Function at 0x10005bd0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ed60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x49
lea edi, [ebp - 0x188]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x14], eax
rep stosd dword es:[edi], eax
mov dword [ebp - 4], eax
mov bl, 0x65
mov al, 0x6c
mov dl, 0x70
mov cl, 0x6e
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x64], 0x43
mov byte [ebp - 0x63], 0x72
mov byte [ebp - 0x62], bl
mov byte [ebp - 0x61], 0x61
mov byte [ebp - 0x60], 0x74
mov byte [ebp - 0x5f], bl
mov byte [ebp - 0x5e], 0x54
mov byte [ebp - 0x5d], 0x6f
mov byte [ebp - 0x5c], 0x6f
mov byte [ebp - 0x5b], al
mov byte [ebp - 0x5a], 0x68
mov byte [ebp - 0x59], bl
mov byte [ebp - 0x58], al
mov byte [ebp - 0x57], dl
mov byte [ebp - 0x56], 0x33
mov byte [ebp - 0x55], 0x32
mov byte [ebp - 0x54], 0x53
mov byte [ebp - 0x53], cl
mov byte [ebp - 0x52], 0x61
mov byte [ebp - 0x51], dl
mov byte [ebp - 0x50], 0x73
mov byte [ebp - 0x4f], 0x68
mov byte [ebp - 0x4e], 0x6f
mov byte [ebp - 0x4d], 0x74
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x24], 0x4b
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], cl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], 0
push ebx
sbb ebx, edx
mov ebx, 0xf0b17439
add ebx, esp
xor ebx, eax
pop ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x24]
push eax
push ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
mov dword [ebp - 0x48], eax
jne 0x10005cef
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10005cec
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x24]
push eax
push ecx
call edi
push eax
call esi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push eax
add eax, esi
sbb eax, esi
sbb eax, esi
add eax, esi
sbb eax, esi
sbb eax, esi
add eax, esi
nop
pop eax
test eax, eax
je 0x10005e5b
push 0
push 2
call eax
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x10005e5b
mov dword [ebp - 0x18c], 0x128
mov byte [ebp - 0x44], 0x50
mov byte [ebp - 0x43], 0x72
mov byte [ebp - 0x42], 0x6f
mov byte [ebp - 0x41], 0x63
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], 0x73
mov byte [ebp - 0x3e], 0x73
mov byte [ebp - 0x3d], 0x33
mov byte [ebp - 0x3c], 0x32
mov byte [ebp - 0x3b], 0x46
mov byte [ebp - 0x3a], 0x69
mov byte [ebp - 0x39], 0x72
mov byte [ebp - 0x38], 0x73
mov byte [ebp - 0x37], 0x74
mov byte [ebp - 0x36], 0
push ebp
xor ebp, esi
sbb ebp, esi
xor ebp, esi
xor ebp, esi
sbb ebp, esi
nop
pop ebp
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x24]
push edx
push eax
call edi
push eax
call esi
test eax, eax
mov dword [ebp - 0x48], eax
jne 0x10005daa
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10005e5b
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x24]
push edx
push eax
call edi
push eax
call esi
test eax, eax
mov dword [ebp - 0x48], eax
je 0x10005e5b
push edx
add edx, eax
xor edx, esi
add edx, esp
mov edx, 0xb95e05ad
and edx, ebp
sub edx, edi
pop edx
mov byte [ebp - 0x34], 0x50
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0x6f
mov byte [ebp - 0x31], 0x63
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x33
mov byte [ebp - 0x2c], 0x32
mov byte [ebp - 0x2b], 0x4e
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], 0x78
mov byte [ebp - 0x28], 0x74
mov byte [ebp - 0x27], 0
push edx
mov edx, 0x4163872d
add edx, edx
add edx, eax
xor edx, esi
pop edx
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x24]
push ecx
push edx
call edi
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x10005e32
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10005e2e
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x24]
push ecx
push edx
call edi
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x10005e5b
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18c]
push eax
push ecx
call dword [ebp - 0x48]
test eax, eax
je 0x10005e82
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x184]
cmp edx, eax
jne 0x10005e71
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18c]
push ecx
push edx
call ebx
test eax, eax
jne 0x10005e44
push eax
mov eax, 0x76757679
xor eax, eax
nop
pop eax
lea eax, [ebp - 0x14]
push eax
call fcn.10005ba0
mov ecx, dword [ebp - 0xc]
add esp, 4
xor eax, eax
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret