Function at 0x10005870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017f01e
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x101f7210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0x102037c0
mov dword [0x102037c0], 0x101cf780
mov dword [ebp - 0x14], 0x102037cc
mov dword [0x102037d0], 0
mov dword [0x102037d4], 0
call fcn.10018490
mov dword [0x102037d0], eax
mov dword [ebp - 4], 0
mov dword [0x102037d8], 0
mov dword [0x102037dc], 0
mov dword [0x102037e0], 0
call fcn.10018490
mov dword [0x102037dc], eax
mov dword [0x102037e4], 0
mov dword [0x102037cc], 0
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x14], 0x102037e8
mov dword [0x102037fc], 7
mov dword [0x102037f8], 0
mov word [0x102037e8], ax
mov dword [0x10203814], 0xf
mov dword [0x10203810], eax
mov byte [0x10203800], al
mov dword [0x1020382c], 7
mov dword [0x10203828], eax
mov word [0x10203818], ax
mov dword [0x10203844], 0xf
mov dword [0x10203840], eax
mov byte [0x10203830], al
push eax
push 0x101cf8e0
mov ecx, 0x102037e8
mov byte [ebp - 4], 5
call fcn.1001e640
xor eax, eax
mov dword [ebp - 0x14], 0x10203848
mov dword [0x1020385c], 7
mov dword [0x10203858], 0
mov word [0x10203848], ax
mov dword [0x10203874], 0xf
mov dword [0x10203870], eax
mov byte [0x10203860], al
mov dword [0x1020388c], 7
mov dword [0x10203888], eax
mov word [0x10203878], ax
mov dword [0x102038a4], 0xf
mov dword [0x102038a0], eax
mov byte [0x10203890], al
push eax
push 0x101cf8e0
mov ecx, 0x10203848
mov byte [ebp - 4], 0xa
call fcn.1001e640
xor eax, eax
mov dword [ebp - 0x14], 0x102038a8
mov dword [0x102038bc], 7
mov dword [0x102038b8], 0
mov word [0x102038a8], ax
mov dword [0x102038d4], 0xf
mov dword [0x102038d0], eax
mov byte [0x102038c0], al
mov dword [0x102038ec], 7
mov dword [0x102038e8], eax
mov word [0x102038d8], ax
mov dword [0x10203904], 0xf
mov dword [0x10203900], eax
mov byte [0x102038f0], al
push eax
push 0x101cf8e0
mov ecx, 0x102038a8
mov byte [ebp - 4], 0xf
call fcn.1001e640
xor eax, eax
mov dword [ebp - 0x14], 0x10203908
mov dword [0x1020391c], 7
mov dword [0x10203918], 0
mov word [0x10203908], ax
mov dword [0x10203934], 0xf
mov dword [0x10203930], eax
mov byte [0x10203920], al
mov dword [0x1020394c], 7
mov dword [0x10203948], eax
mov word [0x10203938], ax
mov dword [0x10203964], 0xf
mov dword [0x10203960], eax
mov byte [0x10203950], al
push eax
push 0x101cf8e0
mov ecx, 0x10203908
mov byte [ebp - 4], 0x14
call fcn.1001e640
xor eax, eax
mov dword [ebp - 0x14], 0x10203968
mov dword [0x1020397c], 7
mov dword [0x10203978], 0
mov word [0x10203968], ax
mov dword [0x10203994], 0xf
mov dword [0x10203990], eax
mov byte [0x10203980], al
mov dword [0x102039ac], 7
mov dword [0x102039a8], eax
mov word [0x10203998], ax
mov dword [0x102039c4], 0xf
mov dword [0x102039c0], eax
mov byte [0x102039b0], al
push eax
push 0x101cf8e0
mov ecx, 0x10203968
mov byte [ebp - 4], 0x19
call fcn.1001e640
xor eax, eax
mov dword [ebp - 0x14], 0x102039c8
mov dword [0x102039dc], 7
mov dword [0x102039d8], 0
mov word [0x102039c8], ax
mov dword [0x102039f4], 0xf
mov dword [0x102039f0], eax
mov byte [0x102039e0], al
mov dword [0x10203a0c], 7
mov dword [0x10203a08], eax
mov word [0x102039f8], ax
mov dword [0x10203a24], 0xf
mov dword [0x10203a20], eax
mov byte [0x10203a10], al
push eax
push 0x101cf8e0
mov ecx, 0x102039c8
mov byte [ebp - 4], 0x1e
call fcn.1001e640
xor eax, eax
mov dword [ebp - 0x14], 0x10203a28
mov dword [0x10203a3c], 7
mov dword [0x10203a38], 0
mov word [0x10203a28], ax
mov dword [0x10203a54], 0xf
mov dword [0x10203a50], eax
mov byte [0x10203a40], al
mov dword [0x10203a6c], 7
mov dword [0x10203a68], eax
mov word [0x10203a58], ax
mov dword [0x10203a84], 0xf
mov dword [0x10203a80], eax
mov byte [0x10203a70], al
push eax
push 0x101cf8e0
mov ecx, 0x10203a28
mov byte [ebp - 4], 0x23
call fcn.1001e640
mov ecx, 0x10203a88
mov byte [ebp - 4], 0x24
call fcn.10002440
mov ecx, 0x10203ae8
mov byte [ebp - 4], 0x25
call fcn.10002440
mov dword [0x10203b4c], 0
mov dword [0x10203b50], 0
mov dword [0x10203b54], 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x27
push eax
push 0
mov ecx, 0x10203b58
mov dword [ebp - 0x14], 0
mov dword [0x10203b58], 0
mov dword [0x10203b5c], 0
mov dword [0x10203b60], 0
call fcn.10017bc0
mov dword [0x10203b64], 0
mov byte [ebp - 4], 0x28
mov dword [0x10203b68], 0
mov dword [0x10203b6c], 0
call fcn.10018520
mov dword [0x10203b68], eax
mov ecx, 0x10203b70
mov byte [ebp - 4], 0x29
call fcn.10012fe0
mov ecx, 0x10203b84
mov byte [ebp - 4], 0x2a
call fcn.1001e000
mov dword [0x10203bf0], 0xf
mov dword [0x10203bec], 0
mov byte [0x10203bdc], 0
mov byte [ebp - 4], 0x2c
mov dword [0x10203bf8], 0
mov dword [0x10203bfc], 0
call fcn.10018550
mov dword [0x10203bf8], eax
mov ecx, 0x10203c00
mov byte [ebp - 4], 0x2d
call fcn.1001e000
xor eax, eax
mov dword [0x10203c34], 7
mov dword [0x10203c30], 0
mov word [0x10203c20], ax
mov dword [0x10203c50], 0xf
mov dword [0x10203c4c], eax
mov byte [0x10203c3c], al
mov dword [0x10203c54], eax
mov dword [0x10203c58], eax
mov dword [0x10203c5c], eax
mov dword [0x10203c74], 0xf
mov dword [0x10203c70], eax
mov byte [0x10203c60], al
mov byte [ebp - 4], 0x32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.1000ebc0
mov ebx, eax
mov esi, 0x10203c20
cmp ebx, esi
je 0x10005dfc
cmp dword [0x10203c34], 8
jb 0x10005dd8
push dword [0x10203c20]
call fcn.1002fb32
add esp, 4
xor eax, eax
mov dword [0x10203c34], 7
push ebx
mov ecx, esi
mov dword [0x10203c30], 0
mov word [0x10203c20], ax
call fcn.1001e150
cmp dword [ebp - 0x18], 8
jb 0x10005e0d
push dword [ebp - 0x2c]
call fcn.1002fb32
add esp, 4
push edi
call fcn.1000ed90
mov dword [0x10203c38], eax
call fcn.10010160
test eax, eax
je 0x10005e82
mov ecx, edi
call fcn.100100e0
test eax, eax
jne 0x10005e82
cmp dword [0x10203c34], 8
lea eax, [ebp - 0x9c]
push ecx
cmovae esi, dword [0x10203c20]
push esi
push eax
call fcn.100108f0
push edi
mov byte [ebp - 4], 0x34
push dword [0x10203c38]
push ecx
mov ecx, eax
call fcn.10002930
push eax
push str.X64:PU._s:SID._lu:PID._.4d
lea eax, [ebp - 0x2c]
push eax
push 0x10203748
call fcn.10011050
add esp, 0x18
mov ecx, 0x10203c3c
push eax
call fcn.100124f0
jmp 0x10005f0f
cmp dword [0x10203c34], 8
lea eax, [ebp - 0x9c]
push ecx
cmovae esi, dword [0x10203c20]
push esi
push eax
call fcn.100108f0
push edi
mov byte [ebp - 4], 0x33
push dword [0x10203c38]
push ecx
mov ecx, eax
call fcn.10002930
push eax
push str.X86:PU._s:SID._lu:PID._.4d
lea eax, [ebp - 0x2c]
push eax
push 0x10203748
call fcn.10011050
mov esi, eax
add esp, 0x18
cmp esi, 0x10203c3c
je 0x10005f0f
cmp dword [0x10203c50], 0x10
jb 0x10005ee9
push dword [0x10203c3c]
call fcn.1002fb32
add esp, 4
push esi
mov ecx, 0x10203c3c
mov dword [0x10203c50], 0xf
mov dword [0x10203c4c], 0
mov byte [0x10203c3c], 0
call fcn.1001e080
cmp dword [ebp - 0x18], 0x10
jb 0x10005f20
push dword [ebp - 0x2c]
call fcn.1002fb32
add esp, 4
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0x32
call fcn.100024d0
mov esi, 0xa
push 0
push 0x101cf8e2
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.1001ec60
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x35
push eax
mov ecx, 0x10203b4c
call fcn.10012930
mov byte [ebp - 4], 0x32
cmp dword [ebp - 0x18], 0x10
jb 0x10005f8e
push dword [ebp - 0x2c]
call fcn.1002fb32
add esp, 4
dec esi
jne 0x10005f46
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0xd]
mov ecx, 0x10203b58
push eax
cmp esi, 6
je 0x10005fa7
mov byte [ebp - 0xd], 1
call fcn.10012f70
inc esi
cmp esi, 0xa
jl 0x10005f91
mov ecx, dword [0x10203b4c]
push 4
push str.NULL
call fcn.1001ec60
mov ecx, dword [0x10203b4c]
push 4
push str.INFO
lea ecx, [ecx + 0x18]
call fcn.1001ec60
mov ecx, dword [0x10203b4c]
push 8
push str.WARNNING
lea ecx, [ecx + 0x30]
call fcn.1001ec60
mov ecx, dword [0x10203b4c]
push 5
push str.ERROR
lea ecx, [ecx + 0x48]
call fcn.1001ec60
mov ecx, dword [0x10203b4c]
push 7
push str.PRIVATE
lea ecx, [ecx + 0x60]
call fcn.1001ec60
mov ecx, dword [0x10203b4c]
push 9
push str.EXCEPTION
lea ecx, [ecx + 0x78]
call fcn.1001ec60
mov ecx, dword [0x10203b4c]
push 5
push str.DEBUG
lea ecx, [ecx + 0x90]
call fcn.1001ec60
xor esi, esi
mov dword [ebp - 0x14], esi
lea ebx, [ebx]
mov eax, dword [0x10203b4c]
lea edi, [esi + esi*2]
cmp dword [eax + edi*8 + 0x10], 0
je 0x100060c0
lea ecx, [eax + edi*8]
mov edx, str.NULL
call fcn.100186e0
test al, al
jne 0x100060c0
mov edx, dword [0x10203b4c]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
lea edx, [edx + edi*8]
call fcn.10018cf0
add esp, 4
push eax
mov ecx, 0x10203b68
mov byte [ebp - 4], 0x36
call fcn.10019930
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, 0x10203b68
push eax
call fcn.10019960
mov byte [ebp - 4], 0x32
cmp dword [ebp - 0x1c], 0x10
jb 0x100060c0
push dword [ebp - 0x30]
call fcn.1002fb32
add esp, 4
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0xa
jl 0x10006050
movdqa xmm0, xmmword [0x101d1d90]
mov ecx, 0x10203bdc
movdqa xmmword [0x10203bb0], xmm0
xorps xmm0, xmm0
push 4
push str.null
mov dword [0x102037c4], 0
mov dword [0x102037c8], 0
mov word [0x10203ba8], 0x101
mov dword [0x10203ba4], 0x64
mov dword [0x10203bac], 0
movdqa xmmword [0x10203bc0], xmm0
mov dword [0x10203bd0], 0
mov dword [0x10203bd4], 0xa
mov byte [0x10203bd8], 1
mov dword [0x10203bf4], 0
call fcn.1001ec60
mov eax, 0x102037c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret