Function at 0x100b3180
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x10161774
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
lea eax, [esp + 6]
push esi
push eax
lea ecx, [esp + 0xc]
push 0
push ecx
lea ecx, [esp + 0xa8]
mov byte [0x1018caf2], 0xd4
call fcn.100b9610
mov eax, 0xff82
mov ecx, 0xff81
mov word [esp + 0x14], ax
mov word [esp + 0x1c], ax
mov word [esp + 0x2a], ax
mov eax, 0xff7d
mov word [esp + 0x3c], ax
mov word [esp + 0x42], ax
mov al, byte [0x10196bfc]
mov ebx, 1
mov word [esp + 0xe], cx
mov word [esp + 0x18], cx
mov word [esp + 0x22], cx
mov esi, 0xff74
mov edx, 0xff3d
mov ecx, 0xff72
test bl, al
mov dword [esp + 0xc4], ebx
mov word [esp + 0xc], 0xff71
mov word [esp + 0x10], 0xff7e
mov word [esp + 0x12], 0xff86
mov word [esp + 0x16], si
mov word [esp + 0x1a], dx
mov word [esp + 0x1e], si
mov word [esp + 0x20], 0xff70
mov word [esp + 0x24], cx
mov word [esp + 0x26], 0xff77
mov word [esp + 0x28], dx
mov word [esp + 0x2c], si
mov word [esp + 0x2e], 0xff7b
mov word [esp + 0x30], si
mov word [esp + 0x32], cx
mov word [esp + 0x34], 0xff83
mov word [esp + 0x36], si
mov word [esp + 0x38], 0xff73
mov word [esp + 0x3a], 0xff54
mov word [esp + 0x3e], 0xff76
mov word [esp + 0x40], 0xff78
mov word [esp + 0x44], si
jne 0x100b32b9
lea edx, [esp + 0xc]
or al, bl
push edx
mov ecx, 0x10196c00
mov byte [0x10196bfc], al
call fcn.100b6320
push 0x100b9460
call fcn.1013c36b
add esp, 4
mov al, byte [esp + 8]
push edi
mov edi, dword [0x10196c00]
push 0
lea ecx, [esp + 0x74]
mov byte [esp + 0x74], al
call fcn.1000bc70
push edi
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x70]
push eax
push edi
call fcn.1000bf40
mov al, byte [0x10196c04]
mov byte [esp + 0xc8], 2
test bl, al
mov word [esp + 0xc], 0x12
jne 0x100b3322
lea ecx, [esp + 0xc]
or al, bl
push ecx
mov ecx, 0x10196c08
mov byte [0x10196c04], al
call fcn.100153e0
push 0x100b9480
call fcn.1013c36b
add esp, 4
mov al, byte [0x10196c0c]
mov word [esp + 0xe], 0xff4d
test bl, al
jne 0x100b3355
lea edx, [esp + 0xe]
or al, bl
push edx
mov ecx, 0x10196c10
mov byte [0x10196c0c], al
call fcn.100b63a0
push 0x100b9470
call fcn.1013c36b
add esp, 4
mov eax, dword [esp + 0xd8]
mov ecx, dword [0x10196c10]
push ebp
push eax
lea edx, [esp + 0x58]
push ecx
push edx
call fcn.1000cdb0
mov ecx, dword [0x10196c08]
lea edx, [esp + 0xc0]
push ecx
push eax
push edx
mov byte [esp + 0xe4], 3
call fcn.1000cf10
add esp, 0x18
mov edi, eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x84]
push eax
mov byte [esp + 0xd0], 4
call fcn.10043a70
lea ecx, [esp + 0x74]
push eax
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd4], 5
call fcn.100b9750
lea edx, [esp + 0x94]
push eax
push edx
lea ecx, [esp + 0xac]
mov byte [esp + 0xd4], 6
call fcn.100b9500
mov ebp, dword [eax]
lea ecx, [esp + 0x14]
mov byte [esp + 0xcc], 5
call fcn.100b7820
push ebx
lea ecx, [esp + 0x88]
mov byte [esp + 0xd0], 4
call fcn.1000bc70
mov eax, dword [0x1016a210]
lea ecx, [ebp + 0x1c]
push eax
push 0
push edi
call fcn.1000ba60
push ebx
lea ecx, [esp + 0xb8]
mov byte [esp + 0xd0], 3
call fcn.1000bc70
push ebx
lea ecx, [esp + 0x58]
mov byte [esp + 0xd0], 2
call fcn.1000bc70
push ebx
lea ecx, [esp + 0x78]
mov byte [esp + 0xd0], bl
call fcn.1000bc70
mov al, byte [0x10196c14]
mov word [esp + 0x54], 0xff6d
test bl, al
mov word [esp + 0x56], 0xff67
mov word [esp + 0x58], 0xff7b
mov word [esp + 0x5a], 0xff79
mov word [esp + 0x5c], 0xff71
mov word [esp + 0x5e], si
mov word [esp + 0x60], 0xff66
mov word [esp + 0x62], 0xff30
mov word [esp + 0x64], 0xff57
mov word [esp + 0x66], 0xff54
mov word [esp + 0x68], 0xff4e
jne 0x100b34c6
lea ecx, [esp + 0x54]
or al, bl
push ecx
mov ecx, 0x10196c18
mov byte [0x10196c14], al
call fcn.100453c0
push 0x100b9490
call fcn.1013c36b
add esp, 4
mov dl, byte [esp + 0x10]
mov esi, dword [0x10196c18]
push 0
lea ecx, [esp + 0x78]
mov byte [esp + 0x78], dl
call fcn.1000bc70
push esi
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x74]
push eax
push esi
call fcn.1000bf40
mov al, byte [0x10196c1c]
mov byte [esp + 0xcc], 7
test bl, al
mov word [esp + 0x10], 0xffcd
jne 0x100b352e
or al, bl
mov ecx, 0x10196c20
mov byte [0x10196c1c], al
lea eax, [esp + 0x10]
push eax
call fcn.100b6470
push 0x100b94b0
call fcn.1013c36b
add esp, 4
mov al, byte [0x10196c24]
mov word [esp + 0x12], 0x13
test bl, al
jne 0x100b3561
lea ecx, [esp + 0x12]
or al, bl
push ecx
mov ecx, 0x10196c28
mov byte [0x10196c24], al
call fcn.100b6410
push 0x100b94a0
call fcn.1013c36b
add esp, 4
mov edx, dword [esp + 0xd8]
mov eax, dword [0x10196c28]
push edx
lea ecx, [esp + 0x88]
push eax
push ecx
call fcn.1000cdb0
mov edx, dword [0x10196c20]
mov byte [esp + 0xd8], 8
push edx
push eax
lea eax, [esp + 0xc8]
push eax
call fcn.1000cf10
add esp, 0x18
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xcc], 9
push ecx
lea ecx, [esp + 0x58]
call fcn.10043a70
lea edx, [esp + 0x74]
push eax
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd4], 0xa
call fcn.100b9750
push eax
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0xac]
mov byte [esp + 0xd4], 0xb
call fcn.100b9500
mov edi, dword [eax]
lea ecx, [esp + 0x14]
mov byte [esp + 0xcc], 0xa
call fcn.100b7820
push ebx
lea ecx, [esp + 0x58]
mov byte [esp + 0xd0], 9
call fcn.1000bc70
mov edx, dword [0x1016a210]
lea ecx, [edi + 0x1c]
push edx
push 0
push esi
call fcn.1000ba60
push ebx
lea ecx, [esp + 0xb8]
mov byte [esp + 0xd0], 8
call fcn.1000bc70
push ebx
lea ecx, [esp + 0x88]
mov byte [esp + 0xd0], 7
call fcn.1000bc70
push ebx
lea ecx, [esp + 0x78]
mov byte [esp + 0xd0], bl
call fcn.1000bc70
mov eax, 0xef
mov ecx, 0xee
mov byte [0x1018caf1], 0xf
mov word [esp + 0x54], 0xe1
mov word [esp + 0x56], ax
mov word [esp + 0x58], 0xf3
mov word [esp + 0x5a], 0xfd
mov word [esp + 0x5c], 0xe5
mov word [esp + 0x5e], 0xf8
mov word [esp + 0x60], cx
mov word [esp + 0x62], 0xa4
mov word [esp + 0x64], ax
mov word [esp + 0x66], 0xe4
mov word [esp + 0x68], 0xeb
mov word [esp + 0x6a], 0xe8
mov word [esp + 0x6c], 0xe6
mov word [esp + 0x6e], ax
mov word [esp + 0x70], cx
mov al, byte [0x10196c2c]
test bl, al
jne 0x100b36fb
or al, bl
push 0x8a
mov byte [0x10196c2c], al
lea eax, [esp + 0x58]
push eax
mov ecx, 0x10196c30
call fcn.100448a0
push 0x100b94c0
call fcn.1013c36b
add esp, 4
mov cl, byte [esp + 0x10]
mov esi, dword [0x10196c30]
mov byte [esp + 0x84], cl
push 0
lea ecx, [esp + 0x88]
call fcn.1000bc70
push esi
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x84]
push eax
push esi
call fcn.1000bf40
mov al, byte [0x10196c34]
mov byte [esp + 0xcc], 0xc
test bl, al
mov word [esp + 0x94], 0xd4
mov word [esp + 0x96], 0xd2
mov word [esp + 0x98], 0xd5
mov word [esp + 0x9a], 0xc5
mov ebp, 0xa0
jne 0x100b3796
lea edx, [esp + 0x94]
or al, bl
push ebp
push edx
mov ecx, 0x10196c38
mov byte [0x10196c34], al
call fcn.1002a5f0
push 0x100b94d0
call fcn.1013c36b
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x54]
push eax
call fcn.10043a70
lea ecx, [esp + 0x84]
push eax
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd4], 0xd
call fcn.100b9750
lea edx, [esp + 0x74]
push eax
push edx
lea ecx, [esp + 0xac]
mov byte [esp + 0xd4], 0xe
call fcn.100b9500
mov edi, dword [eax]
lea ecx, [esp + 0x14]
mov byte [esp + 0xcc], 0xd
call fcn.100b7820
push ebx
lea ecx, [esp + 0x58]
mov byte [esp + 0xd0], 0xc
call fcn.1000bc70
mov esi, dword [0x10196c38]
add edi, 0x1c
push esi
call fcn.1013c2c2
add esp, 4
mov ecx, edi
push eax
push esi
call fcn.1000bf40
push ebx
lea ecx, [esp + 0x88]
mov byte [esp + 0xd0], bl
call fcn.1000bc70
mov eax, 0x12b
mov esi, 0x11
cdq
idiv dword [0x1018cae0]
mov eax, dword [0x1018cadc]
mov word [esp + 0x14], 0x52
mov word [esp + 0x16], 0x10
mov word [esp + 0x18], 0x1d
mov word [esp + 0x20], 0x17
mov word [esp + 0x22], 0x5c
mov word [esp + 0x24], 0x5d
mov word [esp + 0x2a], 0x13
mov word [esp + 0x2c], si
mov word [esp + 0x30], 0x46
mov word [esp + 0x32], 0x4a
mov word [esp + 0x34], bx
mov word [esp + 0x36], 3
mov word [esp + 0x3a], 0x14
mov word [esp + 0x3c], 0x19
mov word [esp + 0x40], si
mov word [esp + 0x44], 9
mov word [esp + 0x46], 0xe
mov cl, byte [edx + eax]
mov eax, 4
sub cl, 0xe
mov edx, 0x16
mov byte [0x1018caf0], cl
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], dx
mov word [esp + 0x26], dx
mov word [esp + 0x28], ax
mov ecx, 0x18
mov eax, 0xb
mov edx, 7
mov word [esp + 0x1a], cx
mov word [esp + 0x2e], ax
mov word [esp + 0x38], dx
mov word [esp + 0x3e], cx
mov word [esp + 0x42], ax
mov word [esp + 0x48], dx
mov word [esp + 0x4a], ax
mov word [esp + 0x4c], ax
mov al, byte [0x10196c3c]
mov word [esp + 0x4e], 0xf
test bl, al
mov word [esp + 0x50], 0xc
mov word [esp + 0x52], 8
jne 0x100b3955
lea edx, [esp + 0x14]
or al, bl
push edx
mov ecx, 0x10196c40
mov byte [0x10196c3c], al
call fcn.100b64e0
push 0x100b94e0
call fcn.1013c36b
add esp, 4
mov al, byte [esp + 0x10]
mov esi, dword [0x10196c40]
push 0
lea ecx, [esp + 0x88]
mov byte [esp + 0x88], al
call fcn.1000bc70
push esi
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x84]
push eax
push esi
call fcn.1000bf40
mov al, byte [0x10196c44]
mov byte [esp + 0xcc], 0xf
test bl, al
mov word [esp + 0x10], 0xff35
jne 0x100b39c6
lea ecx, [esp + 0x10]
or al, bl
push ecx
mov ecx, 0x10196c48
mov byte [0x10196c44], al
call fcn.100b6570
push 0x100b9600
call fcn.1013c36b
add esp, 4
mov al, byte [0x10196c4c]
mov word [esp + 0x12], 0x1c
test bl, al
jne 0x100b39fb
lea edx, [esp + 0x12]
or al, bl
push 0x3e
push edx
mov ecx, 0x10196c50
mov byte [0x10196c4c], al
call fcn.1000b9b0
push 0x100b94f0
call fcn.1013c36b
add esp, 4
mov eax, dword [esp + 0xdc]
mov ecx, dword [0x10196c50]
push eax
lea edx, [esp + 0x98]
push ecx
push edx
call fcn.1000cdb0
mov ecx, dword [0x10196c48]
lea edx, [esp + 0xc0]
push ecx
push eax
push edx
mov byte [esp + 0xe4], 0x10
call fcn.1000cf10
add esp, 0x18
mov esi, eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x54]
push eax
mov byte [esp + 0xd0], 0x11
call fcn.10043a70
lea ecx, [esp + 0x84]
push eax
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd4], 0x12
call fcn.100b9750
lea edx, [esp + 0x74]
push eax
push edx
lea ecx, [esp + 0xac]
mov byte [esp + 0xd4], 0x13
call fcn.100b9500
mov edi, dword [eax]
lea ecx, [esp + 0x14]
mov byte [esp + 0xcc], 0x12
call fcn.100b7820
push ebx
lea ecx, [esp + 0x58]
mov byte [esp + 0xd0], 0x11
call fcn.1000bc70
mov eax, dword [0x1016a210]
lea ecx, [edi + 0x1c]
push eax
push 0
push esi
call fcn.1000ba60
push ebx
lea ecx, [esp + 0xb8]
mov byte [esp + 0xd0], 0x10
call fcn.1000bc70
push ebx
lea ecx, [esp + 0x98]
mov byte [esp + 0xd0], 0xf
call fcn.1000bc70
push ebx
lea ecx, [esp + 0x88]
mov byte [esp + 0xd0], bl
call fcn.1000bc70
mov edx, 0xa6
mov edi, 0xb7
mov word [esp + 0x1c], dx
mov word [esp + 0x24], dx
mov eax, 0xa7
mov ecx, 0xb0
mov esi, 0xfb
mov edx, 0xb4
mov word [esp + 0x14], di
mov word [esp + 0x16], ax
mov word [esp + 0x18], 0xba
mov word [esp + 0x1a], 0xa2
mov word [esp + 0x1e], cx
mov word [esp + 0x20], ax
mov word [esp + 0x22], si
mov word [esp + 0x26], cx
mov word [esp + 0x28], dx
mov word [esp + 0x2a], ax
mov word [esp + 0x42], ax
mov al, byte [0x10196c54]
mov word [esp + 0x34], cx
mov ecx, 0xb9
mov word [esp + 0x3a], bp
mov word [esp + 0x40], bp
test bl, al
mov word [esp + 0x2c], 0xb6
mov word [esp + 0x2e], 0xbd
mov word [esp + 0x30], si
mov word [esp + 0x32], 0xb1
mov word [esp + 0x36], 0xb3
mov word [esp + 0x38], dx
mov word [esp + 0x3c], cx
mov word [esp + 0x3e], 0xa1
mov word [esp + 0x44], cx
pop ebp
jne 0x100b3bd7
lea ecx, [esp + 0x10]
push 0xd5
or al, bl
push ecx
mov ecx, 0x10196c58
mov byte [0x10196c54], al
call fcn.100b5ed0
push 0x100b9640
call fcn.1013c36b
add esp, 4
mov dl, byte [esp + 0xc]
mov esi, dword [0x10196c58]
push 0
lea ecx, [esp + 0x84]
mov byte [esp + 0x84], dl
call fcn.1000bc70
push esi
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x80]
push eax
push esi
call fcn.1000bf40
mov al, byte [0x10196c5c]
mov byte [esp + 0xc8], 0x14
test bl, al
mov word [esp + 0xc], 0x12
jne 0x100b3c48
or al, bl
mov ecx, 0x10196c60
mov byte [0x10196c5c], al
lea eax, [esp + 0xc]
push eax
call fcn.100153e0
push 0x100b9740
call fcn.1013c36b
add esp, 4
mov al, byte [0x10196c64]
mov word [esp + 0xe], 0xfff5
test bl, al
jne 0x100b3c7b
lea ecx, [esp + 0xe]
or al, bl
push ecx
mov ecx, 0x10196c68
mov byte [0x10196c64], al
call fcn.100b65f0
push 0x100b9730
call fcn.1013c36b
add esp, 4
mov edx, dword [esp + 0xd4]
mov eax, dword [0x10196c68]
push edx
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.1000cdb0
mov edx, dword [0x10196c60]
mov byte [esp + 0xd4], 0x15
push edx
push eax
lea eax, [esp + 0x64]
push eax
call fcn.1000cf10
add esp, 0x18
mov esi, eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xc8], 0x16
push ecx
lea ecx, [esp + 0xa4]
call fcn.100b68d0
mov edx, dword [0x1016a210]
mov ecx, eax
push edx
push 0
push esi
call fcn.1000ba60
push ebx
lea ecx, [esp + 0x54]
mov byte [esp + 0xcc], 0x15
call fcn.1000bc70
push ebx
lea ecx, [esp + 0xb4]
mov byte [esp + 0xcc], 0x14
call fcn.1000bc70
push ebx
lea ecx, [esp + 0x84]
mov byte [esp + 0xcc], bl
call fcn.1000bc70
mov eax, 0x98
mov word [esp + 0x70], di
mov word [esp + 0x74], ax
mov word [esp + 0x7e], ax
mov al, byte [0x10196c6c]
mov byte [0x1018caf0], 0xdb
test bl, al
mov word [esp + 0x72], 0x9e
mov word [esp + 0x76], 0x8e
mov word [esp + 0x78], 0x99
mov word [esp + 0x7a], 0xc5
mov word [esp + 0x7c], 0x81
pop edi
jne 0x100b3d8d
or al, bl
push 0xeb
mov byte [0x10196c6c], al
lea eax, [esp + 0x70]
push eax
mov ecx, 0x10196c70
call fcn.100159b0
push 0x100b9870
call fcn.1013c36b
add esp, 4
mov ecx, dword [0x10196c70]
mov edx, dword [esp + 0xcc]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.1000cf10
lea ecx, [esp + 0xa8]
mov byte [esp + 0xd0], 0x17
push ecx
push eax
call fcn.100b0f50
add esp, 0x14
lea ecx, [esp + 0x4c]
mov esi, eax
mov byte [esp + 0xc4], bl
push ebx
call fcn.1000bc70
lea ecx, [esp + 0x9c]
mov dword [esp + 0xc4], 0xffffffff
call fcn.100b6a10
mov ecx, dword [esp + 0xbc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xc0
ret