Function at 0x10017515
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x158
mov eax, 0x10078ce1
call fcn.10040a5d
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov dword [0x100a61d0], eax
test edi, edi
je 0x10017bfc
cmp dword [ebp + 0xc], 1
je 0x10017552
cmp dword [ebp + 0xc], 4
je 0x10017552
cmp dword [ebp + 0xc], 0x100
jne 0x10017bfc
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.10042b60
add esp, 0xc
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 4], ebx
mov eax, 0x100a2e48
push 0x10
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
pop ebx
cmp dword [0x100a2e5c], ebx
cmovae eax, dword [0x100a2e48]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edx, edx
mov dword [ebp - 0x144], 0x3d390649
mov cl, 0x49
mov dword [ebp - 0x140], 0x67272620
mov dword [ebp - 0x13c], 0x202700
mov eax, edx
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 0xa
jae 0x100175de
mov cl, byte [ebp - 0x144]
jmp 0x100175c9
lea eax, [ebp - 0x143]
mov byte [ebp - 0x139], dl
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [esi], 0
je 0x100176bc
cmp edi, dword [esi]
jne 0x100176bc
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x100aa414], 1
setne dl
cmp edx, 1
mov dword [0x100aa414], edx
sete byte [0x100a610f]
call fcn.1000de3b
mov ecx, eax
cmp dword [ecx + 0x14], ebx
jb 0x10017639
mov ecx, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x6e6c5407
mov dl, 7
mov dword [ebp - 0x140], 0x75466b6b
mov word [ebp - 0x13c], 0x6662
mov eax, ebx
mov byte [ebp - 0x13a], bl
xor byte [ebp + eax - 0x143], dl
inc eax
cmp eax, 9
jae 0x10017677
mov dl, byte [ebp - 0x144]
jmp 0x10017662
mov byte [ebp - 0x13a], bl
mov dl, 3
mov dword [ebp - 0x134], 0x706a4e03
mov eax, ebx
mov word [ebp - 0x130], 0x60
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x100176a9
mov dl, byte [ebp - 0x134]
jmp 0x10017694
lea eax, [ebp - 0x114]
push eax
push ecx
lea eax, [ebp - 0x143]
jmp 0x10017acb
cmp dword [esi + 4], 0
je 0x100177b0
cmp edi, dword [esi + 4]
jne 0x100177b0
mov esi, dword [0x100a6050]
xor eax, eax
cmp dword [0x100aa418], 1
setne al
mov dword [0x100aa418], eax
test esi, esi
je 0x1001771e
mov esi, dword [esi + 0xc]
test esi, esi
je 0x1001771e
test eax, eax
je 0x10017714
cmp dword [esi], 0
je 0x1001771e
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001771e
mov ecx, dword [esi]
push 1
call dword [0x10093d0c]
jmp 0x1001771e
sub esp, 0xc
mov ecx, esi
call fcn.100148cd
mov edx, dword [0x100aa418]
lea ecx, [ebp - 0x164]
call fcn.1000de3b
mov ecx, eax
cmp dword [ecx + 0x14], ebx
jb 0x10017738
mov ecx, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x3f341651
mov dl, 0x51
mov dword [ebp - 0x140], 0x38073438
mov dword [ebp - 0x13c], 0x3d333822
mov eax, ebx
mov word [ebp - 0x138], 0x34
xor byte [ebp + eax - 0x143], dl
inc eax
cmp eax, 0xc
jae 0x1001777a
mov dl, byte [ebp - 0x144]
jmp 0x10017765
mov byte [ebp - 0x137], bl
mov dl, 0x6a
mov dword [ebp - 0x134], 0x1903276a
mov eax, ebx
mov word [ebp - 0x130], 9
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x100176a9
mov dl, byte [ebp - 0x134]
jmp 0x10017797
cmp dword [esi + 8], 0
je 0x10017866
cmp edi, dword [esi + 8]
jne 0x10017866
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x100aa420], 1
setne dl
mov dword [0x100aa420], edx
call fcn.1000de3b
mov edx, eax
cmp dword [edx + 0x14], ebx
jb 0x100177e9
mov edx, dword [edx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x4f447321
mov cl, 0x21
mov dword [ebp - 0x140], 0x62534445
mov dword [ebp - 0x13c], 0x445140
mov eax, ebx
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 0xa
jae 0x10017822
mov cl, byte [ebp - 0x144]
jmp 0x1001780d
mov byte [ebp - 0x139], bl
mov cl, 0x64
mov dword [ebp - 0x134], 0x170d2964
mov eax, ebx
mov word [ebp - 0x130], 7
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10017854
mov cl, byte [ebp - 0x134]
jmp 0x1001783f
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x143]
jmp 0x10017aca
cmp dword [esi + 0xc], 0
je 0x1001792c
cmp edi, dword [esi + 0xc]
jne 0x1001792c
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x100aa424], 1
setne dl
