Function at 0x10003140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
push ebx
mov al, 0x45
mov cl, 0x6c
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x25], al
mov byte [esp + 0x28], al
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], cl
push edi
mov dl, 0x52
mov al, 0x64
mov cl, 0x61
push 0
mov byte [esp + 0x2c], 0x4b
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0x4e
mov byte [esp + 0x31], 0x4c
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], al
mov byte [esp + 0x38], 0
mov byte [esp + 0x1c], 0x49
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x42
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], al
mov byte [esp + 0x25], 0x50
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x28], 0
call esi
push 0
mov edi, 1
call esi
mov ebp, dword [esp + 0x3c]
mov eax, dword [ebp]
mov ebx, dword [ebp + 4]
add eax, 0x80
mov dword [esp + 0x10], ebx
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x1000331f
mov edi, dword [eax]
push 0
add edi, ebx
call esi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x14
push edi
mov dword [esp + 0x1c], eax
call eax
test eax, eax
jne 0x10003333
mov eax, dword [edi + 0xc]
test eax, eax
je 0x10003333
push 0
call esi
mov edx, dword [edi + 0xc]
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ebx, eax
call esi
test ebx, ebx
je 0x1000331a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [eax*4 + 4]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x10003329
mov ecx, dword [ebp + 0xc]
push 0
mov dword [eax + ecx*4], ebx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
call esi
mov eax, dword [edi]
test eax, eax
je 0x100032a2
mov edx, dword [esp + 0x10]
push 0
lea ebp, [eax + edx]
call esi
mov esi, dword [edi + 0x10]
mov eax, dword [esp + 0x10]
add esi, eax
jmp 0x100032ae
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x10]
lea ebp, [eax + ecx]
mov esi, ebp
mov eax, dword [ebp]
test eax, eax
je 0x100032e6
test eax, 0x80000000
je 0x100032c3
and eax, 0xffff
jmp 0x100032cb
mov edx, dword [esp + 0x10]
lea eax, [eax + edx + 2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi], eax
je 0x10003307
mov eax, dword [ebp + 4]
add ebp, 4
add esi, 4
test eax, eax
jne 0x100032b5
add edi, 0x14
push 0x14
push edi
call dword [esp + 0x1c]
test eax, eax
jne 0x10003333
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x10]
jmp 0x10003229
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor edi, edi
push edi
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret