Function at 0x10023bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x100ef0f8]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100f29c4]
push esi
push edi
mov dword [esp + 0x20], 0x6d617c7e
mov edi, dword [eax + ecx*4]
mov eax, dword [0x101012f4]
mov dword [esp + 0x24], 0x627e766b
mov byte [esp + 0x10], 0x2e
cmp eax, dword [edi + 4]
jle 0x10023c7e
push 0x101012f4
call fcn.10084984
add esp, 4
cmp dword [0x101012f4], 0xffffffff
jne 0x10023c7e
movq xmm0, qword [esp + 0x20]
mov al, byte [esp + 0x10]
push 0x100c3a50
movq qword [0x101012e8], xmm0
mov byte [0x101012f0], al
call fcn.10084d5f
add esp, 4
push 0x101012f4
call fcn.1008493a
add esp, 4
mov al, byte [0x101012f0]
test al, al
je 0x10023cc6
xor byte [0x101012e8], 0x2e
xor byte [0x101012e9], 0x2e
xor byte [0x101012ea], 0x2e
xor byte [0x101012eb], 0x2e
xor byte [0x101012ec], 0x2e
xor byte [0x101012ed], 0x2e
xor byte [0x101012ee], 0x2e
xor byte [0x101012ef], 0x2e
xor al, 0x2e
mov byte [0x101012f0], al
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push 0
push 0x101012e8
push 0
push 0
call esi
test eax, eax
je 0x10023d0a
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x101012e8
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101012a4]
mov dword [esp + 0x30], 0x2e5d5d4f
cmp eax, dword [edi + 4]
jle 0x10023d66
push 0x101012a4
call fcn.10084984
add esp, 4
cmp dword [0x101012a4], 0xffffffff
jne 0x10023d66
movaps xmm0, xmmword [0x100e6570]
mov eax, dword [esp + 0x30]
push 0x100c3a30
movups xmmword [0x101011fc], xmm0
mov dword [0x1010120c], eax
call fcn.10084d5f
add esp, 4
push 0x101012a4
call fcn.1008493a
add esp, 4
cmp byte [0x1010120f], 0
je 0x10023d9d
movups xmm0, xmmword [0x101011fc]
mov eax, 0x10
movaps xmm1, xmmword [0x100e64a0]
pxor xmm1, xmm0
movups xmmword [0x101011fc], xmm1
nop dword [eax]
xor byte [eax + 0x101011fc], 0x2e
inc eax
cmp eax, 0x14
jb 0x10023d90
push 0
push 0x101011fc
push 0
push 0
call esi
test eax, eax
je 0x10023ddb
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x101011fc
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101011c0]
mov dword [esp + 0x20], 0x4d415c7e
mov dword [esp + 0x24], 0x665d5d4b
mov dword [esp + 0x28], 0x4b454d4f
mov word [esp + 0x2c], 0x2e5c
cmp eax, dword [edi + 4]
jle 0x10023e59
push 0x101011c0
call fcn.10084984
add esp, 4
cmp dword [0x101011c0], 0xffffffff
jne 0x10023e59
mov eax, dword [esp + 0x28]
movq xmm0, qword [esp + 0x20]
mov dword [0x10101268], eax
mov ax, word [esp + 0x2c]
push 0x100c3a10
movq qword [0x10101260], xmm0
mov word [0x1010126c], ax
call fcn.10084d5f
add esp, 4
push 0x101011c0
call fcn.1008493a
add esp, 4
cmp byte [0x1010126d], 0
je 0x10023e71
xor eax, eax
xor byte [eax + 0x10101260], 0x2e
inc eax
cmp eax, 0xe
jb 0x10023e64
push 0
push 0x10101260
push 0
push 0
call esi
test eax, eax
je 0x10023eaf
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x10101260
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101011b4]
mov dword [esp + 0x20], 0x5c7a467e
mov dword [esp + 0x24], 0x4b604b4b
mov word [esp + 0x28], 0x2e59
cmp eax, dword [edi + 4]
jle 0x10023f1c
push 0x101011b4
call fcn.10084984
add esp, 4
cmp dword [0x101011b4], 0xffffffff
jne 0x10023f1c
movq xmm0, qword [esp + 0x20]
mov ax, word [esp + 0x28]
push 0x100c39f0
movq qword [0x10101240], xmm0
mov word [0x10101248], ax
call fcn.10084d5f
add esp, 4
push 0x101011b4
call fcn.1008493a
add esp, 4
mov al, byte [0x10101249]
test al, al
je 0x10023f6b
xor byte [0x10101240], 0x2e
xor byte [0x10101241], 0x2e
xor byte [0x10101242], 0x2e
xor byte [0x10101243], 0x2e
xor byte [0x10101244], 0x2e
xor byte [0x10101245], 0x2e
xor byte [0x10101246], 0x2e
xor byte [0x10101247], 0x2e
xor byte [0x10101248], 0x2e
xor al, 0x2e
mov byte [0x10101249], al
push 0
push 0x10101240
push 0
push 0
call esi
test eax, eax
je 0x10023fa9
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x10101240
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101011c4]
cmp eax, dword [edi + 4]
jle 0x10023ff4
push 0x101011c4
call fcn.10084984
add esp, 4
cmp dword [0x101011c4], 0xffffffff
jne 0x10023ff4
movaps xmm0, xmmword [0x100e64d0]
push 0x100c39e0
movups xmmword [0x101011cc], xmm0
call fcn.10084d5f
add esp, 4
push 0x101011c4
call fcn.1008493a
add esp, 4
cmp byte [0x101011db], 0
je 0x10024016
movups xmm0, xmmword [0x101011cc]
movaps xmm1, xmmword [0x100e64a0]
pxor xmm1, xmm0
movups xmmword [0x101011cc], xmm1
push 0
push 0x101011cc
push 0
push 0
call esi
test eax, eax
je 0x10024054
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x101011cc
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101011b8]
mov word [esp + 0x30], 0x71c
mov byte [esp + 0x10], 0x2e
cmp eax, dword [edi + 4]
jle 0x100240bf
push 0x101011b8
call fcn.10084984
add esp, 4
cmp dword [0x101011b8], 0xffffffff
jne 0x100240bf
mov ax, word [esp + 0x30]
movaps xmm0, xmmword [0x100e6400]
mov word [0x101012c0], ax
mov al, byte [esp + 0x10]
push 0x100c39c0
movups xmmword [0x101012b0], xmm0
mov byte [0x101012c2], al
call fcn.10084d5f
add esp, 4
push 0x101011b8
call fcn.1008493a
add esp, 4
cmp byte [0x101012c2], 0
je 0x100240fd
movups xmm0, xmmword [0x101012b0]
mov eax, 0x10
movaps xmm1, xmmword [0x100e64a0]
pxor xmm1, xmm0
movups xmmword [0x101012b0], xmm1
nop word [eax + eax]
xor byte [eax + 0x101012b0], 0x2e
inc eax
cmp eax, 0x13
jb 0x100240f0
push 0
push 0x101012b0
push 0
push 0
call esi
test eax, eax
je 0x1002413b
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x101012b0
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101012a8]
mov dword [esp + 0x20], 0x625d577d
mov dword [esp + 0x24], 0x785a5d47
mov dword [esp + 0x28], 0x1d594b47
mov word [esp + 0x2c], 0x2e1c
cmp eax, dword [edi + 4]
jle 0x100241b9
push 0x101012a8
call fcn.10084984
add esp, 4
cmp dword [0x101012a8], 0xffffffff
jne 0x100241b9
mov eax, dword [esp + 0x28]
movq xmm0, qword [esp + 0x20]
mov dword [0x10101278], eax
mov ax, word [esp + 0x2c]
push 0x100c39a0
movq qword [0x10101270], xmm0
mov word [0x1010127c], ax
call fcn.10084d5f
add esp, 4
push 0x101012a8
call fcn.1008493a
add esp, 4
cmp byte [0x1010127d], 0
je 0x100241d1
xor eax, eax
xor byte [eax + 0x10101270], 0x2e
inc eax
cmp eax, 0xe
jb 0x100241c4
push 0
push 0x10101270
push 0
push 0
call esi
test eax, eax
je 0x1002420f
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x10101270
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101012ac]
mov dword [esp + 0x48], 0x2e4c437a
cmp eax, dword [edi + 4]
jle 0x1002425d
push 0x101012ac
call fcn.10084984
add esp, 4
cmp dword [0x101012ac], 0xffffffff
jne 0x1002425d
mov eax, dword [esp + 0x48]
push 0x100c3990
mov dword [0x1010125c], eax
call fcn.10084d5f
add esp, 4
push 0x101012ac
call fcn.1008493a
add esp, 4
mov al, byte [0x1010125f]
test al, al
je 0x10024282
xor byte [0x1010125c], 0x2e
xor byte [0x1010125d], 0x2e
xor byte [0x1010125e], 0x2e
xor al, 0x2e
mov byte [0x1010125f], al
push 0
push 0x1010125c
push 0
push 0
call esi
test eax, eax
je 0x100242c0
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x1010125c
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10101258]
mov dword [esp + 0x20], 0x5c41487a
mov dword [esp + 0x24], 0x5a4b7d43
mov dword [esp + 0x28], 0x4940475a
mov word [esp + 0x2c], 0x2e5d
cmp eax, dword [edi + 4]
jle 0x1002433e
push 0x10101258
call fcn.10084984
add esp, 4
cmp dword [0x10101258], 0xffffffff
jne 0x1002433e
mov eax, dword [esp + 0x28]
movq xmm0, qword [esp + 0x20]
mov dword [0x101012cc], eax
mov ax, word [esp + 0x2c]
push 0x100c3970
movq qword [0x101012c4], xmm0
mov word [0x101012d0], ax
call fcn.10084d5f
add esp, 4
push 0x10101258
call fcn.1008493a
add esp, 4
cmp byte [0x101012d1], 0
je 0x1002435d
xor eax, eax
nop dword [eax]
xor byte [eax + 0x101012c4], 0x2e
inc eax
cmp eax, 0xe
jb 0x10024350
push 0
push 0x101012c4
push 0
push 0
call esi
test eax, eax
je 0x1002439b
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x101012c4
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101011c8]
mov dword [esp + 0x30], 0x1e141f1f
mov dword [esp + 0x34], 0x1b1e1c14
mov word [esp + 0x38], 0x1b19
mov byte [esp + 0x10], 0x2e
cmp eax, dword [edi + 4]
jle 0x10024424
push 0x101011c8
call fcn.10084984
add esp, 4
cmp dword [0x101011c8], 0xffffffff
jne 0x10024424
movaps xmm0, xmmword [0x100e6450]
mov ax, word [esp + 0x38]
movups xmmword [0x101011e0], xmm0
mov word [0x101011f8], ax
movq xmm0, qword [esp + 0x30]
mov al, byte [esp + 0x10]
push 0x100c3940
movq qword [0x101011f0], xmm0
mov byte [0x101011fa], al
call fcn.10084d5f
add esp, 4
push 0x101011c8
call fcn.1008493a
add esp, 4
cmp byte [0x101011fa], 0
je 0x1002445d
movups xmm0, xmmword [0x101011e0]
mov eax, 0x10
movaps xmm1, xmmword [0x100e64a0]
pxor xmm1, xmm0
movups xmmword [0x101011e0], xmm1
nop dword [eax + eax]
xor byte [eax + 0x101011e0], 0x2e
inc eax
cmp eax, 0x1b
jb 0x10024450
push 0
push 0x101011e0
push 0
push 0
call esi
test eax, eax
je 0x1002449b
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x101011e0
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10101224]
mov dword [esp + 0x20], 0x4247797a
mov dword [esp + 0x24], 0x415c7e4a
mov dword [esp + 0x28], 0x4f635756
mov word [esp + 0x2c], 0x4047
mov byte [esp + 0x10], 0x2e
cmp eax, dword [edi + 4]
jle 0x10024527
push 0x10101224
call fcn.10084984
add esp, 4
cmp dword [0x10101224], 0xffffffff
jne 0x10024527
mov eax, dword [esp + 0x28]
movq xmm0, qword [esp + 0x20]
mov dword [0x10101234], eax
mov ax, word [esp + 0x2c]
mov word [0x10101238], ax
mov al, byte [esp + 0x10]
push 0x100c3910
movq qword [0x1010122c], xmm0
mov byte [0x1010123a], al
call fcn.10084d5f
add esp, 4
push 0x10101224
call fcn.1008493a
add esp, 4
cmp byte [0x1010123a], 0
je 0x1002453f
xor eax, eax
xor byte [eax + 0x1010122c], 0x2e
inc eax
cmp eax, 0xf
jb 0x10024532
push 0
push 0x1010122c
push 0
push 0
call esi
test eax, eax
je 0x1002457d
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x1010122c
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10101228]
mov byte [esp + 0x10], 0x2e
cmp eax, dword [edi + 4]
jle 0x100245d6
push 0x10101228
call fcn.10084984
add esp, 4
cmp dword [0x10101228], 0xffffffff
jne 0x100245d6
movaps xmm0, xmmword [0x100e6590]
mov al, byte [esp + 0x10]
push 0x100c38f0
movups xmmword [0x10101290], xmm0
mov byte [0x101012a0], al
call fcn.10084d5f
add esp, 4
push 0x10101228
call fcn.1008493a
add esp, 4
mov al, byte [0x101012a0]
test al, al
je 0x100245ff
movups xmm0, xmmword [0x10101290]
xor al, 0x2e
movaps xmm1, xmmword [0x100e64a0]
pxor xmm1, xmm0
mov byte [0x101012a0], al
movups xmmword [0x10101290], xmm1
push 0
push 0x10101290
push 0
push 0
call esi
test eax, eax
je 0x1002463d
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x10101290
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1010124c]
mov word [esp + 0x30], 0x4b49
mov byte [esp + 0x10], 0x2e
cmp eax, dword [edi + 4]
jle 0x100246a8
push 0x1010124c
call fcn.10084984
add esp, 4
cmp dword [0x1010124c], 0xffffffff
jne 0x100246a8
mov ax, word [esp + 0x30]
movaps xmm0, xmmword [0x100e6500]
mov word [0x10101220], ax
mov al, byte [esp + 0x10]
push 0x100c38d0
movups xmmword [0x10101210], xmm0
mov byte [0x10101222], al
call fcn.10084d5f
add esp, 4
push 0x1010124c
call fcn.1008493a
add esp, 4
cmp byte [0x10101222], 0
je 0x100246dd
movups xmm0, xmmword [0x10101210]
mov eax, 0x10
movaps xmm1, xmmword [0x100e64a0]
pxor xmm1, xmm0
movups xmmword [0x10101210], xmm1
nop
xor byte [eax + 0x10101210], 0x2e
inc eax
cmp eax, 0x13
jb 0x100246d0
push 0
push 0x10101210
push 0
push 0
call esi
test eax, eax
je 0x1002471b
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x10101210
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x101011dc]
mov dword [esp + 0x20], 0x434b637a
mov dword [esp + 0x24], 0x6c575c41
mov dword [esp + 0x28], 0x5d59415c
mov word [esp + 0x2c], 0x5c4b
mov byte [esp + 0x10], 0x2e
cmp eax, dword [edi + 4]
jle 0x100247a7
push 0x101011dc
call fcn.10084984
add esp, 4
cmp dword [0x101011dc], 0xffffffff
jne 0x100247a7
mov eax, dword [esp + 0x28]
movq xmm0, qword [esp + 0x20]
mov dword [0x10101288], eax
mov ax, word [esp + 0x2c]
mov word [0x1010128c], ax
mov al, byte [esp + 0x10]
push 0x100c38a0
movq qword [0x10101280], xmm0
mov byte [0x1010128e], al
call fcn.10084d5f
add esp, 4
push 0x101011dc
call fcn.1008493a
add esp, 4
cmp byte [0x1010128e], 0
je 0x100247bf
xor eax, eax
xor byte [eax + 0x10101280], 0x2e
inc eax
cmp eax, 0xf
jb 0x100247b2
push 0
push 0x10101280
push 0
push 0
call esi
test eax, eax
je 0x100247fd
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x10101280
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1010123c]
mov byte [esp + 0x10], 0x2e
cmp eax, dword [edi + 4]
jle 0x10024856
push 0x1010123c
call fcn.10084984
add esp, 4
cmp dword [0x1010123c], 0xffffffff
jne 0x10024856
movaps xmm0, xmmword [0x100e65d0]
mov al, byte [esp + 0x10]
push 0x100c3880
movups xmmword [0x101012d4], xmm0
mov byte [0x101012e4], al
call fcn.10084d5f
add esp, 4
push 0x1010123c
call fcn.1008493a
add esp, 4
mov al, byte [0x101012e4]
test al, al
je 0x1002487f
movups xmm0, xmmword [0x101012d4]
xor al, 0x2e
movaps xmm1, xmmword [0x100e64a0]
pxor xmm1, xmm0
mov byte [0x101012e4], al
movups xmmword [0x101012d4], xmm1
push 0
push 0x101012d4
push 0
push 0
call esi
test eax, eax
je 0x100248bd
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.10023b60
mov ecx, eax
call fcn.1001af10
mov edx, eax
mov ecx, 0x101012d4
call fcn.1002d740
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.10084864
mov esp, ebp
pop ebp
ret