Function at 0x1005f395
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10147ea3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x918
push esi
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100632a7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x654], 0xfffffff6
mov dword [ebp - 0x650], 0xfffffff6
mov dword [ebp - 0x64c], 0xfffffff6
mov dword [ebp - 0x648], 0xfffffff6
lea ecx, [ebp - 0x1e9]
call fcn.10012f28
push eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x82c]
call fcn.1001421b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x750]
call fcn.100141e1
and dword [ebp - 4], 0
mov dword [ebp - 0x510], 0xfffffffd
push 1
push 0x7a30
call fcn.1005dc32
pop ecx
pop ecx
lea eax, [ebp - 0x510]
push eax
push 0x5c0a
push 0x6b1e
push 0
lea eax, [ebp - 0x750]
push eax
call fcn.1005dd55
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x750]
call fcn.10014207
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x294], eax
push 4
lea ecx, [ebp - 0x6e4]
call fcn.100141a5
mov dword [ebp - 4], 1
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x7c8], 4
mov dword [ebp - 0x110], 0
jmp 0x1005f4be
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x1005f4e0
push dword [ebp - 0x110]
lea ecx, [ebp - 0x6e4]
call fcn.1001420c
mov dword [eax], 0xb3198a8f
jmp 0x1005f4b1
push 0x2af9
push 0x5769
push 0
push 0x530a
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 0x4932
push 0x2ef5
call fcn.1005f17f
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e4]
call fcn.10014207
mov eax, dword [ebp - 0x294]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1005f535
jmp 0x100632dc
mov eax, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xac], ecx
mov eax, dword [ebp - 0xac]
cmp dword [eax], 0x4550
je 0x1005f55a
jmp 0x100632dc
mov dword [ebp - 0x114], 0x8c6a53d0
mov dword [ebp - 0x114], 0
jmp 0x1005f57d
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffff6
jle 0x1005f787
mov dword [ebp - 0x668], 0x288a
mov dword [ebp - 0x664], 0x288a
mov dword [ebp - 0x660], 0x288a
mov dword [ebp - 0x65c], 0x288a
lea ecx, [ebp - 0x1d9]
call fcn.10012f28
push eax
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x668]
push eax
lea ecx, [ebp - 0x84c]
call fcn.1001421b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4d0]
call fcn.100141e1
mov dword [ebp - 4], 2
mov dword [ebp - 0x80], 0xa1836ccb
mov dword [ebp - 0x80], 0
jmp 0x1005f605
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x1005f742
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4d0]
call fcn.1001420c
cmp dword [eax], 0
je 0x1005f6bd
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe8], 0
jmp 0x1005f649
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 4
jge 0x1005f671
push 1
push 0x18ab
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.1005dc87
add esp, 0x10
jmp 0x1005f63c
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x1005f6b8
push 0x728
push 0x131f
push 0x4b6
push 0x6ff
push 0x1b0f
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x1005f73d
mov dword [ebp - 0xd8], 0xb61d2250
mov dword [ebp - 0xd8], 3
jmp 0x1005f6e0
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x1005f725
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x4d0]
call fcn.1001420c
mov esi, eax
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4d0]
call fcn.1001420c
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4d0]
call fcn.1001420c
cmp dword [eax], 0
je 0x1005f723
jmp 0x1005f725
jmp 0x1005f6d3
push dword [ebp - 0x80]
lea ecx, [ebp - 0x4d0]
call fcn.1001420c
cmp dword [eax], 0
je 0x1005f73d
jmp 0x1005f5fe
jmp 0x1005f5fe
mov byte [ebp - 0xad], 0
push 0x1575
push 0x6eb2
push 0
push 0x5e7e
push 0x6a54
push 0x56bf
lea eax, [ebp - 0xad]
push eax
call fcn.1005ee8a
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.10014207
jmp 0x1005f570
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xac]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp dword [eax + 4], 0
jne 0x1005f7a8
jmp 0x100632dc
and dword [ebp - 0x24], 0
mov dword [ebp - 0x14c], 0x4fd3df75
mov dword [ebp - 0x768], 0xffffffff
mov dword [ebp - 0x14c], 0xffffffee
jmp 0x1005f7d9
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xfffffff4
jge 0x1005f80f
mov byte [ebp - 0xb0], 0
lea eax, [ebp - 0xb0]
push eax
push 0x11b4
push 1
call fcn.1005dcfa
add esp, 0xc
push 0xdd2
push 0
call fcn.1005e849
pop ecx
pop ecx
jmp 0x1005f7cc
mov eax, dword [ebp - 0xac]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xac]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x16c], 0xfffffff8
mov dword [ebp - 0x4a0], 0x8d06721f
mov dword [ebp - 0x4c0], 0x3dec995f
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x11c], 0
jmp 0x1005f87e
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x1005f89a
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x4f0], 0x38a1
jmp 0x1005f871
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4f0], 2
jg 0x1005f8b6
mov dword [ebp - 0x46c], 1
jmp 0x1005f8bd
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f0]
cmp eax, dword [ebp - 0x46c]
jle 0x1005f8de
mov dword [ebp - 0x474], 1
jmp 0x1005f8e5
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x1005f96b
cmp dword [ebp - 0x16c], 0
jne 0x1005f92d
cmp dword [ebp - 0x1f4], 0
jne 0x1005f92d
and dword [ebp - 0x47c], 0
jmp 0x1005f937
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0x16c]
imul eax, dword [ebp - 0x47c]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x16c], 0
je 0x1005f96b
mov dword [ebp - 0x498], 1
jmp 0x1005f972
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x4a0], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4f0]
imul ecx, dword [ebp - 0x4a0]
add ecx, dword [ebp + eax - 0x4f0]
mov eax, 0xdd44
sub eax, ecx
sub eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0x9e177c42
jbe 0x1005f9ca
mov dword [ebp - 0x4b8], 1
jmp 0x1005f9d1
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0xfff8
je 0x1005f9e9
mov dword [ebp - 0x228], 1
jmp 0x1005f9f0
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x54c], eax
and dword [ebp - 0x204], 0
jmp 0x1005fa21
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0xc4]
add eax, 0x28
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xac]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x204], eax
jge 0x1005faa7
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x464]
jb 0x1005faa2
mov eax, dword [ebp - 0xac]
push dword [eax + 0x38]
mov eax, dword [ebp - 0xc4]
push dword [eax + 8]
call fcn.1005db05
pop ecx
pop ecx
add eax, dword [ebp - 0x464]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x554]
jae 0x1005faa2
push 0x1487
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc4]
push eax
push 1
push 0x5877
call fcn.1005dd55
add esp, 0x14
jmp 0x1005faa7
jmp 0x1005fa05
push 1
lea ecx, [ebp - 0x214]
call fcn.100141a5
mov dword [ebp - 4], 3
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0xe0], 0xfffffffb
push 1
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x744]
push eax
push 0x1765
call fcn.1005dde1
add esp, 0x10
mov dword [ebp - 0x20], 0
jmp 0x1005faf9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x45c], eax
push 2
mov ecx, dword [ebp - 0x45c]
call fcn.1001420c
mov esi, eax
push 2
mov ecx, dword [ebp - 0x45c]
call fcn.1001420c
mov ecx, dword [esi]
mov dword [eax], ecx