Function at 0x1000c8e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov al, 0x65
push ebx
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1c], al
mov al, 0x6c
push esi
push edi
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x20], 0x6b
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov al, 0x65
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], al
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], 0x46
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], al
mov byte [ebp - 6], 0x41
mov byte [ebp - 5], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x54], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov al, 0x65
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2c], al
mov al, 0x6c
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x2a], 0x33
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x28], 0x2e
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], al
mov byte [ebp - 0x25], al
mov byte [ebp - 0x24], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov dl, 0x65
mov cl, 0x74
mov al, 0x79
mov bl, 0x72
mov byte [ebp - 0x44], 0x47
mov byte [ebp - 0x43], dl
mov byte [ebp - 0x42], cl
mov byte [ebp - 0x41], 0x53
mov byte [ebp - 0x40], al
mov byte [ebp - 0x3f], 0x73
mov byte [ebp - 0x3e], cl
mov byte [ebp - 0x3d], dl
mov byte [ebp - 0x3c], 0x6d
mov byte [ebp - 0x3b], 0x44
mov byte [ebp - 0x3a], 0x69
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x38], dl
mov byte [ebp - 0x37], 0x63
mov byte [ebp - 0x36], cl
mov byte [ebp - 0x35], 0x6f
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], 0x41
mov byte [ebp - 0x31], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x50], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
lea ecx, [ebp - 0x158]
xor eax, eax
push 0x104
push ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], eax
call dword [ebp - 0x50]
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov edi, str._syslog.dat
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x158]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
mov ecx, ebx
push 3
push eax
and ecx, 3
push 1
lea eax, [ebp - 0x158]
push bind
rep movsb byte es:[edi], byte [esi]
push eax
call dword [ebp - 0x54]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000cb94
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
jne 0x1000cb50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [ebp - 4]
mov edi, eax
push 0
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
test ebx, ebx
jbe 0x1000cb7e
mov cl, byte [eax + edi]
xor cl, 0x62
mov byte [eax + edi], cl
inc eax
cmp eax, ebx
jb 0x1000cb70
mov ecx, dword [ebp - 0x4c]
push ebx
push edi
call fcn.1000c860
push edi
mov dword [ebp - 0x48], eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov eax, dword [ebp - 0x48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret