Function at 0x81a760
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0xbd33e0]
mov esi, ecx
xor eax, esp
mov dword [esp + 0x50], eax
cmp dword [edx + 0x44], 0
je 0x81a9fa
mov eax, fcn.007adf90
mov edx, 3
movzx ecx, byte [0xbb9b87]
sub edx, eax
mov eax, edx
xor eax, fcn.007adf90
setne al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x81a9e7
mov al, byte [0xbb9b87]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007adf90
setne cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb9b87], ah
jne 0x81a7ae
mov edx, fcn.007adf90
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.007adf90
setne dl
or dl, 4
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x81a817
mov eax, ecx
movzx edx, byte [0xbb9b87]
xor eax, fcn.007adf90
setne al
or al, 4
movzx eax, al
bt edx, eax
jae 0x81a7f7
jmp 0x81a9e7
xor ecx, fcn.007adf90
movzx ecx, byte [0xbb9b87]
setne al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x81a9c2
mov eax, fcn.007adf90
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbb9b50]
xor edx, fcn.007adf90
sete cl
xor ecx, 0xb3d1b0a9
add ecx, 0xa2c
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb9b50], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb9b54]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb9b54], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbb9b58]
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb9b58], edx
or eax, edi
not edx
mov ebx, dword [0xbb9b5c]
imul edx, eax
lea edi, [edx*8]
xor ebx, edx
shr edx, 0x1c
mov dword [0xbb9b5c], ebx
or edx, edi
not ebx
imul ebx, edx
mov edx, dword [0xbb9b60]
mov edi, ebx
shl edi, 4
xor edx, ebx
shr ebx, 0x1b
mov dword [0xbb9b60], edx
or ebx, edi
not edx
mov ebp, dword [0xbb9b64]
imul edx, ebx
mov edi, edx
shl edi, 5
xor ebp, edx
shr edx, 0x1a
mov dword [0xbb9b64], ebp
or edx, edi
not ebp
imul ebp, edx
mov edx, dword [0xbb9b68]
mov edi, ebp
shl edi, 6
xor edx, ebp
shr ebp, 0x19
mov dword [0xbb9b68], edx
or ebp, edi
not edx
mov ebx, dword [0xbb9b6c]
imul edx, ebp
mov edi, edx
shl edi, 7
xor ebx, edx
shr edx, 0x18
mov dword [0xbb9b6c], ebx
or edx, edi
not ebx
imul ebx, edx
mov edx, dword [str._aBFo]
mov edi, ebx
shl edi, 8
xor edx, ebx
shr ebx, 0x17
mov dword [str._aBFo], edx
or ebx, edi
not edx
mov ebp, dword [0xbb9b74]
imul edx, ebx
mov edi, edx
shl edi, 9
xor ebp, edx
shr edx, 0x16
mov dword [0xbb9b74], ebp
or edx, edi
not ebp
imul ebp, edx
mov edx, dword [0xbb9b78]
mov edi, ebp
shl edi, 0xa
xor edx, ebp
shr ebp, 0x15
mov dword [0xbb9b78], edx
or ebp, edi
not edx
mov ebx, dword [0xbb9b7c]
imul edx, ebp
mov edi, edx
shl edi, 0xb
xor ebx, edx
shr edx, 0x14
mov dword [0xbb9b7c], ebx
or edx, edi
not ebx
imul ebx, edx
mov dl, 1
xor dword [0xbb9b80], ebx
shl dl, cl
or byte [0xbb9b87], dl
mov eax, fcn.007adf90
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.007adf90
setne cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbb9b87], al
push 0xbb9b50
push esi
call fcn.0078de60
add esp, 8
jmp 0x81b227
mov eax, dword [edx + 0x1c]
mov ebp, dword [edx + 0x20]
mov ebx, dword [edx + 0x34]
mov edi, edx
mov ecx, esi
mov edx, 0x21
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x20], eax
push 0
push 0
push 0
call fcn.008002d0
add esp, 0xc
test eax, eax
jne 0x81b227
mov ecx, esi
mov dword [esp + 4], ebx
call fcn.007fb640
mov word [edi + 2], 0x140
mov ecx, esi
mov edx, edi
mov dword [esp + 0x18], eax
push eax
call fcn.00815310
add esp, 4
mov eax, dword [edi + 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x34], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0xc]
mov dword [edi + 0x3c], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov ebx, dword [edi + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
test eax, eax
jle 0x81aaac
xor ecx, ecx
lea edx, [ecx + ecx*8]
test byte [ebp + edx*8 + 0x30], 0x20
je 0x81aaa7
mov eax, dword [ebp + edx*8 + 0x34]
mov dword [esp + 0xc], eax
jmp 0x81aaac
inc ecx
cmp ecx, eax
jl 0x81aa93
mov edi, dword [esi + 0x28]
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
lea ecx, [edi + 1]
mov dword [esi + 0x28], ecx
cmp byte [eax], 0x84
jne 0x81aad8
xor eax, eax
test ebx, ebx
mov dword [esp + 0x14], ecx
lea ecx, [edi + 2]
setne al
mov dword [esi + 0x28], ecx
lea edx, [eax + eax + 6]
jmp 0x81aaeb
xor eax, eax
test ebx, ebx
mov dword [esp + 0x14], 0
setne al
lea edx, [eax + eax + 5]
lea ecx, [esp + 0x38]
push edi
call fcn.007fdd40
add esp, 4
mov eax, dword [esi + 0x2c]
mov ebx, esi
mov ebp, dword [esp + 0x10]
mov edx, 0x72
inc eax
mov dword [esi + 0x2c], eax
mov esi, dword [esp + 0x20]
mov ecx, esi
push ebp
mov dword [esp + 0x28], eax
push eax
push dword [esp + 0x14]
call fcn.007d10f0
add esp, 0xc
cmp dword [esp], 0
mov dword [esp + 8], ebx
je 0x81ab5e
mov edx, dword [esp + 0x1c]
mov ecx, ebx
call fcn.0081c0f0
mov ebp, dword [esp]
mov ecx, esi
mov edx, 0x64
mov ebx, dword [ebp]
add ebx, 2
push 0xfffffffffffffff7
push eax
push 0
push ebx
push edi
call fcn.007f75d0
add esp, 0x14
mov dword [esp + 0x4c], ebp
mov ebx, ebp
jmp 0x81ab72
mov ecx, esi
mov edx, 0x64
push ebp
push edi
call fcn.007d10d0
add esp, 8
mov ebx, dword [esp]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], edi
mov ebp, dword [esp + 4]
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x81aba1
mov ecx, dword [esp + 0x20]
mov edx, 0x64
push 0
push eax
call fcn.007d10d0
add esp, 8
mov dword [edi + 0x14], eax
or byte [edi + 4], 0x20
mov edx, fcn.007a46e0
xor eax, eax
movzx esi, byte [0xbb9b93]
imul edx, edx
and edx, 3
cmp edx, 1
seta al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt esi, eax
mov esi, dword [esp + 8]
jb 0x81ad03
mov al, byte [0xbb9b93]
mov ebp, ebx
xor ecx, ecx
cmp edx, 1
mov ah, 1
seta cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb9b93], ah
jne 0x81abdd
mov ecx, fcn.007a46e0
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 6]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x81ac5e
mov ebx, ebp
mov ebp, dword [esp + 4]
xor eax, eax
cmp ecx, 1
seta al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 6]
movzx edx, byte [0xbb9b93]
and al, 7
movzx eax, al
bt edx, eax
jae 0x81ac37
jmp 0x81ad03
xor eax, eax
cmp ecx, 1
movzx edx, byte [0xbb9b93]
seta al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x81acd1
mov ecx, fcn.007a46e0
xor eax, eax
mov ebx, dword [0xbb9b88]
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta al
mov ecx, eax
not ecx
and ecx, 0x101
lea ecx, [eax + ecx*2 - 0x60e78192]
mov edx, ecx
xor ebx, ecx
shr edx, 0x1f
mov dword [0xbb9b88], ebx
not ebx
or edx, ecx
and cl, 7
imul edx, ebx
xor dword [0xbb9b8c], edx
mov dl, 1
shl dl, cl
or byte [0xbb9b93], dl
mov eax, fcn.007a46e0
xor ecx, ecx
mov ebx, ebp
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb9b93], al
mov ebp, dword [esp + 4]
mov dword [edi + 0x30], 0
mov dword [ebp + 0x38], 0
push 0xbb9b88
push 1
push esi
call fcn.007fdcc0
add esp, 0xc
lea eax, [esp + 0x38]
mov ecx, esi
mov edx, ebp
push eax
call fcn.007e17a0
add esp, 4
test eax, eax
mov dword [ebp + 0x38], edi
jne 0x81b213
mov ebp, dword [esp + 0x20]
mov edx, 0x25
mov ecx, ebp
push dword [esp + 0x18]
mov esi, dword [esp + 0x2c]
push esi
call fcn.007d10d0
add esp, 8
mov dword [esp + 0x10], eax
mov ecx, ebp
mov edx, pe_nt_image_headers32
push dword [esp + 0xc]
call fcn.007f9600
add esp, 4
test ebx, ebx
je 0x81ad8e
mov eax, dword [ebx]
mov ecx, ebp
mov edx, 0x59
inc eax
push dword [esp + 0x24]
push eax
push esi
call fcn.007d10f0
add esp, 0xc
jmp 0x81ada2
mov ecx, ebp
mov edx, 0x7e
push dword [esp + 0x24]
push esi
call fcn.007d10d0
add esp, 8
mov ecx, ebp
mov edx, 0x7a
push esi
call fcn.007f9600
add esp, 4
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.007fb640
mov edx, dword [esp + 0x2c]
mov ebx, eax
mov ecx, ebp
push eax
call fcn.0081c1d0
add esp, 4
mov ecx, esi
mov esi, dword [esp + 0x18]
mov edx, edi
push esi
push ebx
push dword [esp + 0x70]
push 0
push 0
push dword [esp + 0x20]
call fcn.00817600
add esp, 0x18
mov eax, dword [esp + 0x30]
test eax, eax
je 0x81ae05
mov ecx, ebp
mov edx, 0x3b
push esi
push eax
call fcn.007d10d0
add esp, 8
mov ecx, ebp
mov edx, ebx
call fcn.007fbd70
test byte [edi + 4], 8
je 0x81b083
mov edx, fcn.007f6da0
mov eax, fcn.007f6da0
movzx esi, byte [0xbb9bcf]
and edx, 1
xor edx, eax
xor eax, eax
cmp edx, 0xffffffff
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt esi, eax
mov esi, dword [esp + 8]
jb 0x81b06d
mov al, byte [0xbb9bcf]
xor ecx, ecx
cmp edx, 0xffffffff
mov ah, 1
sete cl
mov ebx, ecx
not ebx
lea ecx, [ebx + ecx*2]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb9bcf], ah
jne 0x81ae54
mov ecx, fcn.007f6da0
mov edx, fcn.007f6da0
movzx eax, al
and ecx, 1
xor ecx, edx
xor edx, edx
cmp ecx, 0xffffffff
sete dl
mov ebx, edx
not ebx
lea edx, [ebx + edx*2]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x81aecd
xor eax, eax
cmp ecx, 0xffffffff
movzx ebx, byte [0xbb9bcf]
sete al
mov edx, eax
not edx
lea eax, [edx + eax*2]
and al, 7
movzx eax, al
bt ebx, eax
jae 0x81aea8
jmp 0x81b06d
xor eax, eax
cmp ecx, 0xffffffff
movzx edx, byte [0xbb9bcf]
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt edx, eax
jb 0x81b03f
mov ecx, fcn.007f6da0
mov eax, fcn.007f6da0
and ecx, 1
xor ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
sete al
mov ecx, eax
xor ecx, 0x63c757bf
lea ecx, [ecx + eax*2 + 0x1080]
mov eax, dword [0xbb9ba0]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb9ba0], eax
not eax
imul edx, eax
mov eax, dword [0xbb9ba4]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb9ba4], eax
or ebx, edx
not eax
mov edx, dword [0xbb9ba8]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb9ba8], edx
or ebx, eax
not edx
mov eax, dword [0xbb9bac]
imul edx, ebx
lea ebx, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb9bac], eax
or ebx, edx
not eax
mov edx, dword [0xbb9bb0]
imul eax, ebx
