Function at 0x1000154c
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov byte [ebp - 0x20], 0x6b
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x44], 0x49
mov byte [ebp - 0x43], 0x73
mov byte [ebp - 0x42], 0x44
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x62
mov byte [ebp - 0x3f], 0x75
mov byte [ebp - 0x3e], 0x67
mov byte [ebp - 0x3d], 0x67
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x50
mov byte [ebp - 0x39], 0x72
mov byte [ebp - 0x38], 0x65
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x6e
mov byte [ebp - 0x34], 0x74
mov byte [ebp - 0x33], bl
mov byte [ebp - 0xb0], 0x43
mov byte [ebp - 0xaf], 0x68
mov byte [ebp - 0xae], 0x65
mov byte [ebp - 0xad], 0x63
mov byte [ebp - 0xac], 0x6b
mov byte [ebp - 0xab], 0x52
mov byte [ebp - 0xaa], 0x65
mov byte [ebp - 0xa9], 0x6d
mov byte [ebp - 0xa8], 0x6f
mov byte [ebp - 0xa7], 0x74
mov byte [ebp - 0xa6], 0x65
mov byte [ebp - 0xa5], 0x44
mov byte [ebp - 0xa4], 0x65
mov byte [ebp - 0xa3], 0x62
mov byte [ebp - 0xa2], 0x75
mov byte [ebp - 0xa1], 0x67
mov byte [ebp - 0xa0], 0x67
mov byte [ebp - 0x9f], 0x65
mov byte [ebp - 0x9e], 0x72
mov byte [ebp - 0x9d], 0x50
mov byte [ebp - 0x9c], 0x72
mov byte [ebp - 0x9b], 0x65
mov byte [ebp - 0x9a], 0x73
mov byte [ebp - 0x99], 0x65
mov byte [ebp - 0x98], 0x6e
mov byte [ebp - 0x97], 0x74
mov byte [ebp - 0x96], bl
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], bl
mov byte [ebp - 0x94], 0x4e
mov byte [ebp - 0x93], 0x74
mov byte [ebp - 0x92], 0x51
mov byte [ebp - 0x91], 0x75
mov byte [ebp - 0x90], 0x65
mov byte [ebp - 0x8f], 0x72
mov byte [ebp - 0x8e], 0x79
mov byte [ebp - 0x8d], 0x49
mov byte [ebp - 0x8c], 0x6e
mov byte [ebp - 0x8b], 0x66
mov byte [ebp - 0x8a], 0x6f
mov byte [ebp - 0x89], 0x72
mov byte [ebp - 0x88], 0x6d
mov byte [ebp - 0x87], 0x61
mov byte [ebp - 0x86], 0x74
mov byte [ebp - 0x85], 0x69
mov byte [ebp - 0x84], 0x6f
mov byte [ebp - 0x83], 0x6e
mov byte [ebp - 0x82], 0x50
mov byte [ebp - 0x81], 0x72
mov byte [ebp - 0x80], 0x6f
mov byte [ebp - 0x7f], 0x63
mov byte [ebp - 0x7e], 0x65
mov byte [ebp - 0x7d], 0x73
mov byte [ebp - 0x7c], 0x73
mov byte [ebp - 0x7b], bl
mov byte [ebp - 0x5c], 0x4e
mov byte [ebp - 0x5b], 0x74
mov byte [ebp - 0x5a], 0x53
mov byte [ebp - 0x59], 0x65
mov byte [ebp - 0x58], 0x74
mov byte [ebp - 0x57], 0x49
mov byte [ebp - 0x56], 0x6e
mov byte [ebp - 0x55], 0x66
mov byte [ebp - 0x54], 0x6f
mov byte [ebp - 0x53], 0x72
mov byte [ebp - 0x52], 0x6d
mov byte [ebp - 0x51], 0x61
mov byte [ebp - 0x50], 0x74
mov byte [ebp - 0x4f], 0x69
mov byte [ebp - 0x4e], 0x6f
mov byte [ebp - 0x4d], 0x6e
mov byte [ebp - 0x4c], 0x54
mov byte [ebp - 0x4b], 0x68
mov byte [ebp - 0x4a], 0x72
mov byte [ebp - 0x49], 0x65
mov byte [ebp - 0x48], 0x61
mov byte [ebp - 0x47], 0x64
mov byte [ebp - 0x46], bl
mov byte [ebp - 0x30], 0x43
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x47
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x50
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x63
mov byte [ebp - 0x26], 0x65
mov byte [ebp - 0x25], 0x73
mov byte [ebp - 0x24], 0x73
mov byte [ebp - 0x23], 0x49
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x78], 0x4e
mov byte [ebp - 0x77], 0x74
mov byte [ebp - 0x76], 0x51
mov byte [ebp - 0x75], 0x75
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x73], 0x72
mov byte [ebp - 0x72], 0x79
mov byte [ebp - 0x71], 0x49
mov byte [ebp - 0x70], 0x6e
mov byte [ebp - 0x6f], 0x66
mov byte [ebp - 0x6e], 0x6f
mov byte [ebp - 0x6d], 0x72
mov byte [ebp - 0x6c], 0x6d
mov byte [ebp - 0x6b], 0x61
mov byte [ebp - 0x6a], 0x74
mov byte [ebp - 0x69], 0x69
mov byte [ebp - 0x68], 0x6f
mov byte [ebp - 0x67], 0x6e
mov byte [ebp - 0x66], 0x54
mov byte [ebp - 0x65], 0x68
mov byte [ebp - 0x64], 0x72
mov byte [ebp - 0x63], 0x65
mov byte [ebp - 0x62], 0x61
lea eax, [ebp - 0x10]
mov byte [ebp - 0x61], 0x64
push eax
mov byte [ebp - 0x60], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x94]
push eax
push edi
call esi
mov dword [0x1001c814], eax
lea eax, [ebp - 0x78]
push eax
push edi
call esi
mov dword [0x1001c7d8], eax
lea eax, [ebp - 0x5c]
push eax
push edi
call esi
mov dword [0x1001c800], eax
lea eax, [ebp - 0x30]
push eax
push edi
call esi
push 1
mov dword [0x1001c7e0], eax
pop edi
cmp dword [0x10021f1c], edi
jne 0x100018c4
push ebx
push ebx
push 0x11
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [0x1001c800]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], eax
push ecx
push eax
call esi
mov dword [0x1001c81c], eax
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 4]
call esi
mov dword [0x1001c818], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.10001b1a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xbc]
push 4
push eax
push 7
push esi
call dword [0x1001c814]
xor eax, eax
cmp dword [ebp - 0xbc], ebx
push ebx
push 4
setne al
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xb8]
push eax
push 0x1e
push esi
call dword [0x1001c814]
push ebx
lea eax, [ebp - 0xb4]
push 4
push eax
push 0x1f
push esi
call dword [0x1001c814]
mov dword [ebp - 4], ebx
call fcn.10001e10
call fcn.10001d21
cmp eax, edi
je 0x10001a29
call fcn.10001d00
cmp eax, edi
je 0x10001a38
call fcn.10001ce2
cmp eax, edi
je 0x10001a47
call fcn.10001cab
cmp eax, edi
je 0x10001a53
cmp dword [ebp - 0xb4], ebx
je 0x10001a5f
call fcn.10001c74
cmp eax, edi
je 0x10001a6b
cmp dword [ebp - 0xb8], ebx
jne 0x10001a77
call fcn.10001bc5
cmp eax, edi
je 0x10001a83
call fcn.10001b74
cmp eax, edi
je 0x10001a8f
call fcn.10001c1f
cmp eax, edi
je 0x10001a9b
call dword [0x1001c81c]
cmp eax, edi
je 0x10001aa7
lea eax, [ebp - 0xc0]
push eax
push esi
call dword [0x1001c818]
cmp dword [ebp - 0xc0], edi
je 0x10001ab3
cmp dword [ebp - 0xc4], edi
je 0x10001abf
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1000195d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov dword [0x10021df8], 0x38292b8
jmp 0x10001ac9
mov dword [0x10021df8], 0x15883a
jmp 0x10001ac9
mov dword [0x10021df8], 0x52e7fb
jmp 0x10001ac9
mov dword [0x10021df8], 0x38b83
jmp 0x10001ac9
mov dword [0x10021df8], 0x53d8a
jmp 0x10001ac9
mov dword [0x10021df8], 0xdb7ad
jmp 0x10001ac9
mov dword [0x10021df8], 0x12fd1
jmp 0x10001ac9
mov dword [0x10021df8], 0x56ce
jmp 0x10001ac9
mov dword [0x10021df8], 0xd903
jmp 0x10001ac9
mov dword [0x10021df8], 0x1046a
jmp 0x10001ac9
mov dword [0x10021df8], 0x89f9
jmp 0x10001ac9
mov dword [0x10021df8], 0xff99
jmp 0x10001ac9
mov dword [0x10021df8], 0xffa1
xor eax, eax
jmp 0x10001a24