Function at 0x1003dd60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf04
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
mov dword [ebp - 0xf00], ebx
test ebx, ebx
jne 0x1003de83
push 1
push eax
push eax
call dword [sym.imp.USER32.dll_MonitorFromPoint]
test eax, eax
je 0x1003de70
lea ecx, [ebp - 0xefc]
mov dword [ebp - 0xefc], 0x68
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x1003de70
mov eax, dword [ebp - 0xeec]
xor edi, edi
mov ebx, dword [ebp - 0xef0]
sub eax, dword [ebp - 0xef4]
sub ebx, dword [ebp - 0xef8]
push 5
mov dword [ebp - 0xe40], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x1003de70
cmp edi, 0x3e8
jge 0x1003de70
lea eax, [ebp - 0xe94]
mov dword [ebp - 0xe94], 0x3c
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowInfo]
test eax, eax
je 0x1003de60
mov eax, dword [ebp - 0xe70]
test eax, 0x10000000
je 0x1003de60
test eax, 0x20000000
jne 0x1003de60
test byte [ebp - 0xe6c], 8
je 0x1003de60
cmp dword [ebp - 0xe90], 0
jne 0x1003de60
cmp dword [ebp - 0xe8c], 0
jne 0x1003de60
cmp dword [ebp - 0xe88], ebx
jne 0x1003de60
mov eax, dword [ebp - 0xe40]
cmp dword [ebp - 0xe84], eax
je 0x1003e3ee
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
inc edi
test esi, esi
jne 0x1003ddf3
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x1003de70
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0xe44]
push eax
push ebx
mov dword [ebp - 0xe44], 0
call esi
mov edi, dword [ebp - 0xe44]
cmp edi, 4
jae 0x1003dec1
mov dword [ebp - 0xe44], 0
jmp 0x1003e207
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, ebx
je 0x1003de70
lea ecx, [ebp - 0xe40]
mov dword [ebp - 0xe40], 0
push ecx
push eax
call esi
cmp dword [ebp - 0xe40], edi
je 0x1003de70
mov eax, dword [ebp - 0xe44]
cmp eax, 4
jbe 0x1003e207
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1003e207
push 0x104
lea eax, [ebp - 0xe3c]
push eax
push 0
push edi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x1003df2d
mov esi, 1
jmp 0x1003df81
mov eax, dword [0x101e52a0]
mov dword [ebp - 0xe40], 0x104
test eax, eax
jne 0x1003df6c
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1003df53
xor esi, esi
jmp 0x1003df81
push str.QueryFullProcessImageNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101e52a0], eax
test eax, eax
jne 0x1003df6c
xor esi, esi
jmp 0x1003df81
lea ecx, [ebp - 0xe40]
push ecx
lea ecx, [ebp - 0xe3c]
push ecx
push 0
push edi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1003e201
lea eax, [ebp - 0xe3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xe40], eax
test eax, eax
je 0x1003e201
push 0x1f0
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc34], 0x780065
push 0
push eax
mov dword [ebp - 0xc30], 0x6c0070
mov dword [ebp - 0xc2c], 0x72006f
mov dword [ebp - 0xc28], 0x720065
mov dword [ebp - 0xc24], 0x65002e
mov dword [ebp - 0xc20], 0x650078
call fcn.10150460
push 0x1f2
lea eax, [ebp - 0xa16]
mov dword [ebp - 0xa2c], 0x610074
mov ecx, 0x65
mov dword [ebp - 0xa28], 0x6b0073
push 0
push eax
mov dword [ebp - 0xa24], 0x67006d
mov dword [ebp - 0xa20], 0x2e0072
mov dword [ebp - 0xa1c], 0x780065
mov word [ebp - 0xa18], cx
call fcn.10150460
push 0x1e0
lea eax, [ebp - 0x7fc]
mov dword [ebp - 0x824], 0x360033
push 0
push eax
mov dword [ebp - 0x820], 0x440030
mov dword [ebp - 0x81c], 0x730065
mov dword [ebp - 0x818], 0x74006b
mov dword [ebp - 0x814], 0x70006f
mov dword [ebp - 0x810], 0x69004c
mov dword [ebp - 0x80c], 0x650074
mov dword [ebp - 0x808], 0x340036
mov dword [ebp - 0x804], 0x65002e
mov dword [ebp - 0x800], 0x650078
call fcn.10150460
push 0x1e4
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0x61c], 0x360033
push 0
push eax
mov dword [ebp - 0x618], 0x440030
mov dword [ebp - 0x614], 0x730065
mov dword [ebp - 0x610], 0x74006b
mov dword [ebp - 0x60c], 0x70006f
mov dword [ebp - 0x608], 0x69004c
mov dword [ebp - 0x604], 0x650074
mov dword [ebp - 0x600], 0x65002e
mov dword [ebp - 0x5fc], 0x650078
call fcn.10150460
push 0x1f0
lea eax, [ebp - 0x3fc]
mov dword [ebp - 0x414], 0x360033
push 0
push eax
mov dword [ebp - 0x410], 0x770030
mov dword [ebp - 0x40c], 0x730070
mov dword [ebp - 0x408], 0x760072
mov dword [ebp - 0x404], 0x65002e
mov dword [ebp - 0x400], 0x650078
call fcn.10150460
push 0x1f2
lea eax, [ebp - 0x1f6]
mov dword [ebp - 0x20c], 0x690062
mov ecx, 0x65
mov dword [ebp - 0x208], 0x640072
push 0
push eax
mov dword [ebp - 0x204], 0x720073
mov dword [ebp - 0x200], 0x2e0076
mov dword [ebp - 0x1fc], 0x780065
mov word [ebp - 0x1f8], cx
call fcn.10150460
add esp, 0x48
lea edi, [ebp - 0xc34]
xor esi, esi
nop word [eax + eax]
push dword [ebp - 0xe40]
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1003de70
inc esi
add edi, 0x208
cmp esi, 6
jl 0x1003e1e0
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0xf04]
push eax
lea eax, [ebp - 0xe40]
push eax
call fcn.1003e8e0
add esp, 8
test eax, eax
je 0x1003de70
xorps xmm0, xmm0
mov dword [ebp - 0xe48], 0
movlpd qword [ebp - 0xe50], xmm0
push dword [ebp - 0xe4c]
push dword [ebp - 0xe50]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, dword [ebp - 0xf04]
test eax, eax
je 0x1003e264
lea eax, [ebp - 0xe48]
push eax
push ebx
call esi
test eax, eax
jne 0x1003e2a4
lea eax, [ebp - 0xe58]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
mov eax, dword [ebp - 0xe40]
je 0x1003e2aa
cmp dword [ebp - 0xe58], 0
jne 0x1003e2aa
cmp dword [ebp - 0xe54], 0
jne 0x1003e2aa
cmp dword [ebp - 0xe50], eax
jne 0x1003e2aa
cmp dword [ebp - 0xe4c], edi
je 0x1003e3ee
jmp 0x1003e2aa
mov eax, dword [ebp - 0xe40]
push dword [ebp - 0xe44]
lea ebx, [eax - 5]
mov eax, ebx
lea esi, [edi - 5]
shl eax, 4
sub eax, ebx
cdq
and edx, 0xf
lea edi, [edx + eax]
lea eax, [ebp - 0xf00]
sar edi, 4
push eax
push 0
push edi
call fcn.1003e850
add esp, 0x10
test eax, eax
jne 0x1003e2fd
push dword [ebp - 0xe44]
lea eax, [ebp - 0xf00]
push eax
push 0
push edi
call fcn.1003e850
add esp, 0x10
test eax, eax
je 0x1003de70
push dword [ebp - 0xe44]
mov eax, esi
lea ecx, [ebp - 0xf00]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push ecx
push eax
push ebx
mov dword [ebp - 0xf04], eax
call fcn.1003e850
add esp, 0x10
test eax, eax
jne 0x1003e358
push dword [ebp - 0xe44]
mov eax, esi
lea ecx, [ebp - 0xf00]
shl eax, 4
sub eax, esi
cdq
and edx, 0xf
add eax, edx
push ecx
sar eax, 4
push eax
push ebx
call fcn.1003e850
add esp, 0x10
test eax, eax
je 0x1003de70
push dword [ebp - 0xe44]
mov eax, ebx
lea ecx, [ebp - 0xf00]
cdq
and edx, 0xf
push ecx
add eax, edx
sar eax, 4
push esi
push eax
call fcn.1003e850
add esp, 0x10
test eax, eax
jne 0x1003e39d
push dword [ebp - 0xe44]
lea eax, [ebp - 0xf00]
push eax
push esi
push edi
call fcn.1003e850
add esp, 0x10
test eax, eax
je 0x1003de70
push dword [ebp - 0xe44]
lea eax, [ebp - 0xf00]
push eax
push dword [ebp - 0xf04]
push 0
call fcn.1003e850
add esp, 0x10
test eax, eax
jne 0x1003e3ee
push dword [ebp - 0xe44]
mov eax, esi
lea ecx, [ebp - 0xf00]
shl eax, 4
sub eax, esi
cdq
and edx, 0xf
add eax, edx
push ecx
sar eax, 4
push eax
push 0
call fcn.1003e850
add esp, 0x10
test eax, eax
je 0x1003de70
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10128191
mov esp, ebp
pop ebp
ret