Function at 0x10011e70
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [0x1005f06c], eax
call esi
push 0
push 0
push 0
mov dword [0x1005f074], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x1005f070], eax
mov ecx, 0x6c
xor eax, eax
mov dword [ebp - 0xb6], ecx
mov word [ebp - 0x114], ax
mov edx, 0x33
mov eax, 0x57
mov word [ebp - 0xb8], cx
mov word [ebp - 0xc8], ax
mov esi, 0x64
mov eax, 0x5f
mov dword [ebp - 0xfc], ecx
mov word [ebp - 0xc2], ax
lea edi, [edx + 0x3f]
xor eax, eax
mov dword [ebp - 0x11e], 0x2e0032
mov word [ebp - 0xe2], ax
lea ebx, [edx + 0x2e]
mov eax, ecx
mov dword [ebp - 0x124], 0x6c0065
mov word [ebp - 0xf4], ax
lea ecx, [edx + 0x36]
mov dword [ebp - 0xce], eax
mov eax, 0x2e
mov word [ebp - 0xd4], ax
mov eax, 0x55
mov word [ebp - 0xe0], ax
mov eax, 0x41
mov word [ebp - 0x148], ax
xor eax, eax
mov dword [ebp - 0x118], 0x6c006c
mov word [ebp - 0x120], dx
mov dword [ebp - 0x128], 0x6e0072
mov word [ebp - 0x11a], si
mov dword [ebp - 0x12c], 0x65004b
mov dword [ebp - 0xc6], 0x320073
mov dword [ebp - 0xbc], 0x64002e
mov dword [ebp - 0xc0], 0x320033
mov dword [ebp - 0xf8], 0x680053
mov dword [ebp - 0xee], 0x690070
mov dword [ebp - 0xf2], 0x610077
mov dword [ebp - 0xe6], 0x6c006c
mov dword [ebp - 0xea], 0x64002e
mov dword [ebp - 0xd2], 0x6c0064
mov dword [ebp - 0xd8], 0x320033
mov dword [ebp - 0xde], 0x650073
mov word [ebp - 0xda], di
mov dword [ebp - 0x110], 0x680053
mov dword [ebp - 0x100], 0x6c0064
mov dword [ebp - 0x108], 0x33006c
mov dword [ebp - 0x10c], 0x6c0065
mov dword [ebp - 0x104], 0x2e0032
mov dword [ebp - 0x134], 0x6c006c
mov dword [ebp - 0x146], 0x760064
mov dword [ebp - 0x140], 0x690070
mov dword [ebp - 0x138], 0x64002e
mov dword [ebp - 0x13c], 0x320033
mov word [ebp - 0x130], ax
mov word [ebp - 0x142], bx
mov dword [ebp - 0xa6], 0x64002e
mov dword [ebp - 0xac], 0x700061
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x12c]
mov edx, 0x6c
mov dword [ebp - 0xb0], 0x730050
push eax
mov dword [ebp - 0xa0], 0x6c
mov word [ebp - 0xa8], cx
mov word [ebp - 0xa2], dx
call esi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0xc8]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0xf8]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0xe0]
push eax
call esi
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x110]
push eax
call esi
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x148]
push eax
call esi
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0xb0]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x100122b4
lea ecx, [ebp - 0x4c]
mov word [ebp - 0x48], 0x6946
push ecx
push eax
mov word [ebp - 0x45], 0x65
mov dword [ebp - 0x4c], 0x64616552
mov byte [ebp - 0x46], 0x6c
call esi
mov dword [0x1007e1ec], eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x65], 0x57656c
mov dword [ebp - 0x69], 0x69467473
mov dword [ebp - 0x6e], 0x6946646e
mov word [ebp - 0x70], 0x6946
mov byte [ebp - 0x6a], 0x72
call esi
mov dword [0x1007e1f0], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x15], 0x78654e64
mov dword [ebp - 0xf], 0x57656c69
mov word [ebp - 0x17], 0x6e69
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 0xb], 0
mov word [ebp - 0x11], 0x4674
call esi
mov dword [0x1007e1f4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x78]
