Function at 0x1001c1e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
mov eax, dword [0x1009a078]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esp + 0x24], edi
test esi, esi
je 0x1001c5ad
cmp dword [ebp + 0xc], 1
jne 0x1001c5ad
push 0x104
lea eax, [esp + 0x44]
push 0
push eax
call fcn.1005ddd0
add esp, 0xc
mov eax, 0x1009bd28
push 0x10
pop ebx
cmp dword [0x1009bd3c], ebx
cmovae eax, dword [0x1009bd28]
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edx, edx
mov dword [esp + 0xc], 0x3d390649
mov cl, 0x49
mov dword [esp + 0x10], 0x67272620
mov dword [esp + 0x14], 0x202700
mov eax, edx
xor byte [esp + eax + 0xd], cl
inc eax
cmp eax, 0xa
jae 0x1001c27c
mov cl, byte [esp + 0xc]
jmp 0x1001c26c
lea eax, [esp + 0xd]
mov byte [esp + 0x17], dl
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [edi + 0x14], 0
je 0x1001c357
cmp esi, dword [edi + 0x14]
jne 0x1001c357
xor edx, edx
lea ecx, [esp + 0x28]
cmp dword [0x1009bdac], 1
setne dl
mov dword [0x1009bdac], edx
call fcn.1000d7e6
mov edx, eax
cmp dword [edx + 0x14], ebx
jb 0x1001c2c7
mov edx, dword [edx]
mov cl, 0x75
mov word [esp + 0xc], 0x2775
mov byte [esp + 0xe], bl
xor eax, eax
mov byte [esp + 0xf], 0x18
mov byte [esp + 0x10], bl
mov word [esp + 0x11], 0x1718
mov byte [esp + 0x13], bl
mov word [esp + 0x14], 7
xor byte [esp + eax + 0xd], cl
inc eax
cmp eax, 8
jae 0x1001c301
mov cl, byte [esp + 0xc]
jmp 0x1001c2f1
mov byte [esp + 0x15], 0
mov cl, 0x5a
mov dword [esp + 0x18], 0x39391b5a
xor eax, eax
mov dword [esp + 0x1c], 0x2e342f35
mov byte [esp + 0x20], 0
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 7
jae 0x1001c32f
mov cl, byte [esp + 0x18]
jmp 0x1001c31f
lea eax, [esp + 0x40]
mov byte [esp + 0x20], 0
push eax
push edx
lea eax, [esp + 0x15]
push eax
lea eax, [esp + 0x25]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10001e1f
cmp dword [edi + 0x10], 0
je 0x1001c5a9
cmp esi, dword [edi + 0x10]
jne 0x1001c5a9
cmp dword [0x1009bdac], 0
je 0x1001c49a
mov ecx, dword [esp + 0x24]
mov edi, 0x1009bd58
push edi
call fcn.1001c737
mov ecx, dword [esp + 0x24]
mov esi, 0x1009bd70
push esi
call fcn.1001c792
cmp dword [0x1009bd6c], ebx
mov cl, 0x7d
mov dword [esp + 0xc], 0x1e1e3c7d
cmovae edi, dword [0x1009bd58]
xor edx, edx
mov dword [esp + 0x10], 0x9130812
mov eax, edx
mov word [esp + 0x14], 0x3934
mov byte [esp + 0x16], dl
xor byte [esp + eax + 0xd], cl
inc eax
cmp eax, 9
jae 0x1001c3d3
mov cl, byte [esp + 0xc]
jmp 0x1001c3c3
mov byte [esp + 0x16], dl
mov cl, 0x30
mov dword [esp + 0x18], 0x53537130
mov eax, edx
mov dword [esp + 0x1c], 0x445e455f
mov byte [esp + 0x20], dl
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 7
jae 0x1001c3ff
mov cl, byte [esp + 0x18]
jmp 0x1001c3ef
lea eax, [esp + 0x40]
mov byte [esp + 0x20], dl
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [esp + 0x15]
push eax
lea eax, [esp + 0x25]
push eax
call edi
cmp dword [0x1009bd84], ebx
mov cl, 0x3a
mov dword [esp + 0xc], 0x495b6a3a
cmovae esi, dword [0x1009bd70]
xor edx, edx
mov dword [esp + 0x10], 0x48556d49
mov eax, edx
mov word [esp + 0x14], 0x5e
xor byte [esp + eax + 0xd], cl
inc eax
cmp eax, 8
jae 0x1001c455
mov cl, byte [esp + 0xc]
jmp 0x1001c445
mov byte [esp + 0x15], dl
mov eax, edx
mov byte [esp + 0x18], bl
mov dword [esp + 0x19], 0x7f737351
mov dword [esp + 0x1d], 0x647e65
xor byte [esp + eax + 0x19], bl
inc eax
cmp eax, 7
jae 0x1001c47f
mov bl, byte [esp + 0x18]
jmp 0x1001c46f
lea eax, [esp + 0x40]
mov byte [esp + 0x20], dl
push eax
push esi
lea eax, [esp + 0x15]
push eax
lea eax, [esp + 0x25]
push eax
call edi
jmp 0x1001c5a4
xor edx, edx
mov word [esp + 0x24], 0x11
mov byte [esp + 0x25], dl
mov cl, 4
mov dword [esp + 0xc], 0x67674504
mov eax, edx
mov dword [esp + 0x10], 0x706a716b
mov word [esp + 0x14], 0x404d
mov byte [esp + 0x16], dl
xor byte [esp + eax + 0xd], cl
inc eax
cmp eax, 9
jae 0x1001c4d6
mov cl, byte [esp + 0xc]
jmp 0x1001c4c6
push 0x14
pop ebx
mov cl, bl
mov byte [esp + 0x16], dl
mov byte [esp + 0x18], cl
mov eax, edx
mov dword [esp + 0x19], 0x7b777755
mov dword [esp + 0x1d], 0x607a61
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 7
jae 0x1001c505
mov cl, byte [esp + 0x18]
jmp 0x1001c4f5
lea eax, [esp + 0x40]
mov byte [esp + 0x20], dl
push eax
lea eax, [esp + 0x29]
push eax
lea eax, [esp + 0x15]
push eax
lea eax, [esp + 0x25]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor edx, edx
mov word [esp + 0x24], 0x12
mov byte [esp + 0x25], dl
mov eax, edx
mov byte [esp + 0xc], bl
mov dword [esp + 0xd], 0x67677544
mov dword [esp + 0x11], 0x70667b43
mov byte [esp + 0x15], dl
xor byte [esp + eax + 0xd], bl
inc eax
cmp eax, 8
jae 0x1001c55a
mov bl, byte [esp + 0xc]
jmp 0x1001c54a
mov byte [esp + 0x15], dl
mov cl, 0x6e
mov dword [esp + 0x18], 0xd0d2f6e
mov eax, edx
mov dword [esp + 0x1c], 0x1a001b01
mov byte [esp + 0x20], dl
xor byte [esp + eax + 0x19], cl
inc eax
cmp eax, 7
jae 0x1001c586
mov cl, byte [esp + 0x18]
jmp 0x1001c576
lea eax, [esp + 0x40]
mov byte [esp + 0x20], dl
push eax
lea eax, [esp + 0x29]
push eax
lea ecx, [esp + 0x15]
push ecx
lea ecx, [esp + 0x25]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.1001c6c8
mov al, 1
jmp 0x1001c5af
xor al, al
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100454d5
mov esp, ebp
pop ebp
ret 8