Function at 0x10006170
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0xc], 0
xor eax, eax
mov si, word [ebp - 0xc]
nop
movsx dx, byte [eax + 0x1015cd34]
movsx ecx, byte [eax + 0x1015cd35]
add dx, cx
movsx ecx, byte [eax + 0x1015cd37]
add dx, cx
movsx ecx, byte [eax + 0x1015cd36]
add dx, cx
add eax, 4
add si, dx
cmp eax, 0x20
jb 0x10006190
mov al, byte [0x101636b4]
sub al, 0xf
mov word [ebp - 0xc], si
add al, byte [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [0x1016361a], al
mov eax, dword [ebp - 0xc]
shr eax, 8
add al, 0xf
mov dword [ebp - 0xc], 0x76636572
add al, byte [0x101636b0]
mov byte [0x10163619], al
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 8], 0
push eax
mov dword [ebp - 0x1c], 0x5f327357
mov dword [ebp - 0x18], 0x642e3233
mov word [ebp - 0x14], 0x6c6c
mov byte [ebp - 0x12], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [0x101636c4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x646e6573
push eax
mov byte [ebp - 8], 0
mov dword [ebp - 0x1c], 0x5f327357
mov dword [ebp - 0x18], 0x642e3233
mov word [ebp - 0x14], 0x6c6c
mov byte [ebp - 0x12], 0
call esi
push eax
call edi
mov dword [0x101636c0], eax
mov edx, 0xd4
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x1004ef8c]
xor al, dl
mov byte [ebp + ecx - 0x2c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x10006270
mov byte [ebp - 0x20], 0
mov edx, 0x8c
xor ecx, ecx
mov al, byte [ecx + 0x1004ef9c]
xor al, dl
mov byte [ebp + ecx - 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x10006293
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
push eax
call edi
cmp dword [0x101636b4], 0
mov esi, eax
mov ecx, dword [0x101636c4]
xorps xmm0, xmm0
mov edx, dword [0x101636c0]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 0
mov dword [0x101636e4], ecx
mov dword [0x101636e0], edx
mov eax, dword [ecx]
mov dword [0x101636d8], eax
movzx eax, byte [ecx + 4]
mov byte [0x101636dc], al
mov eax, dword [edx]
mov dword [0x101636d0], eax
movzx eax, byte [edx + 4]
mov byte [0x101636d4], al
mov eax, dword [esi]
mov dword [0x101636c8], eax
movzx eax, byte [esi + 4]
mov dword [0x101636bc], esi
mov byte [0x101636cc], al
pop edi
jne 0x10006342
cmp dword [0x101636b0], 0
je 0x100063b6
call fcn.10002180
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10002660
push 0x100060a0
push 0x101636e4
call fcn.10001c30
call fcn.100021f0
call fcn.10002180
call esi
push eax
call fcn.10002660
push 0x100060e0
push 0x101636e0
call fcn.10001c30
call fcn.100021f0
mov ecx, dword [0x101636c4]
mov eax, dword [ecx]
mov dword [0x101636d8], eax
movzx eax, byte [ecx + 4]
mov ecx, dword [0x101636c0]
mov byte [0x101636dc], al
mov eax, dword [ecx]
mov dword [0x101636d0], eax
movzx eax, byte [ecx + 4]
mov byte [0x101636d4], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10026898
mov esp, ebp
pop ebp
ret