Function at 0x10006980
Capabilities:
Access peb ldr_data
Encode data using xor
Get process heap force flags

Disassembly:
push 0x2c0
mov eax, 0x1002fe30
call fcn.10013071
mov esi, ecx
push 0xa
xor ebx, ebx
lea edi, [ebp - 0x260]
pop ecx
xor eax, eax
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x260]
call fcn.100036a1
push esi
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.1000aeb8
lea ecx, [ebp - 0x260]
call fcn.10003767
test al, al
je 0x10006a3b
xor eax, eax
lea edi, [ebp - 0x234]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x234], ebx
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x260]
call fcn.1000398d
test al, al
jne 0x10006a54
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x10006a3b
mov eax, dword [ebp - 0x228]
sub eax, ecx
push eax
push ecx
call fcn.1000ccef
pop ecx
pop ecx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
lea ecx, [ebp - 0x260]
call fcn.10007342
lea ecx, [ebp + 8]
call fcn.1000b9ab
call fcn.10013020
ret
mov eax, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x230]
sub eax, edx
mov ecx, dword [ebp - 0x234]
cmp eax, ecx
jbe 0x1000733c
mov bl, byte [edx + ecx]
inc ecx
mov byte [ebp - 0x299], bl
mov dword [ebp - 0x234], ecx
cmp eax, ecx
jbe 0x1000733c
mov al, byte [edx + ecx]
lea edi, [ebp - 0x220]
mov byte [ebp - 0x2b8], al
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [ebp - 0x234], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x220], ebx
push str.error
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 3
call fcn.1000ae55
mov byte [ebp - 4], 4
mov eax, dword fs:[0x18]
mov dword [ebp - 0x27c], ebx
push 0x29
pop ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov esi, dword [eax + 0x10]
mov eax, ebx
mov dword [ebp - 0x2a8], esi
mov byte [ebp - 0x2c8], cl
mov dword [ebp - 0x2c4], 5
mov dword [ebp - 0x2c0], 0x606136a
mov byte [ebp - 0x2bc], cl
xor byte [ebp + eax - 0x2c0], cl
inc eax
cmp eax, dword [ebp - 0x2c4]
jae 0x10006b37
mov cl, byte [ebp - 0x2c8]
jmp 0x10006b1f
movaps xmm0, xmmword [0x10039520]
mov eax, 0x4ff2a8bd
mov dword [ebp - 0x298], eax
mov ecx, ebx
mov dword [ebp - 0x294], 4
mov dword [ebp - 0x290], 2
movups xmmword [ebp - 0x28c], xmm0
xor dword [ebp + ecx*4 - 0x28c], eax
inc ecx
cmp ecx, dword [ebp - 0x294]
jae 0x10006b7e
mov eax, dword [ebp - 0x298]
jmp 0x10006b66
mov eax, dword [ebp - 0x290]
mov edi, 0x5fe5517b
mov ecx, ebx
mov eax, dword [ebp + eax*4 - 0x28c]
mov dword [ebp - 0x28c], 2
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x284], 0x5fe55103
mov edx, dword [esi + eax]
mov eax, edi
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x280], 0x65363465
xor dword [ebp + ecx*4 - 0x284], eax
inc ecx
cmp ecx, dword [ebp - 0x28c]
jae 0x10006bd9
mov eax, dword [ebp - 0x290]
jmp 0x10006bc1
mov eax, dword [ebp - 0x288]
mov ecx, 0x6fd7fa39
movaps xmm0, xmmword [0x10039530]
mov eax, dword [ebp + eax*4 - 0x284]
add eax, esi
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x294], 4
mov dword [ebp - 0x290], 2
movups xmmword [ebp - 0x28c], xmm0
mov edx, dword [eax + edx]
mov eax, ebx
add edx, esi
mov dword [ebp - 0x2a0], edx
xor dword [ebp + eax*4 - 0x28c], ecx
inc eax
cmp eax, dword [ebp - 0x294]
jae 0x10006c3a
mov ecx, dword [ebp - 0x298]
jmp 0x10006c22
mov eax, dword [ebp - 0x290]
mov eax, dword [ebp + eax*4 - 0x28c]
and dword [ebp - 0x288], 0
mov dword [ebp - 0x28c], 2
mov dword [ebp - 0x284], 0x7fcaa2eb
mov ebx, dword [eax + edx]
mov eax, 0x7fcaa2f7
add ebx, esi
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x2ac], ebx
xor ecx, ecx
mov dword [ebp - 0x280], 0x451b85e0
xor dword [ebp + ecx*4 - 0x284], eax
inc ecx
cmp ecx, dword [ebp - 0x28c]
jae 0x10006c9c
mov eax, dword [ebp - 0x290]
jmp 0x10006c84
mov eax, dword [ebp - 0x288]
movaps xmm0, xmmword [0x10039510]
mov eax, dword [ebp + eax*4 - 0x284]
mov dword [ebp - 0x294], 4
mov dword [ebp - 0x290], 2
movups xmmword [ebp - 0x28c], xmm0
mov edx, dword [eax + edx]
mov eax, 0x4fbd4bb4
add edx, esi
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x2b4], edx
xor ecx, ecx
xor dword [ebp + ecx*4 - 0x28c], eax
inc ecx
cmp ecx, dword [ebp - 0x294]
jae 0x10006cfb
mov eax, dword [ebp - 0x298]
jmp 0x10006ce3
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x28c]
mov eax, dword [eax + ecx]
add eax, esi
mov dword [ebp - 0x2b0], eax
test ebx, ebx
je 0x10006e07
test edx, edx
je 0x10006e07
test eax, eax
je 0x10006e07
xor edx, edx
and dword [ebp - 0x288], 0
mov eax, 0x5faff472
mov dword [ebp - 0x290], eax
xor ecx, ecx
mov dword [ebp - 0x28c], 2
mov dword [ebp - 0x284], 0x5faff46a
mov dword [ebp - 0x280], 0x6500d75c
xor dword [ebp + ecx*4 - 0x284], eax
inc ecx
cmp ecx, dword [ebp - 0x28c]
jae 0x10006d7d
mov eax, dword [ebp - 0x290]
jmp 0x10006d65
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x284]
cmp edx, dword [eax + ecx]
jae 0x10006e02
mov edi, dword [ebx + edx*4]
add edi, esi
mov ecx, edi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006d9f
sub ecx, ebx
push 0x1d
pop ebx
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0x2a4], eax
test eax, eax
je 0x10006dd8
mov esi, eax
movsx eax, byte [ecx + edi]
xor eax, ebx
imul ebx, eax, 5
inc ecx
cmp ecx, esi
jb 0x10006dbc
mov esi, dword [ebp - 0x2a8]
cmp ebx, 0xa9d3be22
je 0x10006de4
mov ebx, dword [ebp - 0x2ac]
inc edx
jmp 0x10006d33
mov eax, dword [ebp - 0x2b0]
mov edi, 0x5fe5517b
mov ecx, dword [ebp - 0x2b4]
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, esi
xor edx, edx
jmp 0x10006e0b
mov edi, 0x5fe5517b
xor edx, edx
mov eax, edx
push edx
push edx
push edx
push edx
lea ecx, [ebp - 0x27c]
push ecx
push edx
push edx
lea ecx, [ebp - 0x2c0]
push ecx
call eax
test al, al
je 0x10006e4d
mov edx, dword [ebp - 0x27c]
lea ecx, [ebp - 0x294]
call fcn.1000316b
push eax
lea ecx, [ebp - 0x278]
call fcn.1000ade7
lea ecx, [ebp - 0x294]
call fcn.1000b9ab
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x294]
call fcn.1000aeb8
mov byte [ebp - 4], 5
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x280], 0x10
lea ecx, [ebp - 0x220]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
call fcn.100035e1
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 4
call fcn.1000b9ab
mov eax, dword fs:[0x18]
mov ecx, 0x4ff2a8bd
movaps xmm0, xmmword [0x10039520]
mov dword [ebp - 0x238], 0x100
push 2
mov eax, dword [eax + 0x30]
pop esi
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x294], 4
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x290], esi
movups xmmword [ebp - 0x28c], xmm0
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov ebx, dword [eax + 0x10]
xor eax, eax
mov dword [ebp - 0x2a8], ebx
xor dword [ebp + eax*4 - 0x28c], ecx
inc eax
cmp eax, dword [ebp - 0x294]
jae 0x10006f04
mov ecx, dword [ebp - 0x298]
jmp 0x10006eec
mov eax, dword [ebp - 0x290]
mov eax, dword [ebp + eax*4 - 0x28c]
and dword [ebp - 0x288], 0
mov dword [ebp - 0x290], edi
mov dword [ebp - 0x28c], esi
mov ecx, dword [eax + ebx]
xor eax, eax
mov dword [ebp - 0x284], 0x5fe55103
mov dword [ebp - 0x280], 0x65363465
xor dword [ebp + eax*4 - 0x284], edi
inc eax
cmp eax, dword [ebp - 0x28c]
jae 0x10006f55
mov edi, dword [ebp - 0x290]
jmp 0x10006f3d
mov eax, dword [ebp - 0x288]
movaps xmm0, xmmword [0x10039530]
mov eax, dword [ebp + eax*4 - 0x284]
add eax, ecx
mov dword [ebp - 0x294], 4
mov ecx, 0x6fd7fa39
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x298], ecx
movups xmmword [ebp - 0x28c], xmm0
mov edx, dword [eax + ebx]
add edx, ebx
xor eax, eax
mov dword [ebp - 0x2b4], edx
xor dword [ebp + eax*4 - 0x28c], ecx
inc eax
cmp eax, dword [ebp - 0x294]
jae 0x10006fb2
mov ecx, dword [ebp - 0x298]
jmp 0x10006f9a
mov eax, dword [ebp - 0x290]
mov ecx, 0x7fcaa2f7
mov eax, dword [ebp + eax*4 - 0x28c]
and dword [ebp - 0x288], 0
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x28c], 2
mov esi, dword [eax + edx]
add esi, ebx
mov dword [ebp - 0x284], 0x7fcaa2eb
mov dword [ebp - 0x2cc], esi
xor eax, eax
mov dword [ebp - 0x280], 0x451b85e0
xor dword [ebp + eax*4 - 0x284], ecx
inc eax
cmp eax, dword [ebp - 0x28c]
jae 0x10007014
mov ecx, dword [ebp - 0x290]
jmp 0x10006ffc
mov eax, dword [ebp - 0x288]
mov edi, 0x4fbd4bb4
movaps xmm0, xmmword [0x10039510]
mov eax, dword [ebp + eax*4 - 0x284]
mov dword [ebp - 0x298], edi
mov dword [ebp - 0x294], 4
mov dword [ebp - 0x290], 2
mov ecx, dword [eax + edx]
add ecx, ebx
xor eax, eax
mov dword [ebp - 0x224], ecx
movups xmmword [ebp - 0x28c], xmm0
xor dword [ebp + eax*4 - 0x28c], edi
inc eax
cmp eax, dword [ebp - 0x294]
jae 0x10007073
mov edi, dword [ebp - 0x298]
jmp 0x1000705b
mov eax, dword [ebp - 0x290]
mov eax, dword [ebp + eax*4 - 0x28c]
mov edi, dword [eax + edx]
add edi, ebx
mov dword [ebp - 0x2ac], edi
test esi, esi
je 0x10007195
test ecx, ecx
je 0x10007195
test edi, edi
je 0x10007195
xor edx, edx
and dword [ebp - 0x288], 0
mov eax, 0x5faff472
mov dword [ebp - 0x290], eax
xor ecx, ecx
mov dword [ebp - 0x28c], 2
mov dword [ebp - 0x284], 0x5faff46a
mov dword [ebp - 0x280], 0x6500d75c
xor dword [ebp + ecx*4 - 0x284], eax
inc ecx
cmp ecx, dword [ebp - 0x28c]
jae 0x100070ef
mov eax, dword [ebp - 0x290]
jmp 0x100070d7
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x2b4]
mov eax, dword [ebp + eax*4 - 0x284]
cmp edx, dword [eax + ecx]
jae 0x10007195
mov esi, dword [esi + edx*4]
add esi, ebx
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0x2b0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000711b
sub ecx, dword [ebp - 0x2b0]
push 0x1d
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0x2a4], eax
pop eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a4], ecx
jbe 0x10007178
mov ebx, dword [ebp - 0x2a4]
mov edi, eax
movsx eax, byte [ecx + esi]
xor eax, edi
imul edi, eax, 5
inc ecx
cmp ecx, ebx
jb 0x1000714c
mov ebx, dword [ebp - 0x2a8]
mov dword [ebp - 0x2a0], edi
cmp dword [ebp - 0x2a0], 0x70dc5270
mov edi, dword [ebp - 0x2ac]
je 0x10007184
mov esi, dword [ebp - 0x2cc]
inc edx
jmp 0x100070a5
movzx eax, word [edi + edx*2]
mov ecx, dword [ebp - 0x224]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x10007197
xor eax, eax
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x210]
push ecx
call eax
sub esp, 0x18
lea eax, [ebp - 0x210]
mov ecx, esp
push eax
call fcn.1000abea
lea ecx, [ebp - 0x220]
call fcn.10003669
push str.sportsfreund___new
lea ecx, [ebp - 0x294]
call fcn.1000ae55
mov byte [ebp - 4], 6
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x280], 0x10
lea ecx, [ebp - 0x220]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
call fcn.100035e1
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 4
call fcn.1000b9ab
mov eax, dword [ebp - 0x218]
xor esi, esi
mov dword [ebp - 0x224], 1
mov cl, byte [ebp + esi - 0x224]
mov byte [ebp - 0x29a], cl
cmp eax, dword [ebp - 0x214]
je 0x10007244
mov byte [eax], cl
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
jmp 0x1000725d
lea ecx, [ebp - 0x29a]
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000ed87
mov eax, dword [ebp - 0x218]
inc esi
cmp esi, 4
jb 0x1000721e
mov bl, byte [ebp - 0x299]
test bl, bl
je 0x1000729a
mov byte [ebp - 0x299], 0
cmp eax, dword [ebp - 0x214]
je 0x10007287
mov byte [eax], 0
inc dword [ebp - 0x218]
jmp 0x1000729a
lea ecx, [ebp - 0x299]
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000ed87
cmp byte [ebp - 0x2b8], 0
je 0x100072b8
sub esp, 0x18
mov ecx, esp
call fcn.10005f7f
lea ecx, [ebp - 0x220]
call fcn.10003669
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x260]
call fcn.1000384f
push dword [ebp - 0x2b8]
mov dl, bl
lea ecx, [ebp - 0x260]
call fcn.10005fe2
pop ecx
lea ecx, [ebp - 0x278]
call fcn.1000b9ab
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x10007318
mov eax, dword [ebp - 0x214]
sub eax, ecx
push eax
push ecx
call fcn.1000ccef
xor eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x10006a3b
mov eax, dword [ebp - 0x228]
sub eax, ecx
push eax
push ecx
call fcn.1000ccef
pop ecx
pop ecx
jmp 0x10006a3b
call fcn.1000b344
int3