Function at 0x10006010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ed70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], edi
push eax
sbb eax, esp
sbb eax, edx
add eax, eax
sbb eax, esi
sbb eax, esp
mov eax, 0x920c8705
pop eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
sub eax, edi
je 0x100062d2
dec eax
jne 0x1000655b
mov al, byte [0x10027eb4]
test al, al
jne 0x1000607a
call fcn.10008fb0
mov byte [0x10027eb4], 1
push eax
sbb eax, esp
add eax, esi
sbb eax, eax
or eax, ebx
pop eax
call fcn.100115c0
cmp eax, edi
jl 0x1000609d
cmp eax, 0xfffffff0
jge 0x1000609d
push edi
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 4], edi
mov bl, 0x61
mov cl, 0x6c
mov al, 0x65
mov dl, 0x72
mov byte [ebp - 0x3c], 0x44
mov byte [ebp - 0x3b], 0x69
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x38], 0x62
mov byte [ebp - 0x37], cl
mov byte [ebp - 0x36], al
mov byte [ebp - 0x35], 0x54
mov byte [ebp - 0x34], 0x68
mov byte [ebp - 0x33], dl
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], 0x64
mov byte [ebp - 0x2f], 0x4c
mov byte [ebp - 0x2e], 0x69
mov byte [ebp - 0x2d], 0x62
mov byte [ebp - 0x2c], dl
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], dl
mov byte [ebp - 0x29], 0x79
mov byte [ebp - 0x28], 0x43
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], cl
mov byte [ebp - 0x25], cl
mov byte [ebp - 0x24], 0x73
mov byte [ebp - 0x23], 0
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], dl
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1b], cl
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x14], 0
push edx
mov edx, 0x6d0dae52
sbb edx, edx
sub edx, edi
or edx, ebx
pop edx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x20]
push eax
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
cmp eax, edi
jne 0x10006178
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
je 0x1000617e
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x20]
push eax
push ecx
call esi
push eax
call ebx
cmp eax, edi
je 0x1000617e
mov edx, dword [ebp + 8]
push edx
call eax
mov eax, dword [ebp + 8]
mov dword [0x100251c4], eax
push ebp
mov ebp, 0xa118108a
add ebp, esi
add ebp, eax
xor ebp, edx
pop ebp
push 0x100251f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x100270d4]
cmp eax, edi
je 0x100062a2
push eax
call fcn.100065f0
add esp, 4
cmp eax, edi
jne 0x10006230
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x144]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
add ebp, eax
xor ebp, eax
add ebp, eax
add ebp, eax
xor ebp, eax
mov ebp, 0x5002b56b
pop ebp
lea edx, [ebp - 0x144]
push edx
push 0x10027878
call fcn.100126f0
add esp, 8
test eax, eax
jne 0x10006229
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [0x100270d4]
je 0x1000629b
cmp eax, dword [0x100270dc]
je 0x1000629b
cmp eax, dword [0x100270e0]
je 0x1000629b
cmp eax, dword [0x100270e4]
je 0x1000629b
mov al, byte [0x100270b5]
test al, al
je 0x1000628a
push 0x100251f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.10005140
push ecx
add ecx, eax
add ecx, esp
xor ecx, eax
add ecx, esp
add ecx, eax
xor ecx, esp
sub ecx, ecx
pop ecx
push 0x100251f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edx
mov edx, 0x70dc4bbb
sbb edx, edx
add edx, esi
sbb edx, edx
sbb edx, esi
pop edx
jmp 0x100062a2
mov byte [0x10025210], 1
push ebp
add ebp, esi
add ebp, eax
xor ebp, edx
add ebp, esp
add ebp, esi
xor ebp, eax
pop ebp
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov al, byte [0x1002521c]
test al, al
je 0x100063dd
cmp dword [0x10025220], edi
je 0x100063dd
push ebx
sbb ebx, edx
mov ebx, 0xd0761ec7
mov ebx, 0xb24eeb8b
or ebx, edi
nop
pop ebx
mov cl, 0x6c
mov al, 0x65
mov byte [ebp - 0x1b], cl
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x36], cl
mov dl, 0x72
mov bl, 0x6d
mov cl, 0x75
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], dl
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x38], 0x44
mov byte [ebp - 0x37], al
mov byte [ebp - 0x35], al
mov byte [ebp - 0x34], 0x74
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], 0x54
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2e], dl
mov byte [ebp - 0x2d], 0x51
mov byte [ebp - 0x2c], cl
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x2a], cl
mov byte [ebp - 0x29], al
mov byte [ebp - 0x28], 0x54
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], al
mov byte [ebp - 0x24], dl
mov byte [ebp - 0x23], 0
push esi
mov esi, 0x88a0f95
mov esi, 0x99128c09
nop
pop esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x20]
push ecx
push edx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x100063c7
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100063c7
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x20]
push ecx
push edx
call ebx
push eax
call edi
mov esi, eax
mov eax, dword [0x10025220]
push 0
push eax
push 0
call esi
mov dword [0x10025220], 0
call fcn.100115c0
xor edi, edi
cmp eax, edi
jl 0x100063f8
cmp eax, 0xfffffff8
jge 0x100063f8
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [0x100270d4]
jne 0x1000653d
call fcn.100050b0
push 0xfffffffffffffffe
call sym.kvh.dll_Ordinal_2
push edi
mov edi, 0xba8bde34
mov edi, 0x4289d21e
xor edi, esp
add edi, eax
pop edi
mov dword [0x100270d4], edi
mov byte [0x100270b4], 0
mov byte [0x10027ead], 0
mov byte [ebp - 4], 7
call fcn.100115c0
cmp eax, edi
jl 0x100064e0
cmp eax, 0xfffffffc
jge 0x100064e0
push edi
xor edi, eax
sbb edi, esp
xor edi, eax
and edi, ebp
pop edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ebx, eax
mov esi, 2
test esi, esi
je 0x100064a8
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
cmp esi, ebx
mov edi, ebx
mov eax, esi
jge 0x1000648c
mov eax, ebx
mov edi, esi
sub eax, edi
je 0x1000649c
push eax
mov eax, 0x57b31272
xor eax, edx
nop
pop eax
mov edi, eax
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov esi, edi
jmp 0x1000646e
xor esi, esi
xor edi, edi
cmp esi, edi
je 0x100064e0
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test esi, esi
mov eax, esi
jge 0x100064c4
xor eax, eax
mov edi, esi
sub eax, edi
je 0x100064d4
push ebx
mov ebx, 0x200cf9e9
or ebx, edi
nop
pop ebx
mov edi, eax
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov esi, edi
jmp 0x100064aa
mov eax, dword [0x10027eb8]
cmp eax, edi
je 0x1000651d
xor esi, esi
cmp esi, 0x34
jge 0x10006504
lea ecx, [eax + esi*4]
push ecx
call fcn.100065b0
mov eax, dword [0x10027eb8]
add esp, 4
inc esi
jmp 0x100064eb
push eax
call fcn.100115e2
push 0x10027eb0
mov dword [0x10027eb8], edi
call fcn.100065b0
add esp, 8
mov byte [0x10027eb4], 0
jmp 0x10006550
call fcn.100010a0
push ebx
mov ebx, 0x8f867f7a
mov ebx, 0x5b4837a7
add ebx, esp
pop ebx
push 0x100251f8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc