Function at 0x100029e0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
mov ebx, dword [ecx]
push esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0x48], 0x4e52454b
mov dword [ebp - 0x44], 0x32334c45
mov dword [ebp - 0x40], 0x6c6c642e
mov byte [ebp - 0x3c], 0
cmp dword [ebx + 0x84], 0
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x5c], esi
jbe 0x10002ca8
push edi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x61427349
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x34], 0x61655264
push eax
mov dword [ebp - 0x30], 0x72745064
mov byte [ebp - 0x2c], 0
call dword [0x10161de8]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebx, dword [ebx + 0x80]
add ebx, esi
mov dword [ebp - 0x84], eax
push 0x14
push ebx
mov dword [ebp - 0x6c], ebx
call eax
test eax, eax
jne 0x10002c9c
mov ecx, dword [0x101b5c48]
mov eax, dword fs:[0x2c]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x80], eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x10002c9c
add eax, esi
push eax
call dword [0x10161de8]
mov dword [ebp - 0x68], eax
cmp eax, 0xffffffff
je 0x10002c93
test eax, eax
je 0x10002c93
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x10], 0x4e52454b
mov dword [ebp - 0xc], 0x32334c45
mov dword [ebp - 8], 0x6c6c642e
mov eax, dword [ecx + 0xc]
mov byte [ebp - 4], 0
mov dword [ebp - 0x58], 0x50746547
mov dword [ebp - 0x54], 0x65636f72
lea esi, [eax*4 + 4]
mov dword [ebp - 0x50], 0x65487373
mov eax, dword [ecx + 8]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x10]
mov word [ebp - 0x4c], 0x7061
push eax
mov byte [ebp - 0x4a], 0
call dword [0x10161de8]
push eax
call edi
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], 0x70616548
push eax
mov dword [ebp - 0x24], 0x6c416552
mov dword [ebp - 0x20], 0x636f6c
call dword [0x10161de8]
push eax
call edi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], 0x70616548
push eax
mov dword [ebp - 0x18], 0x6f6c6c41
mov word [ebp - 0x14], 0x63
call dword [0x10161de8]
push eax
call edi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x70]
push esi
test eax, eax
je 0x10002b6c
push eax
push 0
call dword [ebp - 0x60]
push eax
call dword [ebp - 0x74]
jmp 0x10002b75
push 0
call dword [ebp - 0x60]
push eax
call dword [ebp - 0x78]
mov esi, dword [ebp - 0x64]
mov edx, eax
mov dword [esi + 8], edx
test edx, edx
je 0x10002c93
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x68]
mov dword [edx + eax*4], ecx
inc dword [esi + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x10002b9a
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 0x5c]
mov esi, dword [ebx + 0x10]
add esi, edx
lea ebx, [eax + edx]
mov eax, dword [ebx]
test eax, eax
je 0x10002c75
jns 0x10002bbf
movzx eax, ax
push eax
push ecx
call edi
mov dword [esi], eax
jmp 0x10002c59
lea edi, [edx + 2]
add edi, eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmm0, xmmword [str.GetModuleFileNam]
mov dword [esi], eax
lea eax, [ebp - 0x98]
push edi
push eax
movups xmmword [ebp - 0x98], xmm0
mov word [ebp - 0x88], 0x4165
mov byte [ebp - 0x86], 0
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10002c53
mov ecx, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], esi
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [0x101b5fd0]
cmp eax, dword [ecx + 8]
jle 0x10002c4c
push 0x101b5fd0
call fcn.101432fb
add esp, 4
cmp dword [0x101b5fd0], 0xffffffff
jne 0x10002c4c
push 0x101b5fd0
mov dword [0x101b5fd4], 0x10002cc0
call fcn.101432b1
add esp, 4
mov eax, dword [0x101b5fd4]
mov dword [esi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esi], 0
je 0x10002c93
mov eax, dword [ebx + 4]
add ebx, 4
mov ecx, dword [ebp - 0x68]
add esi, 4
mov edx, dword [ebp - 0x5c]
test eax, eax
jne 0x10002baf
mov ebx, dword [ebp - 0x6c]
add ebx, 0x14
push 0x14
push ebx
mov dword [ebp - 0x6c], ebx
call dword [ebp - 0x84]
test eax, eax
jne 0x10002c9c
mov esi, dword [ebp - 0x5c]
jmp 0x10002a80
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret