Function at 0x10001c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x100f1dd9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1011f07c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor edi, edi
push edi
mov ecx, 0x10122890
mov dword [esp + 0x10], 0x10122890
call sub.mfc90u.dll_CWinApp::CWinApp
mov dword [esp + 0x18], edi
push 0x1012293c
mov dword [0x10122934], 0x100f5d98
mov dword [0x10122938], 0x100f5db4
call fcn.100257a0
mov byte [esp + 0x18], 1
push 0x10122954
mov dword [0x10122890], 0x100f5dec
mov dword [0x10122934], 0x100f5eb0
mov dword [0x10122938], 0x100f5ecc
call fcn.100c5bc0
push 0x10122a80
mov byte [esp + 0x1c], 2
call fcn.100c2340
mov dword [0x10122a80], 0x1010d014
mov dword [0x10122b28], edi
mov dword [0x10122b2c], edi
mov dword [0x10122b30], edi
mov dword [0x10122b34], edi
mov dword [0x10122ac0], 2
push 0x10122b38
mov byte [esp + 0x1c], 3
call fcn.100c2340
mov esi, vtable.CDLLCreateObjectEngine.0
mov dword [0x10122b38], esi
mov dword [0x10122be0], edi
mov dword [0x10122be4], edi
mov dword [0x10122be8], edi
push 0x10122bec
mov byte [esp + 0x1c], 4
call fcn.10011990
push 0x10122c2c
mov byte [esp + 0x1c], 5
call fcn.100c2340
mov dword [0x10122c2c], esi
mov dword [0x10122cd4], edi
mov dword [0x10122cd8], edi
mov dword [0x10122cdc], edi
mov byte [esp + 0x18], 6
push 0x10122ce4
mov dword [0x10122ce0], edi
call fcn.10001210
push 0x10122d04
mov byte [esp + 0x1c], 7
call fcn.1000c890
push 0x10122d40
mov byte [esp + 0x1c], 8
call fcn.10022530
mov byte [esp + 0x18], 9
push 0x10122d50
mov dword [0x10122d4c], edi
call fcn.10001210
push 0x10122d70
mov byte [esp + 0x1c], 0xa
call fcn.100b3e60
push 0x10122d90
mov byte [esp + 0x1c], 0xb
call fcn.10001210
mov ecx, 0x10122db0
mov byte [esp + 0x18], 0xc
call fcn.100a6160
mov byte [esp + 0x18], 0xd
mov ecx, 0x10122df4
call fcn.100a6160
push 0x10122e38
mov byte [esp + 0x1c], 0xe
call fcn.100a6460
push 0x10122eac
mov byte [esp + 0x1c], 0xf
call fcn.100a6460
push 0x10122f28
mov byte [esp + 0x1c], 0x10
call fcn.100b6800
push 0x10122fec
mov byte [esp + 0x1c], 0x11
call fcn.100b6d00
push 0x101230f8
mov byte [esp + 0x1c], 0x12
call fcn.100b7840
push 0x10123264
mov byte [esp + 0x1c], 0x13
call fcn.100b86b0
push 0x10123308
mov byte [esp + 0x1c], 0x14
call fcn.100b8b60
push 0x10123518
mov byte [esp + 0x1c], 0x15
call fcn.100c9bf0
mov dword [0x10123518], 0x1010d544
push 0x10123598
mov byte [esp + 0x1c], 0x16
call fcn.100c9bf0
mov dword [0x10123598], 0x1010d574
push 0x10123618
mov byte [esp + 0x1c], 0x17
call fcn.100c9bf0
mov dword [0x10123618], 0x1010d5a4
push 0x10123698
mov byte [esp + 0x1c], 0x18
call fcn.100cb850
push 0x10123778
mov byte [esp + 0x1c], 0x19
call fcn.100c9bf0
mov dword [0x10123778], 0x1010d604
mov dword [0x101237f8], edi
mov byte [esp + 0x18], 0x1a
mov dword [0x101237fc], edi
mov dword [0x10123800], 0xffffffff
mov dword [0x10123804], edi
push 0x1012380c
mov dword [0x10123808], edi
call fcn.10012d70
push str.NtQuerySystemInformation
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101237fc], eax
push 0x10123824
mov byte [esp + 0x1c], 0x1b
call fcn.1000e2b0
push 0x10123844
mov byte [esp + 0x1c], 0x1c
call fcn.10001210
mov ecx, 0x10123864
call dword [0x100f3984]
mov dword [0x10123868], edi
push 0x1012386c
mov byte [esp + 0x1c], 0x1e
call fcn.10012d70
push 0x10123884
mov byte [esp + 0x1c], 0x1f
call fcn.1000e2b0
push 1
xor eax, eax
mov esi, 0x101238b8
mov byte [esp + 0x1c], 0x20
call fcn.100c0900
push 2
mov eax, str.TrustList.dat
mov esi, 0x101238f0
mov byte [esp + 0x1c], 0x21
call fcn.100c0900
push 0x10123928
mov byte [esp + 0x1c], 0x22
call fcn.100c1960
push 0x1012399c
mov byte [esp + 0x1c], 0x23
call fcn.100c1960
push 0x10123a10
mov byte [esp + 0x1c], 0x24
call fcn.100c1960
mov byte [esp + 0x18], 0x25
push 0x10123a88
mov dword [0x10123a84], 0x1010a18c
call fcn.10012d70
mov dword [0x10123aa0], edi
mov dword [0x10123aa8], edi
mov dword [0x10123aac], edi
mov dword [0x10123ab0], edi
mov dword [0x10123ab4], edi
mov dword [0x10123ab8], edi
mov dword [0x10123abc], edi
mov dword [0x10123ac0], edi
mov dword [0x10123ac4], edi
mov dword [0x10123ac8], edi
mov dword [0x10123acc], edi
mov byte [esp + 0x18], 0x27
mov eax, 0x100077a0
xor ecx, ecx
push 0x10123ae8
mov dword [0x10123ad8], eax
mov dword [0x10123adc], ecx
mov dword [0x10123ae0], 0x10122890
call fcn.10001210
xor ecx, ecx
mov eax, 0x10008a00
mov dword [0x10123b3c], ecx
mov dword [0x10123b08], edi
mov ecx, 0x10123b4c
mov dword [0x10123b0c], edi
mov dword [0x10123b10], edi
mov dword [0x10123b14], edi
mov dword [0x10123b18], edi
mov dword [0x10123b1c], edi
mov dword [0x10123b20], edi
mov dword [0x10123b24], edi
mov dword [0x10123b28], edi
mov dword [0x10123b2c], edi
mov dword [0x10123b38], eax
mov dword [0x10123b40], 0x10122890
mov dword [0x10123b48], edi
call dword [0x100f3984]
mov dword [0x101238a4], edi
mov dword [0x101238a8], edi
mov dword [0x101238ac], edi
mov dword [0x101238b0], edi
mov dword [0x101238b4], edi
mov eax, 0x10122890
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret