Function at 0x10010dc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c57c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push edi
mov edi, ecx
lea ecx, [ebp - 0x25]
mov dword [ebp - 0x64], edi
lea edx, [ecx + 1]
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov word [ebp - 0x26], 0x15
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [ebp - 0x25], 0
mov byte [edi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10010e13
sub ecx, edx
lea eax, [ebp - 0x25]
push ecx
push eax
mov ecx, edi
call fcn.10001d00
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x1004da10]
mov dword [ebp - 0x30], 1
movups xmmword [ebp - 0x23], xmm0
mov dword [ebp - 0x13], 0x6e727972
mov word [ebp - 0xf], 0x7280
mov byte [ebp - 0xd], 0
movsx eax, byte [ebp - 0x23]
and eax, 0x8000000f
jns 0x10010e64
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x22], al
inc ecx
cmp ecx, 0x15
jb 0x10010e54
lea ecx, [ebp - 0x22]
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x50], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10010e90
sub ecx, edx
lea eax, [ebp - 0x22]
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.10001d00
push str._r_n_r_n
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 1
call fcn.10014cc0
mov dword [ebp - 0x30], 3
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.10003400
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x10010f2a
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10010f20
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116bb
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x4c]
cmp edx, 0x10
jb 0x10010f62
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10010f58
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116bb
push edx
push ecx
call fcn.1001a1f6
add esp, 8
push esi
lea ecx, [ebp - 0xb0]
call fcn.10002f50
push eax
mov dword [ebp - 4], 3
mov cl, 0x38
mov byte [ebp - 0x14], 0x70
mov dl, 0x27
xor cl, byte [ebp - 0x14]
mov ch, 0x39
mov byte [ebp - 0x13], cl
mov dh, 0x34
mov cl, byte [ebp - 0x14]
mov al, 0x4a
xor dl, cl
mov byte [ebp - 0xd], 0
xor dh, cl
mov byte [ebp - 0x12], dl
xor ch, cl
mov byte [ebp - 0x10], dh
mov ah, 0x50
mov byte [ebp - 0x11], ch
xor al, cl
mov byte [ebp - 0xd], 0
xor ah, cl
mov byte [ebp - 0xf], al
lea edx, [ebp - 0x13]
mov byte [ebp - 0xe], ah
lea ecx, [ebp - 0x60]
call fcn.10016ce0
add esp, 4
push 0x1004d5c8
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.10014cc0
mov dword [ebp - 0x30], 7
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 5
push eax
mov ecx, edi
call fcn.10003400
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x1001103e
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10011034
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116c0
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4c]
cmp edx, 0x10
jb 0x10011076
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001106c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116c0
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp edx, 0x10
jb 0x100110c6
mov ecx, dword [ebp - 0xb0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100110bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116c0
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov byte [ebp - 0x18], 7
mov cl, 0x54
xor cl, byte [ebp - 0x18]
mov al, 0x52
xor al, byte [ebp - 0x18]
mov ch, 0x43
mov byte [ebp - 0x17], al
mov dl, 0x42
mov byte [ebp - 0x16], cl
mov dh, 0x48
mov cl, byte [ebp - 0x18]
mov ah, 0x55
mov byte [ebp - 0x27], 0x4a
xor dl, cl
mov al, byte [ebp - 0x27]
xor ch, cl
xor al, cl
mov byte [ebp - 0x28], 0x46
mov byte [ebp - 0x11], al
xor dh, cl
mov al, byte [ebp - 0x28]
xor ah, cl
xor al, cl
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0x29]
xor al, cl
mov byte [ebp - 0x25], 0x49
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x25]
xor al, cl
mov byte [ebp - 0x13], ch
lea ecx, [ebp - 0x17]
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x15], dl
mov byte [ebp - 0x12], dh
lea edx, [ecx + 1]
mov byte [ebp - 0x14], ah
mov byte [ebp - 0xe], al
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0xf
mov byte [ebp - 0x7c], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011150
sub ecx, edx
lea eax, [ebp - 0x17]
push ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.10001d00
mov dword [ebp - 4], 6
lea eax, [ebp - 0x7c]
cmp dword [ebp - 0x68], 0x10
cmovae eax, dword [ebp - 0x7c]
push eax
call fcn.10028f1e
add esp, 4
test eax, eax
jne 0x10011239
mov al, 9
mov dword [ebp - 0x1a], 0x56584c09
mov dword [ebp - 0x16], 0x4e5d5e59
xor ecx, ecx
mov dword [ebp - 0x12], 0x564a575b
mov word [ebp - 0xe], 0x4e
nop dword [eax + eax]
movsx eax, al
and eax, 0x8000000f
jns 0x100111bf
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xc
jae 0x100111ce
mov al, byte [ebp - 0x1a]
jmp 0x100111b0
lea eax, [ebp - 0x19]
mov byte [ebp - 0xd], 0
push eax
call fcn.10028f1e
add esp, 4
test eax, eax
je 0x10011265
mov dl, 0x30
mov dword [ebp - 0x1a], 0x7d7f7330
mov dword [ebp - 0x16], 0x75646560
xor ecx, ecx
mov dword [ebp - 0x12], 0x7d717e62
mov word [ebp - 0xe], 0x75
lea eax, [ebp - 0x19]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10011216
mov dl, byte [ebp - 0x1a]
jmp 0x10011205
lea eax, [ebp - 0x19]
mov byte [ebp - 0xd], 0
push eax
call fcn.10028f1e
mov edx, eax
add esp, 4
lea esi, [edx + 1]
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10011230
jmp 0x10011259
cmp dword [ebp - 0x68], 0x10
lea eax, [ebp - 0x7c]
cmovae eax, dword [ebp - 0x7c]
push eax
call fcn.10028f1e
mov edx, eax
add esp, 4
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10011252
sub edx, esi
lea ecx, [ebp - 0x7c]
push edx
push eax
call fcn.10001d00
movaps xmm0, xmmword [0x1004d850]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0xe
jb 0x10011272
lea ecx, [ebp - 0x1b]
mov byte [ebp - 0xd], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011290
mov esi, 0x7fffffff
sub ecx, edx
mov edx, dword [ebp - 0x6c]
mov eax, esi
sub eax, edx
cmp eax, ecx
jb 0x100116c5
cmp dword [ebp - 0x68], 0x10
lea eax, [ebp - 0x7c]
push edx
cmovae eax, dword [ebp - 0x7c]
push eax
push ecx
lea eax, [ebp - 0x1b]
push eax
push ecx
push dword [ebp - 0x64]
lea ecx, [ebp - 0x60]
call fcn.1000d040
mov dword [ebp - 0x30], 0xf
push 0x1004d5c8
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 7
call fcn.10014cc0
mov dword [ebp - 0x30], 0x1f
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 8
push eax
mov ecx, edi
call fcn.10003400
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x10011353
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10011349
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116ca
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x4c]
cmp edx, 0x10
jb 0x1001138b
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10011381
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116ca
push edx
push ecx
call fcn.1001a1f6
add esp, 8
push 0
push 0x1004cc18
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0xf
mov byte [ebp - 0x94], 0
call fcn.10001d00
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 9
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x98], 0
mov byte [ebp - 0xd], 0
jne 0x10011400
mov al, 0x5c
mov cl, 0x84
mov byte [ebp - 0x11], al
mov dl, 0x3f
movsx eax, al
mov ch, 0x3e
and eax, 0x8000000f
jns 0x100113ef
dec eax
or eax, 0xfffffff0
inc eax
sub cl, al
sub dl, al
sub ch, al
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xf], dl
mov byte [ebp - 0xe], ch
jmp 0x1001141a
mov ah, 0x1b
mov al, 0x63
mov cl, 0x2d
mov byte [ebp - 0x11], ah
mov dl, 0x2f
xor al, ah
xor cl, ah
mov byte [ebp - 0x10], al
xor dl, ah
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xe], dl
lea eax, [ebp - 0x10]
mov byte [ebp - 0xd], 0
push eax
lea ecx, [ebp - 0x94]
call fcn.10014cc0
mov ecx, dword [ebp - 0x84]
sub esi, ecx
cmp esi, 4
pop esi
jb 0x100116cf
cmp dword [ebp - 0x80], 0x10
lea eax, [ebp - 0x94]
push 4
cmovae eax, dword [ebp - 0x94]
push str._r_n_r_n
push ecx
push eax
push ecx
push dword [ebp - 0x64]
lea ecx, [ebp - 0x48]
call fcn.1000d040
mov dword [ebp - 0x30], 0x3f
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0xa
push eax
mov ecx, edi
call fcn.10003400
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x100114b3
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100114a9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116d9
push edx
push ecx
call fcn.1001a1f6
add esp, 8
push 0x104
lea eax, [ebp - 0x1b4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x60], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100114e2
sub ecx, edx
lea eax, [ebp - 0x1b4]
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.10001d00
mov byte [ebp - 4], 0xb
xor ecx, ecx
movaps xmm0, xmmword [0x1004d9c0]
movups xmmword [ebp - 0x1e], xmm0
mov word [ebp - 0xe], 0x4c
mov al, byte [ebp - 0x1e]
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 0x10
jb 0x10011512
lea eax, [ebp - 0x60]
mov byte [ebp - 0xd], 0
push eax
lea edx, [ebp - 0x1d]
lea ecx, [ebp - 0x48]
call fcn.10016ce0
add esp, 4
push str._r_n_r_n
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.10014cc0
mov dword [ebp - 0x30], 0x7f
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x24], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x14], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0xd
push eax
mov ecx, edi
call fcn.10003400
mov edx, dword [ebp - 0x10]
cmp edx, 0x10
jb 0x100115b1
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100115a7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116d4
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x100115e5
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100115db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116d4
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp edx, 0x10
jb 0x1001162b
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10011621
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116d4
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov edx, dword [ebp - 0x80]
cmp edx, 0x10
jb 0x10011662
mov ecx, dword [ebp - 0x94]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10011658
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116d9
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0xf
mov byte [ebp - 0x94], 0
cmp edx, 0x10
jb 0x100116aa
mov ecx, dword [ebp - 0x7c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100116a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100116d9
push edx
push ecx
call fcn.1001a1f6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.10020517
call fcn.10020517
call fcn.100018d0
call fcn.10020517
call fcn.100018d0
call fcn.10020517
call fcn.10020517
int3