Function at 0x10017bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020a58
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10061338]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
lea edi, [ebx + 4]
mov dword [ebx], 0x100
mov byte [ebx + 0x14], 0
mov word [ebx + 0x1c], 0
mov byte [ebx + 0x1e], 0
mov eax, dword [ecx]
push edi
push ecx
mov esi, dword [eax + 0xac]
mov ecx, esi
call dword [0x10063524]
call esi
test eax, eax
js 0x10017f50
push edi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x10017f50
mov al, 1
mov edi, dword [ebp + 8]
lea ecx, [ebx + 0x18]
mov byte [ebx + 3], al
push ecx
push edi
mov eax, dword [edi]
mov esi, dword [eax + 0x54]
mov ecx, esi
call dword [0x10063524]
call esi
test eax, eax
js 0x1002480b
mov al, 1
mov byte [ebx + 0x14], al
test al, al
je 0x10017c77
mov eax, dword [ebx + 0x18]
cmp eax, 0xc357
je 0x10024812
cmp eax, 0xc358
je 0x10024812
mov edx, 0x10008290
mov dword [ebp - 4], 1
mov eax, edx
mov esi, 0xc
lea ebx, [ebx]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x10017f25
add edx, 4
add eax, 4
sub esi, 4
jae 0x10017c90
xor eax, eax
test eax, eax
jne 0x10024866
mov edi, 0x10061ea8
mov dword [ebp - 0x28], edi
test eax, eax
js 0x10017d9e
mov eax, 0xb
mov word [ebp - 0x38], ax
xor eax, eax
mov word [ebp - 0x30], ax
mov byte [ebp - 4], 2
mov eax, dword [edi]
push 1
mov esi, dword [eax + 0x24]
lea eax, [ebp - 0x14]
push eax
push edi
cmp esi, fcn.10018410
je 0x10017f11
mov ecx, esi
call dword [0x10063524]
call esi
test eax, eax
js 0x10024883
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
mov esi, dword [ecx]
push ecx
mov esi, dword [esi + 0x28]
mov ecx, esi
call dword [0x10063524]
call esi
test eax, eax
js 0x10024883
cmp word [ebp - 0x30], 0xffff
mov ax, word [ebp - 0x38]
je 0x10024872
xor cl, cl
mov byte [ebx + 0x1d], cl
cmp ax, 0xb
jne 0x1002488c
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [edi]
mov esi, dword [eax + 0x28]
lea eax, [ebp - 0x20]
push eax
push edi
cmp esi, fcn.100181b0
je 0x10017f1b
mov ecx, esi
call dword [0x10063524]
call esi
test eax, eax
js 0x10017d94
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x38]
push ecx
push dword [ebp - 0x20]
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x28]
mov ecx, esi
call dword [0x10063524]
call esi
test eax, eax
js 0x10017d94
cmp word [ebp - 0x30], 0xffff
je 0x100248a4
xor al, al
mov byte [ebx + 0x1e], al
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10017db9
mov eax, dword [edi]
push edi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10063524]
call esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10017df1
push 0x10008238
push esi
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x100248b6
push 0x10008238
push 2
push esi
call dword [sym.imp.USER32.dll_GetAncestor]
push eax
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x100248b6
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 3
mov dword [ebp - 0x18], 0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
push 0x100082b0
mov esi, dword [edi]
push 0x271e
push edi
mov esi, dword [esi + 0x38]
mov ecx, esi
call dword [0x10063524]
call esi
test eax, eax
js 0x10017e39
cmp dword [ebp - 0x1c], 0
jne 0x10017f57
mov byte [ebp - 0xe], 0
mov esi, dword [edi]
lea eax, [ebp - 0x18]
push eax
push 0x100082a0
push 0x272d
mov esi, dword [esi + 0x38]
mov ecx, esi
push edi
call dword [0x10063524]
call esi
test eax, eax
js 0x10017e69
cmp dword [ebp - 0x18], 0
jne 0x100248bf
xor al, al
cmp byte [ebp - 0xe], 0
mov byte [ebp - 0xf], al
jne 0x10017f60
test al, al
jne 0x10017f60
xor al, al
mov byte [ebx], al
lea ecx, [ebp - 0x24]
mov eax, dword [edi]
push ecx
push edi
mov byte [ebp - 0xd], 0
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x10063524]
call esi
test eax, eax
js 0x10017eba
cmp dword [ebp - 0x24], 0
jne 0x100248c6
xor al, al
mov byte [ebx + 2], al
test al, al
jne 0x100248cd
cmp byte [ebx], 0
jne 0x10017f7e
cmp byte [ebx + 0x14], 0
je 0x10017ed6
cmp dword [ebx + 0x18], 0xc354
je 0x10024964
xor al, al
mov byte [ebx], al
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x10024975
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10017ffb
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.10018410
jmp 0x10017cf4
call fcn.100181b0
jmp 0x10017d62
cmp cl, byte [eax]
je 0x10017f33
sbb eax, eax
or eax, 1
jmp 0x10017ca7
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x10017f29
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x10017f29
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
jne 0x10017f29
jmp 0x10017ca5
xor al, al
jmp 0x10017c33
mov byte [ebp - 0xe], 1
jmp 0x10017e3d
cmp byte [ebx + 0x14], 0
je 0x10017e80
cmp dword [ebx + 0x18], 0xc35f
je 0x10017e80
mov al, 1
jmp 0x10017e82
cmp byte [ebp - 0xe], 0
je 0x10017fe9
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x14]
mov esi, dword [edi]
push eax
push 0x100083d0
push 0x2712
mov esi, dword [esi + 0x38]
mov ecx, esi
push edi
call dword [0x10063524]
call esi
test eax, eax
mov eax, dword [ebp - 0x14]
js 0x10017fc6
test eax, eax
je 0x10017fc6
push eax
mov ecx, ebx
call fcn.1001688e
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x14]
mov cl, byte [ebp - 0xd]
test cl, cl
je 0x10024930
mov byte [ebp - 4], 4
test eax, eax
je 0x10017fec
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x10063524]
call esi
mov cl, byte [ebp - 0xd]
cmp byte [ebp - 0xf], 0
je 0x10017eda
jmp 0x10024947
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x10063524]
call esi
jmp 0x10017efb
inc ebp
lodsd eax, dword [esi]
ret 0x45c6
dec dword [edi]
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
enter 0xffffffffffffc666, 0x45
leave
jb 0x10024883
inc ebp
retf 0xc67f
jg 0x10024887
inc ebp
retf
int3
inc ebp
into
jl 0x10024897
inc ebp
iretd
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.100245af
push eax
push esi
push dword [ebp + 8]
call fcn.10024564
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
inc ebp
xchg esi, eax
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
xor eax, esi
inc ebp
wait
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.100245af
push eax
push esi
push dword [ebp + 8]
call fcn.10024564
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100245af
push eax
push esi
push dword [ebp + 8]
call fcn.10024564
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1002459f
jge 0x10024a7d
mov bl, 0xfd
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
push ss