Function at 0x1000f5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push ebx
push esi
push edi
mov dword [ebp - 0x188], ecx
mov byte [ebp - 0x16c], 0x6b
mov byte [ebp - 0x16b], 0x65
mov byte [ebp - 0x16a], 0x72
mov byte [ebp - 0x169], 0x6e
mov byte [ebp - 0x168], 0x65
mov byte [ebp - 0x167], 0x6c
mov byte [ebp - 0x166], 0x33
mov byte [ebp - 0x165], 0x32
mov byte [ebp - 0x164], 0x2e
mov byte [ebp - 0x163], 0x64
mov byte [ebp - 0x162], 0x6c
mov byte [ebp - 0x161], 0x6c
mov byte [ebp - 0x160], 0
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x17c], eax
mov edx, dword [ebp - 0x188]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
je 0x1000f6e0
cmp dword [ebp - 0x18c], 4
je 0x1000f6d7
cmp dword [ebp - 0x18c], 6
je 0x1000f6e9
jmp 0x1000f6f2
mov dword [ebp - 8], 3
jmp 0x1000f6fe
mov dword [ebp - 8], 1
jmp 0x1000f6fe
mov dword [ebp - 8], 5
jmp 0x1000f6fe
mov ecx, dword [ebp - 0x188]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10001a88
push 0x10001a98
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x15c]
push eax
mov ecx, dword [ebp - 0x188]
add ecx, 0x20
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push 9
push 0
lea edx, [ebp - 0x178]
push edx
call fcn.10023a80
add esp, 0xc
nop
nop
nop
nop
mov byte [ebp - 0x178], 0x70
cmp dword [ebp - 0xc], 0xffffffff
je 0x1000f7f1
cmp dword [ebp - 8], 1
jne 0x1000f79e
push 4
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x177]
push ecx
call fcn.10023b10
add esp, 0xc
push 4
lea edx, [ebp - 0x13c]
push edx
lea eax, [ebp - 0x173]
push eax
call fcn.10023b10
add esp, 0xc
mov dword [ebp - 4], 3
jmp 0x1000f7ef
cmp dword [ebp - 8], 3
jne 0x1000f7c0
push 8
push 0
lea ecx, [ebp - 0x177]
push ecx
call fcn.10023a80
add esp, 0xc
mov dword [ebp - 4], 2
jmp 0x1000f7ef
cmp dword [ebp - 8], 5
jne 0x1000f7ef
mov dword [ebp - 0x184], 0xffffffff
push 4
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0x173]
push eax
call fcn.10023b10
add esp, 0xc
mov dword [ebp - 4], 3
jmp 0x1000f80b
push 8
push 0
lea ecx, [ebp - 0x177]
push ecx
call fcn.10023a80
add esp, 0xc
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x80
mov eax, dword [ebp - 4]
push eax
push 0
push 2
push 0x40000000
mov ecx, dword [ebp - 0x188]
add ecx, 0x20
push ecx
call dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffff
jne 0x1000f864
mov edx, dword [ebp - 0x188]
mov dword [edx + 0x128], 0
mov dword [edx + 0x12c], 0
jmp 0x1000f88d
mov eax, dword [ebp - 0x180]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 9
lea ecx, [ebp - 0x178]
push ecx
mov ecx, dword [ebp - 0x188]
call fcn.10015e7b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret