Function at 0x100021c0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10007004]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0xe
mov dword [ebp - 0x30], 0x7676760e
mov dword [ebp - 0x2c], 0x76767676
xor eax, eax
mov dword [ebp - 0x28], 0x76767676
mov word [ebp - 0x24], 0x7676
mov byte [ebp - 0x22], 0
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 0xd
jae 0x10002202
mov cl, byte [ebp - 0x30]
jmp 0x100021f3
mov byte [ebp - 0x22], 0
mov cl, 0x25
mov dword [ebp - 0x40], 0xc9ae7025
xor eax, eax
mov dword [ebp - 0x3c], 0x7639c9a6
mov dword [ebp - 0x38], 0x2d50ae73
mov word [ebp - 0x34], 0xe516
mov byte [ebp - 0x32], 0
nop dword [eax]
xor byte [ebp + eax - 0x3f], cl
inc eax
cmp eax, 0xd
jae 0x1000223f
mov cl, byte [ebp - 0x40]
jmp 0x10002230
push ebx
mov byte [ebp - 0x20], 5
mov al, 0x6b
xor al, byte [ebp - 0x20]
mov dh, 0x69
mov byte [ebp - 0x1f], al
mov ah, 0x2b
mov al, byte [ebp - 0x20]
mov bh, dh
xor ah, al
mov byte [ebp - 0x17], 0
push esi
mov cl, 0x60
mov byte [ebp - 0x1b], ah
mov dl, 0x71
mov byte [ebp - 0x32], 0
mov ch, 0x61
mov byte [ebp - 0x17], 0
mov bl, 0x66
mov dword [ebp - 0xc], 0
xor cl, al
xor dl, al
xor bl, al
mov byte [ebp - 0x1e], cl
xor ch, al
mov byte [ebp - 0x1d], dl
xor dh, al
mov byte [ebp - 0x1c], bl
xor bh, al
mov byte [ebp - 0x1a], ch
push edi
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x19], dh
xorps xmm0, xmm0
mov byte [ebp - 0x18], bh
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
test eax, eax
je 0x100022bf
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetModuleInformation]
lea esi, [ebp - 0x2f]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100022c5
mov eax, dword [ebp - 0x10]
sub esi, ecx
xor edi, edi
mov dword [ebp - 8], esi
sub eax, esi
mov dword [ebp - 0x44], eax
je 0x10002320
nop dword [eax]
xor eax, eax
mov bl, 1
test esi, esi
je 0x10002393
nop dword [eax]
cmp byte [ebp + eax - 0x2f], 0x3f
je 0x1000230d
mov esi, dword [ebp - 0x14]
lea edx, [eax + edi]
mov cl, byte [ebp + eax - 0x3f]
cmp cl, byte [edx + esi]
mov esi, dword [ebp - 8]
je 0x1000230d
xor cl, cl
jmp 0x1000230f
mov cl, 1
inc eax
and bl, cl
cmp eax, esi
jb 0x100022f0
test bl, bl
jne 0x10002393
inc edi
cmp edi, dword [ebp - 0x44]
jb 0x100022e0
xor ebx, ebx
push 0x40
push 0x3000
push 0xb
push 0
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov edi, eax
mov esi, dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
mov dword [edi], ecx
mov cx, word [ebx + 4]
mov word [edi + 4], cx
mov ecx, ebx
sub ecx, edi
mov byte [edi + 6], 0xe9
push 6
sub ecx, 5
push ebx
mov dword [edi + 7], ecx
call esi
mov eax, 0x10002010
mov byte [ebx], 0xe9
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ebx
call esi
mov ecx, dword [ebp - 4]
mov dword [0x10007618], edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10003a5f
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x14]
add ebx, edi
jmp 0x10002322