Function at 0x1001b049
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x100963a4]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
jne 0x1001b331
call fcn.1001ac27
test al, al
jne 0x1001b331
push ebx
push esi
push edi
push 0x6b
pop eax
push 0x65
mov word [ebp - 0x90], ax
pop eax
push 0x72
pop ecx
push 0x6e
mov word [ebp - 0x8e], ax
mov word [ebp - 0x88], ax
mov word [ebp - 0x8c], cx
pop ecx
push 0x6c
mov word [ebp - 0x8a], cx
pop ecx
push 0x33
pop eax
push 0x32
mov word [ebp - 0x84], ax
pop eax
push 0x2e
pop ebx
push 0x64
pop edx
push 0x53
mov word [ebp - 0x82], ax
xor eax, eax
mov word [ebp - 0x78], ax
pop eax
push 0x68
mov word [ebp - 0x74], ax
pop eax
mov esi, dword [0x10080020]
push 0x77
mov word [ebp - 0x72], ax
pop eax
push 0x61
mov word [ebp - 0x6e], ax
pop eax
push 0x70
mov word [ebp - 0x6c], ax
pop eax
mov word [ebp - 0x6a], ax
push 0x69
pop eax
mov word [ebp - 0x68], ax
xor eax, eax
mov word [ebp - 0x5e], ax
lea eax, [ebp - 0x90]
push eax
mov word [ebp - 0x86], cx
mov word [ebp - 0x80], bx
mov word [ebp - 0x7e], dx
mov word [ebp - 0x7c], cx
mov word [ebp - 0x7a], cx
mov word [ebp - 0x70], cx
mov word [ebp - 0x66], bx
mov word [ebp - 0x64], dx
mov word [ebp - 0x62], cx
mov word [ebp - 0x60], cx
call esi
mov ebx, eax
lea eax, [ebp - 0x74]
push eax
call esi
mov edi, eax
push 0x6f
pop eax
push 0x74
pop edx
test ebx, ebx
je 0x1001b270
test edi, edi
je 0x1001b270
movaps xmm0, xmmword [0x100802e0]
mov esi, dword [0x1008001c]
push 0x65
pop ecx
push 0x69
mov byte [ebp - 0xf], al
pop eax
movups xmmword [ebp - 0xd4], xmm0
mov byte [ebp - 0xb], al
xor eax, eax
movaps xmm0, xmmword [str.DisableThreadLibQueryPerformanceCheckRemoteDebugGetModuleFileNamPathRemoveFileSpl]
movups xmmword [ebp - 0xac], xmm0
mov byte [ebp - 0xad], al
lea eax, [ebp - 0x10]
movaps xmm0, xmmword [0x100802f0]
movups xmmword [ebp - 0xc0], xmm0
push eax
movaps xmm0, xmmword [str.PathFileExistsW]
push ebx
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xe], 0x76
mov byte [ebp - 0xd], cl
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], cl
mov dword [ebp - 8], 0x577845
mov byte [ebp - 0xc4], cl
mov word [ebp - 0xc3], 0x57
mov dword [ebp - 0x9c], 0x79726172
mov dword [ebp - 0x98], 0x6c6c6143
mov word [ebp - 0x94], 0x73
mov byte [ebp - 0xb0], cl
mov word [ebp - 0xaf], 0x5763
mov word [ebp - 0x1c], 0x6150
mov byte [ebp - 0x1a], dl
mov dword [ebp - 0x19], 0x70704168
mov byte [ebp - 0x15], cl
mov dword [ebp - 0x14], 0x57646e
movups xmmword [ebp - 0xe4], xmm0
call esi
mov dword [0x10098658], eax
lea eax, [ebp - 0xd4]
push eax
push ebx
call esi
mov dword [0x1009865c], eax
lea eax, [ebp - 0xac]
push eax
push ebx
call esi
mov dword [0x1009866c], eax
lea eax, [ebp - 0xc0]
push eax
push edi
call esi
mov dword [0x10098660], eax
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
mov dword [0x10098664], eax
lea eax, [ebp - 0xe4]
push eax
push edi
call esi
push 0x6f
mov dword [0x10098668], eax
pop eax
push 0x74
pop edx
push 0x6d
mov word [ebp - 0x44], dx
pop edx
push 0x65
pop esi
push 0x62
pop ecx
push 0x2e
pop edi
push 0x78
pop ebx
push 0x6c
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x30], ax
pop eax
push 0x69
mov word [ebp - 0x40], dx
mov word [ebp - 0x3c], dx
pop edx
push 0x6d
mov word [ebp - 0x5a], dx
pop edx
push 0x64
mov word [ebp - 0x5c], ax
mov word [ebp - 0x4c], ax
mov word [ebp - 0x4a], ax
xor eax, eax
mov word [ebp - 0x3a], cx
mov word [ebp - 0x58], cx
mov word [ebp - 0x52], cx
pop ecx
mov word [ebp - 0x48], ax
push 0x74
pop eax
mov word [ebp - 0x2c], ax
push 0x6f
pop eax
mov word [ebp - 0x2a], ax
mov word [ebp - 0x24], ax
xor eax, eax
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x44]
push eax
mov word [ebp - 0x3e], si
mov word [ebp - 0x38], di
mov word [ebp - 0x36], si
mov word [ebp - 0x34], bx
mov word [ebp - 0x32], si
mov word [ebp - 0x56], si
mov word [ebp - 0x54], dx
mov word [ebp - 0x50], di
mov word [ebp - 0x4e], cx
mov word [ebp - 0x28], dx
mov word [ebp - 0x26], di
mov word [ebp - 0x22], bx
call fcn.1001ae75
lea eax, [ebp - 0x5c]
push eax
call fcn.1001ae75
lea eax, [ebp - 0x2c]
push eax
call fcn.1001ae75
add esp, 0xc
call fcn.1001b522
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.1001da1e
mov esp, ebp
pop ebp
ret 0xc