Function at 0x100055d0
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Print debug messages

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
push str.MemoryLoadLibrary
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
xor ebp, ebp
push eax
push ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], ebp
call fcn.10005a50
mov edi, dword [esp + 0x20]
add esp, 8
cmp edi, ebp
je 0x10005914
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x10005914
mov dl, 0x74
mov bl, 0x6c
mov byte [esp + 0x37], dl
mov byte [esp + 0x57], dl
mov byte [esp + 0x5e], dl
mov byte [esp + 0x61], dl
mov byte [esp + 0x2e], dl
lea edx, [esp + 0x24]
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x5a], bl
mov cl, 0x72
mov al, 0x61
mov bl, 0x65
push edx
push edi
mov byte [esp + 0x3c], 0x56
mov byte [esp + 0x3d], 0x69
mov byte [esp + 0x3e], cl
mov byte [esp + 0x40], 0x75
mov byte [esp + 0x41], al
mov byte [esp + 0x43], 0x41
mov byte [esp + 0x46], 0x6f
mov byte [esp + 0x47], 0x63
mov byte [esp + 0x48], 0
mov byte [esp + 0x4c], 0x4c
mov byte [esp + 0x4d], 0x6f
mov byte [esp + 0x4e], al
mov byte [esp + 0x4f], 0x64
mov byte [esp + 0x50], 0x4c
mov byte [esp + 0x51], 0x69
mov byte [esp + 0x52], 0x62
mov byte [esp + 0x53], cl
mov byte [esp + 0x54], al
mov byte [esp + 0x55], cl
mov byte [esp + 0x56], 0x79
mov byte [esp + 0x57], 0x41
mov byte [esp + 0x58], 0
mov byte [esp + 0x5c], 0x56
mov byte [esp + 0x5d], 0x69
mov byte [esp + 0x5e], cl
mov byte [esp + 0x60], 0x75
mov byte [esp + 0x61], al
mov byte [esp + 0x63], 0x50
mov byte [esp + 0x64], cl
mov byte [esp + 0x65], 0x6f
mov byte [esp + 0x67], bl
mov byte [esp + 0x68], 0x63
mov byte [esp + 0x6a], 0
mov byte [esp + 0x2c], 0x49
mov byte [esp + 0x2d], 0x73
mov byte [esp + 0x2e], 0x42
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], 0x64
mov byte [esp + 0x31], 0x52
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], al
mov byte [esp + 0x34], 0x64
mov byte [esp + 0x35], 0x50
mov byte [esp + 0x37], cl
mov byte [esp + 0x38], 0
call esi
cmp eax, ebp
je 0x10005914
mov ebx, dword [esp + 0x68]
push 0x134
push ebx
call eax
test eax, eax
jne 0x10005914
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x34]
push eax
push ecx
call dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x44]
push edx
push eax
call dword [esp + 0x18]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x54]
mov esi, eax
push ecx
push edx
mov dword [esp + 0x24], esi
call dword [esp + 0x18]
cmp edi, ebp
mov dword [esp + 0x20], eax
je 0x10005914
cmp esi, ebp
je 0x10005914
cmp eax, ebp
je 0x10005914
cmp word [ebx], 0x5a4d
jne 0x10005914
mov eax, dword [ebx + 0x3c]
lea esi, [eax + ebx]
mov dword [esp + 0x68], esi
cmp dword [esi], 0x4550
jne 0x10005914
mov ecx, dword [esi + 0x50]
push 0x40
push 0x1000
push ecx
push ebp
call edi
mov ecx, dword [esi + 0x54]
mov ebp, eax
mov edx, ecx
mov esi, ebx
mov edi, ebp
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10005b10
mov ebx, dword [esp + 0x70]
add esp, 8
mov eax, dword [ebx + 0x80]
mov dword [esp + 0x14], eax
lea edi, [eax + ebp]
mov eax, dword [edi + 4]
test eax, eax
jne 0x1000580b
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1000580b
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x1000580b
cmp dword [edi], 0
jne 0x1000580b
mov eax, dword [edi + 8]
test eax, eax
je 0x10005868
mov eax, dword [edi + 0xc]
mov dword [esp + 0x14], eax
add eax, ebp
push eax
call dword [esp + 0x20]
mov esi, eax
test esi, esi
je 0x10005863
mov eax, dword [edi + 0x10]
mov dword [esp + 0x14], eax
add eax, ebp
test eax, eax
je 0x10005863
mov ecx, dword [eax]
test ecx, ecx
je 0x10005863
test ecx, 0x80000000
je 0x10005841
xor ecx, ecx
mov cx, word [eax]
jmp 0x10005845
lea ecx, [ecx + ebp + 2]
push ecx
push esi
call dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [edx + ebp], eax
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp + 0x14], eax
add eax, ebp
test eax, eax
jne 0x1000582c
add edi, 0x14
jmp 0x100057ea
mov esi, dword [ebx + 0xa0]
add esi, ebp
mov eax, dword [esi + 4]
test eax, eax
je 0x100058c9
add eax, 0xfffffff8
lea edi, [esi + 8]
shr eax, 1
mov ecx, eax
dec eax
test ecx, ecx
je 0x100058bf
inc eax
mov dword [esp + 0x68], eax
mov edx, dword [esi]
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
and eax, 0xfff
add eax, edx
mov edx, ebp
sub edx, dword [ebx + 0x34]
add eax, ebp
shr ecx, 0xc
cmp ecx, 3
je 0x100058af
cmp ecx, 0xa
jne 0x100058b1
add dword [eax], edx
mov eax, dword [esp + 0x68]
add edi, 2
dec eax
mov dword [esp + 0x68], eax
jne 0x1000588b
add esi, dword [esi + 4]
mov eax, dword [esi + 4]
test eax, eax
jne 0x10005877
mov ecx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x1c]
lea edx, [esp + 0x14]
add ecx, ebp
push edx
push 0x20
push eax
push ecx
call dword [esp + 0x30]
mov edx, dword [esp + 0x6c]
mov eax, dword [ebx + 0x28]
push edx
push 0x256
add eax, ebp
push ebp
call eax
test eax, eax
jne 0x1000590a
push str.MemoryLoadLibrary:_return_false
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebp
call fcn.10005920
add esp, 4
xor ebp, ebp
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x54
ret