Function at 0x100112d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152e33
mov eax, dword fs:[0]
push eax
mov eax, 0x41b0
call fcn.101516a0
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x41a4], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x4040]
push eax
push 0
push 0
push 0
lea ecx, [ebp + 0x10]
call fcn.10002bf0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ESENT.dll_JetOpenTableW]
mov dword [ebp - 0x4110], eax
cmp dword [ebp - 0x4110], 0
je 0x1001138e
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ESENT.dll_JetCloseDatabase]
push str.JetOpenTable_1fail_
push 3
push 0x2e1
push 0x10165440
push 0x10165404
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x411e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.10003e00
mov al, byte [ebp - 0x411e]
jmp 0x10011c22
xor edx, edx
mov dword [ebp - 0x405c], edx
mov dword [ebp - 0x4058], edx
mov dword [ebp - 0x4054], edx
mov dword [ebp - 0x4050], edx
mov dword [ebp - 0x404c], edx
mov dword [ebp - 0x4048], edx
mov dword [ebp - 0x4044], edx
xor eax, eax
mov dword [ebp - 0x405c], eax
mov dword [ebp - 0x4058], eax
mov dword [ebp - 0x4054], eax
mov dword [ebp - 0x4050], eax
mov dword [ebp - 0x404c], eax
mov dword [ebp - 0x4048], eax
mov dword [ebp - 0x4044], eax
mov dword [ebp - 0x405c], 0x1c
push 0
mov ecx, dword [ebp - 0x405c]
push ecx
lea edx, [ebp - 0x405c]
push edx
push str.ResponseHeaders
lea ecx, [ebp + 0x10]
call fcn.10002bf0
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ESENT.dll_JetGetColumnInfoW]
mov dword [ebp - 0x4110], eax
cmp dword [ebp - 0x4110], 0
je 0x1001147b
mov edx, dword [ebp - 0x4040]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ESENT.dll_JetCloseTable]
push str.ResponseHeaders_1fail_
push 3
push 0x2eb
push 0x101654e8
push 0x10165540
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x4111], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.10003e00
mov al, byte [ebp - 0x4111]
jmp 0x10011c22
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x4058]
mov dword [ebp + edx - 0x4170], eax
xor ecx, ecx
mov dword [ebp - 0x405c], ecx
mov dword [ebp - 0x4058], ecx
mov dword [ebp - 0x4054], ecx
mov dword [ebp - 0x4050], ecx
mov dword [ebp - 0x404c], ecx
mov dword [ebp - 0x4048], ecx
mov dword [ebp - 0x4044], ecx
mov dword [ebp - 0x405c], 0x1c
push 0
mov edx, dword [ebp - 0x405c]
push edx
lea eax, [ebp - 0x405c]
push eax
push 0x1016557c
lea ecx, [ebp + 0x10]
call fcn.10002bf0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ESENT.dll_JetGetColumnInfoW]
mov dword [ebp - 0x4110], eax
cmp dword [ebp - 0x4110], 0
je 0x10011551
mov eax, dword [ebp - 0x4040]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ESENT.dll_JetCloseTable]
push str.AccessedTime_1fail_
push 3
push 0x2f6
push str..._srcMoniterHelper_browserEdgeHelper.cpp
push str.CEdgeHelper::GetDownloadData
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x411d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.10003e00
mov al, byte [ebp - 0x411d]
jmp 0x10011c22
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x4058]
mov dword [ebp + edx - 0x4170], eax
xor ecx, ecx
mov word [ebp - 0x403c], cx
push 0x3ffe
push 0
lea edx, [ebp - 0x403a]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x4100], 0
push 0
push SysReAllocString
mov eax, dword [ebp - 0x4040]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ESENT.dll_JetMove]
mov dword [ebp - 0x4110], eax
jmp 0x100115ca
push 0
push 1
mov edx, dword [ebp - 0x4040]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ESENT.dll_JetMove]
mov dword [ebp - 0x4110], eax
cmp dword [ebp - 0x4110], 0
jne 0x10011bf5
lea ecx, [ebp - 0x40fc]
call fcn.10009800
mov byte [ebp - 4], 1
push 0x4000
push 0
lea ecx, [ebp - 0x403c]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x4100]
push edx
push 0x4000
lea eax, [ebp - 0x403c]
push eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0x4170]
push eax
mov ecx, dword [ebp - 0x4040]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ESENT.dll_JetRetrieveColumn]
mov dword [ebp - 0x4110], eax
mov eax, dword [ebp - 0x4100]
lea ecx, [eax + eax + 1]
push ecx
call fcn.1014578c
add esp, 4
mov dword [ebp - 0x415c], eax
mov edx, dword [ebp - 0x415c]
mov dword [ebp - 0x410c], edx
mov eax, dword [ebp - 0x4100]
lea ecx, [eax + eax + 1]
push ecx
push 0
mov edx, dword [ebp - 0x410c]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x411c], 0
jmp 0x10011696
mov eax, dword [ebp - 0x411c]
add eax, 1
mov dword [ebp - 0x411c], eax
mov ecx, dword [ebp - 0x411c]
cmp ecx, dword [ebp - 0x4100]
jae 0x100116ef
mov edx, dword [ebp - 0x411c]
movzx eax, word [ebp + edx*2 - 0x403c]
and eax, 0xff
mov ecx, dword [ebp - 0x411c]
mov edx, dword [ebp - 0x410c]
mov byte [edx + ecx*2], al
mov eax, dword [ebp - 0x411c]
movzx ecx, word [ebp + eax*2 - 0x403c]
sar ecx, 8
and ecx, 0xff
mov edx, dword [ebp - 0x411c]
mov eax, dword [ebp - 0x410c]
mov byte [eax + edx*2 + 1], cl
jmp 0x10011687
mov dword [ebp - 0x413c], 0xffffffff
mov ecx, dword [ebp - 0x410c]
mov dword [ebp - 0x4134], ecx
mov dword [ebp - 0x4118], 0
jmp 0x10011720
mov edx, dword [ebp - 0x4118]
add edx, 1
mov dword [ebp - 0x4118], edx
mov eax, dword [ebp - 0x4118]
cmp eax, dword [ebp - 0x4100]
jae 0x10011868
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0
mov byte [ebp - 0x28], 0x74
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x26], 0x70
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 0x3a
mov byte [ebp - 0x23], 0
mov byte [ebp - 0x22], 0x2f
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x20], 0x2f
mov byte [ebp - 0x3c], 0x68
mov byte [ebp - 0x3b], 0
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0
mov byte [ebp - 0x38], 0x74
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x36], 0x70
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x34], 0x73
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0x3a
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x30], 0x2f
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0x2f
mov byte [ebp - 0x1c], 0x66
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0x3a
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0x2f
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0x2f
push 0xd
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x4118]
mov eax, dword [ebp - 0x4134]
lea ecx, [eax + edx*2]
push ecx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
mov dword [ebp - 0x4178], eax
cmp dword [ebp - 0x4178], 0
je 0x10011855
push 0xb
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x4118]
mov ecx, dword [ebp - 0x4134]
lea edx, [ecx + eax*2]
push edx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
mov dword [ebp - 0x4180], eax
cmp dword [ebp - 0x4180], 0
je 0x10011855
push 0xf
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x4118]
mov edx, dword [ebp - 0x4134]
lea eax, [edx + ecx*2]
push eax
call sub.MSVCR120.dll_memcmp
add esp, 0xc
mov dword [ebp - 0x4188], eax
cmp dword [ebp - 0x4188], 0
jne 0x10011863
mov ecx, dword [ebp - 0x4118]
mov dword [ebp - 0x413c], ecx
jmp 0x10011868
jmp 0x10011711
cmp dword [ebp - 0x413c], 0xffffffff
jne 0x100118cc
mov edx, dword [ebp - 0x410c]
mov dword [ebp - 0x4150], edx
mov eax, dword [ebp - 0x4150]
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
cmp dword [ebp - 0x4150], 0
jne 0x100118a2
mov dword [ebp - 0x4190], 0
jmp 0x100118b8
mov dword [ebp - 0x410c], 0x8123
mov ecx, dword [ebp - 0x410c]
mov dword [ebp - 0x4190], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40fc]
call fcn.100098a0
jmp 0x100115af
mov edx, dword [ebp - 0x413c]
mov eax, dword [ebp - 0x4134]
lea ecx, [eax + edx*2]
mov dword [ebp - 0x4148], ecx
cmp dword [ebp - 0x4148], 0
je 0x10011b10
mov edx, dword [ebp - 0x4148]
mov dword [ebp - 0x412c], edx
mov eax, dword [ebp - 0x412c]
add eax, 2
mov dword [ebp - 0x4198], eax
mov ecx, dword [ebp - 0x412c]
mov dx, word [ecx]
mov word [ebp - 0x4140], dx
add dword [ebp - 0x412c], 2
cmp word [ebp - 0x4140], 0
jne 0x10011909
mov eax, dword [ebp - 0x412c]
sub eax, dword [ebp - 0x4198]
sar eax, 1
mov dword [ebp - 0x41a0], eax
mov ecx, dword [ebp - 0x41a0]
mov edx, dword [ebp - 0x4148]
lea eax, [edx + ecx*2 + 2]
mov dword [ebp - 0x4144], eax
cmp dword [ebp - 0x4144], 0
je 0x100119c5
mov ecx, dword [ebp - 0x4144]
mov dword [ebp - 0x4128], ecx
mov edx, dword [ebp - 0x4128]
add edx, 2
mov dword [ebp - 0x4184], edx
mov eax, dword [ebp - 0x4128]
mov cx, word [eax]
mov word [ebp - 0x4136], cx
add dword [ebp - 0x4128], 2
cmp word [ebp - 0x4136], 0
jne 0x10011978
mov edx, dword [ebp - 0x4128]
sub edx, dword [ebp - 0x4184]
sar edx, 1
mov dword [ebp - 0x4164], edx
mov eax, dword [ebp - 0x4164]
mov ecx, dword [ebp - 0x4144]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x4130], edx
jmp 0x10011a20
mov eax, dword [ebp - 0x410c]
mov dword [ebp - 0x4158], eax
mov ecx, dword [ebp - 0x4158]
push ecx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
cmp dword [ebp - 0x4158], 0
jne 0x100119f6
mov dword [ebp - 0x4168], 0
jmp 0x10011a0c
mov dword [ebp - 0x410c], 0x8123
mov edx, dword [ebp - 0x410c]
mov dword [ebp - 0x4168], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40fc]
call fcn.100098a0
jmp 0x100115af
cmp dword [ebp - 0x4130], 0
je 0x10011a91
mov eax, dword [ebp - 0x4130]
mov dword [ebp - 0x4124], eax
mov ecx, dword [ebp - 0x4124]
add ecx, 2
mov dword [ebp - 0x4194], ecx
mov edx, dword [ebp - 0x4124]
mov ax, word [edx]
mov word [ebp - 0x413e], ax
add dword [ebp - 0x4124], 2
cmp word [ebp - 0x413e], 0
jne 0x10011a44
mov ecx, dword [ebp - 0x4124]
sub ecx, dword [ebp - 0x4194]
sar ecx, 1
mov dword [ebp - 0x4174], ecx
mov edx, dword [ebp - 0x4174]
mov eax, dword [ebp - 0x4130]
lea ecx, [eax + edx*2 + 2]
mov dword [ebp - 0x417c], ecx
jmp 0x10011aec
mov edx, dword [ebp - 0x410c]
mov dword [ebp - 0x4154], edx
mov eax, dword [ebp - 0x4154]
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
cmp dword [ebp - 0x4154], 0
jne 0x10011ac2
mov dword [ebp - 0x418c], 0
jmp 0x10011ad8
mov dword [ebp - 0x410c], 0x8123
mov ecx, dword [ebp - 0x410c]
mov dword [ebp - 0x418c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40fc]
call fcn.100098a0
jmp 0x100115af
mov edx, dword [ebp - 0x4130]
push edx
lea ecx, [ebp - 0x40fc]
call fcn.10007da0
mov eax, dword [ebp - 0x417c]
push eax
lea ecx, [ebp - 0x40e4]
call fcn.10007da0
mov ecx, dword [ebp - 0x410c]
mov dword [ebp - 0x414c], ecx
mov edx, dword [ebp - 0x414c]
push edx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
cmp dword [ebp - 0x414c], 0
jne 0x10011b41
mov dword [ebp - 0x419c], 0
jmp 0x10011b57
mov dword [ebp - 0x410c], 0x8123
mov eax, dword [ebp - 0x410c]
mov dword [ebp - 0x419c], eax
push 0
push 0
lea ecx, [ebp - 0x4100]
push ecx
push 8
lea edx, [ebp - 0x4108]
push edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + eax - 0x4170]
push ecx
mov edx, dword [ebp - 0x4040]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ESENT.dll_JetRetrieveColumn]
mov dword [ebp - 0x4110], eax
mov ecx, dword [ebp - 0x4104]
push ecx
mov edx, dword [ebp - 0x4108]
push edx
lea eax, [ebp - 0x41bc]
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [ebp - 0x4160], eax
mov ecx, dword [ebp - 0x4160]
push ecx
lea ecx, [ebp - 0x4084]
call fcn.10003480
lea ecx, [ebp - 0x41bc]
call fcn.10003e00
lea edx, [ebp - 0x40fc]
push edx
mov ecx, dword [ebp + 0x28]
call fcn.1000b0d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40fc]
call fcn.100098a0
jmp 0x100115af
mov eax, dword [ebp - 0x4040]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ESENT.dll_JetCloseTable]
mov byte [ebp - 0x4112], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.10003e00
mov al, byte [ebp - 0x4112]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret 0x24