Function at 0x1005aad0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1015b688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x6c], 1
mov byte [esp + 0x1b], 0xf2
call fcn.10059d90
mov esi, dword [0x1018c718]
mov bl, al
mov eax, 0x2fd
mov ecx, dword [0x1018c714]
cdq
idiv esi
mov al, byte [edx + ecx]
add bl, al
mov eax, 0x2c0
cdq
idiv esi
push ebx
mov al, byte [edx + ecx]
push eax
mov eax, 0x32
cdq
idiv esi
mov cl, byte [edx + ecx]
push ecx
push 0x3e
push 0x75
call fcn.1005a1d0
push eax
call fcn.1005a430
mov eax, dword [esp + 0xa0]
mov edi, dword [esp + 0xd8]
add esp, 0x18
mov ecx, edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
push edx
call fcn.10062cd0
test al, al
jne 0x1005ab9a
mov byte [esp + 0x6c], al
mov eax, dword [esp + 0x74]
test eax, eax
je 0x1005ab7c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0xb0]
mov dword [esp + 0x6c], 3
call fcn.10023eb0
mov byte [esp + 0x6c], 2
jmp 0x1005af76
mov eax, dword [esp + 0xa0]
xor ebp, ebp
cmp eax, ebp
je 0x1005abb0
cmp dword [esp + 0xa4], ebp
je 0x1005ac29
xor edx, edx
mov eax, 0x2fb
mov dword [esp + 0x24], edx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], edx
cdq
idiv dword [0x1018c718]
mov eax, dword [0x1018c714]
mov cl, byte [edx + eax]
lea eax, [esp + 0x20]
mov byte [0x1018c73c], cl
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x4c]
cmp dword [esp + 0xa0], ebp
jne 0x1005ac0d
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
sub ecx, eax
mov byte [0x1018c73f], 0xb9
mov dword [esp + 0xa0], ecx
cmp dword [esp + 0xa4], ebp
jne 0x1005ac2d
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
sub edx, eax
mov dword [esp + 0xa4], edx
jmp 0x1005ac2d
mov ebx, dword [esp + 0x74]
mov cl, byte [0x1018c73e]
mov eax, 0xbb8
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, 0xbc2
mov dword [esp + 0x10], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov al, cl
imul byte [0x1018c73f]
inc cl
mov byte [0x1018c73c], al
mov byte [0x1018c73e], cl
mov eax, 0x9b
mov byte [esp + 0x6c], 5
cdq
idiv dword [0x1018c718]
mov eax, dword [0x1018c714]
mov cl, byte [edx + eax]
lea edx, [esp + 0x8c]
lea eax, [esp + 0x20]
push edx
push eax
mov byte [0x1018c73e], cl
call fcn.10059da0
add esp, 8
mov edx, dword [ebx]
push eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
push eax
push 1
lea eax, [esp + 0x84]
push ecx
push eax
mov ecx, ebx
mov byte [esp + 0x80], 6
call dword [edx + 0x54]
push 1
lea ecx, [esp + 0x24]
mov esi, eax
mov byte [esp + 0x70], 5
call fcn.1000bc70
mov eax, 0x192
mov ecx, dword [0x1018c714]
cdq
idiv dword [0x1018c718]
cmp esi, ebp
mov dl, byte [edx + ecx]
mov byte [0x1018c73e], dl
je 0x1005ad99
mov eax, dword [esp + 0x10]
mov byte [esp + 0x6c], 1
cmp eax, ebp
je 0x1005ad06
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp ebx, ebp
mov byte [esp + 0x6c], 0
je 0x1005ad15
mov edx, dword [ebx]
push ebx
call dword [edx + 8]
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb4]
push eax
push ecx
lea ecx, [esp + 0xb8]
mov dword [esp + 0x74], 8
call fcn.100242a0
mov edx, dword [esp + 0xb4]
push edx
call fcn.101307a0
add esp, 4
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xbc], ebp
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x70], 7
call fcn.1000bc70
push 1
lea ecx, [esp + 0x7c]
mov dword [esp + 0x70], 0xffffffff
call fcn.1000bc70
mov eax, esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
jne 0x1005ae3b
cmp ebx, ebp
mov byte [esp + 0x6c], 0
je 0x1005adb4
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb4]
push ecx
push edx
lea ecx, [esp + 0xb8]
mov dword [esp + 0x74], 0xb
call fcn.100242a0
mov eax, dword [esp + 0xb4]
push eax
call fcn.101307a0
add esp, 4
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xbc], ebp
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x70], 0xa
call fcn.1000bc70
push 1
lea ecx, [esp + 0x7c]
mov dword [esp + 0x70], 0xffffffff
call fcn.1000bc70
mov eax, 0x80004003
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov edx, dword [ecx]
push ebp
call dword [edx + 0x48]
push ebp
call fcn.1013c3ac
mov dword [esp + 0x18], eax
mov eax, 0x2c
cdq
add esp, 4
idiv dword [0x1018c718]
mov eax, dword [0x1018c714]
mov cl, byte [edx + eax]
mov byte [esp + 0x1d], cl
mov dl, byte [esp + 0x1d]
mov byte [esp + 0xc0], 0
mov byte [0x1018c73d], dl
xor esi, esi
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x10]
dec al
push ebp
mov byte [esp + 0x1f], al
mov eax, dword [ecx]
call dword [eax + 0x48]
mov bl, byte [0x1018c73d]
push 0x64
mov ecx, edi
call fcn.10062cd0
mov ecx, dword [esp + 0x10]
test al, al
mov edx, dword [ecx]
je 0x1005aeff
lea eax, [esp + 0xc0]
push eax
call dword [edx + 0x1c]
mov al, byte [esp + 0xc0]
add bl, 0xf
test al, al
mov byte [0x1018c73c], bl
jne 0x1005aed2
inc esi
cmp esi, 0x1e
jge 0x1005afaf
jmp 0x1005ae7a
mov ecx, dword [esp + 0x14]
push ecx
push ebp
call fcn.1013c3ac
add esp, 4
push eax
call fcn.1013e4f0
fcomp qword [0x1016a8c8]
add esp, 8
fnstsw ax
test ah, 0x41
je 0x1005afaf
jmp 0x1005ae66
call dword [edx + 0x40]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x6c], 1
cmp eax, ebp
je 0x1005af15
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x74]
mov byte [esp + 0x6c], 0
cmp eax, ebp
je 0x1005af28
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb4]
push eax
push ecx
lea ecx, [esp + 0xb8]
mov dword [esp + 0x74], 0xe
call fcn.100242a0
mov edx, dword [esp + 0xb4]
push edx
call fcn.101307a0
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xbc], ebp
mov dword [esp + 0xc0], ebp
add esp, 4
mov byte [esp + 0x6c], 0xd
push 1
lea ecx, [esp + 0x90]
call fcn.1000bc70
push 1
lea ecx, [esp + 0x7c]
mov dword [esp + 0x70], 0xffffffff
call fcn.1000bc70
mov eax, 0x80004005
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov eax, 0x17
mov word [esp + 0x40], 0x60
mov word [esp + 0x48], ax
mov word [esp + 0x4a], ax
mov al, byte [0x101978bc]
mov word [esp + 0x42], 0x3f
test al, 1
mov word [esp + 0x44], 0x18
mov word [esp + 0x46], 0x12
mov word [esp + 0x4c], 1
mov word [esp + 0x4e], 0x44
mov word [esp + 0x50], 0x42
mov word [esp + 0x52], 0x1b
mov word [esp + 0x54], 0x59
mov word [esp + 0x56], 0x6c
mov word [esp + 0x58], 0x23
mov word [esp + 0x5a], 0x1a
mov word [esp + 0x5c], 0x11
mov word [esp + 0x5e], 0x29
mov word [esp + 0x60], 0x22
jne 0x1005b09b
mov bl, al
push 0x24
or bl, 1
mov byte [0x101978bc], bl
call fcn.1013c2df
add esp, 4
mov dword [0x101978c0], eax
mov edi, 0x30
xor esi, esi
mov bx, word [esp + esi + 0x40]
push edi
mov eax, ebx
mov ecx, 0x101978c0
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x101978c0]
xor eax, edi
xor eax, ebx
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x101978c0]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x22
jb 0x1005b051
push 0x1005ef40
mov word [eax + 0x22], bp
call fcn.1013c36b
add esp, 4
mov esi, dword [0x101978c0]
mov dl, byte [esp + 0x74]
push esi
mov byte [esp + 0x24], dl
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x20]
push eax
push esi
call fcn.1000bf40
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x70], 0x10
mov eax, dword [ecx]
call dword [eax + 0x44]
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x6c], 5
cmp ecx, ebp
je 0x1005b107
mov al, byte [ecx - 1]
test al, al
je 0x1005b0fb
cmp al, 0xff
je 0x1005b0fb
dec al
mov byte [ecx - 1], al
jmp 0x1005b107
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
lea eax, [esp + 0x78]
lea edx, [esp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push edx
mov byte [0x1018c73e], 0x75
call fcn.1000f2b0
mov byte [esp + 0x74], 5
call fcn.1005b6f0
mov ebx, eax
mov eax, dword [esp + 0x18]
add esp, 8
cmp eax, ebp
mov byte [esp + 0x6c], 1
je 0x1005b149
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x74]
mov byte [esp + 0x6c], 0
cmp eax, ebp
je 0x1005b15c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov edi, dword [esp + 0xb8]
mov esi, dword [esp + 0xb4]
cmp esi, edi
mov dword [esp + 0x6c], 0x13
je 0x1005b18d
push 1
mov ecx, esi
call fcn.1000bc70
add esi, 0x10
cmp esi, edi
jne 0x1005b176
mov esi, dword [esp + 0xb4]
push esi
call fcn.101307a0
mov ecx, dword [esp + 0x94]
add esp, 4
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xbc], ebp
cmp ecx, ebp
mov byte [esp + 0x6c], 0x12
je 0x1005b1d9
mov al, byte [ecx - 1]
test al, al
je 0x1005b1cd
cmp al, 0xff
je 0x1005b1cd
dec al
mov byte [ecx - 1], al
jmp 0x1005b1d9
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x90], ebp
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], ebp
cmp ecx, ebp
mov dword [esp + 0x6c], 0xffffffff
je 0x1005b21c
mov al, byte [ecx - 1]
test al, al
je 0x1005b210
cmp al, 0xff
je 0x1005b210
dec al
mov byte [ecx - 1], al
jmp 0x1005b21c
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov eax, ebx
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x60
ret