Function at 0x1000c550
Capabilities:
Contain obfuscated stackstrings
Get file size
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
mov bl, 0x65
push esi
push edi
mov byte [ebp - 0x28], 0x4b
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x33
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x2e
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x40], 0x50
mov byte [ebp - 0x3f], 0x72
mov byte [ebp - 0x3e], 0x6f
mov byte [ebp - 0x3d], 0x63
mov byte [ebp - 0x3c], bl
mov byte [ebp - 0x3b], 0x73
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], 0x49
mov byte [ebp - 0x38], 0x64
mov byte [ebp - 0x37], 0x54
mov byte [ebp - 0x36], 0x6f
mov byte [ebp - 0x35], 0x53
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], 0x73
mov byte [ebp - 0x32], 0x73
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x6f
mov byte [ebp - 0x2f], 0x6e
mov byte [ebp - 0x2e], 0x49
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0
push ebx
xor ebx, esp
add ebx, edx
add ebx, eax
mov ebx, 0x702ce9a9
pop ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
push ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x1000c62d
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000c62d
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
push ecx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor eax, eax
mov dword [0x100251bc], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
push ecx
mov ecx, 0x63788fa8
add ecx, eax
xor ecx, eax
pop ecx
call fcn.100115c0
test eax, eax
jl 0x1000c6b5
cmp eax, 0xfffffff4
jge 0x1000c6b5
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x9b]
mov byte [ebp - 0x9c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x9c]
mov dword [ebp - 0x5c], 8
push eax
mov eax, 0x851cb44f
sbb eax, eax
add eax, esp
sbb eax, eax
nop
pop eax
xor esi, esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov byte [edi + esi], 0
inc esi
cmp esi, 8
jl 0x1000c68a
mov eax, dword [ebp - 0x5c]
add edi, 8
dec eax
mov dword [ebp - 0x5c], eax
jne 0x1000c67a
call fcn.10008e30
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov eax, dword [0x100251bc]
test eax, eax
jne 0x1000c6c4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [0x100251bc]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push ecx
call fcn.1000c440
mov eax, dword [ebp - 4]
add esp, 8
test eax, eax
jne 0x1000c6f5
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100115c0
cmp eax, 0xfffffffb
jne 0x1000c709
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor edx, edx
mov al, 0x70
mov dword [ebp - 0x17], edx
mov byte [ebp - 0x14], al
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x56], al
mov cl, 0x61
mov al, 0x67
mov dword [ebp - 0xf], edx
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], dl
mov byte [ebp - 0x58], 0x49
mov byte [ebp - 0x57], 0x6d
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0x72
mov byte [ebp - 0x53], 0x73
mov byte [ebp - 0x52], 0x6f
mov byte [ebp - 0x51], 0x6e
mov byte [ebp - 0x50], cl
mov byte [ebp - 0x4f], 0x74
mov byte [ebp - 0x4e], bl
mov byte [ebp - 0x4d], 0x4c
mov byte [ebp - 0x4c], 0x6f
mov byte [ebp - 0x4b], al
mov byte [ebp - 0x4a], al
mov byte [ebp - 0x49], bl
mov byte [ebp - 0x48], 0x64
mov byte [ebp - 0x47], 0x4f
mov byte [ebp - 0x46], 0x6e
mov byte [ebp - 0x45], 0x55
mov byte [ebp - 0x44], 0x73
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x42], 0x72
mov byte [ebp - 0x41], dl
push edx
mov edx, 0x2a6eb4fc
mov edx, 0x73ad69a7
nop
pop edx
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x18]
push eax
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x1000c7e5
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000c7e5
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x18]
push eax
push ecx
call edi
push eax
call ebx
mov esi, eax
mov edx, dword [ebp - 4]
push edx
call esi
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x1000c803
lea eax, [ebp - 4]
push eax
call fcn.10005ba0
add esp, 4
push eax
add eax, esi
add eax, esp
xor eax, edx
mov eax, 0xb92fa620
sub eax, edi
nop
pop eax
pop edi
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret