Function at 0x1001a0a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100508eb
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
jne 0x1001a0cd
lea ecx, [ebp - 0x144]
call fcn.1001ab50
mov dword [ebp - 4], 0
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.10024250
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1001a121
mov dword [ebp - 0x16c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001abe0
mov eax, dword [ebp - 0x16c]
jmp 0x1001a513
push 0xc
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
jne 0x1001a162
mov dword [ebp - 0x170], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001abe0
mov eax, dword [ebp - 0x170]
jmp 0x1001a513
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x15c]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x1c], str.attention
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x18], ecx
jmp 0x1001a1b5
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x18], eax
jae 0x1001a200
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x168], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001a1fe
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x168]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001a1fe
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x164], eax
jmp 0x1001a200
jmp 0x1001a1ac
cmp dword [ebp - 0x164], 0
jne 0x1001a230
mov dword [ebp - 0x174], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001abe0
mov eax, dword [ebp - 0x174]
jmp 0x1001a513
xor ecx, ecx
jne 0x1001a230
mov edx, dword [ebp - 0x164]
sub edx, 0x500
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x148], 0
mov byte [ebp - 0x34], 0x8b
mov byte [ebp - 0x33], 0x45
mov byte [ebp - 0x32], 0xc
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x56
mov byte [ebp - 0x2f], 0x57
mov byte [ebp - 0x2e], 0x68
mov byte [ebp - 0x2d], 0xe
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x29], 0x33
mov byte [ebp - 0x28], 0xf6
mov byte [ebp - 0x27], 0x89
mov byte [ebp - 0x26], 0x85
mov byte [ebp - 0x154], 0x89
mov byte [ebp - 0x153], 0x30
mov byte [ebp - 0x152], 0x68
mov byte [ebp - 0x151], 0x24
mov byte [ebp - 0x150], 8
mov byte [ebp - 0x14f], 0
mov byte [ebp - 0x14e], 0
mov byte [ebp - 0x14d], 0x8d
mov byte [ebp - 0x14c], 0x85
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x160], eax
jmp 0x1001a2f9
mov ecx, dword [ebp - 0x160]
sub ecx, 1
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x164]
sub edx, 0x1000
cmp dword [ebp - 0x160], edx
jbe 0x1001a4ac
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x15c]
jbe 0x1001a4ac
push 0xf
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001a34a
mov ecx, 0xf
lea edi, [ebp - 0x34]
mov esi, dword [ebp - 0x160]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001a34c
jmp 0x1001a2ea
mov eax, dword [ebp - 0x160]
add eax, 0x13
mov dword [ebp - 0x148], eax
push 9
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001a385
mov ecx, 9
lea edi, [ebp - 0x154]
mov esi, dword [ebp - 0x148]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001a38a
jmp 0x1001a2ea
mov eax, dword [ebp - 0x148]
add eax, 0xd
mov dword [ebp - 0x148], eax
push 5
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001a401
mov edx, dword [ebp - 0x148]
movzx eax, byte [edx]
cmp eax, 0x50
jne 0x1001a401
mov ecx, dword [ebp - 0x148]
movzx edx, word [ecx + 1]
cmp edx, 0xd98b
jne 0x1001a401
mov eax, dword [ebp - 0x148]
movzx ecx, byte [eax + 3]
cmp ecx, 0xe8
jne 0x1001a401
mov edx, dword [ebp - 0x148]
movzx eax, word [edx + 8]
cmp eax, 0xf88b
jne 0x1001a401
mov ecx, dword [ebp - 0x148]
movzx edx, word [ecx + 0xa]
cmp edx, 0xfe3b
je 0x1001a406
jmp 0x1001a2ea
mov eax, dword [ebp - 0x148]
add eax, 0x1f
mov dword [ebp - 0x148], eax
push 0x14
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001a46d
mov edx, dword [ebp - 0x148]
movzx eax, word [edx]
cmp eax, 0x5650
jne 0x1001a46d
mov ecx, dword [ebp - 0x148]
movzx edx, byte [ecx + 8]
cmp edx, 0xe8
jne 0x1001a46d
mov eax, dword [ebp - 0x148]
movzx ecx, word [eax + 0xd]
cmp ecx, 0xf88b
jne 0x1001a46d
mov edx, dword [ebp - 0x148]
movzx eax, word [edx + 0xf]
cmp eax, 0xfe3b
je 0x1001a472
jmp 0x1001a2ea
mov ecx, dword [ebp - 0x148]
add ecx, 8
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x148]
mov eax, dword [edx + 1]
mov ecx, dword [ebp - 0x148]
lea edx, [ecx + eax + 5]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x148]
add eax, 5
mov dword [0x10067dac], eax
jmp 0x1001a4ac
cmp dword [ebp - 0x38], 0
jne 0x1001a4d6
mov dword [ebp - 0x178], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001abe0
mov eax, dword [ebp - 0x178]
jmp 0x1001a513
mov ecx, dword [ebp - 0x38]
mov dword [0x10067da8], ecx
mov edx, dword [ebp - 0x158]
push edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.10019fb0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001abe0
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret 4