Function at 0x1001568d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x158
mov eax, 0x10074538
call fcn.1003d3a0
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov dword [0x1009ede4], eax
test edi, edi
je 0x10015d5f
cmp dword [ebp + 0xc], 1
je 0x100156ca
cmp dword [ebp + 0xc], 4
je 0x100156ca
cmp dword [ebp + 0xc], 0x100
jne 0x10015d5f
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.10054de0
add esp, 0xc
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 4], ebx
mov eax, 0x1009be40
cmp dword [0x1009be54], 0x10
mov dword [ebp - 0x11c], ebx
cmovae eax, dword [0x1009be40]
push eax
lea eax, [ebp - 0x114]
mov byte [ebp - 0x12c], bl
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov cl, 0x3f
mov dword [ebp - 0x144], 0x4b4f703f
mov dword [ebp - 0x140], 0x11515056
mov edx, ebx
mov dword [ebp - 0x13c], 0x565176
xor cl, byte [ebp + edx - 0x143]
mov byte [ebp + edx - 0x143], cl
inc edx
cmp edx, 0xa
jae 0x10015759
mov cl, byte [ebp - 0x144]
jmp 0x1001573d
lea eax, [ebp - 0x143]
mov byte [ebp - 0x139], bl
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [esi], 0
je 0x10015827
cmp edi, dword [esi]
jne 0x10015827
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x100a303c], 1
setne dl
cmp edx, 1
mov dword [0x100a303c], edx
sete byte [0x1009ed27]
call fcn.1000beb2
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x100157b5
mov edx, dword [edx]
mov cl, 0x6e
mov dword [ebp - 0x144], 0x7053d6e
mov dword [ebp - 0x140], 0x1c2f0202
mov eax, ebx
mov word [ebp - 0x13c], 0xf0b
mov byte [ebp - 0x13a], bl
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 9
jae 0x100157f1
mov cl, byte [ebp - 0x144]
jmp 0x100157dc
mov byte [ebp - 0x13a], bl
mov cl, 0x5a
mov dword [ebp - 0x134], 0x2933175a
mov eax, ebx
mov word [ebp - 0x130], 0x39
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10015d1d
mov cl, byte [ebp - 0x134]
jmp 0x1001580e
cmp dword [esi + 4], 0
je 0x10015921
cmp edi, dword [esi + 4]
jne 0x10015921
mov esi, dword [0x1009ec68]
xor eax, eax
cmp dword [0x100a3040], 1
setne al
mov dword [0x100a3040], eax
test esi, esi
je 0x10015889
mov esi, dword [esi + 0xc]
test esi, esi
je 0x10015889
test eax, eax
je 0x1001587f
cmp dword [esi], 0
je 0x10015889
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10015889
mov ecx, dword [esi]
push 1
call dword [0x1008e47c]
jmp 0x10015889
sub esp, 0xc
mov ecx, esi
call fcn.100129be
mov edx, dword [0x100a3040]
lea ecx, [ebp - 0x164]
call fcn.1000beb2
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x100158a4
mov ecx, dword [ecx]
mov dl, 0x65
mov dword [ebp - 0x144], 0xb002265
mov dword [ebp - 0x140], 0xc33000c
mov eax, ebx
mov dword [ebp - 0x13c], 0x9070c16
mov word [ebp - 0x138], bx
xor byte [ebp + eax - 0x143], dl
inc eax
cmp eax, 0xc
jae 0x100158e2
mov dl, byte [ebp - 0x144]
jmp 0x100158cd
mov byte [ebp - 0x137], bl
mov dl, 0x4e
mov dword [ebp - 0x134], 0x3d27034e
mov eax, ebx
mov word [ebp - 0x130], 0x2d
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x10015914
mov dl, byte [ebp - 0x134]
jmp 0x100158ff
lea eax, [ebp - 0x114]
push eax
push ecx
jmp 0x10015d25
cmp dword [esi + 8], 0
je 0x100159c8
cmp edi, dword [esi + 8]
jne 0x100159c8
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x100a3048], 1
setne dl
mov dword [0x100a3048], edx
call fcn.1000beb2
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x1001595b
mov edx, dword [edx]
mov cl, 0x52
mov dword [ebp - 0x144], 0x3c370052
mov dword [ebp - 0x140], 0x11203736
mov eax, ebx
mov dword [ebp - 0x13c], 0x372233
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 0xa
jae 0x10015992
mov cl, byte [ebp - 0x144]
jmp 0x1001597d
mov byte [ebp - 0x139], bl
mov cl, 0x65
mov dword [ebp - 0x134], 0x160c2865
mov eax, ebx
mov word [ebp - 0x130], 6
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10015d1d
mov cl, byte [ebp - 0x134]
jmp 0x100159af
cmp dword [esi + 0xc], 0
je 0x10015a8b
cmp edi, dword [esi + 0xc]
jne 0x10015a8b
xor edx, edx
lea ecx, [ebp - 0x164]
cmp dword [0x100a304c], 1
setne dl
mov dword [0x100a304c], edx
call fcn.1000beb2
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x10015a02
mov ecx, dword [ecx]
mov dl, 7
mov dword [ebp - 0x148], 0x69665507
mov dword [ebp - 0x144], 0x60696e6c
mov eax, ebx
mov dword [ebp - 0x140], 0x62616142
mov word [ebp - 0x13c], 0x7364
mov byte [ebp - 0x13a], bl
xor byte [ebp + eax - 0x147], dl
inc eax
cmp eax, 0xd
jae 0x10015a48
mov dl, byte [ebp - 0x148]
jmp 0x10015a33
mov byte [ebp - 0x13a], bl
mov dl, 0x63
mov dword [ebp - 0x134], 0x100a2e63
mov eax, ebx
mov word [ebp - 0x130], bx
xor byte [ebp + eax - 0x133], dl
inc eax
cmp eax, 4
jae 0x10015a78
mov dl, byte [ebp - 0x134]
jmp 0x10015a63
lea eax, [ebp - 0x114]
push eax
push ecx
lea eax, [ebp - 0x147]
jmp 0x10015d2b
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10015c2a
cmp edi, ecx
jne 0x10015c2a
call fcn.1000dd95
mov edi, eax
cmp edi, 0x17
ja 0x10015d4d
cmp edi, dword [0x100a3044]
je 0x10015d4d
mov dword [0x100a3044], edi
mov edx, edi
mov ecx, dword [esi + 0x14]
call fcn.1000dd72
mov ecx, ebx
push edi
cmp edi, 0xa
jge 0x10015b0e
movaps xmm0, xmmword [0x1008fa40]
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x13c], 0x1b114f47
mov word [ebp - 0x138], 0x1b
mov al, byte [ebp - 0x14c]
xor byte [ebp + ecx - 0x14b], al
inc ecx
cmp ecx, 0x14
jb 0x10015af3
mov byte [ebp - 0x137], bl
jmp 0x10015b45
movaps xmm0, xmmword [0x100901b0]
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x13c], 0xf0f055b
mov byte [ebp - 0x138], bl
mov al, byte [ebp - 0x14c]
xor byte [ebp + ecx - 0x14b], al
inc ecx
cmp ecx, 0x13
jb 0x10015b2c
mov byte [ebp - 0x138], bl
sub esp, 0x18
lea eax, [ebp - 0x14b]
mov ecx, esp
push eax
call fcn.10004179
lea eax, [ebp - 0x164]
push eax
call fcn.10003c43
add esp, 0x20
lea ecx, [ebp - 0x12c]
push eax
call fcn.10005f9d
push ebx
push 1
lea ecx, [ebp - 0x164]
call fcn.1000402e
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 0x12c]
call fcn.1000de50
push ecx
push edi
call fcn.1001603f
mov edx, dword [0x100a3044]
lea ecx, [ebp - 0x164]
call fcn.1000beb2
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x10015baf
mov edx, dword [edx]
mov cl, 2
mov dword [ebp - 0x140], 0x6f634502
mov dword [ebp - 0x13c], 0x6f6b5667
mov eax, ebx
mov word [ebp - 0x138], 0x67
xor byte [ebp + eax - 0x13f], cl
inc eax
cmp eax, 8
jae 0x10015be5
mov cl, byte [ebp - 0x140]
jmp 0x10015bd0
mov byte [ebp - 0x137], bl
mov cl, 0x62
mov dword [ebp - 0x134], 0x110b2f62
mov eax, ebx
mov word [ebp - 0x130], 1
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10015c17
mov cl, byte [ebp - 0x134]
jmp 0x10015c02
lea eax, [ebp - 0x114]
push eax
push edx
lea eax, [ebp - 0x13f]
jmp 0x10015d2b
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10015d4d
cmp edi, ecx
jne 0x10015d4d
call fcn.1000dd95
mov edi, eax
cmp edi, 0x14
ja 0x10015d4d
cmp edi, dword [0x100a3050]
je 0x10015d4d
mov dword [0x100a3050], edi
mov edx, edi
mov ecx, dword [esi + 0x18]
call fcn.1000dd72
mov ecx, dword [esi + 0x20]
mov edx, edi
call fcn.1000de73
movd xmm0, dword [0x100a3050]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x1008f590]
movss dword [0x1009aaac], xmm0
call fcn.10015287
mov edx, dword [0x100a3050]
lea ecx, [ebp - 0x164]
call fcn.1000beb2
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x10015cae
mov edx, dword [edx]
mov cl, 0xe
mov dword [ebp - 0x144], 0x636f4d0e
mov dword [ebp - 0x140], 0x5c6f7c6b
mov eax, ebx
mov dword [ebp - 0x13c], 0x6b69606f
mov byte [ebp - 0x138], bl
xor byte [ebp + eax - 0x143], cl
inc eax
cmp eax, 0xb
jae 0x10015ceb
mov cl, byte [ebp - 0x144]
jmp 0x10015cd6
mov byte [ebp - 0x138], bl
mov cl, 0x6d
mov dword [ebp - 0x134], 0x1e04206d
mov eax, ebx
mov word [ebp - 0x130], 0xe
xor byte [ebp + eax - 0x133], cl
inc eax
cmp eax, 4
jae 0x10015d1d
mov cl, byte [ebp - 0x134]
jmp 0x10015d08
lea eax, [ebp - 0x114]
push eax
push edx
lea eax, [ebp - 0x143]
push eax
lea eax, [ebp - 0x133]
mov byte [ebp - 0x12f], bl
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
push 1
lea ecx, [ebp - 0x164]
call fcn.1000402e
push ebx
push 1
lea ecx, [ebp - 0x12c]
call fcn.1000402e
mov al, 1
jmp 0x10015d61
xor al, al
call fcn.1003d34a
ret 8