Function at 0x1005c850
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98c
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
cmp byte [0x100c5b68], 0
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
je 0x1005cc36
invalid
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ebx, [esp + 0x2e0]
mov esi, 9
push 0x10
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x1f
push 0
mov dword [ebx - 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x29
push 0
mov dword [ebx - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 1
mov dword [ebx], eax
push 0
mov dword [ebx - 0x14], 1
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx - 0x10], eax
mov byte [eax], 0
push dword [ebx - 0x14]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx - 0xc], eax
lea ebx, [ebx + 0x18]
mov byte [eax], 0
sub esi, 1
jne 0x1005cc48
push 0x10
push esi
mov byte [esp + 0x3ac], 0
mov dword [esp + 0x3b0], esi
mov dword [esp + 0x3b4], esi
mov dword [esp + 0x3b8], esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
push 0x1f
push esi
mov dword [esp + 0x3c8], eax
call edi
push eax
call ebx
push 0x29
push esi
mov dword [esp + 0x3cc], eax
call edi
push eax
call ebx
push 1
push esi
mov dword [esp + 0x3d0], eax
mov dword [esp + 0x3bc], 1
call edi
push eax
call ebx
mov dword [esp + 0x3b8], eax
mov byte [eax], 0
push dword [esp + 0x3b4]
push esi
call edi
push eax
call ebx
mov dword [esp + 0x3bc], eax
lea ecx, [esp + 0x3cc]
mov byte [eax], 0
call fcn.1005f4e0
lea ecx, [esp + 0x5b4]
call fcn.1005f850
lea ecx, [esp + 0x2c0]
mov dword [esp + 0x2c4], 0x400
mov dword [esp + 0x2c8], 0x400
call fcn.1005ffa0
lea ecx, [esp + 0x810]
call fcn.1005e1e0
push 0x5c
push esi
call edi
push eax
call ebx
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1cc], 0x10001000
mov dword [esp + 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp + 0x5c]
mov dword [esp + 0xc], eax
mov ecx, eax
call fcn.10058e40
cmp byte [0x100c5b68], 0
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
je 0x1005d12f
pop ds
pop dword [edi]
rol dl, cl
mov ch, 0xe7
in eax, 0x9d
nop
mov ebp, 0x9997027
dec ecx
mov bl, 0xc3
sal esp, 1
rcl ebp, 1
stosb byte es:[edi], al
xchg ebp, eax
leave
aad 0xd
test ecx, eax
pop ebx
sub al, 0xb3
pop esp
add ah, byte [ebx + esi*4 + 0x988a03f]
jne 0x1005ce5e
nop
les eax, [ebp + 0x3d]
xchg esi, eax
sbb esp, dword [ebx - 0x16]
cld
retf
neg edi
aas
jnp 0x1005ce9d
sti
inc esp
sub eax, ebp
movsb byte es:[edi], byte [esi]
fstp dword [eax + ebp - 0x1f1a95e2]
push 0xffffffffffffffcb
adc esi, eax
cmp al, 0xb2
xchg byte [edx - 0x311e0654], bl
add eax, 0xd0bffcdb
cli
mov dh, 0x83
mov edi, 0x83b6fad0
mov edi, 0x67c126b9
les esi, [ebx - 0xf]
shl dword es:[edi - 0x3c], 0x73
int1
les esi, [bp + di - 0xf]
or bl, byte [eax + 0x4304ecef]
and eax, 0x909557eb
cmp al, 0xa5
sti
and dword [esi - 0x5111ab17], esp
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
loope 0x1005ce5c
lodsd eax, dword [esi]
fsub dword [esi - 0x293e31f7]
jae 0x1005ce87
jmp 0xfdb0f165
in eax, dx
push es
pop ss
ror dword [edx + 0x3a], 1
pop edx
out dx, eax
xchg ebp, eax
xchg edx, eax
out 0x5f, eax
sal byte [ecx], 1
sub bh, byte ss:[edi - 0x1f601b98]
enter 0x3507, 0x58
mov ecx, 0x2f96647
cmp byte [esi], 0xc0
pop edi
cmpsd dword [esi], dword es:[edi]
pop es
xor eax, 0x6647b958
stc
add al, byte [eax - 0x58a03fc2]
sub al, 0x44
in al, dx
loopne 0x1005ce35
and bh, dl
not dword [ebx]
cmc
cmpsb byte [esi], byte es:[edi]
adc dword [edx + 0x760f8936], 0x8aa679a5
jns 0x1005ce55
invalid
push dword [esp + 0x210]
mov eax, dword [ebp + 0x10]
push 0
mov dword [esp + 0x84], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xc8
push dword [ebp + 0x1c]
lea edx, [esp + 0x218]
mov cl, 1
call int.10054670
mov eax, dword [ebp + 0x14]
add esp, 8
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x84], 0
push 0x23f0
push 0
mov dword [esp + 0x90], eax
call edi
push eax
call ebx
mov dword [esp + 0x20c], eax
xor ebx, ebx
nop dword [eax + eax]
mov eax, 0xb21642c9
mov ecx, ebx
mul ebx
shr edx, 6
imul eax, edx, 0x5c
mov edx, eax
sub ecx, eax
add ecx, dword [esp + 0x210]
sub edx, ebx
add edx, 0x5c
call fcn.1005bc50
mov ecx, dword [esp + 0x20c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, 0x23e6
jb 0x1005d1a0
push dword [esp + 0x210]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp + 0x1c]
lea edx, [esp + 0x210]
push 0x32
push ebx
mov cl, 1
call int.10054670
add esp, 8
lea edx, [esp + 0x60]
lea ecx, [esp + 0x228]
call fcn.10067630
cmp dword [esp + 0x70], 0
jne 0x1005d6c9
lea ecx, [esp + 0x60]
call int.1004ed00
cmp byte [0x100c5b68], 0
je 0x1005d6b1
test dword [esi], ebx
xchg dword [eax], edi
push 0xffffffffffffffa4
int3
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x64]
call fcn.10050ab0
add esp, 4
cmp byte [0x100c5b68], 0
je 0x1005d916
fsubr qword [esi + 0x10]
int1
cmp al, 0x79
xor byte [ecx + 8], bl
daa
div byte [ebp - 0x78]
aaa
sbb eax, 0x4653558b
pop edx
push cs
dec ecx
pop esp
invalid
mov eax, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
mov dword [esp + 0x2a0], eax
mov eax, dword [sym.imp.USER32.dll_DestroyMenu]
push 0
mov dword [esp + 0x94], ebx
mov dword [esp + 0x2a0], eax
mov dword [esp + 0x18], 0x33323130
mov dword [esp + 0x1c], 0x37363534
mov word [esp + 0x20], 0x3938
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
push 1
push 0
mov dword [esp + 0x24], eax
call edi
push eax
call ebx
push 1
push 0
mov dword [esp + 0x28], eax
call edi
push eax
call ebx
push 1
push 0
mov dword [esp + 0x2c], eax
call edi
push eax
call ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x226e9d30
mov dword [esp + 0x34], 0x246e9b37
mov dword [esp + 0x38], 0x256e9d36
mov dword [esp + 0x3c], 0x105d9c30
mov eax, dword [esp + 0x30]
mov byte [esp + 0x40], 0
cmp byte [esp + 0x40], 0
jne 0x1005d9d3
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [esp + ecx*4 + 0x30]
xor eax, 0x105da903
mov dword [esp + ecx*4 + 0x30], eax
inc ecx
cmp ecx, 4
jb 0x1005d9c0
mov dword [esp + 0x44], 0x10fb0671
mov dword [esp + 0x48], 0x10f50473
mov dword [esp + 0x4c], 0x13fe0972
mov dword [esp + 0x50], 0x11fb0770
mov dword [esp + 0x54], 0x27cd317d
mov eax, dword [esp + 0x44]
mov byte [esp + 0x58], 0
cmp byte [esp + 0x58], 0
jne 0x1005da23
xor ecx, ecx
nop dword [eax]
mov eax, dword [esp + ecx*4 + 0x44]
xor eax, 0x27cd3145
mov dword [esp + ecx*4 + 0x44], eax
inc ecx
cmp ecx, 5
jb 0x1005da10
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x18]
call fcn.10072190
mov cl, byte [0x100c5b68]
mov dword [esp + 0x210], eax
test cl, cl
je 0x1005de11
dec eax
and al, 0x92
test dword [eax + 0x1c], 0x27ca4d2d
xor edi, dword [ecx - 0x67d02b7d]
mov edx, 0xfeb6c123
sub esi, dword [ebx + 0x49]
pop ds
mov bl, 0x58
in al, dx
fbstp tbyte [eax]
push esi
xlatb
aaa
invalid
and eax, 0x387bf1f7
xchg byte [ecx + edx*4], cl
call dword [edx + 0x322175a2]
pop ebx
out 0x6c, eax
inc eax
test ch, 0x1d
rol byte [esi], cl
sbb dword [esi + 0x3d67c63], eax
scasb al, byte es:[edi]
xchg ebx, eax
add byte [esi - 0x45972bbc], dh
fmul qword [ebx + 0x53]
push eax
xor al, 0xb2
push edi
sub ax, 0x8411
xchg eax, ebx
mov al, byte [0x2cde22c6]
ret 0xea88
mov ecx, fs
call 0x59a95c14
sub dword [ecx], edx
outsb dx, byte [esi]
loopne 0x1005dd92
push edx
out 0xb3, al
push eax
std
shl ah, 1
mov byte [esi - 0x59], bl
int 0x48
mov al, 6
mov esp, dword [ebx - 0x4c]
daa
test al, 0x39
lahf
ret
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x90], eax
test cl, cl
je 0x1005e063
jno 0x1005dddd
pop esp
xchg ebx, eax
out dx, eax
aam 0xdc
int 0x9b
insb byte es:[edi], dx
sbb dword [esi + 0x1c], 0xa5fd5d34
dec ebx
adc byte [edx + edi*4], 0xb9
or byte [ebx], cl
mov dword [ebx - 0x18], edx
lodsd eax, dword [esi]
sbb edx, ebp
out dx, al
movsd dword es:[edi], dword [esi]
push cs
pop es
push ebx
stc
sbb dword [edx + 0x65], edx
lcall 0x4fad, 0x91ce94d6
sahf
inc esp
movsd dword es:[edi], dword [esi]
and esi, dword [ecx - 0x5fd6c563]
cli
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
dec esp
inc ebp
fild qword [ebp - 0x41]
inc eax
jbe 0x1005dea9
insd dword es:[edi], dx
mov edi, 0xc8447640
inc ecx
push edx
cmp byte [edx - 0x2215104f], bh
enter 0x5241, 0x38
mov edx, 0xddeaefb1
add ch, byte [esi - 0x1b]
jmp 0x1005de60
and eax, 0x83957c1
or byte [edi + 0x7f], 0xfd
fstp dword [edx]
mov eax, dword [0x7fdce7b0]
xor bh, byte [0x6909e8e6]
push eax
add eax, 0x7cd990ab
push cs
add ecx, dword [0x45bff3f3]
pop ecx
ficom dword [eax - 0x5170286a]
push ecx
inc eax
inc ecx
push eax
fadd qword [eax + 0x3aac8e70]
ficom dword [esi]
stc
invalid
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x64]
call fcn.10051550
add esp, 4
test al, al
jne 0x1005e087
push 7
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
push 0
mov dword [esp + 0x34], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
push dword [esp + 0x20]
push 0
call edi
push eax
call ebx
push dword [esp + 0x24]
push 0
call edi
push eax
call ebx
push dword [esp + 0x28]
push 0
call edi
push eax
call ebx
lea ecx, [esp + 0x810]
call fcn.1005e520
push dword [esp + 0x5a4]
push 0
call edi
push eax
call ebx
push dword [esp + 0x6e4]
push 0
call edi
push eax
call ebx
lea ecx, [esp + 0x5b4]
call fcn.1005f980
lea ecx, [esp + 0x4a8]
call fcn.1005fa40
lea ecx, [esp + 0x3e4]
call fcn.1005fbf0
push dword [esp + 0x3d8]
push 0
call edi
push eax
call ebx
push dword [esp + 0x3dc]
push 0
call edi
push eax
call ebx
push dword [esp + 0x3e0]
push 0
call edi
push eax
call ebx
push dword [esp + 0x3d0]
push 0
call edi
push eax
call ebx
push dword [esp + 0x3c0]
push 0
call edi
push eax
call ebx
push dword [esp + 0x3c4]
push 0
call edi
push eax
call ebx
push dword [esp + 0x3c8]
push 0
call edi
push eax
call ebx
push dword [esp + 0x3b8]
push 0
call edi
push eax
call ebx
mov eax, 9
lea esi, [esp + 0x3b4]
nop dword [eax]
push dword [esi - 0x1c]
lea esi, [esi - 0x18]
dec eax
push 0
mov dword [esp + 0x14], eax
call edi
push eax
call ebx
push dword [esi]
push 0
call edi
push eax
call ebx
push dword [esi + 4]
push 0
call edi
push eax
call ebx
push dword [esi - 0xc]
push 0
call edi
push eax
call ebx
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x1005e190
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret