Function at 0x1002c6a0
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100409c9
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x1004c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1f8], 8
movups xmmword [ebp - 0x208], xmm0
mov dword [ebp - 0x1f4], 0xf
mov dword [ebp - 0x208], 0x52455355
mov dword [ebp - 0x204], 0x454d414e
mov byte [ebp - 0x200], 0
mov dword [ebp - 4], 0
movzx eax, word [0x1004667c]
movups xmmword [ebp - 0x1f0], xmm0
mov dword [ebp - 0x1e0], 0xa
movq xmm0, qword [str.USERDOMAIN]
mov dword [ebp - 0x1dc], 0xf
movq qword [ebp - 0x1f0], xmm0
mov word [ebp - 0x1e8], ax
mov byte [ebp - 0x1e6], 0
mov eax, dword [0x100466a0]
xorps xmm0, xmm0
movups xmmword [ebp - 0x1d8], xmm0
mov dword [ebp - 0x1c8], 0xc
movq xmm0, qword [str.COMPUTERNAME]
mov dword [ebp - 0x1c4], 0xf
movq qword [ebp - 0x1d8], xmm0
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 0x1cc], 0
movzx eax, word [0x10046694]
xorps xmm0, xmm0
movups xmmword [ebp - 0x1c0], xmm0
mov word [ebp - 0x1b8], ax
movq xmm0, qword [str.LOGONSERVER]
movzx eax, byte [0x10046696]
mov dword [ebp - 0x1b0], 0xb
mov dword [ebp - 0x1ac], 0xf
movq qword [ebp - 0x1c0], xmm0
mov byte [ebp - 0x1b6], al
mov byte [ebp - 0x1b5], 0
xorps xmm0, xmm0
mov dword [ebp - 0x198], 8
movups xmmword [ebp - 0x1a8], xmm0
mov dword [ebp - 0x194], 0xf
mov dword [ebp - 0x1a8], 0x454d4f48
mov dword [ebp - 0x1a4], 0x48544150
mov byte [ebp - 0x1a0], 0
mov eax, dword [str.APPDATA]
movups xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x190], eax
movzx eax, word [0x100466ac]
mov word [ebp - 0x18c], ax
movzx eax, byte [0x100466ae]
mov dword [ebp - 0x180], 7
mov dword [ebp - 0x17c], 0xf
mov byte [ebp - 0x18a], al
mov byte [ebp - 0x189], 0
mov byte [ebp - 4], 5
push 0x20
movups xmmword [ebp - 0x178], xmm0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0xf
call fcn.1003c637
movups xmm0, xmmword [str.CommonProgramFiles]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x168], 0x12
mov dword [ebp - 0x164], 0x1f
movups xmmword [eax], xmm0
movzx ecx, word [0x100466dc]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], 0
mov eax, dword [0x100466c4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x160], xmm0
mov dword [ebp - 0x150], 0xc
movq xmm0, qword [str.ProgramFiles]
mov dword [ebp - 0x14c], 0xf
movq qword [ebp - 0x160], xmm0
mov dword [ebp - 0x158], eax
mov byte [ebp - 0x154], 0
mov eax, dword [0x100466f4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x148], xmm0
mov dword [ebp - 0x140], eax
movzx eax, word [0x100466f8]
movq xmm0, qword [str.ALLUSERSPROFILE]
mov word [ebp - 0x13c], ax
movzx eax, byte [0x100466fa]
mov dword [ebp - 0x138], 0xf
mov dword [ebp - 0x134], 0xf
movq qword [ebp - 0x148], xmm0
mov byte [ebp - 0x13a], al
mov byte [ebp - 0x139], 0
movzx eax, word [0x100466e8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x120], 0xa
movq xmm0, qword [str.SYSTEMROOT]
mov dword [ebp - 0x11c], 0xf
movq qword [ebp - 0x130], xmm0
mov word [ebp - 0x128], ax
mov byte [ebp - 0x126], 0
xorps xmm0, xmm0
mov dword [ebp - 0x108], 4
movups xmmword [ebp - 0x118], xmm0
mov dword [ebp - 0x104], 0xf
mov dword [ebp - 0x118], 0x504d4554
mov byte [ebp - 0x114], 0
movzx eax, word [0x100466fc]
movups xmmword [ebp - 0x100], xmm0
mov word [ebp - 0x100], ax
movzx eax, byte [0x100466fe]
mov dword [ebp - 0xf0], 3
mov dword [ebp - 0xec], 0xf
mov byte [ebp - 0xfe], al
mov byte [ebp - 0xfd], 0
mov eax, dword [str.ComSpec]
movups xmmword [ebp - 0xe8], xmm0
mov dword [ebp - 0xe8], eax
movzx eax, word [0x10046720]
mov word [ebp - 0xe4], ax
movzx eax, byte [0x10046722]
mov dword [ebp - 0xd8], 7
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe2], al
mov byte [ebp - 0xe1], 0
mov byte [ebp - 4], 0xc
push 0x20
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0xf
call fcn.1003c637
movups xmm0, xmmword [str.FP_NO_HOST_CHECK]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xc0], 0x10
mov dword [ebp - 0xbc], 0x1f
movups xmmword [eax], xmm0
mov byte [eax + 0x10], 0
mov byte [ebp - 4], 0xd
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0xb8], xmm0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0xf
call fcn.1003c637
movups xmm0, xmmword [str.NUMBER_OF_PROCESSORS]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xa8], 0x14
mov dword [ebp - 0xa4], 0x1f
movups xmmword [eax], xmm0
mov ecx, dword [0x10046738]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], 0
xorps xmm0, xmm0
mov dword [ebp - 0x90], 2
movups xmmword [ebp - 0xa0], xmm0
mov eax, 0x534f
mov dword [ebp - 0x8c], 0xf
mov word [ebp - 0xa0], ax
mov byte [ebp - 0x9e], 0
mov eax, dword [str.PATHEXT]
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x88], eax
movzx eax, word [0x1004675c]
mov word [ebp - 0x84], ax
movzx eax, byte [0x1004675e]
mov dword [ebp - 0x78], 7
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x82], al
mov byte [ebp - 0x81], 0
mov byte [ebp - 4], 0x10
push 0x20
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
call fcn.1003c637
movups xmm0, xmmword [str.PROCESSOR_ARCHITECTURE]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], 0x16
mov dword [ebp - 0x5c], 0x1f
movups xmmword [eax], xmm0
mov ecx, dword [0x10046750]
mov dword [eax + 0x10], ecx
movzx ecx, word [0x10046754]
mov word [eax + 0x14], cx
mov byte [eax + 0x16], 0
mov byte [ebp - 4], 0x11
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
call fcn.1003c637
movups xmm0, xmmword [str.PROCESSOR_IDENTIFIER]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x48], 0x14
mov dword [ebp - 0x44], 0x1f
movups xmmword [eax], xmm0
mov ecx, dword [0x10046780]
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], 0
mov eax, dword [0x10046768]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], eax
movzx eax, word [0x1004676c]
movq xmm0, qword [str.PROCESSOR_LEVEL]
mov word [ebp - 0x34], ax
movzx eax, byte [0x1004676e]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x2c], 0xf
movq qword [ebp - 0x40], xmm0
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], 0
mov byte [ebp - 4], 0x13
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
call fcn.1003c637
movups xmm0, xmmword [str.PROCESSOR_REVISION]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x12
mov dword [ebp - 0x14], 0x1f
movups xmmword [eax], xmm0
movzx ecx, word [0x1004679c]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], 0
mov dword [ebp - 4], 0x14
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x400
call esi
push 0x400
mov dword [ebp - 0x230], eax
call esi
lea esi, [ebp - 0x208]
mov dword [ebp - 0x234], eax
add esp, 0x20
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], esi
cmp dword [esi + 0x14], 0xf
xorps xmm0, xmm0
mov ecx, 0x16
mov dword [ebp - 0x210], 0
movups xmmword [ebp - 0x220], xmm0
mov dword [ebp - 0x20c], 0
mov eax, esi
mov dword [ebp - 0x224], esi
jbe 0x1002cd02
mov eax, dword [esi]
mov dword [ebp - 0x224], eax
mov edi, dword [esi + 0x10]
cmp edi, 0x7fffffff
ja 0x1002ceef
cmp edi, 0xf
ja 0x1002cd36
mov ecx, 0xf
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x20c], ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x220], xmm0
jmp 0x1002cdd7
mov esi, edi
mov dword [ebp - 0x20c], 0xf
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x1002cd5c
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
jmp 0x1002cd77
cmp esi, 0x16
cmovb esi, ecx
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x1002cd93
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x1002cef4
push ecx
call fcn.1003c637
add esp, 4
test eax, eax
je 0x1002cee9
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x1002cda6
test eax, eax
je 0x1002cda4
push eax
call fcn.1003c637
add esp, 4
mov ecx, eax
jmp 0x1002cda6
xor ecx, ecx
lea eax, [edi + 1]
mov dword [ebp - 0x220], ecx
push eax
push dword [ebp - 0x224]
mov dword [ebp - 0x210], edi
push ecx
mov dword [ebp - 0x20c], esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x20c]
add esp, 0xc
mov esi, dword [ebp - 0x22c]
mov edi, dword [ebp - 0x234]
lea eax, [ebp - 0x220]
cmp ecx, 0xf
mov byte [ebp - 4], 0x15
push 0x400
cmova eax, dword [ebp - 0x220]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.1002c4b0
push eax
push 0x10046788
push dword [ebp - 0x230]
call fcn.1002c320
mov byte [ebp - 4], 0x14
add esp, 0xc
mov ecx, dword [ebp - 0x20c]
cmp ecx, 0xf
jbe 0x1002ce57
mov edx, dword [ebp - 0x220]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ce4d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002cee9
push ecx
push edx
call fcn.1003c526
add esp, 8
mov ecx, dword [ebp - 0x228]
add esi, 0x18
inc ecx
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], ecx
cmp ecx, 0x15
jb 0x1002ccc9
mov esi, dword [ebp - 0x230]
mov ecx, esi
mov byte [edi], 0
call fcn.1002c4b0
push eax
push 0x100467b0
push edi
call fcn.1002c320
mov ecx, edi
call fcn.1002c5b0
push esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, eax
call esi
mov eax, dword [ebp - 0x234]
push eax
call esi
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x208]
push fcn.10011630
push 0x15
push 0x18
push eax
call fcn.1003c670
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c1fe
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.10007470
call fcn.100073d0
int3