Function at 0x10092e60
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x140
mov esi, esp
mov dword [esi + 0x128], ebp
mov dword [esi + 0x14], ecx
mov dword [esi + 0x12c], esp
mov dword [esi + 0x138], 0xffffffff
mov dword [esi + 0x134], 0x100a55f0
mov eax, dword fs:[0]
mov dword [esi + 0x130], eax
lea eax, [esi + 0x130]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x6c], eax
call fcn.100f74c6
lea edi, [esi + 0x70]
push 7
push str.advance
push eax
push edi
call fcn.100953a0
add esp, 0x10
mov dword [esi + 0x138], 0
lea eax, [esi + 0x68]
mov dword [esi + 0xc], edi
mov ecx, edi
push eax
call fcn.10092840
pxor xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov edx, dword [eax + 0x10]
cmp dword [eax + 0x14], 8
jb 0x10092f0b
mov eax, dword [eax]
cmp edx, 0x7fffffff
jae 0x10093406
cmp edx, 7
ja 0x10092f34
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], 7
movdqu xmm0, xmmword [eax]
movdqa xmmword [esi + 0x20], xmm0
jmp 0x10092fc0
mov dword [esi + 0x34], 7
mov ecx, edx
or ecx, 7
cmp ecx, 0x7ffffffe
ja 0x1009342d
cmp ecx, 0xb
mov edi, 0xa
cmovae edi, ecx
lea ecx, [edi + edi]
cmp edi, 0x7ff
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x18], edi
jb 0x10092f93
cmp edi, 0x7fffffee
jae 0x1009342d
add ecx, 0x25
push ecx
call fcn.100f6bcd
mov edx, dword [esi + 0x10]
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x10092fa2
add ecx, 2
push ecx
call fcn.100f6bcd
mov edx, dword [esi + 0x10]
add esp, 4
mov ecx, dword [esi + 0x1c]
mov edi, dword [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], edi
lea ecx, [ecx + ecx + 2]
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0x84]
cmp eax, 8
jb 0x10093000
mov ecx, dword [esi + 0x70]
lea edi, [eax + eax]
add edi, 2
cmp edi, 0x1000
jb 0x10092ff6
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10093427
add eax, eax
add eax, 0x25
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.100f6c02
add esp, 8
call fcn.100f74c6
mov dword [esi + 0x138], 1
push 7
push str.advance
push eax
lea eax, [esi + 0x70]
push eax
call fcn.100953a0
add esp, 0x10
cmp dword [esi + 0x84], 8
jb 0x10093032
mov eax, dword [esi + 0x70]
mov dword [esi + 0xc], eax
push dword [esi + 0xc]
call fcn.100f7587
test edx, edx
jne 0x1009340b
mov eax, dword [esi + 0x84]
cmp eax, 8
jb 0x10093082
mov ecx, dword [esi + 0x70]
lea edi, [eax + eax]
add edi, 2
cmp edi, 0x1000
jb 0x10093078
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10093427
add eax, eax
add eax, 0x25
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.100f6c02
add esp, 8
pxor xmm0, xmm0
movdqa xmmword [esi + 0x40], xmm0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0xf
cmp dword [esi + 0x34], 8
jb 0x100930a4
mov eax, dword [esi + 0x20]
jmp 0x100930a7
lea eax, [esi + 0x20]
mov dword [esi + 0x138], 3
lea ecx, [esi + 0x70]
push 1
push 0x40
push 1
push eax
call fcn.10098d70
mov eax, dword [esi + 0x70]
mov ecx, dword [eax + 4]
lea eax, [esi + 0x70]
add ecx, eax
mov dword [esi + 0x138], 5
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::fail_void_const]
test al, al
je 0x10093118
lea edi, [esi + 0xe0]
mov eax, dword [esi + 0x70]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x70], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi + 0x70]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x70]
mov dword [esi + eax + 0x6c], ecx
lea ecx, [esi + 0x80]
call fcn.10068740
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::ios_base::destructor_void_]
jmp 0x10093378
lea eax, [esi + 0x40]
push eax
lea eax, [esi + 0x70]
push eax
call fcn.10093510
add esp, 8
lea edi, [esi + 0xe0]
mov eax, dword [esi + 0x70]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x70], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi + 0x70]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x70]
mov dword [esi + eax + 0x6c], ecx
lea ecx, [esi + 0x80]
call fcn.10068740
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::ios_base::destructor_void_]
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10093378
cmp dword [esi + 0x54], 0x10
lea ebx, [esi + 0x40]
jb 0x10093173
mov ebx, dword [esi + 0x40]
mov edx, ebx
cmp eax, 8
lea edi, [esi + 0x70]
jb 0x10093281
mov dword [esi + 0xc], ebx
xor ecx, ecx
cmp eax, 0x20
jb 0x10093239
mov ecx, eax
and ecx, 0xffffffe0
lea edx, [ecx - 0x20]
mov edi, edx
shr edi, 5
inc edi
test edx, edx
mov dword [esi + 0x10], edi
je 0x10093270
and edi, 0xfffffffe
xor edx, edx
pcmpeqd xmm0, xmm0
mov ebx, dword [esi + 0xc]
nop word cs:[eax + eax]
movdqu xmm1, xmmword [ebx + edx]
movdqu xmm2, xmmword [ebx + edx + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [ebx + edx], xmm1
movdqu xmmword [ebx + edx + 0x10], xmm2
movdqu xmm1, xmmword [ebx + edx + 0x20]
movdqu xmm2, xmmword [ebx + edx + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [ebx + edx + 0x20], xmm1
movdqu xmmword [ebx + edx + 0x30], xmm2
add edx, 0x40
add edi, 0xfffffffe
jne 0x100931c0
test byte [esi + 0x10], 1
je 0x1009322e
movdqu xmm0, xmmword [ebx + edx]
movdqu xmm1, xmmword [ebx + edx + 0x10]
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [ebx + edx], xmm0
movdqu xmmword [ebx + edx + 0x10], xmm1
cmp eax, ecx
lea edi, [esi + 0x70]
je 0x10093297
test al, 0x18
je 0x1009327d
mov dword [esi + 0x10], eax
and eax, 0xfffffff8
mov ebx, dword [esi + 0xc]
lea edx, [ebx + eax]
pcmpeqd xmm0, xmm0
nop dword [eax]
movq xmm1, qword [ebx + ecx]
pxor xmm1, xmm0
movq qword [ebx + ecx], xmm1
add ecx, 8
cmp eax, ecx
jne 0x10093250
mov ecx, dword [esi + 0x10]
cmp ecx, eax
mov eax, ecx
jne 0x10093281
jmp 0x10093297
xor edx, edx
mov ebx, dword [esi + 0xc]
test byte [esi + 0x10], 1
jne 0x1009320c
jmp 0x1009322e
add ecx, ebx
mov edx, ecx
add ebx, eax
nop word cs:[eax + eax]
not byte [edx]
inc edx
cmp edx, ebx
jne 0x10093290
mov dword [esi + 0xc], esp
push eax
sub esp, 0x34
mov eax, esp
mov dword [eax + 0x2c], 0
mov dword [eax], edi
lea ecx, [esi + 0x40]
mov dword [eax + 4], ecx
mov byte [eax + 0x30], 1
mov byte [eax + 0x34], 0
mov dword [esi + 0x138], 3
call fcn.10093870
add esp, 0x38
mov esp, dword [esi + 0xc]
movzx eax, byte [esi + 0x70]
cmp al, 1
jne 0x1009336c
lea eax, [esi + 0x70]
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x64], Ordinal_2
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x138], 4
push str.advance
call fcn.100a5500
mov dword [esi + 0x5c], eax
movzx ecx, byte [esi + 0x70]
cmp ecx, 2
je 0x10093326
cmp ecx, 1
jne 0x10093333
mov ecx, dword [esi + 0x78]
cmp eax, dword [ecx]
jne 0x10093333
mov al, 1
jmp 0x1009336c
mov eax, dword [esi + 0x78]
cmp dword [eax + 4], 0
je 0x100933ff
lea ecx, [esi + 0x58]
call fcn.10019ac0
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esi + 0x14], eax
cmp ecx, dword [esi + 0x14]
je 0x10093368
nop
mov dword [esi + 0xc], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx]
push dword [esi + 0x10]
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
add ecx, 4
cmp ecx, dword [esi + 0x14]
jne 0x10093350
movzx eax, byte [esi + 0x70]
lea ecx, [esi + 0x78]
movzx eax, al
push eax
call fcn.10018590
mov eax, dword [esi + 0x54]
cmp eax, 0x10
jb 0x100933b0
mov ecx, dword [esi + 0x40]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x100933a6
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10093427
add eax, 0x24
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.100f6c02
add esp, 8
mov eax, dword [esi + 0x34]
cmp eax, 8
jb 0x100933e9
mov ecx, dword [esi + 0x20]
lea edi, [eax + eax]
add edi, 2
cmp edi, 0x1000
jb 0x100933df
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10093427
add eax, eax
add eax, 0x25
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.100f6c02
add esp, 8
mov eax, dword [esi + 0x130]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov al, 2
jmp 0x1009336c
call fcn.10017ca0
mov dword [esi + 0x138], 2
lea eax, [esi + 0x70]
push eax
push edx
push str.create_directory
call fcn.10093bd0
add esp, 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.10016270
nop word cs:[eax + eax]
push ebp
sub esp, 0x38
lea esi, [ebp - 0x13c]
mov ebp, dword [esi + 0x128]
lea ecx, [esi + 0x70]
call fcn.10092920
add esp, 0x38
pop ebp
ret