Function at 0x487330
Capabilities:
Access peb ldr_data
Encode data using xor
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [0x6019e8]
mov esi, dword fs:[0x2c]
mov eax, dword [esi + eax*4]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x6c], edx
cmp byte [eax + 8], 0
je 0x48737c
mov eax, dword [0x6019e8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [eax + 0x14]
mov edi, dword [eax + 0x10]
jmp 0x487789
movaps xmm0, xmmword [str.uespemosarenegylmodnarodsetybdet]
lea edi, [esp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
movups xmmword [esp + 0x28], xmm0
movdqa xmm0, xmmword [0x501340]
movdqu xmmword [esp + 0x38], xmm0
pxor xmm0, xmm0
movq qword [esp + 0x48], xmm0
movq qword [esp + 0x50], xmm0
movq qword [esp + 0x58], xmm0
movq qword [esp + 0x60], xmm0
push edi
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x487d12
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movq xmm0, qword [0x6019d0]
movd esi, xmm0
pshufd xmm0, xmm0, 0x55
mov dword [esp + 4], ecx
movd edx, xmm0
mov eax, esi
or eax, edx
jne 0x48743f
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x487d12
movq xmm0, qword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
movq qword [0x6019d0], xmm0
mov eax, esi
mov ecx, dword [esp + 4]
or eax, edx
je 0x487d18
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp], edx
push edx
push esi
push ecx
push ebx
call fcn.004ee5e0
mov edi, edx
mov ecx, eax
mul esi
imul ebx, edi, 0x3b9aca00
imul edi, esi
mov esi, dword [esp + 0xc]
add edi, edx
mov edx, ecx
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 4]
imul edx, dword [esp]
add edi, edx
sub esi, eax
mov edx, 0x3b9aca00
mov eax, ecx
sbb ebx, edi
mul edx
mov edi, edx
mov dword [esp + 4], eax
mov eax, esi
mov edx, 0x3b9aca00
imul ecx, ebx, 0x3b9aca00
add edi, dword [esp + 0x1c]
mul edx
add edx, ecx
push dword [esp]
push dword [esp + 0xc]
push edx
push eax
call fcn.004ee5e0
mov esi, eax
add esi, dword [esp + 4]
adc edx, edi
push 0
push 0x3b9aca00
push edx
push esi
call fcn.004ee5e0
imul ecx, eax, 0x3b9aca00
lea edi, [esp + 0x28]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea edx, [esp + 0x10]
sub esi, ecx
mov ecx, edi
push 8
call fcn.004198d0
add esp, 4
mov dword [esp + 0x10], esi
lea edx, [esp + 0x10]
mov ecx, edi
push 4
call fcn.004198d0
add esp, 4
mov eax, dword [0x6019e8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
movzx eax, byte [eax + 0x54]
cmp eax, 1
jne 0x487cb4
mov eax, dword [0x6019e8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov esi, dword [eax + 0x50]
test esi, esi
je 0x487cc2
lock inc dword [esi]
jle 0x487d18
test esi, esi
je 0x487d18
movq xmm0, qword [esi + 8]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
movq qword [esp + 0x10], xmm0
push 8
call fcn.004198d0
add esp, 4
lock dec dword [esi]
jne 0x487572
mov ecx, esi
call fcn.00488ff0
mov edx, dword [esp + 0x60]
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x30]
shl edx, 0x18
mov dword [esp + 0x1c], eax
or edx, dword [esp + 0x5c]
mov dword [esp + 0x20], edx
xor edi, edx
mov edx, dword [esp + 0x40]
xor edx, eax
mov eax, dword [esp + 0x28]
add eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
adc eax, esi
add ebx, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
adc eax, edi
mov dword [esp], eax
mov eax, ecx
shld eax, esi, 0xd
shld esi, ecx, 0xd
mov ecx, edx
shrd edx, edi, 0x10
shld ecx, edi, 0x10
mov edi, dword [esp + 0xc]
xor eax, dword [esp + 4]
xor edx, dword [esp]
xor ecx, ebx
xor esi, edi
add ebx, eax
adc dword [esp], esi
add edi, ecx
mov dword [esp + 8], ebx
mov ebx, ecx
adc dword [esp + 4], edx
shld ebx, edx, 0x15
shrd ecx, edx, 0xb
mov dword [esp + 0xc], edi
mov edi, eax
shrd eax, esi, 0xf
mov edx, dword [esp + 4]
shld edi, esi, 0x11
mov esi, dword [esp + 0xc]
xor edi, dword [esp + 8]
xor ecx, edx
xor edx, dword [esp + 0x20]
xor ebx, esi
xor esi, dword [esp + 0x1c]
mov dword [esp + 4], edx
mov edx, dword [esp]
xor eax, edx
xor edx, 0xff
add esi, edi
adc dword [esp + 4], eax
add edx, ebx
mov dword [esp + 0xc], esi
mov esi, ebx
mov dword [esp], edx
mov edx, edi
adc dword [esp + 8], ecx
shrd edi, eax, 0x13
shld esi, ecx, 0x10
shrd ebx, ecx, 0x10
shld edx, eax, 0xd
mov ecx, dword [esp + 8]
mov eax, dword [esp]
xor edi, dword [esp + 4]
xor edx, dword [esp + 0xc]
xor ebx, ecx
xor esi, eax
add eax, edx
adc ecx, edi
mov dword [esp], eax
mov eax, edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add ecx, esi
adc dword [esp + 0xc], ebx
shld eax, edi, 0x11
shrd edx, edi, 0xf
mov edi, esi
shrd esi, ebx, 0xb
shld edi, ebx, 0x15
mov ebx, dword [esp + 0xc]
xor eax, dword [esp]
xor edx, dword [esp + 8]
xor edi, ecx
xor esi, ebx
add ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 8]
adc ebx, edx
mov dword [esp + 0xc], ebx
mov ebx, eax
add ecx, edi
adc dword [esp], esi
shld ebx, edx, 0xd
shrd eax, edx, 0x13
mov edx, edi
shrd edi, esi, 0x10
shld edx, esi, 0x10
mov esi, dword [esp]
xor ebx, dword [esp + 4]
xor eax, dword [esp + 0xc]
xor edx, ecx
xor edi, esi
add ecx, ebx
adc esi, eax
mov dword [esp + 8], ecx
mov ecx, ebx
mov dword [esp], esi
mov esi, dword [esp + 0xc]
add esi, edx
adc dword [esp + 4], edi
shld ecx, eax, 0x11
shrd ebx, eax, 0xf
mov eax, edx
shrd edx, edi, 0xb
shld eax, edi, 0x15
mov edi, dword [esp + 4]
xor ecx, dword [esp + 8]
xor ebx, dword [esp]
xor eax, esi
xor edx, edi
add esi, ecx
adc edi, ebx
add dword [esp], eax
mov dword [esp + 4], edi
mov edi, ecx
adc dword [esp + 8], edx
shld edi, ebx, 0xd
shrd ecx, ebx, 0x13
mov ebx, dword [esp]
xor edi, esi
mov esi, eax
shrd eax, edx, 0x10
xor ecx, dword [esp + 4]
shld esi, edx, 0x10
mov edx, dword [esp + 8]
xor esi, ebx
xor eax, edx
add ebx, edi
adc edx, ecx
mov dword [esp], ebx
mov ebx, edx
mov edx, edi
shld edi, ecx, 0x11
shld ecx, edx, 0x11
mov edx, esi
shrd esi, eax, 0xb
xor edi, ebx
shld edx, eax, 0x15
mov eax, dword [esp]
xor edi, edx
mov edx, dword fs:[0x2c]
xor ecx, eax
xor edi, eax
mov eax, dword [0x6019e8]
xor ecx, esi
xor ecx, ebx
mov eax, dword [edx + eax*4]
mov byte [eax + 8], 1
add edi, 0xaa6c78a5
mov esi, edi
adc ecx, 0x2d358dcc
xor esi, 0x962eacc9
mov ebx, ecx
mov eax, esi
xor ebx, 0x8bb84b93
mul edi
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, ebx
mov dword [esp + 4], edx
mul edi
mov ebx, eax
mov eax, esi
add ebx, dword [esp + 4]
adc edx, 0
mov dword [esp + 4], edx
mul ecx
add eax, ebx
mov esi, edx
mov edx, dword fs:[0x2c]
mov dword [esp + 0xc], eax
adc esi, dword [esp + 4]
mov eax, dword [0x6019e8]
setb bl
mov eax, dword [edx + eax*4]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], ecx
mov eax, dword [esp]
mul ecx
movzx ecx, bl
add eax, esi
adc edx, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00488850
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x28]
mov byte [ebx], 0x2e
mov dword [esp + 0x18], 1
call fcn.0048b670
mov esi, dword [esp + 0x28]
mov eax, esi
neg eax
jno 0x4878a6
cmp byte [esp + 0x2c], 3
jne 0x487892
mov esi, dword [esp + 0x30]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x487865
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x487883
cmp dword [ebx + 8], 9
jb 0x487874
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edi, dword [esp]
mov ebx, dword [esp + 4]
mov dword [esp + 0x1c], 1
jmp 0x4879ec
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
call fcn.00490220
test eax, eax
je 0x487916
cmp edx, 2
mov dword [esp + 0x1c], 1
mov dword [esp + 0x24], esi
jne 0x4878ec
cmp word [eax], 0x2e2e
jne 0x4878ec
mov edi, 2
xor esi, esi
test eax, eax
cmovne esi, eax
test esi, esi
jne 0x487966
jmp 0x4879d5
mov edi, edx
nop
test edi, edi
je 0x487948
mov ecx, edi
dec edi
cmp byte [eax + ecx - 1], 0x2e
jne 0x4878f0
test edi, edi
je 0x487959
mov esi, eax
sub edx, ecx
add esi, ecx
test eax, eax
cmovne esi, eax
test esi, esi
jne 0x487966
jmp 0x4879d5
mov dword [esp + 0x1c], 1
mov edi, dword [esp]
mov ebx, dword [esp + 4]
test esi, 0x7fffffff
je 0x4879ec
push dword [esp + 0x20]
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4879ec
mov esi, eax
mov edi, edx
xor eax, eax
test eax, eax
cmovne esi, eax
test esi, esi
jne 0x487966
jmp 0x4879d5
xor esi, esi
mov edi, edx
test eax, eax
cmovne esi, eax
test esi, esi
je 0x4879d5
test eax, eax
lea ecx, [esp + 0x28]
cmove edi, edx
mov edx, esi
push edi
call fcn.00411e40
add esp, 4
test byte [esp + 0x28], 1
jne 0x4879d5
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edi, 1
lea eax, [edx - 1]
cmp eax, esi
jb 0x487ce7
mov dword [esp + 0x1c], edx
lea eax, [ebx + edi]
push esi
push ecx
push eax
call fcn.004ef180
add esp, 0xc
add edi, esi
cmp edi, dword [esp + 0x1c]
mov dword [esp + 0x18], edi
jne 0x4879c8
lea ecx, [esp + 0x10]
call fcn.00488850
mov ebx, dword [esp + 0x14]
mov byte [ebx + edi], 0x2e
inc edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov esi, dword [esp + 0x24]
mov edi, dword [esp]
mov ebx, dword [esp + 4]
test esi, 0x7fffffff
jne 0x487931
xor edi, dword [esp + 0xc]
xor ebx, dword [esp + 8]
mov edx, 0x8bb84b93
mov eax, 0x962eacc9
mov ecx, 0x2d358dcc
xor esi, esi
jmp 0x487a3e
mov edx, dword [esp + 0x14]
mov byte [edx + edi], bl
mov dword [esp + 8], edx
inc edi
mov edx, 0x8bb84b93
mov esi, dword [esp + 0x20]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov edi, dword [esp]
mov ebx, dword [esp + 4]
inc esi
cmp esi, 0x20
je 0x487bba
mov dword [esp + 0x20], esi
mov esi, 0xaa6c78a5
add ebx, esi
mov esi, ebx
adc edi, ecx
xor esi, eax
mov ecx, edi
mov dword [esp], edi
mov edi, ebx
mov eax, esi
xor ecx, edx
mov dword [esp + 4], edi
mul ebx
mov dword [esp + 8], eax
mov eax, ecx
mov ebx, edx
mul edi
mov edi, eax
mov eax, esi
add edi, ebx
mov ebx, dword [esp]
adc edx, 0
mov dword [esp + 0xc], edx
mul ebx
add eax, edi
adc edx, dword [esp + 0xc]
imul ecx, ebx
add ecx, edx
mov edx, 0x1a
xor ecx, dword [esp + 8]
lea eax, [ecx + ecx*4]
lea esi, [eax + eax*4]
mov eax, ecx
add esi, ecx
mul edx
cmp esi, 0x15
ja 0x487b22
mov esi, dword [esp + 4]
nop dword [eax]
mov eax, 0xaa6c78a5
add esi, eax
mov eax, 0x2d358dcc
adc ebx, eax
mov eax, 0x8bb84b93
mov edi, esi
mov dword [esp], ebx
xor ebx, eax
mov eax, 0x962eacc9
xor edi, eax
mov dword [esp + 8], ebx
mov eax, edi
mul esi
mov dword [esp + 4], eax
mov eax, ebx
mov dword [esp + 0xc], edx
mul esi
mov ecx, eax
mov ebx, edx
mov eax, edi
add ecx, dword [esp + 0xc]
adc ebx, 0
mul dword [esp]
add eax, ecx
mov edi, edx
mov eax, dword [esp + 8]
adc edi, ebx
mov ebx, dword [esp]
mul ebx
add eax, edi
xor eax, dword [esp + 4]
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*4]
add ecx, eax
cmp ecx, 0x16
jb 0x487ab0
mov ecx, 0x1a
mov dword [esp + 4], esi
mul ecx
movzx ebx, byte [edx + 0x5bb809]
mov edi, dword [esp + 0x1c]
mov ecx, 0x2d358dcc
mov eax, 0x962eacc9
test bl, bl
js 0x487b60
cmp edi, dword [esp + 0x10]
jne 0x487a10
lea ecx, [esp + 0x10]
call fcn.00488850
mov ecx, 0x2d358dcc
mov eax, 0x962eacc9
jmp 0x487a10
mov eax, dword [esp + 0x10]
mov edx, 0x8bb84b93
sub eax, edi
cmp eax, 1
jbe 0x487b96
mov esi, dword [esp + 0x14]
mov eax, ebx
and bl, 0xbf
shr al, 6
or al, 0xc0
mov byte [esi + edi], al
mov byte [esi + edi + 1], bl
mov dword [esp + 8], esi
add edi, 2
mov eax, 0x962eacc9
jmp 0x487a21
lea ecx, [esp + 0x10]
mov edx, edi
push 1
push 1
push 2
call fcn.00500270
mov ecx, 0x2d358dcc
mov edx, 0x8bb84b93
add esp, 0xc
mov edi, dword [esp + 0x18]
jmp 0x487b70
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
mov eax, ecx
sub eax, edi
cmp eax, dword [ebp + 0x10]
jb 0x487c88
mov ebx, dword [ebp + 8]
mov esi, dword [esp + 8]
mov dword [esp], ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esi + edi]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.004ef180
add esp, 0xc
add edi, dword [ebp + 0x10]
test ebx, ebx
mov dword [esp + 0x18], edi
js 0x487d18
mov dword [esp + 0x1c], edi
je 0x487c1c
movzx eax, byte [0x6019e5]
xor ecx, ecx
mov edx, ebx
call fcn.00499510
mov edi, eax
test eax, eax
jne 0x487c21
jmp 0x487d18
mov edi, 1
push ebx
push dword [esp + 0x70]
push edi
call fcn.004ef180
add esp, 0xc
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x34], 0
lea ecx, [esp + 0x28]
mov edx, esi
push dword [esp + 0x1c]
call fcn.0048c960
add esp, 4
cmp dword [esp], 0
movsd xmm0, qword [esp + 0x28]
mov eax, dword [esp + 0x70]
movsd xmm1, qword [esp + 0x30]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
je 0x487c80
push esi
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
mov edx, edi
push 1
push 1
push dword [ebp + 0x10]
call fcn.00500270
add esp, 0xc
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [esp], eax
jmp 0x487bd9
test eax, eax
jne 0x487d18
call fcn.004ff140
jmp 0x48751b
call fcn.004ff250
mov eax, dword [0x6019e8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov esi, dword [eax + 0x50]
lock inc dword [esi]
jg 0x487541
jmp 0x487d18
mov edi, ecx
lea ecx, [esp + 0x10]
mov edx, 1
push 1
push 1
push esi
call fcn.00500270
mov ecx, edi
add esp, 0xc
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
jmp 0x48799d
call dword [sym.imp.kernel32.dll_GetLastError]
ud2