Function at 0x10014889
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x158
mov eax, 0x1003f3e0
call fcn.1003dd61
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov dword [0x100579f4], eax
test ebx, ebx
je 0x10014f86
cmp dword [ebp + 0xc], 1
je 0x100148c6
cmp dword [ebp + 0xc], 4
je 0x100148c6
cmp dword [ebp + 0xc], 0x100
jne 0x10014f86
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
lea edi, [ebp - 0x12c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x118], ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x1005549c], ecx
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x12c], al
mov eax, 0x10055488
cmova eax, dword [0x10055488]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov cl, 0x72
mov dword [ebp - 0x144], 0x6023d72
mov dword [ebp - 0x140], 0x5c1c1d1b
xor eax, eax
mov dword [ebp - 0x13c], 0x1b1c3b
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 0xa
jae 0x10014960
mov cl, byte [ebp - 0x144]
jmp 0x1001494b
lea eax, [ebp - 0x143]
mov byte [ebp - 0x139], 0
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [esi], 0
je 0x10014a2d
cmp ebx, dword [esi]
jne 0x10014a2d
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x10057bec], 1
setne dl
mov dword [0x10057bec], edx
mov byte [0x10057936], dl
call fcn.1000b590
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x100149b9
mov ecx, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x484a7221
mov dl, 0x21
mov dword [ebp - 0x140], 0x53604d4d
mov word [ebp - 0x13c], 0x4044
mov eax, ebx
mov byte [ebp - 0x13a], bl
xor byte [ebp + eax - 0x143], dl
inc eax
cmp eax, 9
jae 0x100149f7
mov dl, byte [ebp - 0x144]
jmp 0x100149e2
mov byte [ebp - 0x13a], bl
mov dl, 0x77
mov dword [ebp - 0x134], 0x41e3a77
mov eax, ebx
mov word [ebp - 0x130], 0x14
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x10014f3e
mov dl, byte [ebp - 0x134]
jmp 0x10014a14
cmp dword [esi + 4], 0
je 0x10014b22
cmp ebx, dword [esi + 4]
jne 0x10014b22
mov esi, dword [0x10057868]
xor eax, eax
cmp dword [0x10057bf0], 1
setne al
mov dword [0x10057bf0], eax
test esi, esi
je 0x10014a8f
mov esi, dword [esi + 0xc]
test esi, esi
je 0x10014a8f
test eax, eax
je 0x10014a85
cmp dword [esi], 0
je 0x10014a8f
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10014a8f
mov ecx, dword [esi]
push 1
call dword [0x1004b688]
jmp 0x10014a8f
sub esp, 0xc
mov ecx, esi
call fcn.10011cbf
mov edx, dword [0x10057bf0]
lea ecx, [ebp - 0x164]
call fcn.1000b590
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x10014aaa
mov ecx, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x414a682f
mov dl, 0x2f
mov dword [ebp - 0x140], 0x46794a46
mov dword [ebp - 0x13c], 0x434d465c
mov eax, ebx
mov word [ebp - 0x138], 0x4a
xor byte [ebp + eax - 0x143], dl
inc eax
cmp eax, 0xc
jae 0x10014aec
mov dl, byte [ebp - 0x144]
jmp 0x10014ad7
mov byte [ebp - 0x137], bl
mov dl, 0x17
mov dword [ebp - 0x134], 0x647e5a17
mov eax, ebx
mov word [ebp - 0x130], 0x74
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x10014f3e
mov dl, byte [ebp - 0x134]
jmp 0x10014b09
cmp dword [esi + 8], 0
je 0x10014be4
cmp ebx, dword [esi + 8]
jne 0x10014be4
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x10057bf8], 1
setne dl
mov dword [0x10057bf8], edx
call fcn.1000b590
mov edx, eax
cmp dword [edx + 0x14], 0xf
jbe 0x10014b5c
mov edx, dword [edx]
push 0x61
pop ecx
mov bl, 0x13
mov dword [ebp - 0x144], 0x7d764113
mov word [ebp - 0x140], 0x7677
xor eax, eax
mov byte [ebp - 0x13e], cl
mov dword [ebp - 0x13d], 0x76637250
mov byte [ebp - 0x139], 0
xor byte [ebp + eax - 0x143], bl
inc eax
cmp eax, 0xa
jae 0x10014ba2
mov bl, byte [ebp - 0x144]
jmp 0x10014b8d
xor ebx, ebx
mov byte [ebp - 0x134], cl
mov byte [ebp - 0x139], bl
mov eax, ebx
mov dword [ebp - 0x133], 0x212082c
mov byte [ebp - 0x12f], bl
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10014bd7
mov cl, byte [ebp - 0x134]
jmp 0x10014bc2
lea eax, [ebp - 0x114]
push eax
push edx
jmp 0x10014f46
cmp dword [esi + 0xc], 0
je 0x10014cab
cmp ebx, dword [esi + 0xc]
jne 0x10014cab
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x10057bfc], 1
setne dl
mov dword [0x10057bfc], edx
call fcn.1000b590
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x10014c1e
mov ecx, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x148], 0x656a590b
mov dl, 0xb
mov dword [ebp - 0x144], 0x6c656260
mov dword [ebp - 0x140], 0x6e6d6d4e
mov eax, ebx
mov word [ebp - 0x13c], 0x7f68
mov byte [ebp - 0x13a], bl
xor byte [ebp + eax - 0x147], dl
inc eax
cmp eax, 0xd
jae 0x10014c66
mov dl, byte [ebp - 0x148]
jmp 0x10014c51
mov byte [ebp - 0x13a], bl
mov dl, 0x49
mov dword [ebp - 0x134], 0x3a200449
mov eax, ebx
mov word [ebp - 0x130], 0x2a
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x10014c98
mov dl, byte [ebp - 0x134]
jmp 0x10014c83
lea eax, [ebp - 0x114]
push eax
push ecx
lea eax, [ebp - 0x147]
jmp 0x10014f4c
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10014e49
cmp ebx, ecx
jne 0x10014e49
call fcn.1000d65e
mov edi, eax
cmp edi, 0x17
ja 0x10014f6b
cmp edi, dword [0x10057bf4]
je 0x10014f6b
mov dword [0x10057bf4], edi
mov edx, edi
mov ecx, dword [esi + 0x14]
call fcn.1000d63b
xor ebx, ebx
mov ecx, ebx
push edi
cmp edi, 0xa
jge 0x10014d30
movaps xmm0, xmmword [0x1004d080]
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x13c], 0x3a306e66
mov word [ebp - 0x138], 0x3a
mov al, byte [ebp - 0x14c]
xor byte [ebp + ecx - 0x14b], al
inc ecx
cmp ecx, 0x14
jb 0x10014d15
mov byte [ebp - 0x137], bl
jmp 0x10014d67
movaps xmm0, xmmword [0x1004d020]
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x13c], 0x77777d23
mov byte [ebp - 0x138], bl
mov al, byte [ebp - 0x14c]
xor byte [ebp + ecx - 0x14b], al
inc ecx
cmp ecx, 0x13
jb 0x10014d4e
mov byte [ebp - 0x138], bl
sub esp, 0x18
lea eax, [ebp - 0x14b]
mov ecx, esp
push eax
call fcn.10003d99
lea eax, [ebp - 0x164]
push eax
call fcn.100039e2
add esp, 0x20
lea ecx, [ebp - 0x12c]
push eax
call fcn.10008b20
lea ecx, [ebp - 0x164]
call fcn.10003b97
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x12c]
call fcn.1000d720
push ecx
push edi
call fcn.1001527c
mov edx, dword [0x10057bf4]
lea ecx, [ebp - 0x164]
call fcn.1000b590
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x10014dce
mov ecx, dword [ecx]
mov dl, 0x22
mov dword [ebp - 0x140], 0x4f436522
mov dword [ebp - 0x13c], 0x4f4b7647
mov eax, ebx
mov word [ebp - 0x138], 0x47
xor byte [ebp + eax - 0x13f], dl
inc eax
cmp eax, 8
jae 0x10014e04
mov dl, byte [ebp - 0x140]
jmp 0x10014def
mov byte [ebp - 0x137], bl
mov dl, 0x1e
mov dword [ebp - 0x134], 0x6d77531e
mov eax, ebx
mov word [ebp - 0x130], 0x7d
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x10014e36
mov dl, byte [ebp - 0x134]
jmp 0x10014e21
lea eax, [ebp - 0x114]
push eax
push ecx
lea eax, [ebp - 0x13f]
jmp 0x10014f4c
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10014f6b
cmp ebx, ecx
jne 0x10014f6b
call fcn.1000d65e
mov edi, eax
cmp edi, 0x14
ja 0x10014f6b
cmp edi, dword [0x10057c00]
je 0x10014f6b
mov dword [0x10057c00], edi
mov edx, edi
mov ecx, dword [esi + 0x18]
call fcn.1000d63b
mov ecx, dword [esi + 0x20]
mov edx, edi
call fcn.1000d743
movd xmm0, dword [0x10057c00]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1004c7c4]
movss dword [0x100540dc], xmm0
call fcn.100144ae
mov edx, dword [0x10057c00]
lea ecx, [ebp - 0x164]
call fcn.1000b590
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x10014ecd
mov ecx, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x144], 0x262a084b
mov dl, 0x4b
mov dword [ebp - 0x140], 0x192a392e
mov dword [ebp - 0x13c], 0x2e2c252a
mov eax, ebx
mov byte [ebp - 0x138], bl
xor byte [ebp + eax - 0x143], dl
inc eax
cmp eax, 0xb
jae 0x10014f0c
mov dl, byte [ebp - 0x144]
jmp 0x10014ef7
mov byte [ebp - 0x138], bl
mov dl, 0x10
mov dword [ebp - 0x134], 0x63795d10
mov eax, ebx
mov word [ebp - 0x130], 0x73
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x10014f3e
mov dl, byte [ebp - 0x134]
jmp 0x10014f29
lea eax, [ebp - 0x114]
push eax
push ecx
lea eax, [ebp - 0x143]
push eax
lea eax, [ebp - 0x133]
mov byte [ebp - 0x12f], bl
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x164]
call fcn.10003b97
mov edx, dword [ebp - 0x118]
cmp edx, 0xf
jbe 0x10014f82
mov ecx, dword [ebp - 0x12c]
inc edx
call fcn.10003b6a
mov al, 1
jmp 0x10014f88
xor al, al
call fcn.1003dd1f
ret 8