Function at 0x20001c85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov eax, eax
mov edi, edi
nop
mov edi, edi
nop
nop
mov eax, eax
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
mov edi, edi
nop
mov esi, esi
nop
nop
mov eax, eax
nop
lea eax, [ebp - 0x44]
xor ebx, ebx
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x64], 0x5f325357
mov dword [ebp - 0x60], 0x642e3233
mov dword [ebp - 0x5c], 0x6c6c
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x44], 0x6e6e6f63
mov dword [ebp - 0x40], 0x746365
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add eax, 5
push ebx
mov dword [0x20007320], eax
call fcn.2000330c
mov esi, eax
push esi
call fcn.20003363
pop ecx
cmp esi, ebx
pop ecx
mov edi, eax
je 0x20001f35
cmp edi, ebx
je 0x20001f35
or byte [ebp - 0x36], 0xff
push 2
lea eax, [ebp - 0x38]
push 0xa
push eax
push edi
push esi
mov byte [ebp - 0x38], 0x8b
mov byte [ebp - 0x37], 0xc8
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x34
mov byte [ebp - 0x33], 0x50
mov byte [ebp - 0x32], 0x8d
mov byte [ebp - 0x31], 0x4c
mov byte [ebp - 0x30], 0x24
mov byte [ebp - 0x2f], 0x18
call fcn.20003434
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001d7d
lea eax, [eax + esi + 5]
mov dword [0x20007220], eax
jmp 0x20001d8a
mov dword [ebp - 4], 1
mov dword [0x20007220], ebx
push ebx
lea eax, [ebp - 0xc]
push 6
push eax
push edi
push esi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x40
mov byte [ebp - 0xa], 0xc
mov byte [ebp - 9], 0x5f
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x10
call fcn.20003434
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001dc3
lea eax, [eax + esi + 6]
mov dword [0x200072bc], eax
jmp 0x20001dcc
inc dword [ebp - 4]
mov dword [0x200072bc], ebx
or byte [ebp - 0x49], 0xff
or byte [ebp - 0x48], 0xff
or byte [ebp - 0x47], 0xff
or byte [ebp - 0x46], 0xff
push ebx
lea eax, [ebp - 0x54]
push 0xf
push eax
push edi
push esi
mov byte [ebp - 0x54], 0x83
mov byte [ebp - 0x53], 0xc4
mov byte [ebp - 0x52], 8
mov byte [ebp - 0x51], 0x8d
mov byte [ebp - 0x50], 0x4c
mov byte [ebp - 0x4f], 0x24
mov byte [ebp - 0x4e], 0xc
mov byte [ebp - 0x4d], 0xc7
mov byte [ebp - 0x4c], 0x44
mov byte [ebp - 0x4b], 0x24
mov byte [ebp - 0x4a], 0x18
call fcn.20003434
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001e27
add eax, esi
mov dword [0x2000721c], eax
jmp 0x20001e30
inc dword [ebp - 4]
mov dword [0x2000721c], ebx
or byte [ebp - 0x2c], 0xff
push ebx
lea eax, [ebp - 0x2c]
push 8
push eax
push edi
push esi
mov byte [ebp - 0x2b], 0x52
mov byte [ebp - 0x2a], 0x34
mov byte [ebp - 0x29], 0x50
mov byte [ebp - 0x28], 0x6a
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], 0x8b
mov byte [ebp - 0x25], 0xce
call fcn.20003434
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001e70
lea eax, [eax + esi + 3]
mov dword [0x2000725c], eax
jmp 0x20001e79
inc dword [ebp - 4]
mov dword [0x2000725c], ebx
push ebx
lea eax, [ebp - 0x14]
push 6
push eax
push edi
push esi
mov byte [ebp - 0x14], 0xb9
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], 0x99
call fcn.20003434
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001ead
add eax, esi
mov dword [0x2000615c], eax
jmp 0x20001eb6
inc dword [ebp - 4]
mov dword [0x2000615c], ebx
push ebx
lea eax, [ebp - 0x1c]
push 6
push eax
push edi
push esi
mov byte [ebp - 0x1c], 0x8d
mov byte [ebp - 0x1b], 0x14
mov byte [ebp - 0x1a], 0x89
mov byte [ebp - 0x19], 0x8d
mov byte [ebp - 0x18], 4
mov byte [ebp - 0x17], 0x90
call fcn.20003434
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001eed
add eax, esi
mov dword [0x20007218], eax
jmp 0x20001ef6
inc dword [ebp - 4]
mov dword [0x20007218], ebx
push 1
lea eax, [ebp - 0x24]
push 6
push eax
push edi
push esi
mov byte [ebp - 0x24], 0x88
mov byte [ebp - 0x23], 0x9d
mov byte [ebp - 0x22], 0x34
mov byte [ebp - 0x21], 1
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], bl
call fcn.20003434
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001f2c
add eax, esi
mov dword [0x200061b0], eax
jmp 0x20001f35
inc dword [ebp - 4]
mov dword [0x200061b0], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret