Function at 0x1000c38a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa0
push 0
lea eax, [ebp - 0xf4]
push eax
call fcn.1000deb0
add esp, 0xc
push 4
pop eax
imul eax, eax, 0xb
mov dword [ebp + eax - 0x278], 0x650074
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x278], 0x610074
push 4
pop eax
imul eax, eax, 0xe
mov dword [ebp + eax - 0x278], 0x74006c
push 4
pop eax
shl eax, 2
mov dword [ebp + eax - 0x278], 0x200073
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x278], 0x6e0069
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x278], 0x61004d
push 4
pop eax
imul eax, eax, 0xa
mov dword [ebp + eax - 0x278], 0x610064
push 4
pop eax
shl eax, 4
and dword [ebp + eax - 0x278], 0
push 4
pop eax
shl eax, 3
mov dword [ebp + eax - 0x278], 0x200073
push 4
pop eax
imul eax, eax, 7
mov dword [ebp + eax - 0x278], 0x77006f
push 4
pop eax
imul eax, eax, 0xc
mov dword [ebp + eax - 0x278], 0x480020
push 4
pop eax
imul eax, eax, 6
mov dword [ebp + eax - 0x278], 0x64006e
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x278], 0x6e0069
push 4
pop eax
imul eax, eax, 5
mov dword [ebp + eax - 0x278], 0x690057
push 4
pop eax
imul eax, eax, 0xf
mov dword [ebp + eax - 0x278], 0x68
push 4
pop eax
imul eax, eax, 9
mov dword [ebp + eax - 0x278], 0x700055
push 4
pop eax
imul eax, eax, 0xd
mov dword [ebp + eax - 0x278], 0x610065
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 2
pop eax
imul eax, eax, 0x19
push 0x48
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x23
push 0x76
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 6
push 0x6f
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x26
push 0x65
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x15
push 0x61
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 1
push 0x63
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0xb
push 0x69
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x1a
push 0x65
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 2
push 0x6f
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 7
push 0x66
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x22
push 0x72
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x17
push 0x65
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x12
push 0x55
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x1d
push 0x74
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 3
push 0x74
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x27
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x50
jae 0x1000c5cc
jmp 0x1000c5d1
call fcn.1000c8c4
xor eax, eax
mov ecx, dword [ebp - 0x27c]
mov word [ebp + ecx - 0x54], ax
push 2
pop eax
imul eax, eax, 0x1c
push 0x6c
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0xe
push 0x6f
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 9
push 0x20
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x1b
push 0x61
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 5
push 0x53
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x1f
push 0x20
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 4
push 0x73
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 5
push 0x73
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x13
push 0x70
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0xf
push 0x77
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x1e
push 0x68
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0
push 0x4d
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0xa
push 0x57
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0xd
push 0x64
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0xc
push 0x6e
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x16
push 0x74
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x24
push 0x69
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x14
push 0x64
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 3
push 0x72
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x25
push 0x63
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x11
push 0x20
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x21
push 0x65
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
shl eax, 0
push 0x69
pop ecx
mov word [ebp + eax - 0x54], cx
push 2
pop eax
imul eax, eax, 0x18
push 0x20
pop ecx
mov word [ebp + eax - 0x54], cx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0xc], 0
je 0x1000c755
push dword [ebp + 0xc]
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0x10]
lea eax, [ebp - 0xf4]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x194]
push eax
push str.MsWDXSETUPs
call fcn.1000ad80
add esp, 0x18
cmp eax, 1
je 0x1000c786
xor al, al
jmp 0x1000c788
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c794
leave
ret