Function at 0x10009850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3c2d
mov eax, dword fs:[0]
push eax
sub esp, 0x1dc
push ebx
push esi
push edi
mov eax, dword [0x10126008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
xor eax, eax
mov word [ebp - 0x80], ax
push 7
push str.info_id
lea ecx, [ebp - 0x80]
call fcn.10006940
mov byte [ebp - 4], 1
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.10006640
lea ecx, [eax + 0x20]
call fcn.100066d0
xor edx, edx
mov ecx, eax
call fcn.1003b290
mov dword [ebx + 0x10], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.100068b0
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 7
xor eax, eax
mov word [ebp - 0x98], ax
push 9
push str.file_path
lea ecx, [ebp - 0x98]
call fcn.10006940
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
call fcn.10006640
mov ecx, eax
call fcn.10032700
mov ecx, eax
mov byte [ebp - 4], 7
cmp dword [ecx + 0x14], 8
jb 0x10009972
mov ecx, dword [ecx]
mov edx, 0x7ffffffe
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], ecx
mov esi, 0x104
mov dword [ebp - 0x40], esi
lea eax, [ebx + 0x14]
mov dword [ebp - 0x1c], eax
xor edi, edi
mov dword [ebp - 0x20], edi
test esi, esi
je 0x100099ba
test edx, edx
je 0x100099c4
movzx ebx, word [ecx]
test bx, bx
je 0x100099c4
mov word [eax], bx
add eax, 2
mov dword [ebp - 0x1c], eax
add ecx, 2
mov dword [ebp - 0x3c], ecx
dec esi
mov dword [ebp - 0x40], esi
dec edx
mov dword [ebp - 0x44], edx
inc edi
jmp 0x1000998d
sub eax, 2
mov dword [ebp - 0x1c], eax
dec edi
mov dword [ebp - 0x20], edi
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1a0]
call fcn.100068b0
mov byte [ebp - 4], 9
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x98]
call fcn.100068b0
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
xor eax, eax
mov word [ebp - 0xb0], ax
push 9
push str.file_sign
lea ecx, [ebp - 0xb0]
call fcn.10006940
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, dword [ebp + 8]
call fcn.10006640
mov ecx, eax
call fcn.10032700
mov ecx, eax
mov byte [ebp - 4], 0x11
cmp dword [ecx + 0x14], 8
jb 0x10009a75
mov ecx, dword [ecx]
mov edx, 0x7ffffffe
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], ecx
mov esi, 0x104
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x18]
add eax, 0x814
mov dword [ebp - 0x24], eax
xor edi, edi
mov dword [ebp - 0x28], edi
test esi, esi
je 0x10009ac2
test edx, edx
je 0x10009acc
movzx ebx, word [ecx]
test bx, bx
je 0x10009acc
mov word [eax], bx
add eax, 2
mov dword [ebp - 0x24], eax
add ecx, 2
mov dword [ebp - 0x48], ecx
dec esi
mov dword [ebp - 0x4c], esi
dec edx
mov dword [ebp - 0x50], edx
inc edi
jmp 0x10009a95
sub eax, 2
mov dword [ebp - 0x24], eax
dec edi
mov dword [ebp - 0x28], edi
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1b8]
call fcn.100068b0
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xb0]
call fcn.100068b0
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
xor eax, eax
mov word [ebp - 0xc8], ax
push 8
push str.file_md5
lea ecx, [ebp - 0xc8]
call fcn.10006940
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0xc8]
push eax
mov ecx, dword [ebp + 8]
call fcn.10006640
mov ecx, eax
call fcn.10032700
mov ecx, eax
mov byte [ebp - 4], 0x1b
cmp dword [ecx + 0x14], 8
jb 0x10009b7d
mov ecx, dword [ecx]
mov edx, 0x7ffffffe
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x54], ecx
mov esi, 0x104
mov dword [ebp - 0x58], esi
mov eax, dword [ebp - 0x18]
add eax, 0xa1c
mov dword [ebp - 0x2c], eax
xor edi, edi
mov dword [ebp - 0x30], edi
test esi, esi
je 0x10009bca
test edx, edx
je 0x10009bd4
movzx ebx, word [ecx]
test bx, bx
je 0x10009bd4
mov word [eax], bx
add eax, 2
mov dword [ebp - 0x2c], eax
add ecx, 2
mov dword [ebp - 0x54], ecx
dec esi
mov dword [ebp - 0x58], esi
dec edx
mov dword [ebp - 0x5c], edx
inc edi
jmp 0x10009b9d
sub eax, 2
mov dword [ebp - 0x2c], eax
dec edi
mov dword [ebp - 0x30], edi
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1d0]
call fcn.100068b0
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xc8]
call fcn.100068b0
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 7
xor eax, eax
mov word [ebp - 0xe0], ax
push 0xc
push str.service_name
lea ecx, [ebp - 0xe0]
call fcn.10006940
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0xe0]
push eax
mov ecx, dword [ebp + 8]
call fcn.10006640
mov ecx, eax
call fcn.10032700
mov ecx, eax
mov byte [ebp - 4], 0x25
cmp dword [ecx + 0x14], 8
jb 0x10009c85
mov ecx, dword [ecx]
mov edx, 0x7ffffffe
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x60], ecx
mov esi, 0x104
mov dword [ebp - 0x64], esi
mov eax, dword [ebp - 0x18]
add eax, 0xc24
mov dword [ebp - 0x34], eax
xor edi, edi
mov dword [ebp - 0x38], edi
test esi, esi
je 0x10009cd2
test edx, edx
je 0x10009cdc
movzx ebx, word [ecx]
test bx, bx
je 0x10009cdc
mov word [eax], bx
add eax, 2
mov dword [ebp - 0x34], eax
add ecx, 2
mov dword [ebp - 0x60], ecx
dec esi
mov dword [ebp - 0x64], esi
dec edx
mov dword [ebp - 0x68], edx
inc edi
jmp 0x10009ca5
sub eax, 2
mov dword [ebp - 0x34], eax
dec edi
mov dword [ebp - 0x38], edi
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1e8]
call fcn.100068b0
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xe0]
call fcn.100068b0
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2c
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 7
xor eax, eax
mov word [ebp - 0xf8], ax
push 8
push str.opt_time
lea ecx, [ebp - 0xf8]
call fcn.10006940
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0xf8]
push eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.10006640
lea ecx, [eax + 0x20]
call fcn.100066d0
xor edx, edx
mov ecx, eax
call fcn.1003b290
mov ebx, dword [ebp - 0x18]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xf8]
call fcn.100068b0
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 0x32
mov byte [ebp - 4], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 7
xor eax, eax
mov word [ebp - 0x110], ax
push 9
push str.rule_type
lea ecx, [ebp - 0x110]
call fcn.10006940
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
call fcn.10006640
lea ecx, [eax + 0x20]
call fcn.100066d0
xor edx, edx
mov ecx, eax
call fcn.1003b290
mov dword [ebx + 0xe2c], eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x110]
call fcn.100068b0
mov byte [ebp - 4], 0x35
mov byte [ebp - 4], 0x36
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 7
xor eax, eax
mov word [ebp - 0x128], ax
push 0xa
push str.rule_index
lea ecx, [ebp - 0x128]
call fcn.10006940
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x128]
push eax
mov ecx, esi
call fcn.10006640
lea ecx, [eax + 0x20]
call fcn.100066d0
xor edx, edx
mov ecx, eax
call fcn.1003b290
mov dword [ebx + 0xe30], eax
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x128]
call fcn.100068b0
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x3c
mov byte [ebp - 4], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 7
xor eax, eax
mov word [ebp - 0x140], ax
push 8
push str.opt_type
lea ecx, [ebp - 0x140]
call fcn.10006940
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x140]
push eax
mov ecx, esi
call fcn.10006640
lea ecx, [eax + 0x20]
call fcn.100066d0
xor edx, edx
mov ecx, eax
call fcn.1003b290
mov dword [ebx + 0xe34], eax
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x140]
call fcn.100068b0
mov byte [ebp - 4], 0x3f
mov byte [ebp - 4], 0x40
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 7
xor eax, eax
mov word [ebp - 0x158], ax
push 0xb
push str.delete_file
lea ecx, [ebp - 0x158]
call fcn.10006940
mov byte [ebp - 4], 0x42
lea eax, [ebp - 0x158]
push eax
mov ecx, esi
call fcn.10006640
lea ecx, [eax + 0x20]
call fcn.100066d0
xor edx, edx
mov ecx, eax
call fcn.1003b290
cmp eax, 1
sete al
mov byte [ebx + 0xe38], al
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x158]
call fcn.100068b0
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x45
mov byte [ebp - 4], 0x46
mov byte [ebp - 4], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 7
xor eax, eax
mov word [ebp - 0x170], ax
push 9
push str.kill_proc
lea ecx, [ebp - 0x170]
call fcn.10006940
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x170]
push eax
mov ecx, esi
call fcn.10006640
lea ecx, [eax + 0x20]
call fcn.100066d0
xor edx, edx
mov ecx, eax
call fcn.1003b290
cmp eax, 1
sete al
mov byte [ebx + 0xe39], al
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x170]
call fcn.100068b0
mov byte [ebp - 4], 0x49
mov byte [ebp - 4], 0x4a
mov byte [ebp - 4], 0x4b
mov byte [ebp - 4], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x174], 7
xor eax, eax
mov word [ebp - 0x188], ax
push 0xb
push str.stat_detail
lea ecx, [ebp - 0x188]
call fcn.10006940
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0x188]
push eax
mov ecx, esi
call fcn.10006640
lea ecx, [eax + 0x20]
call fcn.100066d0
xor edx, edx
mov ecx, eax
call fcn.1003b290
cmp eax, 1
sete al
mov byte [ebx + 0xe3a], al
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x188]
call fcn.100068b0
mov byte [ebp - 4], 0x4e
mov byte [ebp - 4], 0x4f
mov byte [ebp - 4], 0x50
mov byte [ebp - 4], 0
mov al, byte [ebp - 0x11]
jmp 0x1000a116
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4