Function at 0x100028d0
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
push ebx
push esi
push edi
mov eax, dword [0x100020bc]
imul eax, eax, 0x5465
mov dword [0x100020bc], eax
add dword [0x100020bc], 0x4565
mov ecx, dword [0x100020bc]
mov eax, 0x42f63401
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0xe
mov dword [0x100020bc], ecx
add dword [0x100020bc], 0xffff9a89
mov ecx, dword [0x100020bc]
mov eax, 0x9e5a7239
mul ecx
shr edx, 0xe
mov dword [0x100020bc], edx
mov edx, dword [0x100020bc]
imul edx, edx, 0x4364
mov ebx, dword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov esi, dword [sym.imp.ntoskrnl.exe_RtlCharToInteger]
mov dword [0x100020bc], edx
mov dword [esp + 0xc], 0xd236
jmp 0x10002960
lea eax, [esp + 0x50]
push eax
push 0xa
push 0x1000304c
call esi
push 0
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x68]
push eax
call ebx
push 0x76
call dword [sym.imp.ntoskrnl.exe_RtlUpperChar]
push 0x65767
push 0x10003054
mov ecx, 0x7f
lea edi, [esp + 0x188]
call fcn.100016f0
lea ecx, [esp + 0x208]
push ecx
call dword [sym.imp.ntoskrnl.exe__wcsupr]
add esp, 0xc
sub dword [esp + 0xc], 1
jne 0x10002960
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x34], 0x10002700
mov ecx, dword [0x100020ac]
mov eax, 0xaf286bcb
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 6
mov dword [0x100020ac], ecx
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x3c]
add dword [0x100020b0], 0x4365c
add dword [0x100020b4], 0xfffab9a4
mov edx, dword [0x100020a0]
imul edx, edx, 0x34e
add ecx, eax
mov dword [0x100020a0], edx
mov esi, dword [ecx + 0x88]
add esi, dword [ebx + 0xc]
add dword [0x100020a4], 0xfffabab5
mov dword [esp + 0x20], ecx
mov ecx, dword [0x100020ac]
imul ecx, ecx, 0x54b
add ecx, 0x545b
mov eax, 0x3c91beb3
mul ecx
mov eax, edx
shr eax, 8
add eax, 0x56475b
xor edx, edx
mov ecx, 0x5c
div ecx
cmp edx, 0x8e
jne 0x10002a93
push 0x325
push 0x45356466
push 0x1004
push 0xe566565b
push 0x2202
push 0xf545458
push 0x5465467
push 0x6546548
push 0xe4345
push 0xe43f8
call dword [sym.imp.ntoskrnl.exe_ZwFsControlFile]
mov edx, dword [ebx + 0xc]
xor edi, edi
mov dword [esp + 0x24], edx
push 0x11c
lea edx, [esp + 0x64]
mov eax, 0x10
mov ecx, 0x12
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x54], 0x10003058
mov word [esp + 0x50], ax
mov word [esp + 0x52], cx
call fcn.10001690
push 1
lea ecx, [esp + 0x4c]
xor eax, eax
push ecx
lea edx, [esp + 0x38]
push edx
mov word [esp + 0x3c], ax
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
call dword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov eax, 0xc
mov ecx, eax
push 0x1000307c
push 0x10003090
mov dword [esp + 0x44], 0x10003108
mov dword [esp + 0x4c], 0x1000306c
mov word [esp + 0x48], ax
mov word [esp + 0x4a], cx
call dword [sym.imp.ntoskrnl.exe_wcsspn]
add esp, 8
cmp eax, 9
jne 0x10002b3e
mov edx, 0x15
mov word [esp + 0x38], dx
jmp 0x10002b58
push 0x7655659
push 0x8658
call dword [sym.imp.ntoskrnl.exe_ZwSetEvent]
mov eax, 0xc
mov word [esp + 0x38], ax
mov edx, dword [esp + 0x34]
mov ecx, 0x15
mov word [esp + 0x3a], cx
cmp byte [edx], 0x44
je 0x10002b72
add byte [0x100030e4], 2
push 0xea
push 0x100030b8
call dword [sym.imp.ntoskrnl.exe_strrchr]
add esp, 8
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
mov eax, 0x100030e4
call fcn.10002630
mov eax, 0x10003108
call fcn.100026a0
push 1
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x10002c18
movzx eax, byte [0x10003112]
sub eax, 0xf
mov byte [0x10003112], al
movzx ecx, byte [0x1000310f]
add ecx, 0xb
mov byte [0x1000310f], cl
movzx edx, byte [0x10003119]
add edx, 0xc
mov byte [0x10003119], dl
movzx eax, byte [0x1000310a]
sub eax, 8
mov byte [0x1000310a], al
movzx ecx, byte [0x1000311b]
sub ecx, 9
mov byte [0x1000311b], cl
movzx edx, byte [0x10003109]
add edx, 0xe
mov byte [0x10003109], dl
push 0x100030e4
push ebx
call fcn.10001230
push 0
push 0x10003108
push eax
push ebx
push 0x6576e
mov dword [esp + 0x24], eax
call fcn.10002230
mov ebx, eax
test ebx, ebx
je 0x10002c66
push 1
push 2
push 0
push 0
mov dword [esp + 0x80], 0xfffb
call dword [sym.imp.ntoskrnl.exe_VerSetConditionMask]
push edx
push eax
push 2
lea eax, [esp + 0x6c]
push eax
call ebx
mov edi, eax
movzx ecx, word [esi + 0xe]
movzx edx, word [esi + 0xc]
lea eax, [ecx + edx]
mov dword [esp + 0x2c], eax
test eax, eax
jbe 0x10002d2c
lea eax, [esi + 0x14]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
and edx, 0x7fffffff
movzx ecx, word [edx + esi + 0xe]
lea eax, [edx + esi]
lea ebx, [eax + 0x10]
movzx eax, word [eax + 0xc]
xor edx, edx
add ecx, eax
je 0x10002d0c
mov eax, dword [ebx]
test eax, eax
jns 0x10002cc9
and eax, 0x7fffffff
add eax, esi
cmp byte [eax], 0xf
jbe 0x10002cc9
cmp byte [eax + 2], 0x56
jne 0x10002cc9
cmp byte [eax + 4], 0x41
jne 0x10002cc9
cmp byte [eax + 6], 0x4c
je 0x10002cd3
inc edx
add ebx, 8
cmp edx, ecx
jb 0x10002ca5
jmp 0x10002d0c
add edi, edi
call fcn.10002610
mov ecx, dword [ebx + 4]
and ecx, 0x7fffffff
mov eax, dword [ecx + esi + 0x14]
mov ecx, dword [eax + esi]
mov edx, dword [eax + esi + 4]
add eax, esi
movzx eax, word [esi + 0xe]
add ecx, edi
mov dword [esp + 0xc], ecx
movzx ecx, word [esi + 0xc]
add eax, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add dword [esp + 0x28], 8
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x2c]
jb 0x10002c84
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x10002d3a
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov edx, esi
imul ecx, ecx, 0xc120
shl edx, 4
sub edx, esi
lea eax, [edx*4 + 0x3adc]
imul eax, dword [esp + 0x18]
lea eax, [eax + ecx + 0x21318]
xor edx, edx
mov ecx, 0x8b
div ecx
cmp edx, 0x13f
jb 0x10002d8b
push 0x300
push 0x54765102
push 0x6576579
push 0x657656c
call dword [sym.imp.ntoskrnl.exe_IoBuildPartialMdl]
movsx edx, word [edi + 2]
mov eax, dword [edi + 0x10]
sub eax, 0x26
imul edx, eax
lea ecx, [esi + esi*2]
lea eax, [edx + ecx*8]
xor edx, edx
mov ecx, 0x56
div ecx
cmp edx, 0x109
jb 0x10002dec
push 0x767567b
call dword [sym.imp.ntoskrnl.exe_RtlRealPredecessor]
test eax, eax
je 0x10002dda
push 5
push 0x100
push 0x76586785
push 0x76586587
push 0x546456a
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
push 0x76586566
push 0x77657655
call dword [sym.imp.ntoskrnl.exe_RtlLookupElementGenericTable]
jmp 0x10002e07
mov edx, dword [esp + 0x10]
push 0
push 0x100030c4
push edx
push edi
push 0x6565a
call fcn.10002230
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov edi, dword [eax - 4]
test edi, edi
jbe 0x10002d2c
mov ebx, dword [esp + 0x1c]
push edi
push 0
call ebx
mov esi, eax
test esi, esi
je 0x10002d2c
push edi
push esi
call fcn.10001690
mov ecx, dword [esp + 0x14]
add ecx, 0x14800
push ecx
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x10002ead
push 0x5200
push section.PAGE
push ebx
call fcn.10001620
xor eax, eax
jmp 0x10002e60
xor byte [eax + ebx], 0x30
inc eax
cmp eax, 0x5200
jb 0x10002e60
mov edx, ebx
shr edx, 4
imul edx, edx, 0x51
mov eax, 0x4ad41b
sub eax, edx
xor edx, edx
mov ecx, 0x64
div ecx
cmp edx, 0x10f
jae 0x10002ead
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
push edx
lea edx, [eax + ecx + 0x7fffff4e]
push edx
lea eax, [ebx + 0x5200]
push eax
call fcn.10001620
mov eax, dword [esp + 0x14]
push esi
add eax, 0x5200
push ebx
call fcn.100011b0
mov ecx, dword [0x10002098]
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 8]
push 0
push ecx
push edx
push eax
push 0x7687
call fcn.10002230
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x3c]
add dword [0x100020a8], 0xfffffcc6
mov ecx, dword [0x100020ac]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, 0x14312dc7
mul ecx
mov eax, dword [ebp + 8]
shr edx, 0xb
mov dword [0x100020ac], edx
mov ecx, dword [0x100020b0]
mov edx, dword [eax + 0xc]
imul ecx, ecx, 0x6546d
mov dword [0x100020b0], ecx
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x10]
add dword [0x100020b4], 0x2129
mov dword [eax + 0xc], esi
mov ecx, dword [0x100020b8]
imul ecx, ecx, 0xe13a
mov dword [0x100020b8], ecx
mov dword [eax + 0x10], edi
add dword [0x100020a4], 0xffffbaa4
mov dword [esp + 0x1c], edx
call fcn.100015d0
test eax, eax
je 0x10002d2c
mov edi, esi
call fcn.10001320
test eax, eax
je 0x10002d2c
mov edx, dword [esp + 0x24]
mov edi, dword [edx + 0x28]
push 0
push ebx
add edi, esi
call dword [esp + 0x28]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
push esi
call edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
pop edi
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8