mov ebx, eax
shl ebx, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb9bb0], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb9bb4]
mov ebx, edx
shl ebx, 5
xor eax, edx
shr edx, 0x1a
mov dword [0xbb9bb4], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb9bb8]
mov ebx, eax
shl ebx, 6
xor edx, eax
shr eax, 0x19
mov dword [0xbb9bb8], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb9bbc]
mov ebx, edx
shl ebx, 7
xor eax, edx
shr edx, 0x18
mov dword [0xbb9bbc], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb9bc0]
mov ebx, eax
shl ebx, 8
xor edx, eax
shr eax, 0x17
mov dword [0xbb9bc0], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb9bc4]
mov ebx, edx
shl ebx, 9
xor eax, edx
shr edx, 0x16
mov dword [0xbb9bc4], eax
or edx, ebx
not eax
imul eax, edx
mov dl, 1
xor dword [0xbb9bc8], eax
shl dl, cl
or byte [0xbb9bcf], dl
mov ecx, fcn.007f6da0
mov eax, fcn.007f6da0
and ecx, 1
xor ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
sete al
mov ecx, eax
not ecx
lea ecx, [ecx + eax*2]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb9bcf], al
push 0xbb9ba0
push esi
call fcn.0078de60
add esp, 8
mov ebx, dword [esp]
jmp 0x81b1fd
mov edx, fcn.007c9750
movzx ecx, byte [0xbb9be3]
mov eax, fcn.007c9750
mov esi, dword [esp + 8]
mov ebx, dword [esp]
and edx, 1
xor edx, eax
xor eax, eax
cmp edx, 0xffffffff
setne al
bt ecx, eax
jb 0x81b1ce
mov al, byte [0xbb9be3]
cmp edx, 0xffffffff
mov ah, 1
setne cl
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb9be3], ah
jne 0x81b0b6
mov ecx, fcn.007c9750
mov edx, fcn.007c9750
movzx eax, al
and ecx, 1
xor ecx, edx
cmp ecx, 0xffffffff
setne dl
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x81b10b
movzx edx, byte [0xbb9be3]
xor eax, eax
cmp ecx, 0xffffffff
setne al
bt edx, eax
jae 0x81b0f2
jmp 0x81b1ce
movzx edx, byte [0xbb9be3]
xor eax, eax
cmp ecx, 0xffffffff
setne al
bt edx, eax
jb 0x81b1ac
mov edx, fcn.007c9750
mov eax, fcn.007c9750
xor ecx, ecx
and edx, 1
xor edx, eax
mov eax, dword [0xbb9bd0]
cmp edx, 0xffffffff
sete cl
xor ecx, 0xec959569
add ecx, 0x400
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb9bd0], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb9bd4]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb9bd4], eax
or ebx, edx
not eax
mov edx, dword [0xbb9bd8]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb9bd8], edx
or ebx, eax
not edx
mov al, 1
imul edx, ebx
mov ebx, dword [esp]
shl al, cl
xor dword [0xbb9bdc], edx
or byte [0xbb9be3], al
mov ecx, fcn.007c9750
mov eax, fcn.007c9750
and ecx, 1
xor ecx, eax
mov al, 0xfe
cmp ecx, 0xffffffff
setne cl
xor cl, 7
rol al, cl
and byte [0xbb9be3], al
mov dword [edi + 0x34], 0
push 0xbb9bd0
push 1
push esi
call fcn.007fdcc0
add esp, 0xc
lea eax, [esp + 0x38]
mov ecx, esi
mov edx, edi
push eax
call fcn.007e17a0
add esp, 4
mov eax, dword [esp + 4]
mov dword [edi + 0x34], eax
mov edx, dword [esp + 0x10]
mov ecx, ebp
call fcn.007f7790
mov edx, dword [esp + 0x18]
mov ecx, ebp
call fcn.007fbd70
mov edx, dword [edi + 0x30]
mov ecx, dword [esi]
call fcn.007cb9f0
mov eax, dword [esp + 0x34]
mov dword [edi + 0x30], ebx
mov dword [edi + 0x3c], eax
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00989fe9
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret