Function at 0x1000f13c
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x33]
mov byte [ebp - 0x34], bl
mov ecx, 0x81
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x36e]
mov word [ebp - 0x370], bx
push 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x52]
push 0x31
mov word [ebp - 0x54], bx
pop edx
rep stosd dword es:[edi], eax
push 0x2e
mov dword [ebp - 4], ebx
pop ecx
mov dword [ebp - 0x10], ebx
push 0x6d
mov byte [ebp - 0x18], 1
stosw word es:[edi], ax
pop eax
mov byte [ebp - 0x17], 0x43
push 0x64
mov byte [ebp - 0x16], 0x44
pop esi
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], dl
mov byte [ebp - 0x20], 2
mov byte [ebp - 0x1f], 0x43
mov byte [ebp - 0x1e], 0x44
mov byte [ebp - 0x1d], 0x30
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], dl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x41
mov byte [ebp - 8], 0x30
mov byte [ebp - 7], dl
mov word [ebp - 0x12c], cx
mov word [ebp - 0x12a], ax
mov word [ebp - 0x128], si
mov word [ebp - 0x126], 0x78
mov word [ebp - 0x124], bx
mov word [ebp - 0x114], cx
mov word [ebp - 0x112], ax
mov word [ebp - 0x110], si
mov word [ebp - 0x10e], 0x66
mov word [ebp - 0x10c], bx
mov word [ebp - 0xfc], cx
mov word [ebp - 0xfa], ax
mov word [ebp - 0xf8], si
mov word [ebp - 0xf6], 0x30
mov word [ebp - 0xf4], bx
mov word [ebp - 0xe4], cx
mov word [ebp - 0xe2], ax
mov word [ebp - 0xe0], si
mov word [ebp - 0xde], dx
mov word [ebp - 0xdc], bx
mov word [ebp - 0xcc], cx
mov word [ebp - 0xca], ax
mov word [ebp - 0xc8], si
mov word [ebp - 0xc6], 0x32
mov word [ebp - 0xc4], bx
mov word [ebp - 0xb4], cx
mov word [ebp - 0xb2], ax
mov word [ebp - 0xb0], si
mov word [ebp - 0xae], 0x33
mov word [ebp - 0xac], bx
mov word [ebp - 0x9c], cx
mov word [ebp - 0x9a], ax
mov word [ebp - 0x98], si
mov word [ebp - 0x96], 0x34
mov word [ebp - 0x94], bx
mov word [ebp - 0x84], cx
mov word [ebp - 0x82], ax
mov word [ebp - 0x80], si
mov word [ebp - 0x7e], 0x35
mov word [ebp - 0x7c], bx
mov word [ebp - 0x6c], cx
mov word [ebp - 0x6a], ax
mov word [ebp - 0x68], si
mov word [ebp - 0x66], 0x36
mov word [ebp - 0x64], bx
mov word [ebp - 0xf0], cx
mov word [ebp - 0xee], ax
mov word [ebp - 0xec], si
mov word [ebp - 0xea], 0x37
mov word [ebp - 0xe8], bx
mov word [ebp - 0x150], cx
mov word [ebp - 0x14e], ax
mov word [ebp - 0x14c], si
mov word [ebp - 0x14a], 0x38
mov word [ebp - 0x148], bx
mov word [ebp - 0xd8], cx
mov word [ebp - 0xd6], ax
mov word [ebp - 0xd4], si
mov word [ebp - 0xd2], 0x39
mov word [ebp - 0xd0], bx
mov word [ebp - 0x120], cx
mov word [ebp - 0x11e], ax
mov word [ebp - 0x11c], dx
mov word [ebp - 0x11a], 0x30
mov word [ebp - 0x118], bx
mov word [ebp - 0x60], cx
mov word [ebp - 0x5e], ax
mov word [ebp - 0x5c], dx
mov word [ebp - 0x5a], dx
mov word [ebp - 0x58], bx
mov word [ebp - 0x168], cx
mov word [ebp - 0x166], ax
mov word [ebp - 0x164], dx
mov word [ebp - 0x162], 0x32
mov word [ebp - 0x160], bx
mov word [ebp - 0xa8], cx
mov word [ebp - 0xa6], ax
mov word [ebp - 0xa4], dx
mov word [ebp - 0xa2], 0x33
mov word [ebp - 0xa0], bx
mov word [ebp - 0x108], cx
mov word [ebp - 0x106], ax
mov word [ebp - 0x104], dx
mov word [ebp - 0x102], 0x34
mov word [ebp - 0x100], bx
mov word [ebp - 0x90], cx
mov word [ebp - 0x8e], ax
mov word [ebp - 0x8c], dx
mov word [ebp - 0x8a], 0x35
mov word [ebp - 0x88], bx
mov word [ebp - 0x138], cx
mov word [ebp - 0x136], ax
mov word [ebp - 0x134], dx
mov word [ebp - 0x132], 0x36
mov word [ebp - 0x130], bx
mov word [ebp - 0x78], cx
mov word [ebp - 0x76], ax
mov word [ebp - 0x74], dx
mov word [ebp - 0x72], 0x37
mov word [ebp - 0x70], bx
mov word [ebp - 0x15c], cx
mov word [ebp - 0x15a], ax
mov word [ebp - 0x158], dx
mov word [ebp - 0x156], 0x38
mov word [ebp - 0x154], bx
mov word [ebp - 0x144], cx
mov word [ebp - 0x142], ax
mov word [ebp - 0x140], dx
mov word [ebp - 0x13e], 0x39
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [ebp - 0x13c], bx
mov word [ebp - 0xc0], cx
mov word [ebp - 0xbe], ax
mov word [ebp - 0xbc], 0x32
mov word [ebp - 0xba], 0x30
mov word [ebp - 0xb8], bx
call esi
cmp eax, 4
jle 0x1000f97d
push dword [ebp + 8]
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x370]
push eax
call esi
push eax
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
lea eax, [ebp - 0x370]
push eax
call esi
mov ax, word [ebp + eax*2 - 0x378]
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x370]
push eax
call esi
mov ax, word [ebp + eax*2 - 0x376]
mov word [ebp - 0x52], ax
lea eax, [ebp - 0x370]
push eax
call esi
mov ax, word [ebp + eax*2 - 0x374]
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x370]
push eax
call esi
mov ax, word [ebp + eax*2 - 0x372]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov word [ebp - 0x4e], ax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
mov esi, eax
lea eax, [ebp - 0x144]
neg esi
push eax
lea eax, [ebp - 0x54]
sbb esi, esi
push eax
neg esi
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
and esi, eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x54]
push eax
call edi
neg eax
sbb eax, eax
neg eax
test eax, esi
jne 0x1000f97d
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1000f978
cmp eax, ebx
je 0x1000f978
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x24], 0x8040
push ebx
push ebx
push dword [ebp - 0x24]
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x34]
push 6
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x18]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
je 0x1000f968
lea eax, [ebp - 0xc]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
je 0x1000f968
lea eax, [ebp - 0x20]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
je 0x1000f968
lea eax, [ebp - 0xc]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
je 0x1000f968
lea eax, [ebp - 0xc]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
je 0x1000f968
add dword [ebp - 0x24], 0x800
cmp dword [ebp - 0x24], 0xb040
jl 0x1000f7a2
push ebx
push ebx
push 0x8000
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x34]
push 6
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x18]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
jne 0x1000f88b
mov dword [ebp - 4], 1
push ebx
push ebx
push 0x8000
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x34]
push 6
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0xc]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
jne 0x1000f8c4
mov dword [ebp - 4], 1
push ebx
push ebx
push 0x8800
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x34]
push 6
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x20]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
jne 0x1000f8fd
mov dword [ebp - 4], 1
push ebx
push ebx
push 0x9000
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x34]
push 6
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0xc]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
jne 0x1000f936
mov dword [ebp - 4], 1
push ebx
push ebx
push 0x9800
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x34]
push 6
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0xc]
push 6
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10012400
add esp, 0xc
test eax, eax
jne 0x1000f96f
mov dword [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x1000f980
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret