Function at 0x1000e5e0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x10155978
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov al, byte [0x1018c2a0]
push ebx
mov byte [esp + 0x18], al
mov al, 0x56
mov byte [esp + 0x1e], al
mov byte [esp + 0x25], al
mov byte [esp + 0x2a], al
mov byte [esp + 0x2d], al
push esi
mov al, 0x5c
push edi
mov edi, ecx
mov byte [esp + 0x38], al
mov byte [esp + 0x3b], al
mov byte [esp + 0x40], al
mov al, byte [0x10194c88]
mov dl, 0x55
mov cl, 0x4b
mov bl, 0x5a
mov byte [esp + 0x1d], 0xe5
test al, 1
mov dword [esp + 0xc], 0
mov byte [esp + 0x24], 0x79
mov byte [esp + 0x25], 0x54
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x28], 0x50
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0x58
mov byte [esp + 0x2c], 0x17
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], 0x5e
mov byte [esp + 0x30], 0x16
mov byte [esp + 0x31], 0x5d
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], dl
mov byte [esp + 0x36], 0x58
mov byte [esp + 0x37], 0x5d
mov byte [esp + 0x39], cl
mov byte [esp + 0x3a], 0x4a
mov byte [esp + 0x3c], cl
mov byte [esp + 0x3d], 0x4f
mov byte [esp + 0x3e], 0x50
mov byte [esp + 0x3f], bl
mov byte [esp + 0x41], 2
mov byte [esp + 0x42], 8
jne 0x1000e70b
mov bl, al
push 0x20
or bl, 1
mov byte [0x10194c88], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10194c8c], eax
xor esi, esi
mov bl, byte [esp + esi + 0x24]
push 0x39
movsx ecx, bl
push ecx
mov ecx, 0x10194c8c
call fcn.100a8ee0
mov edx, dword [0x10194c8c]
add al, 0x39
xor al, bl
mov byte [esi + edx], al
inc esi
cmp esi, 0x1f
jb 0x1000e6ce
mov eax, dword [0x10194c8c]
push 0x1000e8e0
mov byte [eax + 0x1f], 0
call fcn.1013c36b
add esp, 4
mov ecx, dword [0x10194c8c]
lea edx, [esp + 0xc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 0
lea eax, [esp + 0x14]
push 0x1016a3a0
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x54], 0
call fcn.100207f9
mov eax, dword [esp + 0xc]
mov dword [esp + 0x4c], 1
test eax, 0x80000000
jne 0x1000e7c3
mov eax, 0x35a
mov ecx, dword [0x1018c278]
cdq
idiv dword [0x1018c27c]
mov dl, byte [edx + ecx]
mov byte [esp + 0x17], dl
inc dl
test edi, edi
mov byte [0x1018c2a0], dl
je 0x1000e77d
lea eax, [edi + 4]
jmp 0x1000e77f
xor eax, eax
mov ecx, dword [esp + 0x10]
push 0xf
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x17]
push eax
mov byte [esp + 0x21], 0xe6
call fcn.1000d640
mov cl, al
mov eax, 0x3a5
cdq
idiv dword [0x1018c27c]
mov eax, dword [0x1018c278]
add esp, 4
mov dl, byte [edx + eax]
sub dl, 0x21
add cl, dl
mov byte [0x1018c2a0], cl
lea ecx, [edi + 0x1c]
call fcn.100119d0
mov cl, byte [0x1018c2a0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffd3
push ecx
push 0xffffffffffffffd9
push 0xffffffffffffffa2
call fcn.1000e5d0
add esp, 0x10
mov dl, 0x6d
push eax
mov al, byte [esp + 0x25]
imul dl
push eax
mov al, byte [0x1018c2a0]
push 0xffffffffffffffc1
push 0xffffffffffffffdd
push 0x65
push eax
push 0xffffffffffffffa0
call fcn.1000dde0
add esp, 0x14
push eax
call fcn.1000ddf0
push eax
call fcn.1000dde0
mov eax, 0x2fa
mov ecx, dword [0x1018c278]
cdq
idiv dword [0x1018c27c]
push 0x2e
mov dl, byte [edx + ecx]
push edx
call fcn.101081c0
mov eax, 0x202
cdq
idiv dword [0x1018c27c]
mov eax, dword [0x1018c278]
mov cl, byte [edx + eax]
mov dl, byte [0x1018c2a0]
push ecx
push edx
call fcn.101081c0
mov ecx, dword [edi + 0x3c]
add esp, 0x24
call fcn.1001d450
test eax, 0x80000000
mov dword [esp + 0xc], eax
je 0x1000e86f
inc byte [0x1018c2a0]
test edi, edi
je 0x1000e878
lea eax, [edi + 0x10]
jmp 0x1000e87a
xor eax, eax
mov ecx, dword [edi + 0x3c]
push eax
call fcn.1001dc50
call fcn.1000ddf0
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x1000e8b1
mov eax, dword [ecx]
push 0
call dword [eax + 4]
mov eax, 0x3e8
mov ecx, dword [0x1018c278]
cdq
idiv dword [0x1018c27c]
mov dl, byte [edx + ecx]
mov byte [0x1018c2a0], dl
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x4c], 0xffffffff
call fcn.10020761
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret