Function at 0x100036d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
push ebx
mov al, 0x45
mov cl, 0x6c
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x25], al
mov byte [esp + 0x28], al
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], cl
push edi
mov dl, 0x52
mov al, 0x64
mov cl, 0x61
push 0
mov byte [esp + 0x2c], 0x4b
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0x4e
mov byte [esp + 0x31], 0x4c
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], al
mov byte [esp + 0x38], 0
mov byte [esp + 0x1c], 0x49
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x42
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], al
mov byte [esp + 0x25], 0x50
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x28], 0
call esi
push 0
mov edi, 1
call esi
mov ebp, dword [esp + 0x3c]
mov eax, dword [ebp]
mov ebx, dword [ebp + 4]
add eax, 0x80
mov dword [esp + 0x10], ebx
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x100038af
mov edi, dword [eax]
push 0
add edi, ebx
call esi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x14
push edi
mov dword [esp + 0x1c], eax
call eax
test eax, eax
jne 0x100038c3
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100038c3
push 0
call esi
mov edx, dword [edi + 0xc]
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ebx, eax
call esi
test ebx, ebx
je 0x100038aa
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [eax*4 + 4]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x100038b9
mov ecx, dword [ebp + 0xc]
push 0
mov dword [eax + ecx*4], ebx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
call esi
mov eax, dword [edi]
test eax, eax
je 0x10003832
mov edx, dword [esp + 0x10]
push 0
lea ebp, [eax + edx]
call esi
mov esi, dword [edi + 0x10]
mov eax, dword [esp + 0x10]
add esi, eax
jmp 0x1000383e
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x10]
lea ebp, [eax + ecx]
mov esi, ebp
mov eax, dword [ebp]
test eax, eax
je 0x10003876
test eax, 0x80000000
je 0x10003853
and eax, 0xffff
jmp 0x1000385b
mov edx, dword [esp + 0x10]
lea eax, [eax + edx + 2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi], eax
je 0x10003897
mov eax, dword [ebp + 4]
add ebp, 4
add esi, 4
test eax, eax
jne 0x10003845
add edi, 0x14
push 0x14
push edi
call dword [esp + 0x1c]
test eax, eax
jne 0x100038c3
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x10]
jmp 0x100037b9
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor edi, edi
push edi
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret