Function at 0x1000fee0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 4], 0
push 0x131bc6a1
lea ecx, [ebp - 0x441]
call fcn.100137b0
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4ec]
push eax
mov ecx, dword [0x10053820]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x441]
call fcn.1001ac70
mov edx, dword [0x10053824]
cmp dword [edx + 0xc], 0
jne 0x1000ff4a
mov dword [ebp - 4], 1
push 0x5b93d37b
lea ecx, [ebp - 0x44d]
call fcn.10013830
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4f0]
push eax
mov ecx, dword [0x10053820]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x238], eax
lea ecx, [ebp - 0x44d]
call fcn.10012c70
mov edx, dword [0x10053824]
cmp dword [edx + 0x238], 0
jne 0x1000ffa4
mov dword [ebp - 4], 0x1b
push 0x7bd15893
lea ecx, [ebp - 0x458]
call fcn.100138b0
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
push eax
mov ecx, dword [0x10053820]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x148], eax
lea ecx, [ebp - 0x458]
call fcn.10012b50
mov edx, dword [0x10053824]
cmp dword [edx + 0x148], 0
jne 0x1001000b
push str.WinAPITable__OpenThread_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
mov eax, 0xc322d5d5
push eax
lea ecx, [ebp - 0x468]
call fcn.10013930
mov dword [ebp - 0x4f8], eax
mov ecx, dword [ebp - 0x4f8]
push ecx
mov edx, dword [0x10053820]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x128], eax
lea ecx, [ebp - 0x468]
call fcn.1001ad00
mov edx, dword [0x10053824]
cmp dword [edx + 0x128], 0
jne 0x10010073
push str.WinAPITable__OpenThreadToken_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
push 0x2781c308
lea ecx, [ebp - 0x474]
call fcn.100139b0
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
push eax
mov ecx, dword [0x10053820]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x14c], eax
lea ecx, [ebp - 0x474]
call fcn.10012c70
mov edx, dword [0x10053824]
cmp dword [edx + 0x14c], 0
jne 0x100100da
push str.WinAPITable__OpenProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
mov eax, 0xaaaac3b
push eax
lea ecx, [ebp - 0x488]
call fcn.10013a30
mov dword [ebp - 0x500], eax
mov ecx, dword [ebp - 0x500]
push ecx
mov edx, dword [0x10053820]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x150], eax
lea ecx, [ebp - 0x488]
call fcn.1001ac40
mov edx, dword [0x10053824]
cmp dword [edx + 0x150], 0
jne 0x10010142
push str.WinAPITable__MultiByteToWideChar_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
push 0x437511fb
lea ecx, [ebp - 0x4a3]
call fcn.10013ab0
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x504]
push eax
mov ecx, dword [0x10053820]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x154], eax
lea ecx, [ebp - 0x4a3]
call fcn.10028a70
mov edx, dword [0x10053824]
cmp dword [edx + 0x154], 0
jne 0x100101a9
push str.WinAPITable__WinStationTerminateProcess_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
push 0x37f91141
lea ecx, [ebp - 0x4af]
call fcn.10013b30
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
push eax
mov ecx, dword [0x10053820]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x8c], eax
lea ecx, [ebp - 0x4af]
call fcn.10012c70
mov edx, dword [0x10053824]
cmp dword [edx + 0x8c], 0
jne 0x10010210
push str.WinAPITable__CloseHandle_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
mov eax, 0xc157e7f6
push eax
lea ecx, [ebp - 0x4bd]
call fcn.10013bb0
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
push ecx
mov edx, dword [0x10053820]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x124], eax
lea ecx, [ebp - 0x4bd]
call fcn.1001ae20
mov edx, dword [0x10053824]
cmp dword [edx + 0x124], 0
jne 0x100102cc
mov eax, 0xef40da26
push eax
lea ecx, [ebp - 0x4cb]
call fcn.10013c30
mov dword [ebp - 0x510], eax
mov ecx, dword [ebp - 0x510]
push ecx
mov edx, dword [0x10053820]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x124], eax
lea ecx, [ebp - 0x4cb]
call fcn.1001ae20
mov edx, dword [0x10053824]
cmp dword [edx + 0x124], 0
jne 0x100102cc
push str.WinAPITable__EnumProcesses_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
push 0x2ad01365
lea ecx, [ebp - 0x4e1]
call fcn.10013cb0
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x514]
push eax
mov ecx, dword [0x10053820]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x1ac], eax
lea ecx, [ebp - 0x4e1]
call fcn.10012ca0
mov edx, dword [0x10053824]
cmp dword [edx + 0x1ac], 0
jne 0x10010333
push str.WinAPITable__LookupPrivilegeValueA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
push str.GetProcessImageFileNameA
mov eax, dword [0x10053820]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x10053824]
mov dword [edx + 0x138], eax
mov eax, dword [0x10053824]
cmp dword [eax + 0x138], 0
jne 0x10010375
push str.WinAPITable__GetProcessImageFileNameA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
push str.GetModuleFileNameExA
mov ecx, dword [0x10053820]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x10053824]
mov dword [ecx + 0x13c], eax
mov edx, dword [0x10053824]
cmp dword [edx + 0x13c], 0
jne 0x100103b9
push str.WinAPITable__GetModuleFileNameExA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
push str.GetLogicalDriveStringsA
mov eax, dword [0x10053820]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x10053824]
mov dword [edx + 0x140], eax
mov eax, dword [0x10053824]
cmp dword [eax + 0x140], 0
jne 0x100103fb
push str.WinAPITable__GetLogicalDriveStringsA_bind_fail_
call sub.MSVCR90.dll_printf
add esp, 4
xor al, al
jmp 0x10012ade
push str.GetModuleFileNameA