Function at 0x10021a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1003a8d6
mov eax, dword fs:[0]
push eax
sub esp, 0x60c
mov eax, dword [0x10043330]
xor eax, esp
mov dword [esp + 0x604], eax
push ebx
push esi
push edi
mov eax, dword [0x10043330]
xor eax, esp
push eax
lea eax, [esp + 0x61c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x62c]
mov ecx, 0x6c
lea esi, [esp + 0x630]
lea edi, [esp + 0x4c]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push 0x3fe
lea ecx, [esp + 0x21a]
push esi
push ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x220], si
call fcn.1002fb20
add esp, 0xc
push 0x400
lea edx, [esp + 0x218]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10021ccd
mov edi, 7
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], esi
mov word [esp + 0x34], si
lea eax, [esp + 0x214]
mov dword [esp + 0x624], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x10021b06
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x218]
push eax
lea esi, [esp + 0x38]
call fcn.100031f0
push 1
mov ebx, esi
call fcn.10027b20
cmp eax, 0xffffffff
je 0x10021cb9
mov ecx, dword [esp + 0x44]
add ecx, 0xffffffff
cmp eax, ecx
je 0x10021cb9
mov edx, esi
xor ebx, ebx
lea ecx, [eax + 1]
push edx
lea esi, [esp + 0x18]
mov word [esp + 0x200], 0x41
mov word [esp + 0x202], 0x6d
mov word [esp + 0x204], 0x43
mov word [esp + 0x206], 0x6f
mov word [esp + 0x208], 0x72
mov word [esp + 0x20a], 0x65
mov word [esp + 0x20c], 0x2e
mov word [esp + 0x20e], 0x64
mov word [esp + 0x210], 0x6c
mov word [esp + 0x212], 0x6c
mov word [esp + 0x214], bx
call fcn.10016b90
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0x62c], 1
call fcn.10003860
mov byte [esp + 0x624], bl
cmp dword [esp + 0x2c], 8
jb 0x10021bf4
mov eax, dword [esp + 0x18]
push eax
call fcn.1002b322
add esp, 4
mov eax, dword [esp + 0x10]
cmp byte [eax + 0x6c], bl
je 0x10021c0f
lea ecx, [esp + 0x30]
lea edx, [eax + 0x16e]
push ecx
call fcn.10002c90
jmp 0x10021c41
lea eax, [esp + 0x1fc]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10021c20
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x200]
push edx
lea ecx, [esp + 0x38]
call fcn.10003120
push ebx
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push ebx
lea eax, [esp + 0x5c]
mov word [ecx + 4], bx
call fcn.10003860
lea ecx, [esp + 0x34]
call fcn.10028120
cmp al, bl
je 0x10021c96
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x14]
push ecx
mov esi, 0x1b0
call fcn.10028680
test al, al
mov eax, dword [esp + 0x10]
jne 0x10021ca1
cmp eax, ebx
je 0x10021c96
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x30]
call fcn.10003e00
jmp 0x10021ccd
cmp eax, ebx
je 0x10021cac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x30]
call fcn.10003e00
mov al, 1
jmp 0x10021ccf
cmp dword [esp + 0x48], 8
jb 0x10021ccd
mov edx, dword [esp + 0x34]
push edx
call fcn.1002b322
add esp, 4
xor al, al
mov ecx, dword [esp + 0x61c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x604]
xor ecx, esp
call fcn.1002b6af
add esp, 0x618
ret 0x1b4