp - 0x2d8]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x1001ef84
lea eax, [ebp - 0x218]
push eax
call fcn.1000213a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.10003401
push str.BQ87_X_rT2PHcY2_b_X_Kc__rb_V0L22P_iP2bc_Kc__rbd
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x5c8], 0x20019
mov byte [ebp - 0x5b9], bl
call fcn.10002e3f
mov byte [ebp - 4], 2
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 0x5c0], reloc.OLEAUT32.dll_SysReAllocString
call fcn.1000c43d
lea ecx, [ebp - 0x5c8]
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x5b9]
push ecx
push eax
lea eax, [ebp - 0x5c0]
push eax
lea ecx, [ebp - 0x4d4]
call fcn.1002b11c
push ebx
push edi
lea ecx, [ebp - 0x2c0]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 6
call fcn.10003109
cmp dword [ebp - 0x4cc], 0
jne 0x1001f01a
mov byte [ebp - 0x5b9], bl
jmp 0x1001f9f3
push str.8M3..8c_S_ppbc
lea ecx, [ebp - 0x278]
call fcn.10002e3f
lea edx, [ebp - 0x278]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2f0]
call fcn.1000c43d
push eax
lea eax, [ebp - 0x3e8]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x4d4]
call fcn.1002b25f
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 9
push ecx
mov ecx, eax
call fcn.10021e8e
xor eax, eax
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x290]
mov dword [ebp - 0x298], ebx
push eax
call fcn.10003028
push ebx
push edi
lea ecx, [ebp - 0x290]
call fcn.10003109
lea ecx, [ebp - 0x3e8]
call fcn.1002b748
push ebx
push edi
lea ecx, [ebp - 0x2f0]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xd
call fcn.10003109
cmp dword [ebp - 0x298], 0
jne 0x1001f0e9
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.10003076
jmp 0x1001f143
push 0x10076e58
lea edx, [ebp - 0x2d8]
lea ecx, [ebp - 0x308]
call fcn.1001d579
pop ecx
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0xf
push ecx
mov edx, eax
lea ecx, [ebp - 0x2c0]
call fcn.10003daa
pop ecx
push eax
lea ecx, [ebp - 0x2a8]
call fcn.10002e95
push ebx
push edi
lea ecx, [ebp - 0x2c0]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0xd
call fcn.10003109
push str._tZ_SpD3pSH3_8VZa
lea ecx, [ebp - 0x248]
call fcn.10002e3f
lea eax, [ebp - 0x398]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x4d4]
call fcn.10021e71
push eax
lea ecx, [ebp - 0x380]
mov byte [ebp - 4], 0x11
call fcn.10008070
mov esi, eax
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x308]
call fcn.1000c43d
push eax
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x13
call fcn.10008070
push esi
mov edx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x350]
call fcn.10008bd2
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2c0]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x308]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x380]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x398]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x1a
call fcn.10003109
push str.8M3..8c_S_ppbc
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x5c0], edi
call fcn.10002e3f
lea eax, [ebp - 0x5c0]
mov byte [ebp - 4], 0x1b
push eax
lea edx, [ebp - 0x2a8]
lea ecx, [ebp - 0x3e4]
call fcn.100213aa
pop ecx
mov esi, eax
lea edx, [ebp - 0x290]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x504]
call fcn.1000c43d
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x368]
push eax
call fcn.10008070
push eax
lea edx, [ebp - 0x350]
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x2f0]
call fcn.10008bd2
pop ecx
push esi
mov edx, eax
lea ecx, [ebp - 0x5b8]
call fcn.100213ca
pop ecx
mov esi, eax
lea ecx, [ebp - 0x488]
push esi
call fcn.10002e70
add esi, 0x18
lea ecx, [ebp - 0x470]
push esi
call fcn.10002e70
mov ax, word [esi + 0x18]
mov word [ebp - 0x458], ax
push ebx
push edi
lea ecx, [ebp - 0x5a0]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x5b8]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x2f0]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x368]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x504]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x3e4]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x23
call fcn.10003109
push 0x10077b28
lea ecx, [ebp - 0x278]
call fcn.10002e3f
lea edx, [ebp - 0x278]
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x534]
call fcn.1000c43d
push eax
lea ecx, [ebp - 0x4ec]
mov byte [ebp - 4], 0x25
call fcn.10008070
push eax
lea edx, [ebp - 0x350]
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x51c]
call fcn.10008bd2
pop ecx
push 4
mov dword [ebp - 0x5c4], 0x10077b24
pop edi
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 0x5c0], edi
push ecx
mov edx, eax
lea ecx, [ebp - 0x584]
call fcn.100213f1
pop ecx
mov esi, eax
push esi
lea ecx, [ebp - 0x454]
call fcn.10002e70
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x43c]
push dword [esi + 0x18]
call fcn.10002e3f
mov ax, word [esi + 0x1c]
mov word [ebp - 0x424], ax
xor esi, esi
lea ecx, [ebp - 0x584]
push ebx
inc esi
push esi
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x51c]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x4ec]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x534]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x2f
call fcn.10003109
push str.8MtR:skPuLc2P7c:P_3..8c_S_ppbg
lea ecx, [ebp - 0x260]
call fcn.10002e3f
lea edx, [ebp - 0x260]
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x230]
call fcn.1000c43d
push eax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0x31
call fcn.10008070
push eax
lea edx, [ebp - 0x350]
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x3b0]
call fcn.10008bd2
pop ecx
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 0x5c4], 0x100773e8
push ecx
mov edx, eax
mov dword [ebp - 0x5c0], edi
lea ecx, [ebp - 0x554]
call fcn.100213f1
pop ecx
mov esi, eax
push esi
lea ecx, [ebp - 0x420]
call fcn.10002e70
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x408]
push dword [esi + 0x18]
call fcn.10002e3f
mov ax, word [esi + 0x1c]
lea ecx, [ebp - 0x554]
xor esi, esi
mov word [ebp - 0x3f0], ax
push ebx
inc esi
push esi
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x3b0]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x338]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x230]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x260]
call fcn.10003109
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x3ec]
push dword [ebp - 0x5c0]
lea ecx, [ebp - 0x5d4]
mov dword [ebp - 0x5d4], ebx
push eax
lea eax, [ebp - 0x488]
mov dword [ebp - 0x5d0], ebx
push eax
push ebx
mov dword [ebp - 0x5cc], ebx
call fcn.1002157e
push fcn.10005961
push 3
push 0x34
pop eax
push eax
lea eax, [ebp - 0x488]
mov byte [ebp - 4], 0x38
push eax
call fcn.1004745f
xor eax, eax
mov dword [ebp - 0x30c], 7
mov dword [ebp - 0x310], ebx
mov word [ebp - 0x320], ax
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0x39
call fcn.1001e045
mov edi, dword [ebp - 0x5d4]
test al, al
jne 0x1001f554
mov byte [ebp - 0x5b9], bl
jmp 0x1001f998
push str.2P:sPgPa
lea ecx, [ebp - 0x248]
call fcn.10002e3f
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x3b0]
call fcn.1000c43d
push eax
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0x3b
call fcn.10008070
mov esi, eax
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x3c
push eax
lea ecx, [ebp - 0x230]
call fcn.10008070
push esi
mov edx, eax
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x3c8]
call fcn.10008bd2
pop ecx
xor esi, esi
lea ecx, [ebp - 0x230]
push ebx
inc esi
push esi
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x338]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x3b0]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x248]
call fcn.10003109
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0x5d0]
sub eax, edi
push 0x34
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x5c0], eax
test eax, eax
je 0x1001f963
mov esi, edi
mov edi, eax
mov dword [ebp - 0x5c8], esi
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.10002ef7
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x44
push ecx
mov ecx, eax
call fcn.10002ede
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x46
call fcn.10003109
lea eax, [ebp - 0x290]
mov ecx, esi
push eax
call fcn.1000811f
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x230]
call fcn.10011f2c
push eax
lea ecx, [ebp - 0x248]
call fcn.10002e95
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.10003109
lea edx, [ebp - 0x290]
lea ecx, [ebp - 0x230]
call fcn.10011f2c
push eax
lea ecx, [ebp - 0x290]
call fcn.10002e95
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.10003109
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x278]
call fcn.10002e17
xor eax, eax
mov byte [ebp - 4], 0x48
movzx esi, word [esi + 0x30]
inc eax
cmp si, ax
jne 0x1001f70d
lea edx, [ebp - 0x278]
lea ecx, [ebp - 0x230]
call fcn.10011f2c
push eax
lea ecx, [ebp - 0x278]
call fcn.10002e95
xor eax, eax
lea ecx, [ebp - 0x230]
push ebx
inc eax
push eax
call fcn.10003109
push str.T__a
lea ecx, [ebp - 0x368]
call fcn.10002e3f
lea edx, [ebp - 0x368]
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x4a8]
call fcn.1000c43d
xor eax, eax
mov byte [ebp - 4], 0x4b
push ebx
inc eax
lea ecx, [ebp - 0x368]
push eax
call fcn.10003109
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x490]
call fcn.10002e17
push str._X__9a
lea ecx, [ebp - 0x398]
mov byte [ebp - 4], 0x4c
call fcn.10002e3f
lea edx, [ebp - 0x398]
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x478]
call fcn.1000c43d
xor eax, eax
mov byte [ebp - 4], 0x4f
push ebx
inc eax
lea ecx, [ebp - 0x398]
push eax
call fcn.10003109
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x460]
call fcn.10002e17
push 0x10077bcc
lea ecx, [ebp - 0x380]
mov byte [ebp - 4], 0x50
call fcn.10002e3f
lea edx, [ebp - 0x380]
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x448]
call fcn.1000c43d
xor eax, eax
mov byte [ebp - 4], 0x53
push ebx
inc eax
lea ecx, [ebp - 0x380]
push eax
call fcn.10003109
mov edx, esi
lea ecx, [ebp - 0x430]
call fcn.1002b798
push 0x10077bd4
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0x54
call fcn.10002e3f
lea edx, [ebp - 0x308]
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x418]
call fcn.1000c43d
mov byte [ebp - 4], 0x57
xor eax, eax
push ebx
inc eax
lea ecx, [ebp - 0x308]
push eax
call fcn.10003109
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x400]
call fcn.10002e17
lea eax, [ebp - 0x3e8]
mov byte [ebp - 4], 0x58
push eax
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.10002f45
push 0x10002eba
push 8
push 0x18
lea eax, [ebp - 0x4a8]
mov byte [ebp - 4], 0x5a
push eax
call fcn.1004745f
push 0x10076e58
lea ecx, [ebp - 0x2f0]
call fcn.10002e3f
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 0x5b
push eax
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.10008ae6
mov esi, eax
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x5c
push eax
lea ecx, [ebp - 0x3c8]
call fcn.1000314f
push esi
mov edx, eax
lea ecx, [ebp - 0x564]
call fcn.10008c19
pop ecx
push eax
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0x5e
call fcn.1002106e
lea ecx, [ebp - 0x564]
call fcn.10005961
xor esi, esi
lea ecx, [ebp - 0x230]
push ebx
inc esi
push esi
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x338]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x2f0]
call fcn.10003109
lea ecx, [ebp - 0x2c0]
call fcn.10003dd2
push ebx
push esi
lea ecx, [ebp - 0x278]
call fcn.10003109
push ebx
push esi
lea ecx, [ebp - 0x290]
call fcn.10003109
mov byte [ebp - 4], 0x43
push ebx
push esi
lea ecx, [ebp - 0x248]
call fcn.10003109
mov esi, dword [ebp - 0x5c8]
push 0x34
pop eax
add esi, eax
mov dword [ebp - 0x5c8], esi
dec edi
jne 0x1001f627
mov edi, dword [ebp - 0x5d4]
push 0x2710
lea ecx, [ebp - 0x254]
call fcn.1002fd08
xor eax, eax
pop ecx
inc eax
lea ecx, [ebp - 0x254]
mov byte [ebp - 0x5b9], al
call fcn.100082ec
xor eax, eax
lea ecx, [ebp - 0x3c8]
push ebx
inc eax
push eax
call fcn.10003109
xor eax, eax
lea ecx, [ebp - 0x320]
push ebx
inc eax
push eax
call fcn.10003109
test edi, edi
je 0x1001f9d3
mov esi, edi
cmp edi, dword [ebp - 0x5d0]
je 0x1001f9cc
push 0x34
pop ebx
mov ecx, esi
call fcn.10005961
add esi, ebx
cmp esi, dword [ebp - 0x5d0]
jne 0x1001f9b9
xor ebx, ebx
push edi
call fcn.10046c15
pop ecx
xor eax, eax
lea ecx, [ebp - 0x350]
push ebx
inc eax
push eax
call fcn.10003109
xor eax, eax
lea ecx, [ebp - 0x2a8]
push ebx
inc eax
push eax
call fcn.10003109
lea ecx, [ebp - 0x4d4]
call fcn.1002b1d6
xor eax, eax
lea ecx, [ebp - 0x2d8]
push ebx
inc eax
push eax
call fcn.10003109
mov al, byte [ebp - 0x5b9]
call fcn.1004ada2
ret