Function at 0x1001c138
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0xa4]
sub esp, 0x124
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0xa0], eax
mov eax, dword [ebp + 0xac]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xb4]
mov esi, pe_nt_image_headers32
push esi
mov dword [ebp - 0x80], eax
xor ebx, ebx
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x74], ecx
call fcn.1008ef90
push 1
call fcn.1006d89f
push 1
push ebx
push eax
mov dword [ebp - 0x78], eax
call fcn.1008ef90
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
add esp, 0x1c
push eax
push 1
push 0x4a10
mov byte [eax], 0x10
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.1001c09d
mov ecx, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push dword [ebp + 0xb0]
push dword [ebp - 0x80]
call fcn.1001c06b
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
call fcn.1006d8a4
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.1008ef90
push 1
call fcn.1006d89f
push 1
push ebx
push eax
mov dword [ebp - 0x78], eax
call fcn.1008ef90
mov eax, dword [ebp - 0x78]
add esp, 0x20
cmp dword [edi], ebx
push eax
push 1
setne cl
push 0x4110
mov byte [eax], cl
mov ecx, dword [ebp - 0x74]
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.1001c09d
mov ecx, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp + 0xb0]
push dword [ebp - 0x80]
call fcn.1001c06b
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
call fcn.1006d8a4
push esi
push ebx
lea eax, [ebp - 0x70]
push eax
call fcn.1008ef90
push 2
call fcn.1006d89f
push 2
push ebx
push eax
mov dword [ebp - 0x78], eax
call fcn.1008ef90
mov eax, dword [ebp - 0x78]
add esp, 0x20
cmp byte [edi + 4], 1
jne 0x1001c260
mov byte [eax], bl
mov byte [eax + 1], bl
cmp byte [edi + 4], 2
jne 0x1001c26c
mov byte [eax], bl
mov byte [eax + 1], 4
mov ecx, dword [ebp - 0x74]
push eax
push 2
push 0x1210
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.1001c09d
mov ecx, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp + 0xb0]
push dword [ebp - 0x80]
call fcn.1001c06b
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
call fcn.1006d8a4
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.1008ef90
push 2
call fcn.1006d89f
push 2
push ebx
push eax
mov dword [ebp - 0x78], eax
call fcn.1008ef90
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
add esp, 0x20
push eax
push 2
push 0x5310
mov byte [eax], 0x22
mov byte [eax + 1], 0x8c
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.1001c09d
mov ecx, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp + 0xb0]
push dword [ebp - 0x80]
call fcn.1001c06b
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
call fcn.1006d8a4
cmp byte [edi + 5], 0x20
pop ecx
jb 0x1001c401
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.1008ef90
mov ecx, dword [ebp - 0x74]
add esp, 0xc
lea eax, [ebp + 0x90]
push eax
push 0x10
push 0x4810
push esi
lea eax, [ebp - 0x70]
push eax
mov byte [ebp + 0x90], 0x52
mov byte [ebp + 0x91], 0x61
mov byte [ebp + 0x92], 0x6c
mov byte [ebp + 0x93], 0x69
mov byte [ebp + 0x94], 0x6e
mov byte [ebp + 0x95], 0x6b
mov byte [ebp + 0x96], 0x57
mov byte [ebp + 0x97], 0x50
mov byte [ebp + 0x98], 0x53
mov byte [ebp + 0x99], 0x2d
mov byte [ebp + 0x9a], 1
mov byte [ebp + 0x9b], 2
mov byte [ebp + 0x9c], 3
mov byte [ebp + 0x9d], 4
mov byte [ebp + 0x9e], 5
mov byte [ebp + 0x9f], 6
call fcn.1001c09d
mov ecx, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp + 0xb0]
push dword [ebp - 0x80]
call fcn.1001c06b
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.1008ef90
mov ecx, dword [ebp - 0x74]
add esp, 0xc
push edi
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.1001bf7d
mov ecx, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp + 0xb0]
push dword [ebp - 0x80]
call fcn.1001c06b
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp + 0xa0]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008e5e8
add ebp, 0xa4
leave
ret 0xc