Function at 0x1010c03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x102312e
call fcn.01014f68
sub esp, 0x1c0
mov eax, dword [0x10309f4]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x124], esi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edi, edi
mov dword [ebp - 0x11c], edi
cmp dword [esi + 0x44], edi
je 0x1010c67
mov dword [ebp - 4], edi
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1010c67
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x11c], edi
jl 0x1010ca3
mov dword [ebp - 4], 2
push 8
push edi
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi + 0x44], eax
jmp 0x1010ca3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x11c], edi
jl 0x10110ed
cmp dword [esi + 0x44], edi
je 0x10110ed
push dword [esi + 0x14]
push 0x1002964
push 0xc
call sub.wbemcomn.dll_int___cdecl_DebugTrace_char__char_const__
add esp, 0xc
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x128], edi
mov eax, dword [esi + 0x1c]
mov ebx, 0x100
cmp eax, edi
je 0x1010d27
push edi
push edi
push ebx
lea ecx, [ebp - 0x114]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push dword [esi + 0x1c]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1010d1b
lea eax, [ebp - 0x114]
push eax
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x120], eax
push edi
push edi
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push dword [esi + 0x20]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1010d5e
lea eax, [ebp - 0x114]
push eax
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x12c], eax
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x1010db2
push edi
push edi
push ebx
lea ecx, [ebp - 0x114]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push dword [esi + 0x24]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1010da6
lea eax, [ebp - 0x114]
push eax
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x128], eax
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x1010dc2
cmp dword [esi + 0x28], edi
jne 0x1010dc2
cmp eax, edi
jne 0x1010de3
cmp dword [esi + 0x2c], edi
je 0x1010de3
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x10111da
cmp dword [esi + 0x30], edi
jne 0x10111da
cmp eax, edi
je 0x10111da
lea ebx, [esi + 0x14]
push dword [ebx]
push 0x100292c
push 0xc
call sub.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__
add esp, 0xc
lea ecx, [ebp - 0x118]
call sub.wbemcomn.dll_public:_void___thiscall_WString::constructor_void_
mov dword [ebp - 4], 4
push 0x10028c0
lea ecx, [ebp - 0x118]
call sub.wbemcomn.dll_public:_class_WString____thiscall_WString::operator_unsigned_short_int_const__
push ebx
lea ecx, [ebp - 0x118]
call fcn.010153ca
cmp dword [esi + 0x1c], edi
je 0x1010f06
cmp dword [esi + 0x28], edi
jne 0x1010f06
push ecx
push ecx
mov dword [ebp - 0x1a0], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 5
push ecx
push ecx
mov dword [ebp - 0x1cc], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 6
push ecx
push ecx
mov dword [ebp - 0x138], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 7
push ecx
push ecx
mov dword [ebp - 0x1a8], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 8
push ecx
push ecx
mov dword [ebp - 0x140], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 9
push ecx
push ecx
mov dword [ebp - 0x188], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0xa
push ecx
push ecx
mov dword [ebp - 0x148], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0xb
push ecx
push ecx
mov dword [ebp - 0x1c8], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0xc
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x150], esp
push dword [ebp - 0x120]
call sub.wbemcomn.dll_public:_void___thiscall_CInsertionString::constructor_long_int_
mov byte [ebp - 4], 0xd
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x190], esp
push dword [ebp - 0x118]
call fcn.010058fb
mov byte [ebp - 4], 0xe
jmp 0x10110ba
cmp dword [esi + 0x2c], edi
jne 0x1010fde
push ecx
push ecx
mov dword [ebp - 0x158], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0xf
push ecx
push ecx
mov dword [ebp - 0x1b0], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x10
push ecx
push ecx
mov dword [ebp - 0x160], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x11
push ecx
push ecx
mov dword [ebp - 0x198], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x12
push ecx
push ecx
mov dword [ebp - 0x168], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x13
push ecx
push ecx
mov dword [ebp - 0x1c0], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x14
push ecx
push ecx
mov dword [ebp - 0x170], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x15
push ecx
push ecx
mov dword [ebp - 0x130], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x16
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x178], esp
push dword [ebp - 0x12c]
call sub.wbemcomn.dll_public:_void___thiscall_CInsertionString::constructor_long_int_
mov byte [ebp - 4], 0x17
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8], esp
push dword [ebp - 0x118]
call fcn.010058fb
mov byte [ebp - 4], 0x18
jmp 0x10110ba
cmp dword [esi + 0x24], edi
je 0x10110ca
cmp dword [esi + 0x30], edi
jne 0x10110ca
push ecx
push ecx
mov dword [ebp - 0x180], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x19
push ecx
push ecx
mov dword [ebp - 0x134], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x1a
push ecx
push ecx
mov dword [ebp - 0x13c], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x1b
push ecx
push ecx
mov dword [ebp - 0x144], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x1c
push ecx
push ecx
mov dword [ebp - 0x14c], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x1d
push ecx
push ecx
mov dword [ebp - 0x154], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x1e
push ecx
push ecx
mov dword [ebp - 0x15c], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x1f
push ecx
push ecx
mov dword [ebp - 0x164], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x20
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x16c], esp
push dword [ebp - 0x128]
call sub.wbemcomn.dll_public:_void___thiscall_CInsertionString::constructor_long_int_
mov byte [ebp - 4], 0x21
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x174], esp
push dword [ebp - 0x118]
call fcn.010058fb
mov byte [ebp - 4], 0x22
push 0xc000002f
push 2
mov byte [ebp - 4], 4
call fcn.0100e07c
or dword [esi + 0x38], 4
mov edi, 0x80041001
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x118]
lea ecx, [ebp - 0x118]
call sub.wbemcomn.dll_private:_void___thiscall_WString::DeleteString_unsigned_short_int__
jmp 0x10111da
push dword [esi + 0x14]
push 0x1002890
push 0xc
call sub.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__
pop ecx
mov dword [ebp - 0x17c], esp
mov ecx, esp
call fcn.010058c4
mov dword [ebp - 4], 0x23
push ecx
push ecx
mov dword [ebp - 0x184], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x24
push ecx
push ecx
mov dword [ebp - 0x18c], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x25
push ecx
push ecx
mov dword [ebp - 0x194], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x26
push ecx
push ecx
mov dword [ebp - 0x19c], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x27
push ecx
push ecx
mov dword [ebp - 0x1a4], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x28
push ecx
push ecx
mov dword [ebp - 0x1ac], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x29
push ecx
push ecx
mov dword [ebp - 0x1b4], esp
mov ecx, esp
call fcn.010058c4
mov byte [ebp - 4], 0x2a
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x1bc], esp
push dword [ebp - 0x11c]
call sub.wbemcomn.dll_public:_void___thiscall_CInsertionString::constructor_class_CHex_
mov byte [ebp - 4], 0x2b
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c4], esp
push dword [esi + 0x18]
call fcn.010058fb
mov byte [ebp - 4], 0x2c
push 0xc0000025
push 2
or dword [ebp - 4], 0xffffffff
call fcn.0100e07c
mov edi, 0x80041001
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.01014c6a
pop edi
pop esi
pop ebx
leave
ret