Function at 0x10101ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x884
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x880], eax
mov eax, dword [esp + 0x890]
push ebx
push esi
push edi
mov dword [esp + 0x28], eax
xor edi, edi
cmp dword [0x101d30e4], 0xffffedfe
mov esi, esi
cmp dword [0x101d30d4], 0xffffe6a7
cmp dword [0x101d30d0], 0xffff8705
mov eax, 0x5c
mov word [esp + 0x454], ax
mov word [esp + 0x456], ax
mov word [esp + 0x45a], ax
mov eax, 0x69
mov word [esp + 0x458], 0x2e
mov word [esp + 0x45c], 0x50
mov word [esp + 0x45e], 0x68
mov word [esp + 0x460], 0x79
mov word [esp + 0x462], 0x73
mov word [esp + 0x464], ax
mov word [esp + 0x466], 0x63
mov word [esp + 0x468], 0x61
mov word [esp + 0x46a], 0x6c
mov word [esp + 0x46c], 0x44
mov word [esp + 0x46e], 0x72
mov word [esp + 0x470], ax
mov word [esp + 0x472], 0x76
mov word [esp + 0x474], 0x65
mov word [esp + 0x476], 0x25
mov word [esp + 0x478], 0x64
mov word [esp + 0x47a], di
cmp dword [0x101d30cc], 0xffff80a1
mov ebx, dword [esp + 0x894]
push ebx
lea ecx, [esp + 0x458]
push ecx
lea edx, [esp + 0x484]
push edx
call fcn.10031450
add esp, 0xc
mov cl, cl
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
lea eax, [esp + 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, eax
cmp esi, 0xffffffff
je 0x101021c8
mov ebp, ebp
mov dword [esp + 0xc], edi
cmp dword [0x101d30dc], 0x5ffd
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
cmp dword [0x101d30e0], 0x5350
push edi
lea ecx, [esp + 0x10]
push ecx
push 0x18
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push 0x74080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x101021bf
cmp byte [esp + 0x13], 0
jbe 0x101021bf
push ebx
pop ebx
mov al, byte [esp + 0x13]
mov cl, bl
shr al, cl
and al, 0x10
neg al
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [esp + 0x2c], al
cmp dword [0x101d30cc], 0xffff80a1
xor eax, eax
mov dword [esp + 0x430], eax
mov dword [esp + 0x434], eax
mov dword [esp + 0x438], eax
mov dword [esp + 0x43c], eax
mov dword [esp + 0x440], eax
mov dword [esp + 0x444], eax
mov dword [esp + 0x448], eax
mov dword [esp + 0x44c], eax
mov byte [esp + 0x450], al
cmp dword [0x101d30e0], 0xffffacaf
push 0x210
lea ecx, [esp + 0x680]
push edi
push ecx
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d30dc], 0xffffa002
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push edx
push ebx
push eax
lea ecx, [esp + 0x688]
push ecx
lea edx, [esp + 0x440]
push edx
push esi
call fcn.10101a60
add esp, 0x18
test eax, eax
je 0x101021bf
mov ebx, ebx
cmp dword [0x101d30f0], 0xc4e
mov cl, cl
xor eax, eax
movzx ecx, word [esp + eax*2 + 0x68c]
mov dword [esp + eax*4 + 0x30], ecx
cmp dword [0x101d30d8], 0x50d8
add eax, 1
cmp eax, 0x100
jl 0x10102174
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x898]
push edx
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.10101bb0
add esp, 0xc
cmp dword [0x101d30d0], 0x78fa
mov edi, 1
push edx
pop edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
pop eax
mov ecx, dword [esp + 0x88c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1012e3ba
add esp, 0x884
ret