Function at 0x10015070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057a7d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1011eba8]
test eax, eax
jne 0x1001529c
mov dword [ebp - 0x18], 0x438c0000
xor ecx, ecx
mov dword [ebp - 0x14], 0x43c30000
mov dword [ebp - 0x24], 0xa893e1e2
mov dword [ebp - 0x20], 0xbaa2bfa4
mov word [ebp - 0x1c], 0x100
nop dword [eax]
lea eax, [ecx - 0x3f]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 8
jb 0x100150d0
sub esp, 8
mov byte [ebp - 0x1b], 0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.10020120
add esp, 8
call fcn.100125e0
call fcn.10012ed0
mov dword [ebp - 0x30], 0x6e6e7542
mov dword [ebp - 0x2c], 0x706f4879
mov byte [ebp - 0x28], 0
mov edx, 0x100a96d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.10046320
mov ecx, 0xa9
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x10059e64]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x34], al
and ecx, 0x800000ff
jns 0x1001514d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10015130
mov byte [ebp - 0x28], 0
mov edx, 0x100a96d2
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.10046320
mov ecx, 0xd1
xor edx, edx
mov al, byte [edx + 0x10059e74]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x38], al
and ecx, 0x800000ff
jns 0x1001518f
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x10015172
mov byte [ebp - 0x2a], 0
mov edx, 0x100a96d3
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.10046320
mov dword [ebp - 4], 0xffffffff
cmp byte [0x100a96d3], 0
je 0x100151e2
call fcn.100541b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10054680
push 0x10010580
push 0x100a962c
call fcn.10053c10
call fcn.10054210
call fcn.100201a0
mov eax, dword [0x1011eb84]
mov edx, dword [eax + 0x3e48]
cmp byte [edx + 0xaf], 0
jne 0x1001524e
movss xmm1, dword [edx + 0xf8]
addss xmm1, dword [0x1005f96c]
movss xmm0, dword [edx + 0xfc]
movss dword [edx + 0xf0], xmm1
movss dword [edx + 0xf4], xmm0
mov eax, dword [edx + 0x120]
mov ecx, dword [edx + 0x124]
mov dword [edx + 0x118], eax
mov eax, dword [edx + 0x130]
mov dword [edx + 0x11c], ecx
mov dword [edx + 0x12c], eax
mov byte [edx + 0x134], 1
mov dword [ebp - 0x24], 0x438c0000
xor ecx, ecx
mov dword [ebp - 0x20], 0x43c30000
mov dword [ebp - 0x18], 0xf191e2e3
mov word [ebp - 0x14], 0x97
mov byte [ebp - 0x12], 1
nop
lea eax, [ecx - 0x40]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 5
jb 0x10015270
sub esp, 8
mov byte [ebp - 0x12], 0
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x18]
call fcn.10020120
add esp, 8
call fcn.100128f0
jmp 0x10015782
cmp eax, 1
jne 0x100153a9
mov dword [ebp - 0x18], 0x438c0000
xor ecx, ecx
mov dword [ebp - 0x14], 0x43c30000
mov dword [ebp - 0x24], 0xa194e1e2
mov dword [ebp - 0x20], 0xa6a8b6a4
mov word [ebp - 0x1c], 0x100
nop dword [eax]
lea eax, [ecx - 0x3f]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 8
jb 0x100152d0
sub esp, 8
mov byte [ebp - 0x1b], 0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.10020120
add esp, 8
call fcn.100130c0
call fcn.10013370
call fcn.100201a0
mov eax, dword [0x1011eb84]
mov edx, dword [eax + 0x3e48]
cmp byte [edx + 0xaf], 0
jne 0x10015368
movss xmm1, dword [edx + 0xf8]
addss xmm1, dword [0x1005f96c]
movss xmm0, dword [edx + 0xfc]
movss dword [edx + 0xf0], xmm1
movss dword [edx + 0xf4], xmm0
mov eax, dword [edx + 0x120]
mov ecx, dword [edx + 0x124]
mov dword [edx + 0x118], eax
mov eax, dword [edx + 0x130]
mov dword [edx + 0x11c], ecx
mov dword [edx + 0x12c], eax
mov byte [edx + 0x134], 1
mov dword [ebp - 0x18], 0x438c0000
xor ecx, ecx
mov dword [ebp - 0x14], 0x43c30000
mov dword [ebp - 0x24], 0xa086e1e2
mov dword [ebp - 0x20], 0xbaa8b2ac
mov word [ebp - 0x1c], 0xba
mov byte [ebp - 0x1a], 1
lea eax, [ecx - 0x3f]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 9
jb 0x10015390
mov byte [ebp - 0x1a], 0
lea ecx, [ebp - 0x24]
jmp 0x10015774
cmp eax, 2
jne 0x100155fc
mov dword [ebp - 0x18], 0x438c0000
xor ecx, ecx
mov dword [ebp - 0x14], 0x43c30000
mov dword [ebp - 0x24], 0xb490e1e2
mov dword [ebp - 0x20], 0xada1a9aa
mov word [ebp - 0x1c], 0xbb
mov byte [ebp - 0x1a], 1
nop word [eax + eax]
lea eax, [ecx - 0x3f]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 9
jb 0x100153e0
sub esp, 8
mov byte [ebp - 0x1a], 0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.10020120
add esp, 8
mov ecx, 8
xor edx, edx
nop dword [eax]
mov al, byte [edx + str.Ijbzlzj0Bbsse]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x38], al
and ecx, 0x800000ff
jns 0x1001542d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x10015410
mov byte [ebp - 0x28], 0
mov edx, 0x100a9665
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x38]
call fcn.10046320
mov dword [ebp - 4], 0xffffffff
cmp byte [0x100a9665], 0
je 0x10015545
call fcn.100541b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10054680
push 0x10010350
push 0x100a94e8
call fcn.10053c10
call fcn.10054210
mov dword [ebp - 0x34], 0x72616843
mov dword [ebp - 0x30], 0x65746361
mov word [ebp - 0x2c], 0x72
mov edx, 0x100a9667
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x34]
call fcn.10046320
mov dword [ebp - 0x18], 0x48205048
mov dword [ebp - 0x14], 0x6b6361
mov edx, 0x100a96cb
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x18]
call fcn.10046320
mov dword [ebp - 0x18], 0x6d6c6548
mov word [ebp - 0x14], 0x7465
mov byte [ebp - 0x12], 0
mov edx, 0x100a96c9
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.10046320
mov dword [ebp - 0x18], 0x67676f47
mov word [ebp - 0x14], 0x656c
mov byte [ebp - 0x12], 0
mov edx, 0x100a96c8
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x18]
call fcn.10046320
mov dword [ebp - 0x30], 0x6b636142
mov dword [ebp - 0x2c], 0x6b636170
mov byte [ebp - 0x28], 0
mov edx, 0x100a96ca
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x30]
call fcn.10046320
mov dword [ebp - 4], 0xffffffff
call fcn.100201a0
mov eax, dword [0x1011eb84]
mov edx, dword [eax + 0x3e48]
cmp byte [edx + 0xaf], 0
jne 0x100155b1
movss xmm1, dword [edx + 0xf8]
addss xmm1, dword [0x1005f96c]
movss xmm0, dword [edx + 0xfc]
movss dword [edx + 0xf0], xmm1
movss dword [edx + 0xf4], xmm0
mov eax, dword [edx + 0x120]
mov ecx, dword [edx + 0x124]
mov dword [edx + 0x118], eax
mov eax, dword [edx + 0x130]
mov dword [edx + 0x11c], ecx
mov dword [edx + 0x12c], eax
mov byte [edx + 0x134], 1
mov dword [ebp - 0x24], 0x438c0000
xor ecx, ecx
mov dword [ebp - 0x20], 0x43c30000
mov dword [ebp - 0x18], 0xad8fe1e2
mov dword [ebp - 0x14], 0x100b2b6
nop
lea eax, [ecx - 0x3f]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 6
jb 0x100155d0
sub esp, 8
mov byte [ebp - 0x11], 0
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x18]
call fcn.10020120
add esp, 8
call fcn.10013e70
jmp 0x10015782
cmp eax, 3
jne 0x10015787
mov dword [ebp - 0x24], 0x438c0000
xor ecx, ecx
mov dword [ebp - 0x20], 0x43c30000
mov dword [ebp - 0x18], 0xf191e2e3
mov word [ebp - 0x14], 0x97
mov byte [ebp - 0x12], 1
lea eax, [ecx - 0x40]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 5
jb 0x10015626
sub esp, 8
mov byte [ebp - 0x12], 0
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x18]
call fcn.10020120
add esp, 8
mov dword [ebp - 0x18], 0x48205047
mov dword [ebp - 0x14], 0x6b6361
mov edx, 0x100f78fd
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x18]
call fcn.10046320
mov dword [ebp - 4], 0xffffffff
cmp byte [0x100f78fd], 0
je 0x100156c8
mov dword [ebp - 0x34], 0x41205047
mov dword [ebp - 0x30], 0x6e756f6d
mov word [ebp - 0x2c], 0x74
push ecx
push 0x10059c24
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], 0x64
push eax
push 0x1011ea60
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], 1
call fcn.10048fe0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
call fcn.100140c0
call fcn.100201a0
mov eax, dword [0x1011eb84]
mov edx, dword [eax + 0x3e48]
cmp byte [edx + 0xaf], 0
jne 0x10015739
movss xmm1, dword [edx + 0xf8]
addss xmm1, dword [0x1005f96c]
movss xmm0, dword [edx + 0xfc]
movss dword [edx + 0xf0], xmm1
movss dword [edx + 0xf4], xmm0
mov eax, dword [edx + 0x120]
mov ecx, dword [edx + 0x124]
mov dword [edx + 0x118], eax
mov eax, dword [edx + 0x130]
mov dword [edx + 0x11c], ecx
mov dword [edx + 0x12c], eax
mov byte [edx + 0x134], 1
mov dword [ebp - 0x18], 0x438c0000
xor ecx, ecx
mov dword [ebp - 0x14], 0x43c30000
mov dword [ebp - 0x30], 0xb08ce1e2
mov dword [ebp - 0x2c], 0xb5a3ad
mov byte [ebp - 0x28], 1
nop dword [eax + eax]
lea eax, [ecx - 0x3f]
xor byte [ebp + ecx - 0x30], al
inc ecx
cmp ecx, 7
jb 0x10015760
mov byte [ebp - 0x28], 0
lea ecx, [ebp - 0x30]
sub esp, 8
lea edx, [ebp - 0x18]
call fcn.10020120
add esp, 8
call fcn.100201a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100555b4
mov esp, ebp
pop ebp
ret