Function at 0x10160900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x102414b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x114], ebx
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x108], eax
xor eax, eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov eax, dword [edx]
cdq
xor eax, edx
mov dword [ebp - 0x198], 0
sub eax, edx
mov dword [ebp - 0x11c], ecx
movzx eax, ax
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x170]
push eax
push 0x10212608
push ebx
movups xmmword [ebp - 0x190], xmm0
call fcn.10113430
add esp, 0xc
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x101609ff
cmp dword [ebp - 0x16c], 0x774f4632
push esi
push edi
je 0x101609f8
mov ecx, dword [ebp - 0x168]
cmp ecx, dword [ebx + 4]
jne 0x101609f8
mov ax, word [ebp - 0x164]
test ax, ax
je 0x101609f8
movzx edi, ax
lea eax, [edi + edi*4]
lea eax, [eax*4 + 0x30]
cmp eax, ecx
jae 0x101609f8
mov esi, dword [ebp - 0x158]
mov edx, dword [ebp - 0x154]
test esi, esi
jne 0x10160a0e
test edx, edx
jne 0x101609f8
cmp dword [ebp - 0x150], edx
je 0x10160a1b
pop edi
mov eax, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016b209
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x10160a1b
cmp dword [ebp - 0x150], 0
je 0x101609f8
cmp esi, ecx
jae 0x101609f8
mov eax, ecx
sub eax, esi
cmp eax, edx
jb 0x101609f8
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
test eax, eax
jne 0x10160a3b
test edx, edx
jne 0x101609f8
cmp eax, ecx
jae 0x101609f8
sub ecx, eax
cmp ecx, edx
jb 0x101609f8
mov esi, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
push eax
push 0
push edi
push 0
push 0x20
push esi
mov dword [ebp - 0x130], 0
call fcn.10115120
add esp, 0x18
mov edi, eax
cmp dword [ebp - 0x104], 0
mov dword [ebp - 0x180], edi
jne 0x1016103d
movzx ecx, word [ebp - 0x164]
lea eax, [ebp - 0x104]
push eax
push 0
push ecx
push 0
push 4
push esi
call fcn.10115120
add esp, 0x18
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x104], 0
jne 0x1016103d
mov cx, word [ebp - 0x164]
xor eax, eax
mov dword [ebp - 0x110], 0
cmp ax, cx
jae 0x10160e40
lea esi, [edi + 4]
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.101133c0
mov cl, al
add esp, 8
mov byte [esi - 4], cl
cmp dword [ebp - 0x104], 0
jne 0x1016103d
and al, 0x3f
cmp al, 0x3f
jne 0x10160b25
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x114]
call fcn.10113670
add esp, 8
mov dword [esi], eax
cmp dword [ebp - 0x104], 0
jne 0x1016103d
mov cl, byte [esi - 4]
jmp 0x10160d5a
mov dword [ebp - 0x100], 0x636d6170
mov dword [ebp - 0xfc], 0x68656164
mov dword [ebp - 0xf8], 0x68686561
mov dword [ebp - 0xf4], 0x686d7478
mov dword [ebp - 0xf0], 0x6d617870
mov dword [ebp - 0xec], 0x6e616d65
mov dword [ebp - 0xe8], 0x4f532f32
mov dword [ebp - 0xe4], 0x706f7374
mov dword [ebp - 0xe0], 0x63767420
mov dword [ebp - 0xdc], 0x6670676d
mov dword [ebp - 0xd8], 0x676c7966
mov dword [ebp - 0xd4], 0x6c6f6361
mov dword [ebp - 0xd0], 0x70726570
mov dword [ebp - 0xcc], 0x43464620
mov dword [ebp - 0xc8], 0x564f5247
mov dword [ebp - 0xc4], 0x45424454
mov dword [ebp - 0xc0], 0x45424c43
mov dword [ebp - 0xbc], 0x67617370
mov dword [ebp - 0xb8], 0x68646d78
mov dword [ebp - 0xb4], 0x6b65726e
mov dword [ebp - 0xb0], 0x4c545348
mov dword [ebp - 0xac], 0x50434c54
mov dword [ebp - 0xa8], 0x56444d58
mov dword [ebp - 0xa4], 0x76686561
mov dword [ebp - 0xa0], 0x766d7478
mov dword [ebp - 0x9c], 0x42415345
mov dword [ebp - 0x98], 0x47444546
mov dword [ebp - 0x94], 0x47504f53
mov dword [ebp - 0x90], 0x47535542
mov dword [ebp - 0x8c], 0x45425343
mov dword [ebp - 0x88], 0x4a535446
mov dword [ebp - 0x84], 0x4d415448
mov dword [ebp - 0x80], 0x43424454
mov dword [ebp - 0x7c], 0x43424c43
mov dword [ebp - 0x78], 0x434f4c52
mov dword [ebp - 0x74], 0x4350414c
mov dword [ebp - 0x70], 0x53564720
mov dword [ebp - 0x6c], 0x73626978
mov dword [ebp - 0x68], 0x61636e74
mov dword [ebp - 0x64], 0x61766172
mov dword [ebp - 0x60], 0x62646174
mov dword [ebp - 0x5c], 0x626c6f63
mov dword [ebp - 0x58], 0x62736c6e
mov dword [ebp - 0x54], 0x63766172
mov dword [ebp - 0x50], 0x66647363
mov dword [ebp - 0x4c], 0x66656174
mov dword [ebp - 0x48], 0x666d7478
mov dword [ebp - 0x44], 0x66766172
mov dword [ebp - 0x40], 0x67766172
mov dword [ebp - 0x3c], 0x68737479
mov dword [ebp - 0x38], 0x6a757374
mov dword [ebp - 0x34], 0x6c636172
mov dword [ebp - 0x30], 0x6d6f7274
mov dword [ebp - 0x2c], 0x6d6f7278
mov dword [ebp - 0x28], 0x6f706264
mov dword [ebp - 0x24], 0x70726f70
mov dword [ebp - 0x20], 0x7472616b
mov dword [ebp - 0x1c], 0x5a617066
mov dword [ebp - 0x18], 0x53696c66
mov dword [ebp - 0x14], 0x476c6174
mov dword [ebp - 0x10], 0x476c6f63
mov dword [ebp - 0xc], 0x46656174
mov dword [ebp - 8], 0x53696c6c
cmp al, 0x3e
ja 0x1016102d
movzx eax, al
mov eax, dword [ebp + eax*4 - 0x100]
mov dword [esi], eax
test eax, eax
je 0x10161033
xor edi, edi
shr cl, 6
cmp eax, 0x676c7966
je 0x10160d78
cmp eax, 0x6c6f6361
je 0x10160d78
test cl, cl
je 0x10160d82
mov edi, pe_nt_image_headers32
jmp 0x10160d82
test cl, cl
mov eax, pe_nt_image_headers32
cmove edi, eax
movzx eax, cl
or edi, eax
lea eax, [esi + 4]
push eax
push dword [ebp - 0x114]
call fcn.1015b110
add esp, 8
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x1016103d
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
mov dword [ebx], eax
test edi, 0x100
je 0x10160de4
push ebx
push dword [ebp - 0x114]
call fcn.1015b110
add esp, 8
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x1016103d
cmp dword [esi], 0x6c6f6361
jne 0x10160de4
cmp dword [ebx], eax
jne 0x10161033
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebx]
lea ecx, [eax + edx]
cmp ecx, edx
jb 0x10161033
mov ebx, dword [ebp - 0x114]
mov dword [esi + 0xc], edi
mov edi, dword [ebp - 0x110]
mov dword [esi + 0x14], eax
lea eax, [esi - 4]
mov dword [ebp - 0x11c], ecx
mov ecx, dword [ebp - 0x118]
mov dword [esi + 0x10], edx
add esi, 0x20
mov dword [ecx + edi*4], eax
inc edi
mov cx, word [ebp - 0x164]
movzx eax, cx
mov dword [ebp - 0x110], edi
cmp edi, eax
jl 0x10160ad1
mov esi, dword [ebp - 0x108]
movzx eax, cx
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + eax*4 - 4]
mov eax, dword [edx + 0x14]
add eax, dword [edx + 0x18]
mov dword [ebp - 0x144], eax
cmp eax, dword [edx + 0x14]
jb 0x10161033
cmp dword [ebp - 0x16c], 0x74746366
mov eax, 1
mov word [ebp - 0x138], ax
mov dword [ebp - 0x13c], 0
jne 0x10161194
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.10113670
add esp, 8
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x104], 0
jne 0x1016103d
cmp eax, 0x10000
je 0x10160ebd
cmp eax, 0x20000
jne 0x10161033
lea eax, [ebp - 0x138]
push eax
push ebx
call fcn.1015b040
add esp, 8
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x1016103d
mov ax, word [ebp - 0x138]
test ax, ax
je 0x10161033
lea ecx, [ebp - 0x104]
movzx eax, ax
push ecx
push 0
push eax
push 0
push 0xc
push esi
call fcn.10115120
add esp, 0x18
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x104], 0
jne 0x1016103d
xor ecx, ecx
mov dword [ebp - 0x110], 0
cmp cx, word [ebp - 0x138]
jae 0x1016119e
xor edx, edx
mov dword [ebp - 0x120], edx
nop dword [eax]
mov edi, dword [ebp - 0x114]
lea esi, [edx + eax]
lea ebx, [esi + 4]
mov dword [ebp - 0x11c], esi
push ebx
push edi
call fcn.1015b040
add esp, 8
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x1016103d
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.10113670
add esp, 8
mov dword [esi], eax
cmp dword [ebp - 0x104], 0
jne 0x1016103d
lea eax, [ebp - 0x104]
push eax
movzx eax, word [ebx]
push 0
push eax
push 0
push 2
push dword [ebp - 0x108]
call fcn.10115120
xor ebx, ebx
mov dword [esi + 8], eax
add esp, 0x18
cmp dword [ebp - 0x104], ebx
jne 0x1016103f
mov eax, dword [ebp - 0x11c]
xor ecx, ecx
xor edi, edi
xor esi, esi
cmp cx, word [eax + 4]
jae 0x10161162
nop
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x114]
call fcn.1015b040
add esp, 8
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x1016103d
mov cx, word [ebp - 0x10c]
cmp cx, word [ebp - 0x164]
jae 0x10161033
mov edx, dword [ebp - 0x11c]
mov eax, dword [edx + 8]
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x118]
movzx ecx, cx
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 4]
cmp eax, 0x6c6f6361
jne 0x10161132
mov ebx, ecx
jmp 0x1016113a
mov dword [esi], 0
mov dword [ebp - 0x104], 8
xor ebx, ebx
push dword [ebp - 0x180]
push dword [ebp - 0x108]
call fcn.10114fd0
push dword [ebp - 0x118]
push dword [ebp - 0x108]
call fcn.10114fd0
push dword [ebp - 0x124]
push dword [ebp - 0x108]
call fcn.10114fd0
push dword [ebp - 0x190]
push dword [ebp - 0x108]
call fcn.10114fd0
mov eax, dword [ebp - 0x130]
add esp, 0x20
test eax, eax
je 0x101610e4
xor ecx, ecx
xor edi, edi
cmp cx, word [ebp - 0x138]
jae 0x101610cb
lea esi, [eax + 8]
push dword [esi]
push dword [ebp - 0x108]
call fcn.10114fd0
mov dword [esi], 0
lea esi, [esi + 0xc]
movzx eax, word [ebp - 0x138]
inc edi
add esp, 8
cmp edi, eax
jl 0x101610a0
mov eax, dword [ebp - 0x130]
push eax
push dword [ebp - 0x108]
call fcn.10114fd0
add esp, 8
mov dword [ebp - 0x130], 0
cmp dword [ebp - 0x104], 0
je 0x1016111b
push ebx
push dword [ebp - 0x108]
call fcn.10114fd0
mov ebx, dword [ebp - 0x128]
add esp, 8
test ebx, ebx
je 0x1016111b
push ebx
call fcn.10112e90
push ebx
push dword [ebp - 0x108]
call fcn.10114fd0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x104]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1016b209
mov esp, ebp
pop ebp
ret
cmp eax, 0x676c7966
cmove edi, ecx
movzx eax, word [edx + 4]
inc esi
cmp esi, eax
jb 0x10160fd0
test edi, edi
jne 0x1016114f
test ebx, ebx
je 0x10161162
cmp edi, ebx
ja 0x10161033
sub ebx, edi
cmp ebx, 1
jne 0x10161033
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x120]
inc ecx
movzx eax, word [ebp - 0x138]
add edx, 0xc
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x120], edx
cmp ecx, eax
jge 0x1016119e
mov eax, dword [ebp - 0x130]
jmp 0x10160f40
mov dword [ebp - 0x130], 0
push dword [ebp - 0x114]
call fcn.101132b0
mov ecx, dword [ebp - 0x15c]
add esp, 4
mov edx, dword [ebp - 0x168]
add ecx, 3
add ecx, eax
mov dword [ebp - 0x140], eax
and ecx, 0xfffffffc
cmp ecx, edx
ja 0x10161033
mov esi, dword [ebp - 0x158]
test esi, esi
je 0x101611ec
cmp ecx, esi
jne 0x10161033
lea ecx, [esi + 3]
add ecx, dword [ebp - 0x154]
and ecx, 0xfffffffc
mov esi, dword [ebp - 0x14c]
test esi, esi
je 0x1016120a
cmp ecx, esi
jne 0x10161033
lea ecx, [esi + 3]
add ecx, dword [ebp - 0x148]
and ecx, 0xfffffffc
lea eax, [edx + 3]
and eax, 0xfffffffc
cmp ecx, eax
jne 0x10161033
mov ecx, dword [ebp - 0x178]
mov esi, dword [ebp - 0x174]
movzx eax, word [ebp - 0x138]
mov edi, dword [ebp - 0x12c]
mov dword [ecx], eax
mov esi, dword [esi]
test esi, esi
lea ecx, [edi - 1]
cmovns ecx, edi
cmp ecx, eax
jl 0x10161256
test esi, esi
js 0x10161254
mov dword [ebp - 0x104], 6
jmp 0x1016103d
xor ecx, ecx
cmp dword [ebp - 0x13c], 0
je 0x10161362
mov eax, dword [ebp - 0x130]
lea ecx, [ecx + ecx*2]
mov edi, dword [ebp - 0x108]
lea esi, [eax + ecx*4]
lea eax, [ebp - 0x104]
push eax
movzx eax, word [esi + 4]
push 0
push eax
push 0
push 4
push edi
call fcn.10115120
add esp, 0x18
mov ebx, eax
cmp dword [ebp - 0x104], 0
jne 0x1016103d
movzx ecx, word [esi + 4]
xor edx, edx
mov dword [ebp - 0x12c], edx
mov eax, ecx
cmp dx, cx
jae 0x101612de
mov edi, dword [ebp - 0x118]
nop dword [eax + eax]
mov eax, dword [esi + 8]
movzx eax, word [eax + edx*2]
mov eax, dword [edi + eax*4]
mov dword [ebx + edx*4], eax
inc edx
movzx ecx, word [esi + 4]
cmp edx, ecx
jl 0x101612c0
mov edi, dword [ebp - 0x108]
mov eax, ecx
lea ecx, [ebp - 0x104]
movzx eax, ax
push ecx
push dword [ebp - 0x118]
push eax
movzx eax, word [ebp - 0x164]
push eax
push 4
push edi
call fcn.10115120
add esp, 0x18
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x104], 0
jne 0x1016103d
xor ecx, ecx
xor edx, edx
cmp cx, word [esi + 4]
jae 0x10161337
mov edi, ebx
mov ecx, eax
sub edi, eax
mov eax, dword [edi + ecx]
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
inc edx
movzx eax, word [esi + 4]
cmp edx, eax
jl 0x10161325
push ebx
mov ebx, dword [ebp - 0x108]
push ebx
call fcn.10114fd0
mov eax, dword [esi]
add esp, 8
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x16c], eax
mov ax, word [esi + 4]
mov word [ebp - 0x164], ax
jmp 0x1016136f
mov ax, word [ebp - 0x164]
mov ebx, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x160]
movzx esi, ax
shl esi, 4
add esi, 0xc
mov dword [ebp - 0x11c], esi
cmp ecx, esi
jbe 0x101613aa
mov eax, ecx
shr eax, 6
cmp eax, edx
jbe 0x10161398
mov esi, edx
shl esi, 6
jmp 0x1016139a
mov esi, ecx
mov eax, 0x4000000
cmp esi, eax
cmovae esi, eax
mov dword [ebp - 0x11c], esi
lea eax, [ebp - 0x104]
push eax
push esi
push ebx
call fcn.10114f60
mov edi, eax
add esp, 0xc
cmp dword [ebp - 0x104], 0
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x110], edi
jne 0x101614ec
lea eax, [ebp - 0x104]
push eax
push 0x28
push ebx
call fcn.10114f60
add esp, 0xc
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x104], 0
jne 0x101614ec
mov ecx, dword [ebp - 0x16c]
lea edx, [edi + 1]
shr ecx, 0x18
mov byte [edi], cl
mov ecx, dword [ebp - 0x16c]
shr ecx, 0x10
mov byte [edx], cl
mov eax, dword [ebp - 0x16c]
shr eax, 8
mov byte [edx + 1], al
mov al, byte [ebp - 0x16c]
mov byte [edx + 2], al
mov di, word [ebp - 0x164]
test di, di
je 0x101614a8
movzx ebx, di
xor ecx, ecx
mov eax, ebx
test eax, eax
je 0x10161445
inc ecx
shr eax, 1
jne 0x10161440
dec ecx
shl ebx, 4
mov eax, 1
shl eax, cl
shl eax, 4
sub ebx, eax
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x164]
shr eax, 8
mov byte [edx + 3], al
mov al, byte [ebp - 0x164]
mov byte [edx + 4], al
mov eax, dword [ebp - 0x120]
shr eax, 8
mov byte [edx + 5], al
mov eax, dword [ebp - 0x120]
mov byte [edx + 6], al
mov eax, ecx
shr eax, 8
mov byte [edx + 7], al
mov eax, ebx
shr eax, 8
mov byte [edx + 0xa], bl
mov ebx, dword [ebp - 0x108]
mov byte [edx + 8], cl
mov byte [edx + 9], al
mov di, word [ebp - 0x164]
mov eax, dword [ebp - 0x10c]
push 0xc
push eax
call fcn.1015b370
push 0x1015b340
mov dword [ebp - 0x198], eax
movzx eax, di
mov edi, dword [ebp - 0x118]
push 4
push eax
push edi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
mov eax, dword [ebp - 0x144]
add esp, 0x18
cmp eax, 1
jae 0x101614f7
mov dword [ebp - 0x104], 8
mov ebx, dword [ebp - 0x10c]
jmp 0x1016103f
cmp eax, esi
jbe 0x10161510
mov ebx, dword [ebp - 0x10c]
mov dword [ebp - 0x104], 8
jmp 0x1016103f
lea ecx, [ebp - 0x104]
push ecx
push eax
push ebx
call fcn.10114f60
add esp, 0xc
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x104], 0
jne 0x101614ec
push dword [ebp - 0x15c]
mov ebx, dword [ebp - 0x114]
push ebx
call fcn.10112eb0
add esp, 8
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x101614ec
push ebx
mov dword [ebp - 0x104], 7
call fcn.10112fb0
add esp, 4
cmp dword [ebp - 0x104], 0
jne 0x101614ec
mov esi, dword [ebp - 0x108]
lea eax, [ebp - 0x11c]
push esi
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x170]
push eax
push edi
push dword [ebp - 0x144]
push dword [ebp - 0x124]
call fcn.1015c3b0
add esp, 0x20
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x1016165c
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x11c]
cmp eax, ecx
jae 0x101615f8
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x110]
push eax
push ecx
push 1
push esi
call fcn.10115120
add esp, 0x18
mov edi, eax
cmp dword [ebp - 0x104], 0
mov dword [ebp - 0x10c], edi
jne 0x101614ec
mov eax, dword [ebp - 0x134]
jmp 0x10161604
mov edi, dword [ebp - 0x110]
mov dword [ebp - 0x10c], edi
mov esi, dword [ebp - 0x128]
push eax
push edi
push esi
call fcn.10113280
mov eax, dword [ebx + 0x1c]
mov ebx, dword [ebp - 0x17c]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], 0x1015dd90
mov eax, dword [ebx + 8]
shr eax, 0xa
and eax, 1
push eax
push dword [ebx + 0x68]
call fcn.10113020
mov ecx, dword [ebp - 0x174]
add esp, 0x14
and dword [ebx + 8], 0xfffffbff
mov dword [ebx + 0x68], esi
mov eax, dword [ecx]
sar eax, 0x1f
mov dword [ecx], eax
mov ebx, dword [ebp - 0x10c]
jmp 0x1016103f
mov ebx, dword [ebp - 0x110]
jmp 0x1016103f