Function at 0x45842e0
Capabilities:
Encode data using xor
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc78
mov eax, dword [0x4612008]
xor eax, esp
mov dword [esp + 0xc74], eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 8]
push esi
push edi
push 0xa
mov edx, str.5__aIT5_IR
mov dword [0x461f0b4], eax
call fcn.045833b0
add esp, 4
mov eax, dword [eax]
test eax, eax
je 0x4584322
mov eax, dword [eax + 8]
jmp 0x4584324
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov dword [0x461f184], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4584351
add dword [eax + 4], 0xffffffff
jne 0x4584351
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4584351
push eax
call fcn.045c460a
add esp, 4
push 0
call esi
push 0x208
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x86c]
push 0x208
push eax
call fcn.045c6ca8
lea eax, [esp + 0x54]
push 0x5c
push eax
call fcn.045bdf0b
add esp, 0x14
test eax, eax
je 0x4584396
xor ecx, ecx
mov word [eax + 2], cx
cmp dword [0x461f184], 0
je 0x458443b
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x45c]
push 0x208
push eax
call fcn.045c6ca8
push 0x10
mov edx, str.B_2KUt5_aaI5KVS
lea ecx, [esp + 0x20]
call fcn.045833b0
add esp, 0x10
mov eax, dword [eax]
test eax, eax
je 0x45843d8
mov eax, dword [eax + 8]
jmp 0x45843da
xor eax, eax
push eax
lea eax, [esp + 0x45c]
push 0x208
push eax
call fcn.045c6d0c
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x458440f
add dword [eax + 4], 0xffffffff
jne 0x458440f
mov eax, dword [esp + 0x10]
test eax, eax
je 0x458440f
push eax
call fcn.045c460a
add esp, 4
lea eax, [esp + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x461f184]
xor edx, edx
cmp eax, ecx
cmovne ecx, edx
mov dword [0x461f184], ecx
test eax, eax
je 0x458443b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call esi
push 0
push 1
mov ecx, dword [eax + 0x3c]
mov byte [esp + 0x23], 0
mov esi, dword [ecx + eax + 0x34]
add esi, dword [ecx + eax + 0x28]
lea eax, [esp + 0x23]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x458448c
cmp byte [esp + 0x1b], 0xe8
jne 0x458448c
push 9
lea eax, [esi + 0xb]
push str.krnln.fne
push eax
call fcn.045c7017
add esp, 0xc
test eax, eax
jne 0x458448c
mov al, 1
jmp 0x458448e
xor al, al
cmp dword [0x461f184], 0
mov byte [0x461f090], al
je 0x45844a4
test al, al
jne 0x45844a4
xor edi, edi
jmp 0x45844ab
call fcn.0457ad50
mov edi, eax
mov esi, dword [0x461f818]
mov dword [esp + 0x10], edi
test esi, esi
jne 0x458456e
test edi, edi
je 0x458456a
push 0x42
mov dword [esp + 0x24], 0xc880cbf6
mov dword [esp + 0x28], 0x44a6b685
mov word [esp + 0x2c], 0xb98b
mov byte [esp + 0x2e], 0x5c
mov word [esp + 0x32], 0x3fd4
call fcn.045c4625
mov esi, eax
add esp, 4
test esi, esi
je 0x45846e7
push 0x42
push 0
push esi
call fcn.045be2d0
mov al, byte [esp + 0x1e]
xor ecx, ecx
add esp, 0xc
mov word [esp + 0x2b], di
mov byte [esp + 0x2d], al
xor edi, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 0xc9bd75c1
mov eax, edi
and eax, 3
mov al, byte [esp + eax + 0x1c]
xor al, byte [esp + edi + 0x20]
movzx eax, al
push eax
mov eax, 0x21
sub eax, ecx
push str._02x
push eax
lea eax, [esi + ecx*2]
push eax
call fcn.045716f0
mov ecx, dword [esp + 0x24]
inc edi
add ecx, eax
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp edi, 0x10
jb 0x4584526
mov edi, dword [esp + 0x10]
mov dword [0x461f818], esi
test esi, esi
je 0x4584580
push esi
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
jmp 0x4584582
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp byte [0x461f390], 0
mov edx, 1
movzx ecx, byte [0x461f08f]
cmove ecx, edx
mov byte [0x461f08f], cl
cmp edi, eax
je 0x45845e5
test edi, edi
je 0x45845e5
test esi, esi
je 0x45845e5
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x45845de
movups xmm0, xmmword [eax]
push eax
mov dword [0x461f184], 1
movups xmmword [0x461f094], xmm0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x703
mov ecx, 9
call fcn.0457acc0
xor edi, edi
mov dword [0x461f0a8], 0x46182c0
cmp byte [0x461f090], 0
mov dword [0x461f0ac], 0x4618838
je 0x4584637
mov edx, 0x4618838
mov edi, 0x17
nop dword [eax]
mov ecx, dword [edx]
mov eax, dword [edx + 4]
add edx, 8
mov dword [ecx*4 + 0x46182c0], eax
cmp edx, 0x46188f0
jne 0x4584620
push str.ComCtl32.dll
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4584695
push str.DllGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x458468b
xorps xmm0, xmm0
lea ecx, [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
push ecx
movaps xmmword [esp + 0x34], xmm0
mov dword [esp + 0x24], 0x20
call eax
test eax, eax
js 0x458468b
movzx esi, word [esp + 0x24]
movzx eax, word [esp + 0x28]
shl esi, 0x10
or esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, 0x60000
setae byte [0x461f08c]
test di, di
je 0x45846bc
cmp dword [0x461f184], 0
jne 0x45846bc
mov edx, edi
mov ecx, 7
call fcn.0457acc0
push 4
call fcn.045bc771
mov ecx, dword [esp + 0xc80]
add esp, 4
mov dword [eax], vtable._iext_interface_.0
pop edi
pop esi
xor ecx, esp
mov dword [0x461f0b0], eax
call fcn.045bc602
mov esp, ebp
pop ebp
ret 4
push 0
push 0
call fcn.045be262
int3