Function at 0x100068e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov dword [ebp - 0x27c], ecx
mov byte [ebp - 0x26c], 0x46
mov byte [ebp - 0x26b], 0x69
mov byte [ebp - 0x26a], 0x6e
mov byte [ebp - 0x269], 0x64
mov byte [ebp - 0x268], 0x46
mov byte [ebp - 0x267], 0x69
mov byte [ebp - 0x266], 0x72
mov byte [ebp - 0x265], 0x73
mov byte [ebp - 0x264], 0x74
mov byte [ebp - 0x263], 0x46
mov byte [ebp - 0x262], 0x69
mov byte [ebp - 0x261], 0x6c
mov byte [ebp - 0x260], 0x65
mov byte [ebp - 0x25f], 0x41
mov byte [ebp - 0x25e], 0
lea eax, [ebp - 0x26c]
push eax
push 0x10022c80
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x27c]
mov dword [ecx + 0x120], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x25c], 0x2800
mov edx, dword [ebp - 0x25c]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
push 0x10022c90
mov eax, dword [ebp + 8]
push eax
push 0x10022c98
lea ecx, [ebp - 0x110]
push ecx
call dword [0x10025e7c]
add esp, 0x10
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x118]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x10006a30
mov byte [ebp - 0x278], 0x68
push 1
lea ecx, [ebp - 0x278]
push ecx
mov ecx, dword [ebp - 0x27c]
call fcn.1000de40
jmp 0x10006bbf
mov edx, dword [ebp - 4]
mov byte [edx], 0x68
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x25c]
sub eax, 0x208
cmp dword [ebp - 0xc], eax
jbe 0x10006a75
mov ecx, dword [ebp - 0x25c]
add ecx, 0x208
mov dword [ebp - 0x25c], ecx
push 0x42
mov edx, dword [ebp - 0x25c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x22c]
mov dword [ebp - 8], ecx
push 0x10022ca0
mov edx, dword [ebp - 8]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x10006aa8
push 0x10022ca4
mov eax, dword [ebp - 8]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x10006aad
jmp 0x10006b6d
mov ecx, dword [ebp - 0x258]
and ecx, 0x10
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x270], eax
mov edx, dword [ebp - 0x270]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x270]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 4
lea edx, [ebp - 0x23c]
push edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx + 4]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0xc]
add edx, 8
mov dword [ebp - 0xc], edx
push 8
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0xc]
add edx, 8
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10006a3d
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x27c]
call fcn.1000de40
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x114]
mov esp, ebp
pop ebp
ret 4