Function at 0x1004e5bd
Capabilities:
Encode data using xor
Set file attributes

Disassembly:
push 0x2b8
mov eax, 0x101a417e
call fcn.1017516e
mov esi, ecx
and dword [ebp - 0x2a0], 0
push 0x7d
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1f60], eax
pop eax
push 0x33
pop edi
push 0x45
pop ecx
mov word [ebp - 0x284], ax
push 0x39
pop edx
push 0x3b
pop eax
push 0x43
mov word [ebp - 0x282], di
mov word [ebp - 0x280], cx
mov word [ebp - 0x27e], dx
mov word [ebp - 0x27c], ax
pop eax
mov word [ebp - 0x27a], ax
push 0x2f
mov word [ebp - 0x278], cx
mov word [ebp - 0x276], di
pop edi
mov word [ebp - 0x274], ax
push 0x3a
pop eax
push 0x34
mov word [ebp - 0x272], di
mov word [ebp - 0x270], ax
pop eax
push 0x48
pop ecx
push 0x36
mov word [ebp - 0x26e], dx
mov word [ebp - 0x26c], ax
pop edx
push 0x65
pop eax
push 0x66
mov word [ebp - 0x26a], cx
mov word [ebp - 0x268], di
mov word [ebp - 0x266], dx
mov word [ebp - 0x264], ax
pop eax
mov word [ebp - 0x262], ax
push 0x67
pop eax
mov word [ebp - 0x260], ax
push 0x3b
pop eax
push 0x39
mov word [ebp - 0x25e], di
mov word [ebp - 0x25c], ax
pop eax
push 0x34
mov word [ebp - 0x25a], dx
mov word [ebp - 0x258], ax
pop eax
mov ebx, dword [ebp + 8]
mov word [ebp - 0x256], ax
push 0x27
pop eax
push 0x32
mov word [ebp - 0x254], di
mov word [ebp - 0x252], ax
pop eax
push 0x3a
mov word [ebp - 0x250], ax
pop eax
push 0x7a
mov word [ebp - 0x24e], ax
pop eax
push 0x34
mov word [ebp - 0x24c], ax
pop eax
mov word [ebp - 0x24a], di
push 0x3a
mov word [ebp - 0x248], ax
pop edi
push 0x37
pop eax
mov word [ebp - 0x246], di
mov word [ebp - 0x244], cx
mov word [ebp - 0x242], ax
push 0x39
pop eax
mov word [ebp - 0x240], ax
push 0x3b
pop ecx
mov word [ebp - 0x23e], dx
push 0x33
mov word [ebp - 0x23c], cx
pop eax
mov word [ebp - 0x23a], di
mov word [ebp - 0x238], ax
push 0x38
pop eax
mov word [ebp - 0x236], ax
push 0x34
mov word [ebp - 0x234], cx
pop eax
mov word [ebp - 0x232], ax
push 0x7f
pop eax
mov word [ebp - 0x230], ax
xor eax, eax
mov word [ebp - 0x22e], ax
xor ecx, ecx
mov ax, word [ebp - 0x284]
mov ax, word [ebp + ecx*2 - 0x284]
movzx eax, ax
add eax, 0xfffffffe
mov word [ebp + ecx*2 - 0x284], ax
inc ecx
cmp ecx, 0x2b
jb 0x1004e77a
push ebx
call fcn.10016845
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.10007b06
add esp, 0x10
lea edi, [esi + 0x1f5c]
lea edx, [ebp - 0x218]
mov ecx, edi
call fcn.1004e19e
test eax, eax
js 0x1004eaca
lea edx, [ebp - 0x2ac]
mov dword [ebp - 0x2ac], esi
lea ecx, [ebp - 0x2c4]
call fcn.100514f9
and dword [ebp - 4], 0
and dword [ebp - 0x2a4], 0
mov byte [ebp - 4], 1
push ecx
push dword [edi]
lea ecx, [ebp - 0x2a4]
call fcn.100514a7
mov edi, eax
test edi, edi
js 0x1004ea9a
mov ecx, 0x4c56
mov dword [ebp - 0x22c], 0x4c3b
mov word [ebp - 0x228], cx
lea eax, [ecx + 8]
mov word [ebp - 0x226], ax
add eax, 0xffffffa3
mov word [ebp - 0x224], cx
mov word [ebp - 0x222], ax
lea eax, [ecx - 0x42]
mov word [ebp - 0x220], ax
mov word [ebp - 0x21e], ax
xor eax, eax
mov word [ebp - 0x21c], ax
xor edx, edx
mov ax, word [ebp - 0x228]
mov ax, word [ebp + edx*2 - 0x228]
movzx ecx, ax
movzx eax, word [ebp - 0x22c]
xor ecx, eax
mov word [ebp + edx*2 - 0x228], cx
inc edx
cmp edx, 6
jb 0x1004e865
xor eax, eax
lea ecx, [ebp - 0x29c]
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x228]
push eax
call fcn.1001eac7
mov byte [ebp - 4], 2
lea eax, [ebp - 0x29c]
cmp dword [ebp - 0x288], 8
push dword [ebp - 0x28c]
cmovae eax, dword [ebp - 0x29c]
push eax
push ebx
call fcn.100e8d07
add esp, 0xc
test eax, eax
jne 0x1004e914
lea ecx, [ebp - 0x2b0]
call fcn.10051546
mov byte [ebp - 4], 3
mov ecx, dword [eax]
and dword [eax], 0
mov edx, dword [esi + 0x1f58]
mov dword [esi + 0x1f58], ecx
test edx, edx
je 0x1004e8fa
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2b0]
test ecx, ecx
je 0x1004e991
mov eax, dword [ecx]
push 1
call dword [eax]
jmp 0x1004e991
mov byte [ebp - 4], 4
push 8
call fcn.100e04ba
pop ecx
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 4], 5
mov dword [eax], 0x10206714
mov byte [ebp - 4], 6
or dword [eax + 4], 0xffffffff
mov dword [eax], 0x102066b4
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x1f58]
mov dword [ebp - 0x2b4], eax
and dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2a0], 2
mov dword [esi + 0x1f58], eax
test ecx, ecx
je 0x1004e96f
mov eax, dword [ecx]
push 1
call dword [eax]
push 2
pop eax
mov dword [ebp - 0x2a0], eax
and eax, 0xfffffffd
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 4], 2
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x2a8]
mov dword [ebp - 0x2a8], esi
lea ecx, [ebp - 0x2bc]
call fcn.100515af
mov byte [ebp - 4], 7
cmp dword [ebp + 0xc], 0
mov eax, dword [esi + 0x1f58]
mov ecx, dword [eax]
je 0x1004ead2
push 1
push ebx
push eax
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
js 0x1004ea73
xor ebx, ebx
lea edi, [esi + 8]
push 0x20
mov dword [edi], 0x7473754d
lea ecx, [esi + 0x48]
mov dword [esi + 0x14], ebx
lea eax, [esi + 0x8a0]
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
pop edx
mov dword [eax - 8], ebx
mov dword [eax], ebx
lea eax, [eax + 0xc]
mov dword [eax - 0x10], ebx
mov dword [ecx], ebx
lea ecx, [ecx + 0x44]
sub edx, 1
jne 0x1004e9ef
push 0xa10
push edi
call fcn.100167df
mov dword [esi + 0xc], eax
lea eax, [esi + 0xa18]
push 0x210
push eax
mov dword [esi + 0xc24], 0x78747241
mov dword [esi + 0xc20], 1
mov dword [esi + 0xc18], ebx
mov dword [esi + 0xc1c], ebx
call fcn.100167df
mov ecx, esi
mov dword [esi + 0xc1c], eax
call fcn.1004f242
mov edi, eax
test edi, edi
js 0x1004ea73
mov ecx, esi
call fcn.1004f70f
mov edi, eax
test edi, edi
js 0x1004ea73
mov byte [ebp - 0x2bc], 1
mov edi, ebx
mov byte [ebp - 0x2c4], 1
mov byte [ebp - 4], 2
cmp byte [ebp - 0x2bc], 0
jne 0x1004ea8b
lea ecx, [ebp - 0x2b8]
call fcn.10051a41
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x29c]
call fcn.1001701c
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2a4]
test eax, eax
je 0x1004eab0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x2c4], 0
jne 0x1004eac8
lea ecx, [ebp - 0x2c0]
call fcn.10051aa1
mov eax, edi
call fcn.10175118
ret 0xc
push 0
push ebx
push eax
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
js 0x1004ea73
mov ecx, esi
call fcn.1004f3b4
mov edi, eax
xor ebx, ebx
test edi, edi
jns 0x1004eb12
cmp dword [esi + 0x1f60], ebx
jne 0x1004eb0a
mov ecx, esi
call fcn.1004fdb7
test eax, eax
js 0x1004eb0a
mov ecx, esi
call fcn.1004f3b4
mov edi, eax
test edi, edi
js 0x1004ea73
mov ecx, esi
call fcn.1004f0d0
jmp 0x1004ea5d