mov word [ebp - 0x1f], 0x6f6c
mov dword [ebp - 0x23], 0x43646e69
mov word [ebp - 0x1c], 0x65
mov byte [ebp - 0x24], 0x46
mov byte [ebp - 0x1d], 0x73
call esi
mov dword [0x1007e1f8], eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x78]
mov word [ebp - 0x60], 0x6554
mov word [ebp - 0x55], 0x636f
mov word [ebp - 0x52], 0x7373
mov dword [ebp - 0x5d], 0x616e696d
mov dword [ebp - 0x59], 0x72506574
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x53], 0x65
mov byte [ebp - 0x5e], 0x72
call esi
mov dword [0x1007e1fc], eax
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x93], 0x73736563
mov dword [ebp - 0x87], 0x6d614e65
mov word [ebp - 0x82], 0x57
mov dword [ebp - 0x8d], 0x46656761
mov dword [ebp - 0x97], 0x6f725074
mov word [ebp - 0x89], 0x6c69
mov dword [ebp - 0x9c], 0x4732334b
mov word [ebp - 0x8f], 0x6d49
mov byte [ebp - 0x83], 0x65
mov byte [ebp - 0x98], 0x65
call esi
mov dword [0x1007e24c], eax
test eax, eax
jne 0x100122b4
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x100122b4
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2b], 0x57656d
push ecx
push eax
mov dword [ebp - 0x3e], 0x6f725074
mov dword [ebp - 0x34], 0x46656761
mov dword [ebp - 0x39], 0x49737365
mov dword [ebp - 0x2f], 0x614e656c
mov word [ebp - 0x40], 0x6547
mov byte [ebp - 0x35], 0x6d
mov byte [ebp - 0x30], 0x69
mov byte [ebp - 0x3a], 0x63
call esi
mov dword [0x1007e24c], eax
test ebx, ebx
je 0x10012391
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x53415357
push eax
push ebx
mov dword [ebp - 0x20], 0x74726174
mov word [ebp - 0x1b], 0x70
mov byte [ebp - 0x1c], 0x75
call esi
mov dword [0x1007e200], eax
lea eax, [ebp - 0x6c]
push eax
push ebx
mov word [ebp - 0x69], 0x6c43
mov word [ebp - 0x66], 0x6e61
mov word [ebp - 0x6b], 0x4153
mov byte [ebp - 0x6c], 0x57
mov word [ebp - 0x63], 0x70
mov byte [ebp - 0x67], 0x65
mov byte [ebp - 0x64], 0x75
call esi
mov dword [0x1007e204], eax
lea eax, [ebp - 0x48]
push eax
push ebx
mov dword [ebp - 0x48], 0x6e6e6f63
mov word [ebp - 0x43], 0x7463
mov byte [ebp - 0x44], 0x65
mov byte [ebp - 0x41], 0
call esi
mov dword [0x1007e208], eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov word [ebp - 0x11], 0x6573
mov word [ebp - 0xa], 0x74
mov word [ebp - 0x14], 0x6c63
mov dword [ebp - 0xf], 0x6b636f73
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xb], 0x65
call esi
mov dword [0x1007e20c], eax
lea eax, [ebp - 0x80]
push eax
push ebx
mov dword [ebp - 0x80], 0x646e6573
mov byte [ebp - 0x7c], 0
call esi
mov dword [0x1007e210], eax
lea eax, [ebp - 0x78]
push eax
push ebx
mov word [ebp - 0x78], 0x6572
mov word [ebp - 0x75], 0x76
mov byte [ebp - 0x76], 0x63
call esi
mov dword [0x1007e214], eax
test edi, edi
je 0x100124a7
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x39], 0x6d655268
push eax
push edi
mov dword [ebp - 0x33], 0x6c694665
mov dword [ebp - 0x2f], 0x65705365
mov word [ebp - 0x2b], 0x5763
mov word [ebp - 0x3b], 0x7461
mov byte [ebp - 0x3c], 0x50
mov word [ebp - 0x35], 0x766f
mov byte [ebp - 0x29], 0
call esi
mov dword [0x1007e218], eax
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x11], 0x70704168
mov word [ebp - 0x14], 0x6150
mov dword [ebp - 0xc], 0x57646e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x65
call esi
mov dword [0x1007e21c], eax
lea eax, [ebp - 0x70]
push eax
push edi
mov dword [ebp - 0x68], 0x576575
mov word [ebp - 0x6f], 0x5348
mov dword [ebp - 0x6c], 0x6c615674
mov byte [ebp - 0x6d], 0x65
mov byte [ebp - 0x70], 0x53
call esi
mov dword [0x1007e220], eax
lea eax, [ebp - 0x24]
push eax
push edi
mov word [ebp - 0x22], 0x5472
mov word [ebp - 0x1f], 0x6e49
mov word [ebp - 0x1c], 0x57
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1d], 0x74
mov word [ebp - 0x24], 0x7453
call esi
mov dword [0x1007e224], eax
lea eax, [ebp - 0x60]
push eax
push edi
mov dword [ebp - 0x59], 0x69784565
mov dword [ebp - 0x55], 0x57737473
mov dword [ebp - 0x5e], 0x69466874
mov word [ebp - 0x60], 0x6150
mov byte [ebp - 0x5a], 0x6c
mov byte [ebp - 0x51], 0
call esi
mov dword [0x1007e228], eax
lea eax, [ebp - 0x4c]
push eax
push edi
mov dword [ebp - 0x45], 0x5765756c
mov byte [ebp - 0x41], 0
mov dword [ebp - 0x49], 0x61567465
mov word [ebp - 0x4b], 0x4748
mov byte [ebp - 0x4c], 0x53
call esi
mov dword [0x1007e22c], eax
mov ebx, dword [ebp - 0x14c]
test ebx, ebx
je 0x1001254c
lea eax, [ebp - 0x24]
mov word [ebp - 0x1c], 0x57
push eax
push ebx
mov dword [ebp - 0x21], 0x746e6972
mov word [ebp - 0x23], 0x7073
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x24], 0x77
call esi
mov dword [0x1007e230], eax
lea eax, [ebp - 0x40]
push eax
push ebx
mov dword [ebp - 0x2b], 0x644973
mov dword [ebp - 0x3a], 0x54776f64
mov dword [ebp - 0x35], 0x64616572
mov dword [ebp - 0x31], 0x636f7250
mov byte [ebp - 0x36], 0x68
mov word [ebp - 0x3c], 0x6e69
mov word [ebp - 0x3f], 0x7465
mov byte [ebp - 0x40], 0x47
mov word [ebp - 0x2d], 0x7365
mov byte [ebp - 0x3d], 0x57
call esi
mov dword [0x1007e234], eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0xd], 0x6f50776f
mov dword [ebp - 0x14], 0x57746553
mov word [ebp - 9], 0x73
mov word [ebp - 0xf], 0x646e
mov byte [ebp - 0x10], 0x69
call esi
mov dword [0x1007e238], eax
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x10012598
lea ecx, [ebp - 0x40]
mov word [ebp - 0x2d], 0x7461
push ecx
push eax
mov dword [ebp - 0x40], 0x65474853
mov dword [ebp - 0x3c], 0x65705374
mov word [ebp - 0x2a], 0x57
mov dword [ebp - 0x38], 0x6c616963
mov dword [ebp - 0x34], 0x646c6f46
mov word [ebp - 0x2f], 0x5072
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2b], 0x68
call esi
mov dword [0x1007e23c], eax
mov ebx, dword [ebp - 0x154]
test ebx, ebx
je 0x10012631
lea eax, [ebp - 0x18]
mov dword [ebp - 0x17], 0x6e457465
push eax
push ebx
mov word [ebp - 0xd], 0x416e
mov word [ebp - 0x10], 0x7365
mov dword [ebp - 0xb], 0x576c63
mov word [ebp - 0x13], 0x7274
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xe], 0x49
call esi
mov dword [0x1007e240], eax
lea eax, [ebp - 0x60]
push eax
push ebx
mov dword [ebp - 0x60], 0x53746553
mov word [ebp - 0x55], 0x6e49
mov dword [ebp - 0x5c], 0x72756365
mov word [ebp - 0x52], 0x6f
mov word [ebp - 0x57], 0x7974
mov byte [ebp - 0x58], 0x69
mov byte [ebp - 0x53], 0x66
call esi
mov dword [0x1007e244], eax
lea eax, [ebp - 0x48]
push eax
push ebx
mov dword [ebp - 0x46], 0x69536565
mov word [ebp - 0x42], 0x64
mov word [ebp - 0x48], 0x7246
call esi
mov dword [0x1007e248], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret