Function at 0x20003112
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
mov eax, eax
mov ecx, ecx
nop
nop
mov edi, edi
mov edi, edi
nop
mov eax, eax
mov ecx, ecx
nop
nop
mov edi, edi
nop
mov eax, eax
nop
mov ecx, ecx
mov edi, edi
mov edi, edi
xor ebx, ebx
cmp dword [0x200694cc], ebx
je 0x20003161
cmp dword [0x200694d0], ebx
je 0x20003161
cmp dword [0x200694d4], ebx
je 0x20003161
cmp dword [0x200694d8], ebx
jne 0x20003225
mov eax, 0x74656e72
mov ecx, 0x65746e49
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
mov edx, 0x6e65704f
push eax
mov dword [ebp - 0x20], 0x696e6977
mov dword [ebp - 0x1c], 0x2e74656e
mov dword [ebp - 0x18], 0x6c6c64
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], 0x736f6c43
mov dword [ebp - 0x68], 0x6e614865
mov dword [ebp - 0x64], 0x656c64
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x41
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], 0x416c7255
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], 0x64616552
mov dword [ebp - 0x28], 0x656c6946
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x74]
push eax
push edi
call esi
mov dword [0x200694cc], eax
lea eax, [ebp - 0x48]
push eax
push edi
call esi
mov dword [0x200694d0], eax
lea eax, [ebp - 0x5c]
push eax
push edi
call esi
mov dword [0x200694d4], eax
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov dword [0x200694d8], eax
push ebx
push ebx
push ebx
mov esi, 0x200
push ebx
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
xor edi, edi
call dword [0x200694d0]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x20003302
push ebx
push 0x84000000
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [0x200694d4]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x200032f9
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x200694d8]
test eax, eax
je 0x200032e7
mov eax, dword [ebp - 4]
cmp eax, ebx
jbe 0x200032e3
add eax, edi
cmp eax, dword [ebp - 8]
jbe 0x200032af
add dword [ebp - 8], esi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_realloc]
pop ecx
cmp eax, ebx
pop ecx
je 0x200032e3
mov dword [ebp + 8], eax
push dword [ebp - 4]
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 4]
add edi, dword [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x200694d8]
test eax, eax
jne 0x20003289
cmp edi, ebx
ja 0x200032f3
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp 0x200032f9
mov eax, dword [ebp + 8]
mov byte [eax + edi], bl
push dword [ebp - 0xc]
call dword [0x200694cc]
push dword [ebp - 0x10]
call dword [0x200694cc]
xor eax, eax
cmp eax, edi
pop edi
sbb eax, eax
pop esi
and eax, dword [ebp + 8]
pop ebx
leave
ret