Function at 0x10005b20
Capabilities:
Access peb ldr_data
Encode data using xor
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10015690
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
lea eax, [ecx + 0xc]
mov dword [ebp - 0x58], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x5c], ecx
mov eax, dword [ecx + 0x20]
mov dword [ebp - 0x4c], eax
movaps xmm0, xmmword [0x100170d0]
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x100170e0]
movups xmmword [ebp - 0x30], xmm0
xor edi, edi
lea esi, [ebp - 0x40]
nop word cs:[eax + eax]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + edi*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + edi*4 - 0x34], eax
inc edi
cmp edi, dword [ebp - 0x3c]
jb 0x10005ba0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov ecx, dword [ebp - 0x20]
mov edi, dword [eax + ecx]
movaps xmm0, xmmword [0x100170f0]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x6573b858
xor ebx, ebx
lea esi, [ebp - 0x40]
nop dword [eax]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + ebx*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
cmp ebx, dword [ebp - 0x3c]
jb 0x10005be0
add edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov edi, dword [eax + edi]
movaps xmm0, xmmword [0x10017100]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x7580be35
mov dword [ebp - 0x2c], 0x7ada6ad4
xor ebx, ebx
lea esi, [ebp - 0x40]
nop word cs:[eax + eax]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + ebx*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
cmp ebx, dword [ebp - 0x3c]
jb 0x10005c30
add edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [eax + edi]
mov dword [ebp - 0x48], eax
movaps xmm0, xmmword [0x10017110]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x458dc411
mov dword [ebp - 0x2c], 0x4ae770b0
mov dword [ebp - 0x28], 0x50411d4f
xor ebx, ebx
lea esi, [ebp - 0x40]
nop dword [eax]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + ebx*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
cmp ebx, dword [ebp - 0x3c]
jb 0x10005c80
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [eax + edi]
mov dword [ebp - 0x50], eax
movaps xmm0, xmmword [0x10017120]
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x10017130]
movups xmmword [ebp - 0x30], xmm0
xor ebx, ebx
lea esi, [ebp - 0x40]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + ebx*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
cmp ebx, dword [ebp - 0x3c]
jb 0x10005cc0
cmp dword [ebp - 0x4c], 8
mov eax, dword [ebp - 0x44]
cmovb eax, dword [ebp - 0x58]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x20]
add dword [ebp - 0x48], ecx
add dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [eax + edi]
add eax, ecx
mov dword [ebp - 0x54], eax
xor edi, edi
jmp 0x10005d1f
cmp eax, 0xeb461b5b
mov edi, dword [ebp - 0x4c]
je 0x10005df3
inc edi
lea ebx, [ebp - 0x40]
movaps xmm0, xmmword [0x10017140]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x65a7cfcb
xor esi, esi
nop word cs:[eax + eax]
mov ecx, ebx
push dword [ebp - 0x40]
push dword [ebp + esi*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + esi*4 - 0x34], eax
inc esi
cmp esi, dword [ebp - 0x3c]
jb 0x10005d40
mov eax, dword [ebp - 0x48]
mov ebx, dword [eax + edi*4]
add ebx, dword [ebp - 0x20]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xffffffff
je 0x10005d1e
mov dword [ebp - 0x4c], edi
lea ecx, [eax + 1]
mov edx, ecx
and edx, 3
mov dword [ebp - 0x60], edx
cmp eax, 3
jae 0x10005d90
mov eax, 0x1d
xor edx, edx
jmp 0x10005dce
and ecx, 0xfffffffc
lea esi, [ebx + 3]
mov eax, 0x1d
xor edx, edx
nop dword [eax]
movsx edi, byte [esi + edx - 3]
xor edi, eax
lea eax, [edi + edi*4]
movsx edi, byte [esi + edx - 2]
xor edi, eax
lea eax, [edi + edi*4]
movsx edi, byte [esi + edx - 1]
xor edi, eax
lea eax, [edi + edi*4]
movsx edi, byte [esi + edx]
xor edi, eax
lea eax, [edi + edi*4]
add edx, 4
cmp ecx, edx
jne 0x10005da0
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x10005d10
add ebx, edx
xor ecx, ecx
nop dword [eax]
movsx edx, byte [ebx + ecx]
xor edx, eax
lea eax, [edx + edx*4]
inc ecx
cmp esi, ecx
jne 0x10005de0
jmp 0x10005d10
mov eax, dword [ebp - 0x54]
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x50]
add ecx, dword [edx + eax*4]
mov dword [ebp - 0x10], 0
push dword [ebp - 0x44]
call ecx
mov ebx, dword [ebp - 0x5c]
mov ecx, dword [ebx]
mov dword [ecx], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x74], 1
mov dword [ebp - 0x70], 9
movsd xmm0, qword [str.rdui_ri]
movsd qword [ebp - 0x6c], xmm0
mov byte [ebp - 0x64], 1
xor edi, edi
lea esi, [ebp - 0x74]
movsx eax, byte [ebp + edi - 0x6c]
mov ecx, esi
push eax
call fcn.1000afe0
mov byte [ebp + edi - 0x6c], al
inc edi
cmp edi, dword [ebp - 0x70]
jb 0x10005e50
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
movaps xmm0, xmmword [0x100170d0]
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x100170e0]
movups xmmword [ebp - 0x30], xmm0
xor edi, edi
lea esi, [ebp - 0x40]
nop dword [eax]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + edi*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + edi*4 - 0x34], eax
inc edi
cmp edi, dword [ebp - 0x3c]
jb 0x10005e90
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov ecx, dword [ebp - 0x20]
mov edi, dword [eax + ecx]
movaps xmm0, xmmword [0x100170f0]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x6573b858
xor ebx, ebx
lea esi, [ebp - 0x40]
nop dword [eax]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + ebx*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
cmp ebx, dword [ebp - 0x3c]
jb 0x10005ed0
add edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov edi, dword [eax + edi]
movaps xmm0, xmmword [0x10017100]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x7580be35
mov dword [ebp - 0x2c], 0x7ada6ad4
xor ebx, ebx
lea esi, [ebp - 0x40]
nop word cs:[eax + eax]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + ebx*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
cmp ebx, dword [ebp - 0x3c]
jb 0x10005f20
add edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [eax + edi]
mov dword [ebp - 0x48], eax
movaps xmm0, xmmword [0x10017110]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x458dc411
mov dword [ebp - 0x2c], 0x4ae770b0
mov dword [ebp - 0x28], 0x50411d4f
xor ebx, ebx
lea esi, [ebp - 0x40]
nop dword [eax]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + ebx*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
cmp ebx, dword [ebp - 0x3c]
jb 0x10005f70
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [eax + edi]
mov dword [ebp - 0x44], eax
movaps xmm0, xmmword [0x10017120]
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x10017130]
movups xmmword [ebp - 0x30], xmm0
xor ebx, ebx
lea esi, [ebp - 0x40]
mov ecx, esi
push dword [ebp - 0x40]
push dword [ebp + ebx*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
cmp ebx, dword [ebp - 0x3c]
jb 0x10005fb0
mov ecx, dword [ebp - 0x20]
add dword [ebp - 0x48], ecx
add dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [eax + edi]
add eax, ecx
mov dword [ebp - 0x54], eax
xor edi, edi
jmp 0x10005fff
cmp eax, 0x52e8c03b
mov edi, dword [ebp - 0x4c]
je 0x100060d3
inc edi
lea ebx, [ebp - 0x40]
movaps xmm0, xmmword [0x10017140]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x65a7cfcb
xor esi, esi
nop word cs:[eax + eax]
mov ecx, ebx
push dword [ebp - 0x40]
push dword [ebp + esi*4 - 0x34]
call fcn.10008fc0
mov dword [ebp + esi*4 - 0x34], eax
inc esi
cmp esi, dword [ebp - 0x3c]
jb 0x10006020
mov eax, dword [ebp - 0x48]
mov ebx, dword [eax + edi*4]
add ebx, dword [ebp - 0x20]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xffffffff
je 0x10005ffe
mov dword [ebp - 0x4c], edi
lea ecx, [eax + 1]
mov edx, ecx
and edx, 3
mov dword [ebp - 0x60], edx
cmp eax, 3
jae 0x10006070
mov eax, 0x1d
xor edx, edx
jmp 0x100060ae
and ecx, 0xfffffffc
lea esi, [ebx + 3]
mov eax, 0x1d
xor edx, edx
nop dword [eax]
movsx edi, byte [esi + edx - 3]
xor edi, eax
lea eax, [edi + edi*4]
movsx edi, byte [esi + edx - 2]
xor edi, eax
lea eax, [edi + edi*4]
movsx edi, byte [esi + edx - 1]
xor edi, eax
lea eax, [edi + edi*4]
movsx edi, byte [esi + edx]
xor edi, eax
lea eax, [edi + edi*4]
add edx, 4
cmp ecx, edx
jne 0x10006080
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x10005ff0
add ebx, edx
xor ecx, ecx
nop dword [eax]
movsx edx, byte [ebx + ecx]
xor edx, eax
lea eax, [edx + edx*4]
inc ecx
cmp esi, ecx
jne 0x100060c0
jmp 0x10005ff0
mov eax, dword [ebp - 0x54]
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x44]
add ecx, dword [edx + eax*4]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x50]
call ecx
test eax, eax
je 0x10006105
mov ecx, dword [ebp - 0x5c]
push dword [ecx + 8]
push dword [ecx + 4]
call eax
add esp, 8
mov edi, dword [ebp - 0x5c]
mov eax, dword [edi + 0x20]
cmp eax, 8
jb 0x10006143
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x10006139
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10006168
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.10015b8b
add esp, 8
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 7
mov word [edi + 0xc], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
push ebp
sub esp, 8
add ebp, 0xc
mov ecx, dword [ebp - 0x58]
call fcn.10004600
add esp, 8
pop ebp
ret