Function at 0x100013e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
mov dword [esp + 0x18], ebx
call fcn.100030b0
mov esi, eax
push esi
call fcn.10003100
add esp, 8
cmp esi, ebx
mov edi, eax
je 0x10001607
cmp edi, ebx
je 0x10001607
push ebx
lea eax, [esp + 0x28]
push 7
push eax
push edi
push esi
mov byte [esp + 0x38], 0xff
mov byte [esp + 0x39], 0xd0
mov byte [esp + 0x3a], 0xbd
mov byte [esp + 0x3b], 0xf
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
call fcn.10003130
mov ebp, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0x14
cmp eax, 0xffffffff
je 0x1000146a
push ebx
lea eax, [eax + esi + 2]
push 5
push 0x10006128
push eax
mov dword [0x100067fc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
jmp 0x10001478
mov dword [esp + 0x14], 1
mov dword [0x100067fc], ebx
call fcn.10001d60
test eax, eax
jne 0x1000148e
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x34
ret
push ebx
lea ecx, [esp + 0x1c]
push 9
push ecx
push edi
push esi
mov byte [esp + 0x2c], 0x5f
mov byte [esp + 0x2d], 0xb0
mov byte [esp + 0x2e], 1
mov byte [esp + 0x2f], 0x5e
mov byte [esp + 0x30], 0xc2
mov byte [esp + 0x31], 0xc
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0x6a
mov byte [esp + 0x34], 0xff
call fcn.10003130
add esp, 0x14
cmp eax, 0xffffffff
je 0x100014ec
push ebx
add eax, esi
push 7
push 0x10006100
push eax
mov dword [0x10006290], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
jmp 0x100014fb
mov eax, dword [esp + 0x14]
mov dword [0x10006290], ebx
inc eax
mov dword [esp + 0x14], eax
push ebx
lea edx, [esp + 0x30]
push 8
push edx
mov al, 0x88
push edi
push esi
mov byte [esp + 0x40], 0x39
mov byte [esp + 0x41], al
mov byte [esp + 0x42], 0x68
mov byte [esp + 0x43], al
mov byte [esp + 0x44], 0x25
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x76
mov byte [esp + 0x47], 0x19
call fcn.10003130
add esp, 0x14
cmp eax, 0xffffffff
je 0x10001557
push ebx
lea esi, [eax + esi - 5]
push 5
push 0x10006c70
push esi
mov dword [0x10006c60], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
jmp 0x10001566
mov eax, dword [esp + 0x14]
mov dword [0x10006c60], ebx
inc eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x79646453
push eax
mov dword [esp + 0x3c], 0x3430446e
mov dword [esp + 0x40], 0x6c6c642e
mov dword [esp + 0x44], ebx
call fcn.100030b0
mov esi, eax
push esi
call fcn.10003100
add esp, 8
cmp esi, ebx
je 0x10001607
cmp eax, ebx
je 0x10001607
push ebx
lea ecx, [esp + 0x1c]
push 5
push ecx
push eax
push esi
mov byte [esp + 0x2c], 0x68
mov byte [esp + 0x2d], 0xc0
mov byte [esp + 0x2e], 0x7d
mov byte [esp + 0x2f], 0xc9
mov byte [esp + 0x30], 0x82
mov byte [esp + 0x27], 0xc3
call fcn.10003130
add esp, 0x14
cmp eax, 0xffffffff
je 0x100015f8
push ebx
lea edx, [esp + 0x17]
push 1
add eax, esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov eax, dword [esp + 0x14]
mov dword [0x10006c60], ebx
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret