Function at 0x10005900
Capabilities:
Encode data using xor
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [0x10030040]
xor eax, esp
mov dword [esp + 0x2b8], eax
cmp dword [0x1013bc4c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
jne 0x10005c0a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1013bc4c], eax
mov word [esp + 0x10], 0x5c1
call fcn.10010094
and eax, 0x800000ff
jns 0x10005956
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x10030924], 0xffffffff
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 3
mov byte [esp + 0x14], bl
je 0x10005c01
cmp byte [0x10130958], 0
je 0x10005c01
mov word [esp + 0x18], 0x9bc1
call fcn.10010094
and eax, 0x800000ff
jns 0x10005997
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x1013bc48]
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 3
mov byte [esp + 0x1c], bl
test ecx, ecx
jne 0x100059c2
xorps xmm0, xmm0
mov word [esp + 0x25], cx
movq qword [esp + 0x1d], xmm0
mov byte [esp + 0x27], cl
jmp 0x100059dc
movq xmm0, qword [ecx]
movq qword [esp + 0x1d], xmm0
mov ax, word [ecx + 8]
mov word [esp + 0x25], ax
mov al, byte [ecx + 0xa]
mov byte [esp + 0x27], al
mov ecx, dword [0x1013bc44]
test ecx, ecx
je 0x10005a08
mov ecx, dword [ecx]
test ecx, ecx
je 0x10005a08
movq xmm0, qword [ecx]
movq qword [esp + 0x28], xmm0
mov ax, word [ecx + 8]
mov word [esp + 0x30], ax
mov al, byte [ecx + 0xa]
mov byte [esp + 0x32], al
jmp 0x10005a1d
xorps xmm0, xmm0
mov word [esp + 0x30], 0
movq qword [esp + 0x28], xmm0
mov byte [esp + 0x32], 0
test esi, esi
jne 0x10005a33
push 0x40
lea eax, [esp + 0x37]
push esi
push eax
call fcn.1000e330
add esp, 0xc
jmp 0x10005a56
movups xmm0, xmmword [esi]
movups xmmword [esp + 0x33], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [esp + 0x43], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [esp + 0x53], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [esp + 0x63], xmm0
push 0x40
lea eax, [esp + 0x77]
push 0
push eax
call fcn.1000e330
add esp, 0xc
test edi, edi
je 0x10005b20
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10005b20
push 0x104
lea eax, [esp + 0xbc]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10005b19
lea ecx, [esp + 0xb8]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005ab0
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x10005b01
nop dword [eax]
nop word [eax + eax]
lea eax, [ecx + ecx]
cmp word [esp + eax + 0xb8], 0x5c
je 0x10005ae5
dec ecx
test ecx, ecx
jg 0x10005ad0
jmp 0x10005b01
lea ecx, [esp + 0xba]
add eax, ecx
push eax
push 0x208
push 0x1013be20
call fcn.10012175
add esp, 0xc
push 0x1013be20
lea eax, [esp + 0x77]
push 0x1002af0c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
push 0
push 0x1013c168
call fcn.1000e330
movaps xmm1, xmmword [0x1002c660]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [eax + str.rj_j]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c168], xmm0
movups xmm0, xmmword [eax + 0x10029d18]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c178], xmm0
movups xmm0, xmmword [eax + 0x10029d28]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c188], xmm0
movups xmm0, xmmword [eax + 0x10029d38]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c198], xmm0
add eax, 0x40
cmp eax, 0x100
jb 0x10005b50
lea eax, [esp + 0x73]
push eax
lea eax, [esp + 0x37]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x29]
push eax
movzx eax, byte [esp + 0x2c]
push eax
push 0x1013c168
push 0
push 0x10130ac0
call fcn.100083d0
movzx eax, byte [esp + 0x39]
add esp, 0x20
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10003d60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.1000c666
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.10005500
mov ecx, dword [esp + 0x2c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000c666
mov esp, ebp
pop ebp
ret