Function at 0x10020915
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
lea eax, [ebp - 0x38]
mov word [ebp - 0x34], 0x7061
push edi
xor ebx, ebx
mov word [ebp - 0x2e], 0x6c
push eax
mov dword [0x1002c01c], ebx
mov word [ebp - 0x31], 0x642e
mov byte [ebp - 0x32], 0x69
mov dword [ebp - 0x38], 0x74766577
mov byte [ebp - 0x2f], 0x6c
call fcn.10020c28
mov esi, eax
pop ecx
test esi, esi
je 0x10020ae9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x64]
push eax
push esi
mov dword [ebp - 0x62], 0x65724374
mov word [ebp - 0x4f], 0x74
mov dword [ebp - 0x54], 0x65746e6f
mov dword [ebp - 0x5e], 0x52657461
mov dword [ebp - 0x59], 0x7265646e
mov word [ebp - 0x64], 0x7645
mov byte [ebp - 0x55], 0x43
mov byte [ebp - 0x5a], 0x65
mov byte [ebp - 0x50], 0x78
call edi
mov dword [0x1002e380], eax
test eax, eax
je 0x10020ae2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x79726575
push eax
push esi
mov byte [ebp - 0xc], bl
mov dword [ebp - 0x14], 0x51747645
call edi
mov dword [0x1002e384], eax
test eax, eax
je 0x10020ae2
lea eax, [ebp - 8]
mov word [ebp - 7], 0x7476
push eax
push esi
mov dword [ebp - 4], 0x747865
mov byte [ebp - 5], 0x4e
mov byte [ebp - 8], 0x45
call edi
mov dword [0x1002e388], eax
test eax, eax
je 0x10020ae2
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x26], 0x726564
push eax
push esi
mov word [ebp - 0x28], 0x6e65
mov word [ebp - 0x2b], 0x7476
mov byte [ebp - 0x29], 0x52
mov byte [ebp - 0x2c], 0x45
call edi
mov dword [0x1002e38c], eax
test eax, eax
je 0x10020ae2
lea eax, [ebp - 0x80]
mov dword [ebp - 0x75], 0x65687369
push eax
push esi
mov word [ebp - 0x70], 0x654d
mov word [ebp - 0x6d], 0x6461
mov dword [ebp - 0x7d], 0x6e65704f
mov word [ebp - 0x80], 0x7645
mov word [ebp - 0x6a], 0x6174
mov byte [ebp - 0x6e], 0x74
mov word [ebp - 0x78], 0x6275
mov byte [ebp - 0x68], bl
mov byte [ebp - 0x6b], 0x61
mov byte [ebp - 0x79], 0x50
mov byte [ebp - 0x7e], 0x74
mov byte [ebp - 0x76], 0x6c
mov byte [ebp - 0x71], 0x72
call edi
mov dword [0x1002e390], eax
test eax, eax
je 0x10020ae2
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x46747645
push eax
push esi
mov dword [ebp - 0x43], 0x7373654d
mov dword [ebp - 0x3f], 0x656761
mov dword [ebp - 0x47], 0x74616d72
mov byte [ebp - 0x48], 0x6f
call edi
mov dword [0x1002e394], eax
test eax, eax
je 0x10020ae2
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1f], 0x6c437476
push eax
push esi
mov word [ebp - 0x1a], 0x6573
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x1b], 0x6f
call edi
mov dword [0x1002e398], eax
test eax, eax
je 0x10020ae2
xor eax, eax
inc eax
mov dword [0x1002e39c], eax
jmp 0x10020aeb
push esi
call fcn.1001ea1e
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10020af2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov word [ebp - 0xa], 0x3233
push eax
mov dword [ebp - 0xf], 0x656e7265
mov byte [ebp - 0xb], 0x6c
mov dword [ebp - 7], 0x6c6c64
mov byte [ebp - 8], 0x2e
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret