Function at 0x10047cd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10120863
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x1015fc40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x15c], 0
sub eax, 0
je 0x100484bc
sub eax, 1
jne 0x100484d6
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movaps xmm0, xmmword [0x1012f260]
xor ecx, ecx
movups xmmword [ebp - 0x128], xmm0
mov word [ebp - 0x118], 0x7865
mov byte [ebp - 0x116], 0
nop word [eax + eax]
mov al, byte [ebp - 0x128]
xor byte [ebp + ecx - 0x127], al
inc ecx
cmp ecx, 0x11
jb 0x10047d50
mov byte [ebp - 0x116], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.100462b0
lea ecx, [ebp - 0x127]
add esp, 8
mov edx, eax
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10047d90
mov eax, dword [edx + 0x10]
sub ecx, esi
cmp dword [edx + 0x14], 0xf
jbe 0x10047da4
mov edx, dword [edx]
push ecx
lea ecx, [ebp - 0x127]
push ecx
push eax
push edx
call fcn.10045080
add esp, 0x10
mov byte [ebp - 0x155], al
lea ecx, [ebp - 0x154]
call fcn.10022b40
cmp byte [ebp - 0x155], 0
je 0x100484d6
mov dl, 0x54
mov dword [ebp - 0x138], 0x333b3854
mov dword [ebp - 0x134], 0x333b387b
xor ecx, ecx
mov dword [ebp - 0x130], 0x202c207a
mov byte [ebp - 0x12c], 0
nop dword [eax]
lea eax, [ebp - 0x137]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x10047e17
mov dl, byte [ebp - 0x138]
jmp 0x10047e00
xorps xmm0, xmm0
mov byte [ebp - 0x12c], 0
movups xmmword [ebp - 0x154], xmm0
mov dword [ebp - 0x140], 7
lea ecx, [ebp - 0x137]
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10047e42
xor eax, eax
mov dword [ebp - 0x144], 0
push eax
mov word [ebp - 0x154], ax
sub ecx, edx
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x137]
add eax, ecx
push eax
lea eax, [ebp - 0x137]
push eax
call fcn.100eda90
push 0
lea eax, [ebp - 0x154]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.100ef430
mov eax, dword [ebp - 0x120]
add esp, 0x1c
test eax, eax
je 0x10047eb0
mov byte [ebp - 0x155], 1
cmp eax, 1
jne 0x10047eb7
mov byte [ebp - 0x155], 0
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 7
jbe 0x10047efe
mov edx, dword [ebp - 0x154]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10047ef4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100484f5
push ecx
push edx
call fcn.100d4f2c
add esp, 8
cmp byte [ebp - 0x155], 0
je 0x10048155
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x20c], 0x1012f204
call fcn.100453f0
push 0
push 0
lea eax, [ebp - 0x208]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x15c], 1
call fcn.10045470
mov eax, dword [ebp - 0x20c]
xorps xmm0, xmm0
push 8
mov dword [ebp - 4], 3
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x210], eax
mov dword [ebp - method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
movups xmmword [ebp - 0x204], xmm0
movups xmmword [ebp - 0x1f4], xmm0
movups xmmword [ebp - 0x1e4], xmm0
call fcn.100d4efc
mov esi, eax
add esp, 4
test esi, esi
je 0x10047fba
push 1
mov byte [ebp - 4], 4
call fcn.100d7598
add esp, 4
mov dword [esi + 4], eax
jmp 0x10047fbc
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x1d4], esi
call fcn.10046710
mov ecx, dword [0x10198ba0]
lea eax, [ebp - 0x204]
mov dword [ebp - 0x1fc], eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0x1f4]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1f0]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x1dc], eax
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1d8], eax
mov eax, dword [0x10198b9c]
mov dword [ebp - method.std::basic_filebuf_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebp - 0x1c0], 0
mov byte [ebp - 0x1cb], 0
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], ecx
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 4], 5
mov dl, 6
mov dword [ebp - 0x138], 0x61696a06
xor ecx, ecx
mov dword [ebp - 0x134], 0x61696a29
mov dword [ebp - 0x130], 0x727e7228
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x137]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x100480db
mov dl, byte [ebp - 0x138]
jmp 0x100480c4
push 0x40
push 0x12
lea eax, [ebp - 0x137]
mov byte [ebp - 0x12c], 0
push eax
lea ecx, [ebp - 0x20c]
call fcn.10046cf0
lea ecx, [ebp - 0x208]
call fcn.10046860
test eax, eax
jne 0x10048143
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
xor eax, eax
cmp dword [ebp + ecx - 0x1d4], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ebp + ecx - 0x200]
and eax, 0x17
mov dword [ebp + ecx - 0x200], eax
mov ecx, dword [ebp + ecx - 0x1fc]
and ecx, eax
jne 0x100484fa
lea ecx, [ebp - 0x20c]
mov dword [ebp - 4], 0xffffffff
call fcn.10045ee0
call fcn.1007cb60
test al, al
jne 0x1004822a
mov cl, 0x29
mov byte [ebp - 0x120], 0x5b
mov dl, cl
mov byte [ebp - 0x155], 0x78
mov ch, cl
mov byte [ebp - 0x156], 0x6b
xor cl, byte [ebp - 0x120]
mov al, 0x1e
xor al, byte [ebp - 0x120]
mov ah, 0x34
mov byte [ebp - 0x11f], al
mov dh, 0x7b
mov al, byte [ebp - 0x155]
mov byte [ebp - 0x11e], cl
mov cl, byte [ebp - 0x120]
xor al, cl
mov byte [ebp - 0x157], 0x6d
mov byte [ebp - 0x119], al
xor ah, cl
mov al, byte [ebp - 0x156]
xor dl, cl
xor al, cl
mov byte [ebp - 0x11c], ah
mov byte [ebp - 0x118], al
xor ch, cl
mov al, byte [ebp - 0x157]
xor dh, cl
xor al, cl
mov byte [ebp - 0x116], 0
mov byte [ebp - 0x117], al
lea eax, [ebp - 0x11f]
push eax
mov byte [ebp - 0x11d], dl
mov byte [ebp - 0x11b], ch
mov byte [ebp - 0x11a], dh
mov byte [ebp - 0x116], 0
call fcn.100595e0
add esp, 4
push dword [0x10198b94]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1c
call fcn.10074540
add esp, 4
jmp 0x100484d6
call fcn.1007ca70
call fcn.1007c980
test al, al
jne 0x10048304
mov cl, 0x77
mov byte [ebp - 0x120], 5
mov dl, cl
mov byte [ebp - 0x157], 0x26
mov ch, cl
mov byte [ebp - 0x156], 0x35
xor cl, byte [ebp - 0x120]
mov al, 0x40
xor al, byte [ebp - 0x120]
mov ah, 0x6a
mov byte [ebp - 0x11f], al
mov dh, 0x25
mov al, byte [ebp - 0x157]
mov byte [ebp - 0x11e], cl
mov cl, byte [ebp - 0x120]
xor al, cl
mov byte [ebp - 0x155], 0x30
mov byte [ebp - 0x119], al
xor ah, cl
mov al, byte [ebp - 0x156]
xor dl, cl
xor al, cl
mov byte [ebp - 0x11c], ah
mov byte [ebp - 0x118], al
xor ch, cl
mov al, byte [ebp - 0x155]
xor dh, cl
xor al, cl
mov byte [ebp - 0x116], 0
mov byte [ebp - 0x117], al
lea eax, [ebp - 0x11f]
push eax
mov byte [ebp - 0x11d], dl
mov byte [ebp - 0x11b], ch
mov byte [ebp - 0x11a], dh
mov byte [ebp - 0x116], 0
call fcn.100595e0
add esp, 4
push dword [0x10198b94]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x18
call fcn.10074540
add esp, 4
jmp 0x100484d6
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov cl, 0x2a
mov byte [ebp - 0x120], 0x4e
mov ah, cl
mov byte [ebp - 0x156], 0x22
xor cl, byte [ebp - 0x120]
mov al, 0x12
xor al, byte [ebp - 0x120]
mov dl, 0x7d
mov byte [ebp - 0x11f], al
mov ch, 0x77
mov byte [ebp - 0x157], ah
mov dh, 0x60
mov al, byte [ebp - 0x157]
mov byte [ebp - 0x11e], cl
mov cl, byte [ebp - 0x120]
xor al, cl
mov byte [ebp - 0x155], 0x22
mov byte [ebp - 0x119], al
xor ah, cl
mov al, byte [ebp - 0x156]
xor dl, cl
xor al, cl
mov byte [ebp - 0x11c], ah
mov byte [ebp - 0x118], al
xor ch, cl
mov al, byte [ebp - 0x155]
xor dh, cl
xor al, cl
mov byte [ebp - 0x116], 0
mov byte [ebp - 0x117], al
lea eax, [ebp - 0x11f]
push eax
lea eax, [ebp - 0x114]
mov byte [ebp - 0x11d], dl
push 0x104
push eax
mov byte [ebp - 0x11b], ch
mov byte [ebp - 0x11a], dh
mov byte [ebp - 0x116], 0
call fcn.10103760
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10198b94], eax
test eax, eax
je 0x100484d6
call fcn.100627b0
movaps xmm0, xmmword [str._aLW_FQ]
xor ecx, ecx
movups xmmword [ebp - 0x13c], xmm0
mov byte [ebp - 0x12c], 0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x13c]
xor byte [ebp + ecx - 0x13b], al
inc ecx
cmp ecx, 0xf
jb 0x10048410
lea eax, [ebp - 0x13b]
mov byte [ebp - 0x12c], 0
push eax
push dword [0x10198b94]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10198b8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [0x10198eb0], eax
call fcn.1007f480
add esp, 4
call fcn.1007c250
call fcn.1007b840
call fcn.1004c2e0
call fcn.10059360
call fcn.10075620
call fcn.1007ed80
call fcn.10075d30
call fcn.10076b10
call fcn.1006d010
call fcn.1007c3f0
call fcn.10076270
call fcn.10050f40
call fcn.1006cc10
call fcn.10074890
call fcn.1007cd50
call fcn.1007e310
call fcn.1004b060
call fcn.10054ef0
call fcn.10050a70
call fcn.1006b5c0
jmp 0x100484d6
cmp dword [0x10198b94], 0
je 0x100484d6
call fcn.1006ba70
push dword [0x10198b94]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d4eee
mov esp, ebp
pop ebp
ret 0xc
call fcn.10100cd5
test cl, 4
je 0x10048506
mov esi, str.ios_base::badbit_set
jmp 0x10048516
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x120]
push 1
push eax
call fcn.10046c00
add esp, 8
lea ecx, [ebp - 0x13c]
push eax
push esi
call fcn.10045a10
push 0x10156418
lea eax, [ebp - 0x13c]
push eax
call fcn.100f1f9e
int3