Function at 0x10011000
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x454
mov eax, dword [0x100dd9d4]
xor eax, esp
mov dword [esp + 0x450], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
movzx edi, word [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
imul eax, edi
push eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edi
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov ecx, dword [esi + 8]
imul ecx, edi
push ecx
mov ebx, eax
push 0
push ebx
call sub.ntdll.dll_memset
xor eax, eax
add esp, 0x10
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x1c], 0
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0xc]
mov ecx, 0x80
mov esi, 0x100dd108
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [eax + 8]
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 0x18]
mov edi, dword [esp + 0x24]
mov dx, word [eax + 0xa8]
mov dword [esp + 0x54], esi
mov esi, dword [eax + 0x10]
mov dword [esp + 0x58], esi
mov esi, dword [esp + 0x1a]
add edi, esi
imul edi, edi, 0x64
add edi, dword [esp + 0x26]
mov word [esp + 0x43], cx
movzx ecx, word [eax + 0xa6]
mov word [esp + 0x50], dx
mov dl, byte [eax + 0xa4]
mov word [esp + 0x52], cx
mov cx, word [ebp + 0x14]
mov byte [esp + 0x45], dl
mov edx, dword [ebp + 0x18]
mov word [esp + 0x46], cx
xor ecx, ecx
add edi, dword [esp + 0x1e]
mov dword [esp + 0x5c], edx
mov edx, 2
mov byte [esp + 0x48], dl
mov word [esp + 0x49], cx
mov word [esp + 0x4b], cx
mov dword [esp + 0x64], edx
mov byte [esp + 0x4d], pe_nt_image_headers32
mov word [esp + 0x4e], cx
mov word [esp + 0x60], cx
mov word [esp + 0x62], cx
mov word [esp + 0x68], 1
mov word [esp + 0x6a], 6
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], ecx
mov byte [esp + 0x78], 0x80
mov byte [esp + 0x79], cl
mov byte [esp + 0x7a], 0x29
movzx esi, di
mov edi, dword [esp + 0x20]
imul edi, edi, 0x64
add edi, dword [esp + 0x22]
add edi, dword [esp + 0x18]
movzx edi, di
shl edi, 0x10
or esi, edi
mov dword [esp + 0x7b], esi
lea esi, [eax + 0x20]
mov eax, esi
lea edi, [eax + 2]
mov dword [esp + 0x14], edi
lea ebx, [ebx]
mov di, word [eax]
add eax, edx
cmp di, cx
jne 0x10011180
sub eax, dword [esp + 0x14]
sar eax, 1
je 0x1001120d
xor eax, eax
push ecx
push ecx
push 0x20
mov dword [esp + 0x449], eax
mov dword [esp + 0x44d], eax
mov dword [esp + 0x451], eax
mov dword [esp + 0x455], eax
mov dword [esp + 0x459], eax
mov dword [esp + 0x45d], eax
mov dword [esp + 0x461], eax
mov word [esp + 0x465], ax
mov byte [esp + 0x467], al
lea eax, [esp + 0x448]
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
mov byte [esp + 0x45c], cl
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xb
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x87]
push edx
call dword [sym.imp.ntdll.dll_strncpy]
add esp, 0xc
mov eax, dword [esp + 0xc]
mov dword [esp + 0x8a], 0x33544146
mov dword [esp + 0x8e], 0x20202032
mov ecx, 0x80
lea esi, [esp + 0x38]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 8]
lea ecx, [eax + eax*2]
push 0x200
lea edi, [ebx + ecx*2]
lea edx, [esp + 0x3c]
push 0
mov ecx, 0x80
lea esi, [esp + 0x40]
push edx
rep movsd dword es:[edi], dword [esi]
call sub.ntdll.dll_memset
push 0x200
lea eax, [esp + 0x248]
push 0
push eax
call sub.ntdll.dll_memset
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x24]
add ecx, 0xffffffff
mov dword [esp + 0x238], ecx
mov eax, 0xaa550000
mov dword [esp + 0x24c], eax
mov dword [esp + 0x44c], eax
mov eax, dword [esp + 0x24]
mov edi, dword [eax + 8]
add edi, ebx
mov dword [esp + 0x23c], edx
mov dword [esp + 0x50], 0x41615252
mov dword [esp + 0x234], 0x61417272
mov ecx, 0x80
lea esi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 8]
lea edi, [ebx + ecx*2]
mov ecx, 0x80
lea esi, [esp + 0x250]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 8]
lea edi, [ecx*8]
sub edi, ecx
add edi, ebx
mov ecx, 0x80
lea esi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax + 8]
lea edi, [ebx + edx*8]
mov ecx, 0x80
lea esi, [esp + 0x250]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 8]
lea eax, [eax + eax*2]
lea edi, [ebx + eax*4]
mov eax, dword [esp + 0x48]
cdq
push edx
push eax
mov eax, dword [esp + 0x30]
mov ecx, 0x80
mov esi, 0x100dd308
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x4c]
push ecx
push edx
push ebx
call fcn.10010f20
push ebx
mov esi, eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 0x30
test esi, esi
jne 0x1001138f
call fcn.10059c60
mov edi, eax
mov esi, dword [edi]
push 0x253
mov ecx, str..._fatfmt.cpp
add esi, 8
call fcn.10010c40
push eax
mov eax, dword [esi]
push str._s:_Failed_to_write_the_reserved_sector_of_FAT32.
push edi
call eax
mov ecx, dword [esp + 0x44]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
add esp, 0x10
push 0x69
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.10059076
mov esp, ebp
pop ebp
ret 0x24
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10059076
mov esp, ebp
pop ebp
ret 0x24