Function at 0x10010020
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x158
mov eax, 0x1003685e
call fcn.10035531
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov dword [0x10047144], eax
test esi, esi
je 0x1001072c
cmp dword [ebp + 0xc], 1
je 0x1001005d
cmp dword [ebp + 0xc], 4
je 0x1001005d
cmp dword [ebp + 0xc], 0x100
jne 0x1001072c
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x114]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 4], ebx
mov eax, 0x100463c8
cmp dword [0x100463dc], 0x10
mov dword [ebp - 0x11c], ebx
cmovae eax, dword [0x100463c8]
push eax
lea eax, [ebp - 0x114]
mov byte [ebp - 0x12c], bl
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1c
pop ebx
mov cl, 0x55
mov dword [ebp - 0x144], 0x21251a55
mov dword [ebp - 0x140], 0x7b3b3a3c
xor edx, edx
mov byte [ebp - 0x13c], bl
mov word [ebp - 0x13b], 0x3c3b
mov byte [ebp - 0x139], 0
xor cl, byte [ebp + edx - 0x143]
mov byte [ebp + edx - 0x143], cl
inc edx
cmp edx, 0xa
jae 0x100100fb
mov cl, byte [ebp - 0x144]
jmp 0x100100df
lea eax, [ebp - 0x143]
mov byte [ebp - 0x139], 0
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [edi], 0
je 0x100101da
cmp esi, dword [edi]
jne 0x100101da
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x1004b398], 1
setne dl
cmp edx, 1
mov dword [0x1004b398], edx
sete byte [0x10047083]
call fcn.100081b6
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x10010158
mov ecx, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x595b6330
mov dl, 0x30
mov dword [ebp - 0x140], 0x42715c5c
mov word [ebp - 0x13c], 0x5155
mov eax, ebx
mov byte [ebp - 0x13a], bl
xor byte [ebp + eax - 0x143], dl
inc eax
cmp eax, 9
jae 0x10010196
mov dl, byte [ebp - 0x144]
jmp 0x10010181
mov byte [ebp - 0x13a], bl
mov dl, 0x4d
mov dword [ebp - 0x134], 0x3e24004d
mov eax, ebx
mov word [ebp - 0x130], 0x2e
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x100101c8
mov dl, byte [ebp - 0x134]
jmp 0x100101b3
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x143]
jmp 0x100105f7
cmp dword [edi + 4], 0
je 0x100102cf
cmp esi, dword [edi + 4]
jne 0x100102cf
mov esi, dword [0x10047000]
xor eax, eax
cmp dword [0x1004b39c], 1
setne al
mov dword [0x1004b39c], eax
test esi, esi
je 0x1001023c
mov esi, dword [esi + 0xc]
test esi, esi
je 0x1001023c
test eax, eax
je 0x10010232
cmp dword [esi], 0
je 0x1001023c
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001023c
mov ecx, dword [esi]
push 1
call dword [0x1003dcdc]
jmp 0x1001023c
sub esp, 0xc
mov ecx, esi
call fcn.1000d310
mov edx, dword [0x1004b39c]
lea ecx, [ebp - 0x164]
call fcn.100081b6
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x10010257
mov ecx, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x6f644601
mov dl, 1
mov dword [ebp - 0x140], 0x68576468
mov dword [ebp - 0x13c], 0x6d636872
mov eax, ebx
mov word [ebp - 0x138], 0x64
xor byte [ebp + eax - 0x143], dl
inc eax
cmp eax, 0xc
jae 0x10010299
mov dl, byte [ebp - 0x144]
jmp 0x10010284
mov byte [ebp - 0x137], bl
mov dl, 0x6e
mov dword [ebp - 0x134], 0x1d07236e
mov eax, ebx
mov word [ebp - 0x130], 0xd
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x100101c8
mov dl, byte [ebp - 0x134]
jmp 0x100102b6
cmp dword [edi + 8], 0
je 0x10010397
cmp esi, dword [edi + 8]
jne 0x10010397
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x1004b3a4], 1
setne dl
mov dword [0x1004b3a4], edx
call fcn.100081b6
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x10010309
mov edx, dword [edx]
push 0x1e
pop ecx
mov bl, 0x5d
mov dword [ebp - 0x144], 0x33380f5d
mov word [ebp - 0x140], 0x3839
xor eax, eax
mov byte [ebp - 0x13e], 0x2f
mov byte [ebp - 0x13d], cl
mov dword [ebp - 0x13c], 0x382d3c
xor byte [ebp + eax - 0x143], bl
inc eax
cmp eax, 0xa
jae 0x1001034f
mov bl, byte [ebp - 0x144]
jmp 0x1001033a
xor ebx, ebx
mov byte [ebp - 0x134], cl
mov byte [ebp - 0x139], bl
mov eax, ebx
mov dword [ebp - 0x133], 0x7d6d7753
mov byte [ebp - 0x12f], bl
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10010384
mov cl, byte [ebp - 0x134]
jmp 0x1001036f
lea eax, [ebp - 0x114]
push eax
push edx
lea eax, [ebp - 0x143]
jmp 0x100105f8
cmp dword [edi + 0xc], 0
je 0x1001045c
cmp esi, dword [edi + 0xc]
jne 0x1001045c
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x1004b3a8], 1
setne dl
mov dword [0x1004b3a8], edx
call fcn.100081b6
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x100103d1
mov edx, dword [edx]
mov byte [ebp - 0x148], bl
xor eax, eax
mov dword [ebp - 0x147], 0x77727d4e
mov dword [ebp - 0x143], 0x597b7275
mov dword [ebp - 0x13f], 0x7f797a7a
mov word [ebp - 0x13b], 0x68
xor byte [ebp + eax - 0x147], bl
inc eax
cmp eax, 0xd
jae 0x10010415
mov bl, byte [ebp - 0x148]
jmp 0x10010400
xor ebx, ebx
mov dword [ebp - 0x134], 0x4e54703d
mov byte [ebp - 0x13a], bl
mov cl, 0x3d
mov word [ebp - 0x130], 0x5e
mov eax, ebx
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10010449
mov cl, byte [ebp - 0x134]
jmp 0x10010434
lea eax, [ebp - 0x114]
push eax
push edx
lea eax, [ebp - 0x147]
jmp 0x100105f8
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x1001061f
cmp esi, ecx
jne 0x1001061f
call fcn.10009e17
mov esi, eax
cmp esi, 0x17
ja 0x10010718
cmp esi, dword [0x1004b3a0]
je 0x10010718
mov dword [0x1004b3a0], esi
mov edx, esi
mov ecx, dword [edi + 0x14]
call fcn.10009df4
xor ebx, ebx
mov ecx, ebx
push esi
cmp esi, 0xa
jge 0x100104e1
movaps xmm0, xmmword [0x1003fc00]
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x13c], 0x6c663830
mov word [ebp - 0x138], 0x6c
mov al, byte [ebp - 0x14c]
xor byte [ebp + ecx - 0x14b], al
inc ecx
cmp ecx, 0x14
jb 0x100104c6
mov byte [ebp - 0x137], bl
jmp 0x10010518
movaps xmm0, xmmword [0x1003f900]
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x13c], 0x4040e50
mov byte [ebp - 0x138], bl
mov al, byte [ebp - 0x14c]
xor byte [ebp + ecx - 0x14b], al
inc ecx
cmp ecx, 0x13
jb 0x100104ff
mov byte [ebp - 0x138], bl
sub esp, 0x18
lea eax, [ebp - 0x14b]
mov ecx, esp
push eax
call fcn.10002845
lea eax, [ebp - 0x164]
push eax
call fcn.10004ac0
add esp, 0x20
lea ecx, [ebp - 0x12c]
push eax
call fcn.100056a7
push ebx
push 1
lea ecx, [ebp - 0x164]
call fcn.100026f1
mov ecx, dword [edi + 0x1c]
lea edx, [ebp - 0x12c]
call fcn.10009ed2
push ecx
push esi
call fcn.10010a0c
mov edx, dword [0x1004b3a0]
lea ecx, [ebp - 0x164]
call fcn.100081b6
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x10010582
mov ecx, dword [ecx]
mov dl, 0x2e
mov dword [ebp - 0x140], 0x434f692e
mov dword [ebp - 0x13c], 0x43477a4b
mov eax, ebx
mov word [ebp - 0x138], 0x4b
xor byte [ebp + eax - 0x13f], dl
inc eax
cmp eax, 8
jae 0x100105b8
mov dl, byte [ebp - 0x140]
jmp 0x100105a3
mov byte [ebp - 0x137], bl
mov dl, 0x45
mov dword [ebp - 0x134], 0x362c0845
mov eax, ebx
mov word [ebp - 0x130], 0x26
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x100105ea
mov dl, byte [ebp - 0x134]
jmp 0x100105d5
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x13f]
push ecx
push eax
lea eax, [ebp - 0x133]
mov byte [ebp - 0x12f], bl
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
push 1
lea ecx, [ebp - 0x164]
call fcn.100026f1
jmp 0x1001071a
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x10010718
cmp esi, ecx
jne 0x10010718
call fcn.10009e17
mov esi, eax
cmp esi, 0x14
ja 0x10010718
cmp esi, dword [0x1004b3ac]
je 0x10010718
mov dword [0x1004b3ac], esi
mov edx, esi
mov ecx, dword [edi + 0x18]
call fcn.10009df4
mov ecx, dword [edi + 0x20]
mov edx, esi
call fcn.10009ef5
movd xmm0, dword [0x1004b3ac]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1003ecf0]
movss dword [0x10045034], xmm0
call fcn.1000fc15
mov edx, dword [0x1004b3ac]
lea ecx, [ebp - 0x164]
call fcn.100081b6
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x100106a3
mov edx, dword [edx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x1e123073
mov cl, 0x73
mov dword [ebp - 0x140], 0x21120116
mov dword [ebp - 0x13c], 0x16141d12
mov eax, ebx
mov byte [ebp - 0x138], bl
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 0xb
jae 0x100106e2
mov cl, byte [ebp - 0x144]
jmp 0x100106cd
mov byte [ebp - 0x138], bl
mov cl, 0x59
mov dword [ebp - 0x134], 0x2a301459
mov eax, ebx
mov word [ebp - 0x130], 0x3a
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10010384
mov cl, byte [ebp - 0x134]
jmp 0x100106ff
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x12c]
call fcn.100026f1
mov al, 1
jmp 0x1001072e
xor al, al
call fcn.100354db
ret 8