Function at 0x10014370
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x1001c060]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x184], ecx
mov byte [ebp - 1], 0
push 0x2000
call fcn.10003f00
add esp, 4
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x158], eax
mov byte [ebp - 0x140], 0
xor ecx, ecx
mov dword [ebp - 0x13f], ecx
mov dword [ebp - 0x13b], ecx
mov word [ebp - 0x137], cx
mov byte [ebp - 0x135], cl
mov byte [ebp - 0x140], 0x61
mov byte [ebp - 0x13a], 0x67
mov byte [ebp - 0x13e], 0x69
mov byte [ebp - 0x137], 0x6c
mov byte [ebp - 0x139], 0x2e
mov byte [ebp - 0x13c], 0x6c
mov byte [ebp - 0x13d], 0x5f
mov byte [ebp - 0x136], 0x6c
mov byte [ebp - 0x138], 0x64
mov byte [ebp - 0x13b], 0x6f
mov byte [ebp - 0x13f], 0x70
mov byte [ebp - 0x134], 0
xor edx, edx
mov dword [ebp - 0x133], edx
mov dword [ebp - 0x12f], edx
mov word [ebp - 0x12b], dx
mov byte [ebp - 0x129], dl
mov byte [ebp - 0x12b], 0x6c
mov byte [ebp - 0x12d], 0x2e
mov byte [ebp - 0x130], 0x64
mov byte [ebp - 0x132], 0x69
mov byte [ebp - 0x134], 0x73
mov byte [ebp - 0x133], 0x62
mov byte [ebp - 0x12f], 0x6c
mov byte [ebp - 0x131], 0x65
mov byte [ebp - 0x12e], 0x6c
mov byte [ebp - 0x12a], 0x6c
mov byte [ebp - 0x12c], 0x64
mov byte [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov byte [ebp - 0xb], al
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x10], 0x68
mov byte [ebp - 0xf], 0x2e
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0x15], 0x5f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x14c], 0
xor ecx, ecx
mov dword [ebp - 0x14b], ecx
mov dword [ebp - 0x147], ecx
mov word [ebp - 0x143], cx
mov byte [ebp - 0x141], cl
mov byte [ebp - 0x146], 0x63
mov byte [ebp - 0x144], 0x64
mov byte [ebp - 0x143], 0x6c
mov byte [ebp - 0x148], 0x72
mov byte [ebp - 0x14a], 0x74
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x147], 0x65
mov byte [ebp - 0x145], 0x2e
mov byte [ebp - 0x149], 0x6f
mov byte [ebp - 0x14b], 0x73
mov byte [ebp - 0x14c], 0x70
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x150]
push edx
push 0x1000
mov eax, dword [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10014723
mov dword [ebp - 0x20], 0
jmp 0x1001457e
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x150]
shr eax, 2
cmp dword [ebp - 0x20], eax
jae 0x10014723
push 0x10019e28
push 0x10019e3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f75c], eax
cmp dword [0x1001f75c], 0
jne 0x100145ba
jmp 0x1001476a
push 0x104
lea ecx, [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax + edx*4]
push ecx
call dword [0x1001f75c]
test eax, eax
je 0x1001471e
mov dword [ebp - 0x178], 0
jmp 0x100145fc
mov edx, dword [ebp - 0x178]
add edx, 1
mov dword [ebp - 0x178], edx
lea eax, [ebp - 0x128]
push eax
call fcn.10004460
add esp, 4
cmp dword [ebp - 0x178], eax
jae 0x10014639
mov ecx, dword [ebp - 0x178]
movsx edx, byte [ebp + ecx - 0x128]
push edx
call fcn.10006323
add esp, 4
mov ecx, dword [ebp - 0x178]
mov byte [ebp + ecx - 0x128], al
jmp 0x100145ed
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0x174]
call fcn.10001e20
push 0
push str.DBGHELP.DLL
lea ecx, [ebp - 0x174]
call fcn.10003590
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x100
jae 0x10014673
mov byte [ebp - 1], 1
push 0
push str.API_LOG.DLL
lea ecx, [ebp - 0x174]
call fcn.10003590
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x100
jae 0x1001469b
mov byte [ebp - 1], 1
push 0
push str.SBIEDLL.DLL
lea ecx, [ebp - 0x174]
call fcn.10003590
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x100
jae 0x100146c3
mov byte [ebp - 1], 1
push 0
push str.DIR_WATCH.DLL
lea ecx, [ebp - 0x174]
call fcn.10003590
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x100
jae 0x100146eb
mov byte [ebp - 1], 1
push 0
push str.PSTOREC.DLL
lea ecx, [ebp - 0x174]
call fcn.10003590
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x100
jae 0x10014713
mov byte [ebp - 1], 1
lea ecx, [ebp - 0x174]
call fcn.10001680
jmp 0x10014575
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x158]
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x180]
push edx
call fcn.1000634f
add esp, 4
movzx eax, byte [ebp - 1]
cmp eax, 1
jne 0x1001476a
mov ecx, dword [ebp - 0x184]
mov edx, dword [ecx]
add edx, 0x40
mov eax, dword [ebp - 0x184]
mov dword [eax], edx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10003f16
mov esp, ebp
pop ebp
ret