Function at 0x10014830
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10064318]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x64], ecx
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x58], eax
lea ebx, [eax + 6]
cmp ebx, eax
jl 0x100148a8
push ebx
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
test edi, edi
je 0x100148a8
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, dword [ebp - 0x58]
test eax, eax
jne 0x10025a45
push 0xc
push 0x100080bc
lea eax, [edi + esi*2]
push 0xc
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025a65
xor eax, eax
push eax
mov word [edi + ebx*2], ax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, edi
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ProcessIdToSessionId]
push dword [ebp - 0x60]
lea eax, [ebp - 0x2c]
push 0x100080b4
push 0x14
push eax
call fcn.10014b50
lea edi, [ebp - 0x2c]
add esp, 0x10
lea ecx, [edi + 2]
lea esp, [esp]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x100148e0
sub edi, ecx
sar edi, 1
test esi, esi
je 0x100148fb
test edi, edi
je 0x1001497d
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov dword [ebp - 0x58], ecx
lea eax, [ecx + edi]
cmp eax, ecx
jl 0x1001497d
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
test ebx, ebx
je 0x1001497d
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x10014948
mov edx, dword [ebp - 0x58]
lea ecx, [edx + edx]
push ecx
lea eax, [edx + edi]
push esi
add eax, eax
push eax
push ebx
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025a96
lea eax, [edi + edi]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov eax, dword [ebp - 0x58]
lea eax, [ebx + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025ab6
mov eax, dword [ebp - 0x58]
xor edx, edx
add eax, edi
push esi
mov word [ebx + eax*2], dx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
test eax, eax
je 0x10014a4d
push 0
push 0x28
lea ecx, [ebp - 0x54]
push ecx
push 2
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x10014a4d
lea edi, [ebp - 0x54]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x100149b1
sub edi, ecx
sar edi, 1
test esi, esi
je 0x100149cc
test edi, edi
je 0x10014a4d
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov dword [ebp - 0x58], ecx
lea eax, [ecx + edi]
mov dword [ebp - 0x5c], eax
cmp eax, ecx
jl 0x10014a4d
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
test ebx, ebx
je 0x10014a4d
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x10014a1b
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
add ecx, ecx
push ecx
push esi
add eax, eax
push eax
push ebx
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025ad3
add edi, edi
lea eax, [ebp - 0x54]
push edi
push eax
mov eax, dword [ebp - 0x58]
push edi
lea eax, [ebx + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025ae9
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
push esi
mov word [ebx + eax*2], cx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, ebx
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x5c], eax
lea ebx, [eax + 0xf]
cmp ebx, eax
jl 0x10014ac5
push ebx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
test edi, edi
je 0x10014ac5
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x10014a95
mov ecx, dword [ebp - 0x5c]
lea eax, [ebx + ebx]
add ecx, ecx
push ecx
push esi
push eax
push edi
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025aff
mov eax, dword [ebp - 0x5c]
push 0x1e
push 0x10008094
push 0x1e
lea eax, [edi + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
jne 0x10025b19
xor eax, eax
push esi
mov word [edi + ebx*2], ax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, edi
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
push 0
push 4
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
mov edi, dword [ebp - 0x64]
mov dword [edi], eax
test eax, eax
je 0x10014b1f
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [edi + 4], eax
test eax, eax
je 0x10025b33
xor ebx, ebx
cmp dword [edi + 4], 0
je 0x10014b36
xor ebx, ebx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f1e0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10014afd
movzx ebx, bx
or ebx, 0x80070000
jmp 0x10014afd
test ebx, ebx
js 0x10014b05
mov ebx, 0x80004005
jmp 0x10014b05
jmp [edx - 1]
xchg ebp, eax
jo 0x10025a61
invalid
into
int1
invalid
invalid
call dword [ebp - 0x39c]
mov eax, dword [ebp - 0x33c]
mov esp, dword [ebp + 0x1c]
mov dword [esp - 4], eax
popal
add esp, 0x14
jmp dword [esp - 0x38]
adc al, 0xff
and al, 0xc8
call fcn.10024c68
invalid
add bh, bh
xchg ebp, eax
sar ah, 0xff
dec dword [ecx + 0x4680845]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.10024c68
das
sal esp, cl
rol byte [eax - 0x22f5b], cl
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
mov ebp, 0xfffffdd1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10024c46
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10024c78
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10024c2d
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10024c68
jnp 0x10025cc0
bnd retf 0x468
out dx, eax
mov dword [0xe2f045c6], eax
lea eax, [ebp - 0x20]
push eax
call fcn.10024c78
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10024c2d
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x10025d14
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x10025d34
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x10025d51
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x10025db8
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
and eax, 0x80
test eax, eax
je 0x10025d83
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
jmp 0x10025db6
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
cmp eax, 0x5c
jne 0x10025da2
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
test eax, eax
jne 0x10025db6
jmp 0x10025db8
jmp 0x10025d44
mov eax, dword [ebp - 0x670]
add eax, dword [ebp - 0x384]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.10024bd9
add esp, 0xc
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
invalid
inc dword [ebx - 0x7cff039b]
movsd dword es:[edi], dword [esi]
pushal
cld
invalid
inc dword [eax]
and dword [ebp - 0x37c], 0
and dword [ebp - 0x388], 0
and dword [ebp - 0x374], 0
mov al, byte [ebp - 8]
add al, byte [ebp - 0x670]
mov byte [ebp - 8], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov ecx, dword [ebp - 0x548]
inc dword [ebx]
dec eax
cmp al, 0x89
invalid
invalid
cli
invalid
dec dword [ebx - 0x53b7b]
dec dword [ebx + 0x4803084d]
sub byte [ecx - 0x3a773], cl
dec dword [edx - 0x7ad523bb]
nop
stc
invalid
dec dword [eax - 0x331723bb]
in eax, dx
invalid
invalid
mov edx, 0x4a580a9
cld
invalid