Function at 0x1000ca00
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub esp, 0x14c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [0x1003302c], eax
call esi
push 0
push 0
push 0
mov dword [0x10033034], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10033030], eax
mov ecx, 0x33
xor eax, eax
mov word [esp + 0x124], cx
mov word [esp + 0x130], ax
mov esi, 0x64
mov eax, 0x57
mov dword [esp + 0x126], 0x2e0032
mov word [esp + 0xb8], ax
lea edi, [ecx + 0x3f]
mov eax, 0x5f
mov dword [esp + 0x120], 0x6c0065
mov word [esp + 0xbe], ax
lea ebx, [edi - 0x11]
xor eax, eax
mov dword [esp + 0x12c], 0x6c006c
mov ecx, 0x6c
mov word [esp + 0xfe], ax
mov eax, ecx
mov word [esp + 0xc8], cx
mov word [esp + 0xec], ax
mov dword [esp + 0xe2], eax
mov eax, 0x2e
mov word [esp + 0xdc], ax
mov eax, 0x55
mov word [esp + 0xd0], ax
mov eax, 0x41
mov word [esp + 0x134], ax
xor eax, eax
mov dword [esp + 0x114], ecx
lea ecx, [edi - 9]
mov dword [esp + 0x11c], 0x6e0072
mov word [esp + 0x12a], si
mov dword [esp + 0x118], 0x65004b
mov dword [esp + 0xba], 0x320073
mov dword [esp + 0xc4], 0x64002e
mov dword [esp + 0xca], 0x6c
mov dword [esp + 0xc0], 0x320033
mov dword [esp + 0xe8], 0x680053
mov dword [esp + 0xf2], 0x690070
mov dword [esp + 0xee], 0x610077
mov dword [esp + 0xfa], 0x6c006c
mov dword [esp + 0xf6], 0x64002e
mov dword [esp + 0xde], 0x6c0064
mov dword [esp + 0xd8], 0x320033
mov dword [esp + 0xd2], 0x650073
mov word [esp + 0xd6], di
mov dword [esp + 0x100], 0x680053
mov dword [esp + 0x110], 0x6c0064
mov dword [esp + 0x108], 0x33006c
mov dword [esp + 0x104], 0x6c0065
mov dword [esp + 0x10c], 0x2e0032
mov dword [esp + 0x148], 0x6c006c
mov dword [esp + 0x136], 0x760064
mov dword [esp + 0x13c], 0x690070
mov dword [esp + 0x144], 0x64002e
mov dword [esp + 0x140], 0x320033
mov word [esp + 0x14c], ax
mov word [esp + 0x13a], bx
mov dword [esp + 0xae], 0x64002e
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, 0x6c
mov word [esp + 0xb2], ax
lea eax, [esp + 0x118]
push eax
mov dword [esp + 0xac], 0x700061
mov dword [esp + 0xa8], 0x730050
mov dword [esp + 0xb8], 0x6c
mov word [esp + 0xb0], cx
call esi
mov ebp, eax
lea eax, [esp + 0xb8]
push eax
call esi
mov ebx, eax
lea eax, [esp + 0xe8]
push eax
call esi
mov edi, eax
lea eax, [esp + 0xd0]
push eax
call esi
mov dword [esp + 0x150], eax
lea eax, [esp + 0x100]
push eax
call esi
mov dword [esp + 0x154], eax
lea eax, [esp + 0x134]
push eax
call esi
mov dword [esp + 0x158], eax
lea eax, [esp + 0xa4]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x80], eax
test ebp, ebp
je 0x1000cea7
lea eax, [esp + 0x20]
mov word [esp + 0x24], 0x6946
push eax
push ebp
mov word [esp + 0x2f], 0x65
mov dword [esp + 0x28], 0x64616552
mov byte [esp + 0x2e], 0x6c
call esi
mov dword [0x10051e30], eax
lea eax, [esp + 0x44]
push eax
push ebp
mov dword [esp + 0x57], 0x57656c
mov dword [esp + 0x53], 0x69467473
mov dword [esp + 0x4e], 0x6946646e
mov word [esp + 0x4c], 0x6946
mov byte [esp + 0x52], 0x72
call esi
mov dword [0x10051e34], eax
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x1b], 0x78654e64
mov dword [esp + 0x21], 0x57656c69
mov word [esp + 0x19], 0x6e69
mov byte [esp + 0x18], 0x46
mov byte [esp + 0x25], 0
mov word [esp + 0x1f], 0x4674
call esi
mov dword [0x10051e38], eax
lea eax, [esp + 0x54]
push eax
push ebp
mov word [esp + 0x61], 0x6f6c
mov dword [esp + 0x5d], 0x43646e69
mov word [esp + 0x64], 0x65
mov byte [esp + 0x5c], 0x46
mov byte [esp + 0x63], 0x73
call esi
mov dword [0x10051e3c], eax
lea eax, [esp + 0x2c]
push eax
push ebp
mov word [esp + 0x34], 0x6554
mov word [esp + 0x3f], 0x636f
mov word [esp + 0x42], 0x7373
mov dword [esp + 0x37], 0x616e696d
mov dword [esp + 0x3b], 0x72506574
mov byte [esp + 0x44], 0
mov byte [esp + 0x41], 0x65
mov byte [esp + 0x36], 0x72
call esi
mov dword [0x10051e40], eax
lea eax, [esp + 0x88]
push eax
push ebp
mov dword [esp + 0x99], 0x73736563
mov dword [esp + 0xa5], 0x6d614e65
mov word [esp + 0xaa], 0x57
mov dword [esp + 0x9f], 0x46656761
mov dword [esp + 0x95], 0x6f725074
mov word [esp + 0xa3], 0x6c69
mov dword [esp + 0x90], 0x4732334b
mov word [esp + 0x9d], 0x6d49
mov byte [esp + 0xa9], 0x65
mov byte [esp + 0x94], 0x65
call esi
mov dword [0x10051e88], eax
test eax, eax
jne 0x1000cea7
mov eax, dword [esp + 0x80]
test eax, eax
je 0x1000cea7
lea ecx, [esp + 0x64]
mov dword [esp + 0x79], 0x57656d
push ecx
push eax
mov dword [esp + 0x6e], 0x6f725074
mov dword [esp + 0x78], 0x46656761
mov dword [esp + 0x73], 0x49737365
mov dword [esp + 0x7d], 0x614e656c
mov word [esp + 0x6c], 0x6547
mov byte [esp + 0x77], 0x6d
mov byte [esp + 0x7c], 0x69
mov byte [esp + 0x72], 0x63
call esi
mov dword [0x10051e88], eax
test ebx, ebx
je 0x1000cf79
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0x53415357
push eax
push ebx
mov dword [esp + 0x50], 0x74726174
mov word [esp + 0x55], 0x70
mov byte [esp + 0x54], 0x75
call esi
mov dword [0x10051e44], eax
lea eax, [esp + 0x10]
push eax
push ebx
mov word [esp + 0x1b], 0x6c43
mov word [esp + 0x1e], 0x6e61
mov word [esp + 0x19], 0x4153
mov byte [esp + 0x18], 0x57
mov word [esp + 0x21], 0x70
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x20], 0x75
call esi
mov dword [0x10051e48], eax
lea eax, [esp + 0x20]
push eax
push ebx
mov dword [esp + 0x28], 0x6e6e6f63
mov word [esp + 0x2d], 0x7463
mov byte [esp + 0x2c], 0x65
mov byte [esp + 0x2f], 0
call esi
mov dword [0x10051e4c], eax
lea eax, [esp + 0x80]
push eax
push ebx
mov dword [esp + 0x88], 0x646e6573
mov byte [esp + 0x8c], 0
call esi
mov dword [0x10051e50], eax
lea eax, [esp + 0x54]
push eax
push ebx
mov word [esp + 0x5c], 0x6572
mov word [esp + 0x5f], 0x76
mov byte [esp + 0x5e], 0x63
call esi
mov dword [0x10051e54], eax
test edi, edi
je 0x1000d085
lea eax, [esp + 0x2c]
mov dword [esp + 0x2f], 0x6d655268
push eax
push edi
mov dword [esp + 0x3d], 0x6c694665
mov dword [esp + 0x41], 0x65705365
mov word [esp + 0x45], 0x5763
mov word [esp + 0x35], 0x7461
mov byte [esp + 0x34], 0x50
mov word [esp + 0x3b], 0x766f
mov byte [esp + 0x47], 0
call esi
mov dword [0x10051e58], eax
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x1b], 0x70704168
mov word [esp + 0x18], 0x6150
mov dword [esp + 0x20], 0x57646e
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1f], 0x65
call esi
mov dword [0x10051e5c], eax
lea eax, [esp + 0x44]
push eax
push edi
mov dword [esp + 0x54], 0x576575
mov word [esp + 0x4d], 0x5348
mov dword [esp + 0x50], 0x6c615674
mov byte [esp + 0x4f], 0x65
mov byte [esp + 0x4c], 0x53
call esi
mov dword [0x10051e60], eax
lea eax, [esp + 0x54]
push eax
push edi
mov dword [esp + 0x63], 0x69784565
mov dword [esp + 0x67], 0x57737473
mov dword [esp + 0x5e], 0x69466874
mov word [esp + 0x5c], 0x6150
mov byte [esp + 0x62], 0x6c
mov byte [esp + 0x6b], 0
call esi
mov dword [0x10051e64], eax
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x2f], 0x5765756c
mov byte [esp + 0x33], 0
mov dword [esp + 0x2b], 0x61567465
mov word [esp + 0x29], 0x4748
mov byte [esp + 0x28], 0x53
call esi
mov dword [0x10051e68], eax
mov ebx, dword [esp + 0x150]
test ebx, ebx
je 0x1000d145
lea eax, [esp + 0x20]
mov word [esp + 0x28], 0x57
push eax
push ebx
mov dword [esp + 0x2b], 0x746e6972
mov word [esp + 0x29], 0x7073
mov byte [esp + 0x2f], 0x66
mov byte [esp + 0x28], 0x77
call esi
mov dword [0x10051e6c], eax
lea eax, [esp + 0x64]
push eax
push ebx
mov dword [esp + 0x81], 0x644973
mov dword [esp + 0x72], 0x54776f64
mov dword [esp + 0x77], 0x64616572
mov dword [esp + 0x7b], 0x636f7250
mov byte [esp + 0x76], 0x68
mov word [esp + 0x70], 0x6e69
mov word [esp + 0x6d], 0x7465
mov byte [esp + 0x6c], 0x47
mov word [esp + 0x7f], 0x7365
mov byte [esp + 0x6f], 0x57
call esi
mov dword [0x10051e70], eax
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x1f], 0x6f50776f
mov dword [esp + 0x18], 0x57746553
mov word [esp + 0x23], 0x73
mov word [esp + 0x1d], 0x646e
mov byte [esp + 0x1c], 0x69
call esi
mov dword [0x10051e74], eax
mov eax, dword [esp + 0x154]
test eax, eax
je 0x1000d19c
lea ecx, [esp + 0x2c]
mov word [esp + 0x3f], 0x7461
push ecx
push eax
mov dword [esp + 0x34], 0x65474853
mov dword [esp + 0x38], 0x65705374
mov word [esp + 0x4a], 0x57
mov dword [esp + 0x3c], 0x6c616963
mov dword [esp + 0x40], 0x646c6f46
mov word [esp + 0x45], 0x5072
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x49], 0x68
call esi
mov dword [0x10051e78], eax
mov ebx, dword [esp + 0x158]
test ebx, ebx
je 0x1000d24b
lea eax, [esp + 0x2c]
mov dword [esp + 0x2d], 0x6e457465
push eax
push ebx
mov word [esp + 0x3f], 0x416e
mov word [esp + 0x3c], 0x7365
mov dword [esp + 0x41], 0x576c63
mov word [esp + 0x39], 0x7274
mov byte [esp + 0x34], 0x53
mov byte [esp + 0x3b], 0x69
mov byte [esp + 0x3e], 0x49
call esi
mov dword [0x10051e7c], eax
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x53746553
mov word [esp + 0x23], 0x6e49
mov dword [esp + 0x1c], 0x72756365
mov word [esp + 0x26], 0x6f
mov word [esp + 0x21], 0x7974
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x25], 0x66
call esi
mov dword [0x10051e80], eax
lea eax, [esp + 0x20]
push eax
push ebx
mov dword [esp + 0x2a], 0x69536565
mov word [esp + 0x2e], 0x64
mov word [esp + 0x28], 0x7246
call esi
mov dword [0x10051e84], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret