Function at 0x1000a720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x1002b130]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
or esi, 0xffffffff
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], 0
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test ecx, ecx
je 0x1000af5d
mov eax, dword [ecx]
lea edx, [ebp - 0x144]
push edx
push 0x10021a7c
push ecx
mov dword [ebp - 0x144], 0
call dword [eax]
test eax, eax
js 0x1000a78c
mov eax, dword [ebp - 0x144]
test eax, eax
je 0x1000a78c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov dword [ebp - 0x114], 0x6f0074
mov word [ebp - 0xc4], ax
mov word [ebp - 0x28], ax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x110], 0x6c006f
mov dword [ebp - 0x10c], 0x610062
mov dword [ebp - 0x108], 0x490072
mov dword [ebp - 0x104], 0x44
mov dword [ebp - 0xe0], 0x6e0069
mov dword [ebp - 0xdc], 0x740073
mov dword [ebp - 0xd8], 0x6c0061
mov dword [ebp - 0xd4], 0x65006c
mov dword [ebp - 0xd0], 0x5f0072
mov dword [ebp - 0xcc], 0x61006e
mov dword [ebp - 0xc8], 0x65006d
mov dword [ebp - 0x40], 0x720070
mov dword [ebp - 0x3c], 0x64006f
mov dword [ebp - 0x38], 0x630075
mov dword [ebp - 0x34], 0x5f0074
mov dword [ebp - 0x30], 0x61006e
mov dword [ebp - 0x2c], 0x65006d
mov dword [ebp - 0x100], 0x720070
mov dword [ebp - 0xfc], 0x64006f
mov dword [ebp - 0xf8], 0x630075
mov dword [ebp - 0xf4], 0x5f0074
mov dword [ebp - 0xf0], 0x650076
mov dword [ebp - 0xec], 0x730072
mov dword [ebp - 0xe8], 0x6f0069
mov dword [ebp - 0xe4], 0x6e
mov dword [ebp - 0x5c], 0x6e0069
mov dword [ebp - 0x58], 0x740073
mov dword [ebp - 0x54], 0x6c0061
mov dword [ebp - 0x50], 0x5f006c
mov dword [ebp - 0x4c], 0x690074
mov dword [ebp - 0x48], 0x65006d
call fcn.1000cd60
add esp, 4
mov eax, dword [eax]
test eax, eax
jne 0x1000a8e4
xor esi, esi
lea eax, [ebp - 0x114]
push eax
call edi
mov edi, eax
test edi, edi
jne 0x1000a8f2
jmp 0x1000b168
push eax
call edi
mov esi, eax
test esi, esi
jne 0x1000a8d0
jmp 0x1000b172
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push esi
push edi
push ecx
call dword [eax + 0x1c]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov edx, dword [ebp - 0x13c]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000a92a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push str.shopperz121220150817.exe
call fcn.10001490
push ecx
lea eax, [ebp - 0xe0]
mov ecx, esp
push eax
call fcn.10001490
push ecx
mov ecx, esp
push str.SOFTWARE_shopperz121220150817
call fcn.10001490
lea eax, [ebp - 0x13c]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1000d8b0
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
add esp, 0x14
mov eax, dword [eax]
test eax, eax
jne 0x1000a989
xor esi, esi
lea eax, [ebp - 0xe0]
push eax
call edi
mov edi, eax
test edi, edi
jne 0x1000a997
jmp 0x1000b17c
push eax
call edi
mov esi, eax
test esi, esi
jne 0x1000a975
jmp 0x1000b186
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push esi
push edi
push ecx
call dword [eax + 0x1c]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov edx, dword [ebp - 0x13c]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000a9cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push str.shopperz121220150817
call fcn.10001490
push ecx
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.10001490
push ecx
mov ecx, esp
push str.SOFTWARE_shopperz121220150817
call fcn.10001490
lea eax, [ebp - 0x13c]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1000d8b0
add esp, 0x14
mov eax, dword [eax]
test eax, eax
jne 0x1000aa26
xor esi, esi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
jne 0x1000aa38
jmp 0x1000b190
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x1000aa11
jmp 0x1000b19a
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push esi
push edi
push ecx
call dword [eax + 0x1c]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov edx, dword [ebp - 0x13c]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000aa70
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push 0x10021b88
call fcn.10001490
push ecx
lea eax, [ebp - 0x100]
mov ecx, esp
push eax
call fcn.10001490
push ecx
mov ecx, esp
push str.SOFTWARE_shopperz121220150817
call fcn.10001490
lea eax, [ebp - 0x13c]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1000d8b0
add esp, 0x14
mov eax, dword [eax]
test eax, eax
jne 0x1000aacd
xor esi, esi
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
jne 0x1000aadf
jmp 0x1000b1a4
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x1000aab5
jmp 0x1000b1ae
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push esi
push edi
push ecx
call dword [eax + 0x1c]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov edx, dword [ebp - 0x13c]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000ab17
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push 0x10021a14
call fcn.10001490
push ecx
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
call fcn.10001490
push ecx
mov ecx, esp
push str.SOFTWARE_shopperz121220150817
call fcn.10001490
lea eax, [ebp - 0x13c]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1000d8b0
add esp, 0x14
mov eax, dword [eax]
test eax, eax
jne 0x1000ab6e
xor esi, esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
jne 0x1000ab80
jmp 0x1000b1b8
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x1000ab59
jmp 0x1000b1c2
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push esi
push edi
push ecx
call dword [eax + 0x1c]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov edx, dword [ebp - 0x13c]
or esi, 0xffffffff
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000abba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov dword [ebp - 0x24], 0x6e0064
push eax
push ecx
mov word [ebp - 0x10], ax
mov ecx, esp
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x430073
push eax
mov dword [ebp - 0x1c], 0x740061
mov dword [ebp - 0x18], 0x680063
mov dword [ebp - 0x14], 0x6e004f
call fcn.10001490
push ecx
mov ecx, esp
push str.Software_shopperz121220150817
call fcn.10001490
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1000d7e0
mov ecx, dword [ebp - 0x154]
lea edx, [ebp - 0x14c]
add esp, 0x10
mov dword [ebx + 0x50], eax
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x14c], 0
mov eax, dword [ecx]
push edx
push 0x10021a6c
push ecx
call dword [eax]
test eax, eax
jns 0x1000ac4b
mov dword [ebp - 0x14c], 0
jmp 0x1000accc
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x1000accc
mov ecx, dword [eax]
lea edx, [ebp - 0x144]
push edx
push 0x100215dc
push 0x10021f74
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x1000acbc
cmp dword [ebp - 0x144], 0
je 0x1000acbc
cmp dword [ebx + 0x4c], 0
je 0x1000ac93
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x1000ac93
mov dword [ebx + 0x4c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [ebp - 0x144]
lea ecx, [ebx + 0x4c]
call fcn.10008490
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000acbc
push eax
lea ecx, [ebx + 0xc]
call fcn.10009110
test eax, eax
js 0x1000acbc
mov dword [ebx + 0x48], 1
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x1000accc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x144]
test eax, eax
je 0x1000acdc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, 0x65
mov dword [ebp - 0x134], 0x6e0069
push ecx
xor eax, eax
mov dword [ebp - 0x60], ecx
mov ecx, esp
mov dword [ebp - 0x130], 0x740073
push 0x10021a14
mov dword [ebp - 0x12c], 0x6c0061
mov dword [ebp - 0x128], 0x65006c
mov dword [ebp - 0x124], 0x5f0072
mov dword [ebp - 0x120], 0x61006e
mov dword [ebp - 0x11c], 0x65006d
mov word [ebp - 0x118], ax
mov dword [ebp - 0xc0], 0x630073
mov dword [ebp - 0xbc], 0x690072
mov dword [ebp - 0xb8], 0x740070
mov dword [ebp - 0xb4], 0x73005f
mov dword [ebp - 0xb0], 0x6f0074
mov dword [ebp - 0xac], 0x610072
mov dword [ebp - 0xa8], 0x650067
mov word [ebp - 0xa4], ax
mov dword [ebp - 0x84], 0x650074
mov dword [ebp - 0x80], 0x70006d
mov dword [ebp - 0x7c], 0x69005f
mov dword [ebp - 0x78], 0x73006e
mov dword [ebp - 0x74], 0x610074
mov dword [ebp - 0x70], 0x6c006c
mov dword [ebp - 0x6c], 0x720065
mov dword [ebp - 0x68], 0x6e005f
mov dword [ebp - 0x64], 0x6d0061
mov dword [ebp - 0xc], 0x61647075
mov word [ebp - 8], 0x6574
mov byte [ebp - 6], al
call fcn.10001490
push ecx
lea eax, [ebp - 0xc0]
mov ecx, esp
push eax
call fcn.10001490
push ecx
lea eax, [ebp - 0x134]
mov ecx, esp
push eax
call fcn.10001490
lea eax, [ebp - 0x148]
push eax
call fcn.1000dd10
add esp, 0xc
mov ecx, esp
push 0x10021a14
call fcn.10001490
push ecx
lea eax, [ebp - 0xc0]
mov ecx, esp
push eax
call fcn.10001490
push ecx
lea eax, [ebp - 0x84]
mov ecx, esp
push eax
call fcn.10001490
lea eax, [ebp - 0x150]
push eax
call fcn.1000dd10
mov eax, dword [ebp - 0x148]
add esp, 0x10
test eax, eax
je 0x1000aebf
lea edx, [eax + 2]
jmp 0x1000ae60
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000ae60
sub eax, edx
sar eax, 1
je 0x1000aebf
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.10008710
add esp, 8
test al, al
je 0x1000aebf
lea eax, [ebp - 0xc]
mov dword [ebp - 0x158], 1
push eax
lea ecx, [ebp - 0x13c]
call fcn.100081f0
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.10008710
add esp, 8
mov byte [ebp - 0x13d], 1
test al, al
jne 0x1000aec6
mov byte [ebp - 0x13d], 0
test byte [ebp - 0x158], 1
je 0x1000aeee
mov edx, dword [ebp - 0x13c]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000aeee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x13d], 0
je 0x1000b0f2
mov eax, dword [ebp - 0x148]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.100021c0
add eax, 0x10
mov ecx, esp
mov dword [esi], eax
lea eax, [ebp - 0x84]
push eax
call fcn.10001490
push ecx
mov ecx, esp
push str.SOFTWARE_shopperz121220150817
call fcn.10001490
lea eax, [ebp - 0x13c]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1000d8b0
add esp, 0x14
mov eax, dword [eax]
test eax, eax
jne 0x1000af9e
xor esi, esi
lea eax, [ebp - 0x84]
push eax
call edi
mov edi, eax
test edi, edi
jne 0x1000afac
jmp 0x1000b1cc
cmp dword [ebx + 0x48], 0
je 0x1000af81
push dword [ebx + 0x34]
push 0x10021f84
push dword [ebx + 0x4c]
call fcn.10008e40
mov dword [ebx + 0x34], 0xfefefefe
mov dword [ebx + 0x48], 0
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x1000ace2
mov dword [ebx + 0x4c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
jmp 0x1000ace2
push eax
call edi
mov esi, eax
test esi, esi
jne 0x1000af49
jmp 0x1000b1d6
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push esi
push edi
push ecx
call dword [eax + 0x1c]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov edx, dword [ebp - 0x13c]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000afe4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov dword [ebp - 0xa0], 0x420056
mov ecx, 0x61
mov word [ebp - 0x10], ax
push ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x9c], 0x540041
mov ecx, esp
mov dword [ebp - 0x98], 0x530045
push eax
mov dword [ebp - 0x94], 0x73005f
mov dword [ebp - 0x90], 0x610074
mov dword [ebp - 0x8c], 0x750074
mov dword [ebp - 0x88], 0x73
mov dword [ebp - 0x1c], 0x630061
mov dword [ebp - 0x18], 0x690074
mov dword [ebp - 0x14], 0x650076
call fcn.10001490
push ecx
lea eax, [ebp - 0xa0]
mov ecx, esp
push eax
call fcn.10001490
push ecx
mov ecx, esp
push str.SOFTWARE_shopperz121220150817
call fcn.10001490
lea eax, [ebp - 0x13c]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1000d8b0
add esp, 0x14
mov eax, dword [eax]
test eax, eax
jne 0x1000b0a6
xor esi, esi
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
jne 0x1000b0b8
jmp 0x1000b1e0
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x1000b08e
jmp 0x1000b1ea
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push esi
push edi
push ecx
call dword [eax + 0x1c]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov edx, dword [ebp - 0x13c]
or esi, 0xffffffff
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000b0f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x154]
cmp dword [ebx + 4], edi
je 0x1000b117
test edi, edi
je 0x1000b107
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [ebx + 4]
mov dword [ebx + 4], edi
test eax, eax
je 0x1000b117
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x150]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000b136
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x148]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x1000b153
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ef8b
mov esp, ebp
pop ebp
ret 8
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
push 0x8007000e
call fcn.10002190
int3