Function at 0x10020140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
mov al, 0xb6
mov cl, 0x89
push ebx
push esi
mov byte [esp + 0x2f], al
mov byte [esp + 0x33], al
mov byte [esp + 0x1c], cl
xor ebx, ebx
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], al
mov dl, 2
mov al, 0x8b
mov cl, 0xc
push 0xa00000
push ebx
mov byte [esp + 0x30], 0x33
mov byte [esp + 0x31], 0xc9
mov byte [esp + 0x32], 0x83
mov byte [esp + 0x33], 0xc0
mov byte [esp + 0x34], dl
mov byte [esp + 0x35], 0x57
mov byte [esp + 0x36], 0xf
mov byte [esp + 0x38], 0x50
mov byte [esp + 0x39], 0xfe
mov byte [esp + 0x3a], 0xf
mov byte [esp + 0x3c], 0x70
mov byte [esp + 0x25], 0x87
mov byte [esp + 0x26], 0x10
mov byte [esp + 0x27], 0xf
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x5f
mov byte [esp + 0x2b], 0x5e
mov byte [esp + 0x2c], 0x5d
mov byte [esp + 0x10], 0xb9
mov byte [esp + 0x11], 0x64
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 0xbf
mov byte [esp + 0x19], 0x4d
mov byte [esp + 0x1a], 0xe8
mov byte [esp + 0x1b], 0x33
mov byte [esp + 0x1c], 0xf6
mov byte [esp + 0x1d], 0xf
mov byte [esp + 0x1f], 0x7a
mov byte [esp + 0x20], dl
mov byte [esp + 0x40], al
mov byte [esp + 0x41], 0x45
mov byte [esp + 0x42], 0xbc
mov byte [esp + 0x43], al
mov byte [esp + 0x44], 0x4e
mov byte [esp + 0x45], cl
mov byte [esp + 0x46], al
mov byte [esp + 0x47], 0x40
mov byte [esp + 0x48], 4
mov byte [esp + 0x49], 0x51
mov byte [esp + 0x4a], 0xff
mov byte [esp + 0x4b], 0xd0
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], 0x75
mov byte [esp + 0x4e], cl
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1002041e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov eax, dword [0x10037034]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebx
push 0xa00000
push esi
push 0x500000
push eax
call edi
test eax, eax
je 0x10020416
lea ecx, [esp + 0x14]
push 9
push ecx
push 0xa00000
push esi
call fcn.1001a3d0
add esp, 0x10
cmp eax, ebx
je 0x100202dc
add eax, 0x4ffff7
push ebx
mov dword [0x10036ff8], eax
push 0x100
mov edx, dword [eax + 2]
lea ecx, [eax + 6]
mov dword [0x10036ffc], edx
mov edx, dword [0x10037034]
add eax, 0xffffff80
push 0x10037084
push eax
push edx
mov dword [0x10037000], ecx
call edi
mov eax, dword [0x10036ff8]
mov dword [0x10037074], eax
jmp 0x1002033d
lea ecx, [esp + 0x2c]
push 0xd
push ecx
push 0xa00000
push esi
call fcn.1001a3d0
add esp, 0x10
cmp eax, ebx
je 0x1002033d
add eax, 0x4ffff8
push ebx
mov dword [0x10037004], eax
push 0x100
mov edx, dword [eax + 2]
lea ecx, [eax + 6]
mov dword [0x10037008], edx
mov edx, dword [0x10037034]
add eax, 0xffffff80
push 0x10037384
push eax
push edx
mov dword [0x1003700c], ecx
call edi
mov eax, dword [0x10037004]
mov dword [0x10037040], 1
mov dword [0x10037080], eax
lea ecx, [esp + 0x20]
push 9
push ecx
push 0xa00000
push esi
call fcn.1001a3d0
add esp, 0x10
cmp eax, ebx
je 0x10020382
mov edx, dword [0x10037034]
add eax, 0x500007
mov dword [0x10037010], eax
push ebx
push 0x100
add eax, 0xffffff80
push 0x10037184
push eax
push edx
call edi
mov eax, dword [0x10037010]
mov dword [0x10037078], eax
lea ecx, [esp + 0xc]
push 6
push ecx
push 0xa00000
push esi
call fcn.1001a3d0
add esp, 0x10
cmp eax, ebx
je 0x100203c7
mov edx, dword [0x10037034]
add eax, 0x500000
mov dword [0x10037018], eax
push ebx
push 0x100
add eax, 0xffffff80
push 0x10037284
push eax
push edx
call edi
mov eax, dword [0x10037018]
mov dword [0x1003707c], eax
lea ecx, [esp + 0x3c]
push 0xf
push ecx
push 0xa00000
push esi
call fcn.1001a3d0
add esp, 0x10
cmp eax, ebx
je 0x10020416
add eax, 0x50001e
push ebx
mov dword [0x1003701c], eax
push 0x100
lea edx, [eax + 6]
add eax, 0xffffff80
push 0x10037484
push eax
mov eax, dword [0x10037034]
mov dword [0x10037020], edx
push eax
call edi
mov ecx, dword [0x1003701c]
mov dword [0x10037084], ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
cmp dword [0x10037018], ebx
je 0x10020449
cmp dword [0x10037004], ebx
je 0x10020449
cmp dword [0x10037010], ebx
je 0x10020449
cmp dword [0x1003701c], ebx
je 0x10020449
pop esi
mov eax, 1
pop ebx
add esp, 0x40
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x40
ret