Function at 0x100015cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [0x1006110c], eax
mov ecx, dword [ebp + 0x14]
mov dword [0x10061108], ecx
mov edx, dword [ebp + 0x10]
mov dword [0x10061110], edx
call fcn.10006238
mov dword [0x100289e0], eax
cmp dword [0x100289e0], 0
jne 0x10001607
jmp 0x10001db0
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f4]
cmp ecx, 4
jne 0x1000161d
jmp 0x1000182c
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f4]
cmp eax, 3
jne 0x10001634
jmp 0x10001b3f
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f4]
cmp edx, 2
jne 0x1000164b
jmp 0x100017bc
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f4]
cmp ecx, 1
jne 0x1000165e
jmp 0x10001674
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f4]
test eax, eax
jne 0x10001674
jmp 0x10001db0
push 0x250
push 0xffffffffffffffff
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [0x100289e0]
add edx, 4
push edx
mov eax, dword [0x100289e0]
push eax
call fcn.10002bf8
add esp, 0x14
push 0x124
mov ecx, dword [0x100289e0]
add ecx, 0x250
push ecx
mov edx, dword [ebp - 0xc]
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [0x100289e0]
cmp dword [eax + 0x186ec], 0
je 0x10001d91
mov ecx, dword [0x100289e0]
mov edx, dword [ecx + 0x186ec]
sub edx, 1
mov eax, dword [0x100289e0]
mov dword [eax + 0x186ec], edx
mov ecx, dword [0x100289e0]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x10001731
push 0x124
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x250
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [0x100289e0]
add eax, 4
push eax
mov ecx, dword [0x100289e0]
push ecx
call fcn.10002fa8
add esp, 0xc
jmp 0x10001736
jmp 0x10001d91
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f2]
cmp eax, 1
jne 0x10001768
mov ecx, dword [0x100289e0]
add ecx, 0x250
push ecx
push 0
push 0xc
mov edx, dword [0x100089ac]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100017bc
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f2]
cmp ecx, 2
jne 0x100017bc
push 0x10008064
call fcn.100060cf
push 0x100089b0
call fcn.100060cf
push 0x100089b4
call fcn.100060cf
mov edx, dword [0x100289e0]
add edx, 0x250
push edx
call fcn.100060cf
mov eax, dword [0x100289e0]
mov word [eax + 0x186f4], 2
jmp 0x10001dd4
mov ecx, dword [0x100289e0]
add ecx, 0x186e4
push ecx
push 0x20019
push 0
mov edx, dword [0x100289e0]
add edx, 0x250
push edx
mov eax, dword [0x100289e0]
mov ecx, dword [eax + 0x186e0]
push ecx
call fcn.10005d1b
add esp, 0x14
test eax, eax
je 0x100017fa
jmp 0x100016b6
mov edx, dword [0x100289e0]
mov dword [edx + 0x186e8], 0xffffffff
mov eax, dword [0x100289e0]
cmp dword [eax + 0x186fc], 0
jne 0x1000182c
mov ecx, dword [0x100289e0]
cmp dword [ecx + 0x18700], 0
jne 0x1000182c
jmp 0x10001b3f
mov edx, dword [0x100289e0]
mov eax, dword [edx + 0x186e8]
add eax, 1
mov ecx, dword [0x100289e0]
mov dword [ecx + 0x186e8], eax
mov edx, dword [0x100289e0]
mov byte [edx + 0x86de], 0
mov dword [ebp - 0x18], 0x124
mov dword [ebp - 0x1c], 0x10000
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x86de
push ecx
lea edx, [ebp - 4]
push edx
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x6e0
push ecx
mov edx, dword [0x100289e0]
mov eax, dword [edx + 0x186e8]
push eax
mov ecx, dword [0x100289e0]
mov edx, dword [ecx + 0x186e4]
push edx
call fcn.10005dd3
add esp, 0x20
test eax, eax
jne 0x10001b2f
mov eax, dword [0x100289e0]
cmp dword [eax + 0x186fc], 0
je 0x100019ab
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f6]
test edx, edx
je 0x10001980
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f6]
cmp ecx, 1
jne 0x1000190b
mov edx, dword [0x100289e0]
add edx, 8
push edx
mov eax, dword [0x100289e0]
add eax, 0x6e0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10001980
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f6]
cmp edx, 2
jne 0x10001945
push 0
push 0
push 1
mov eax, dword [0x100289e0]
add eax, 8
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x6e0
push ecx
call fcn.10002b24
add esp, 0x14
test eax, eax
jne 0x10001980
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f6]
cmp eax, 3
jne 0x100019ab
push 0
push 0
push 0
mov ecx, dword [0x100289e0]
add ecx, 8
push ecx
mov edx, dword [0x100289e0]
add edx, 0x6e0
push edx
call fcn.10002b24
add esp, 0x14
test eax, eax
je 0x100019ab
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f0]
cmp ecx, 0xffffffff
je 0x10001ab3
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f0]
cmp eax, dword [ebp - 4]
je 0x10001ab3
mov ecx, dword [0x100289e0]
cmp dword [ecx + 0x18700], 0
je 0x10001b2a
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f6]
test eax, eax
je 0x10001a90
cmp dword [ebp - 4], 1
je 0x100019e3
cmp dword [ebp - 4], 2
jne 0x10001b2a
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f6]
cmp edx, 1
jne 0x10001a15
mov eax, dword [0x100289e0]
add eax, 8
push eax
mov ecx, dword [0x100289e0]
add ecx, 0x86de
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10001a90
mov edx, dword [0x100289e0]
movsx eax, word [edx + 0x186f6]
cmp eax, 2
jne 0x10001a50
push 0
push 0
push 1
mov ecx, dword [0x100289e0]
add ecx, 8
push ecx
mov edx, dword [0x100289e0]
add edx, 0x86de
push edx
call fcn.10002b24
add esp, 0x14
test eax, eax
jne 0x10001a90
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f6]
cmp ecx, 3
jne 0x10001b2a
push 0
push 0
push 0
mov edx, dword [0x100289e0]
add edx, 8
push edx
mov eax, dword [0x100289e0]
add eax, 0x86de
push eax
call fcn.10002b24
add esp, 0x14
test eax, eax
je 0x10001b2a
mov ecx, dword [0x100289e0]
movsx edx, word [ecx + 0x186f0]
cmp edx, 0xffffffff
je 0x10001ab3
mov eax, dword [0x100289e0]
movsx ecx, word [eax + 0x186f0]
cmp ecx, dword [ebp - 4]
jne 0x10001b2a
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [0x100289e0]
add eax, 0x86de
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x100089e0
call fcn.10005110
add esp, 0x14
invalid
pop esi
leave
ret
and al, 0xc
push dword [esp + 0xc]
call dword [esp + 0xc]
ret
dec dword [ecx - 0x311707bb]
std
invalid
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x10001dbc
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x10001dad
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10001b68
clc
mov edx, 0x458d76ef
test al, 0x50
call fcn.10001b78
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10001b2d
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10001e56
inc ebp
lodsd eax, dword [esi]
ret 0x45c6
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
invalid
inc ebp