mov dword [0x100aa424], edx
call fcn.1000de3b
mov edx, eax
cmp dword [edx + 0x14], ebx
jb 0x1001789f
mov edx, dword [edx]
push 0x26
pop ecx
xor ebx, ebx
mov byte [ebp - 0x148], cl
mov dword [ebp - 0x147], 0x4d484774
mov eax, ebx
mov dword [ebp - 0x143], 0x6341484f
mov dword [ebp - 0x13f], 0x45434040
mov word [ebp - 0x13b], 0x52
xor byte [ebp + eax - 0x147], cl
inc eax
cmp eax, 0xd
jae 0x100178e8
mov cl, byte [ebp - 0x148]
jmp 0x100178d3
mov byte [ebp - 0x13a], bl
mov cl, 0x58
mov dword [ebp - 0x134], 0x2b311558
mov eax, ebx
mov word [ebp - 0x130], 0x3b
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x1001791a
mov cl, byte [ebp - 0x134]
jmp 0x10017905
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x147]
jmp 0x10017aca
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10017af2
cmp edi, ecx
jne 0x10017af2
call fcn.1000fe49
mov edi, eax
cmp edi, 0x17
ja 0x10017be8
cmp edi, dword [0x100aa41c]
je 0x10017be8
mov dword [0x100aa41c], edi
mov edx, edi
mov ecx, dword [esi + 0x14]
call fcn.1000fe26
xor ecx, ecx
push edi
cmp edi, 0xa
jge 0x100179b0
movaps xmm0, xmmword [0x10095aa0]
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x13c], 0x505a040c
mov word [ebp - 0x138], 0x50
mov al, byte [ebp - 0x14c]
xor byte [ebp + ecx - 0x14b], al
inc ecx
cmp ecx, 0x14
jb 0x10017994
mov byte [ebp - 0x137], 0
jmp 0x100179e9
movaps xmm0, xmmword [0x10095980]
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x13c], 0x61616b35
mov byte [ebp - 0x138], 0
mov al, byte [ebp - 0x14c]
xor byte [ebp + ecx - 0x14b], al
inc ecx
cmp ecx, 0x13
jb 0x100179cf
mov byte [ebp - 0x138], 0
sub esp, 0x18
lea eax, [ebp - 0x14b]
mov ecx, esp
push eax
call fcn.10004181
lea eax, [ebp - 0x164]
push eax
call fcn.10003c4b
add esp, 0x20
lea ecx, [ebp - 0x12c]
push eax
call fcn.10007a5b
push 0
push 1
lea ecx, [ebp - 0x164]
call fcn.10004036
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x12c]
call fcn.1000ff04
push ecx
push edi
call fcn.10017edc
mov edx, dword [0x100aa41c]
lea ecx, [ebp - 0x164]
call fcn.1000de3b
mov edx, eax
cmp dword [edx + 0x14], ebx
jb 0x10017a53
mov edx, dword [edx]
xor ebx, ebx
mov dword [ebp - 0x140], 0x2f230542
mov cl, 0x42
mov dword [ebp - 0x13c], 0x2f2b1627
mov word [ebp - 0x138], 0x27
mov eax, ebx
xor byte [ebp + eax - 0x13f], cl
inc eax
cmp eax, 8
jae 0x10017a8b
mov cl, byte [ebp - 0x140]
jmp 0x10017a76
mov byte [ebp - 0x137], bl
mov cl, 0x52
mov dword [ebp - 0x134], 0x213b1f52
mov eax, ebx
mov word [ebp - 0x130], 0x31
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10017abd
mov cl, byte [ebp - 0x134]
jmp 0x10017aa8
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x13f]
push edx
push eax
lea eax, [ebp - 0x133]
mov byte [ebp - 0x12f], bl
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
push 1
lea ecx, [ebp - 0x164]
call fcn.10004036
jmp 0x10017bea
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10017be8
cmp edi, ecx
jne 0x10017be8
call fcn.1000fe49
mov edi, eax
cmp edi, 0x14
ja 0x10017be8
cmp edi, dword [0x100aa428]
je 0x10017be8
mov dword [0x100aa428], edi
mov edx, edi
mov ecx, dword [esi + 0x18]
call fcn.1000fe26
mov ecx, dword [esi + 0x20]
mov edx, edi
call fcn.1000ff27
movd xmm0, dword [0x100aa428]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x10094ee8]
movss dword [0x100a1a9c], xmm0
call fcn.10017129
mov edx, dword [0x100aa428]
lea ecx, [ebp - 0x164]
call fcn.1000de3b
mov edx, eax
cmp dword [edx + 0x14], ebx
jb 0x10017b75
mov edx, dword [edx]
mov byte [ebp - 0x144], bl
xor eax, eax
mov dword [ebp - 0x143], 0x757d7153
mov dword [ebp - 0x13f], 0x71427162
mov dword [ebp - 0x13b], 0x75777e
xor byte [ebp + eax - 0x143], bl
inc eax
cmp eax, 0xb
jae 0x10017bb0
mov bl, byte [ebp - 0x144]
jmp 0x10017b9b
xor ebx, ebx
mov dword [ebp - 0x134], 0x1d07236e
mov byte [ebp - 0x138], bl
mov cl, 0x6e
mov word [ebp - 0x130], 0xd
mov eax, ebx
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10017854
mov cl, byte [ebp - 0x134]
jmp 0x10017bcf
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x12c]
call fcn.10004036
mov al, 1
jmp 0x10017bfe
xor al, al
call fcn.10040a07
ret 8