Function at 0x1003ecb0
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [0x100bf198]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jne 0x1003f0bb
mov eax, dword [0x100be5a4]
xor edx, edx
div dword [0x100be5a8]
xor eax, 0x3682a145
sub eax, 0x361dd1e5
or eax, 0x10a1e8f1
or eax, 0x8ee2b50f
mov ecx, 0xc2d18322
xor edx, edx
div ecx
or eax, 0x276c459b
or eax, 0x1a42915
mov ecx, 0x31c945de
xor edx, edx
div ecx
add eax, 0x81714580
and eax, 0xc5496ad
mov ecx, 0xf49d508f
xor edx, edx
div ecx
sub eax, 0x7888ef0d
add eax, 0x34e5c16d
or eax, 0x5886ca4c
xor eax, 0x85a1a0f
or eax, 0x462647b1
and eax, 0xc0dd327
mov ecx, 0xb2aee628
xor edx, edx
div ecx
sub eax, 0x8a517296
and eax, 0x7a908ac9
or eax, 0xbf2f8bfb
imul eax, eax, 0xde664ef7
xor eax, 0x8ca99f9f
and eax, 0x6ec0d94c
xor eax, 0xed427055
mov ecx, 0xb7f5b0de
xor edx, edx
div ecx
add eax, 0x46fffbc3
sub eax, 0x43b88891
mov ecx, 0x279b1bde
xor edx, edx
div ecx
add eax, 0xc69a21a4
add eax, 0x375afbfb
sub eax, 0x247f5137
add eax, 0xa896c84c
or eax, 0xfee4c400
sub eax, 0x5ef8b876
sub eax, 0x82ba3b73
and eax, 0x1eae1cd1
or eax, 0xcbd356d6
or eax, 0x59738e88
mov ecx, 0xba7712ec
xor edx, edx
div ecx
mov ecx, 0x33a71a7a
xor edx, edx
div ecx
xor eax, 0xa1f1a75d
or eax, 0x892cb236
mov ecx, 0x9666b5de
xor edx, edx
div ecx
xor eax, 0xdfe08f48
imul eax, eax, 0xd66d3280
sub eax, 0x88e84eb3
sub eax, 0x8342c12b
add eax, 0x63d5bd75
or eax, 0xa20e3859
add eax, 0x2cd6f5f8
and eax, 0xc9179647
and eax, 0x10e5c453
mov ecx, 0xa1257d68
xor edx, edx
div ecx
or eax, 0x6580c9ab
mov ecx, 0xa7328ccd
xor edx, edx
div ecx
add eax, 0x2ea86c43
add eax, 0xf7198c08
imul eax, eax, 0x80fe0d04
imul eax, eax, 0xcee79fbc
mov ecx, 0x3fb2b7e4
xor edx, edx
div ecx
mov ecx, 0x271c1f1f
xor edx, edx
div ecx
sub eax, 0xb4534bc4
sub eax, 0x204e9e22
mov ecx, 0x37ec1011
xor edx, edx
div ecx
imul eax, eax, 0xd213a16d
add eax, 0xa36f6afd
xor eax, 0x89fd301f
add eax, 0x947d38a5
xor eax, 0x584c97ed
and eax, 0x640e7fc
mov ecx, 0xd6870f7e
xor edx, edx
div ecx
cmp eax, 0x912da6bd
jae 0x1003f86c
mov eax, dword [0x100be5ac]
sub eax, dword [0x100be5b0]
xor eax, 0x485cae7e
or eax, 0x94749378
xor eax, 0xd8ff7e12
and eax, 0x93def3ed
mov ecx, 0xbac88899
xor edx, edx
div ecx
xor eax, 0x42a40cd3
xor eax, 0xc72e2639
imul eax, eax, 0x5544d612
add eax, 0x8af2f372
xor eax, 0x62e5c46c
or eax, 0x3a42b614
xor eax, 0xc49b2909
add eax, 0x9211ed1b
and eax, 0x77dfba10
imul eax, eax, 0xab7f50df
sub eax, 0xe2c1ad
add eax, 0xcf9c7571
or eax, 0x6324d922
or eax, 0xf7018705
or eax, 0x338350ca
xor eax, 0xac5cb691
or eax, 0xfbdeb99d
add eax, 0x5170d0e6
add eax, 0x4df48e17
and eax, 0xd64529a4
and eax, 0xba18123f
xor eax, 0xd335f47f
add eax, 0x397867c6
mov ecx, 0xf5ebbe10
xor edx, edx
div ecx
sub eax, 0xe9205738
xor eax, 0x4342dc45
add eax, 0x23afc6c0
xor eax, 0x66dd06f5
and eax, 0x10f2fc03
sub eax, 0xaeca12de
and eax, 0x45f7aa7d
imul eax, eax, 0x9c57ecb1
sub eax, 0x6e3c40b5
or eax, 0xd3c2c34e
imul eax, eax, 0x69539ba6
xor eax, 0xc8fe3c13
add eax, 0x99cde804
mov ecx, 0xd22a17de
xor edx, edx
div ecx
sub eax, 0xecec13dc
mov ecx, 0x446cb9e3
xor edx, edx
div ecx
add eax, 0xdb21ffc5
imul eax, eax, 0xf4ef8787
sub eax, 0x86c7f138
sub eax, 0x7922b765
sub eax, 0xf1513ff6
add eax, 0x5c214ff7
xor eax, 0x1dcc2026
and eax, 0xf8940a2a
or eax, 0xb9bd3943
sub eax, 0x89a963f2
and eax, 0xc064560
and eax, 0xcb0f4136
or eax, 0xc0762cf5
add eax, 0x4e4e53a4
add eax, 0x2dc14832
sub eax, 0x18987a45
and eax, 0x62870131
add eax, 0xcad17c66
or eax, 0x48a28007
or eax, 0xa122216a
sub eax, 0x4ab7b6cf
add eax, 0xa4169c9f
or eax, 0xdd2dcfb4
mov ecx, 0xfd72d169
xor edx, edx
div ecx
mov ecx, 0x95b5ddaa
xor edx, edx
div ecx
sub eax, 0xa509c102
and eax, 0x69385451
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x20c]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x20c]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
sub esp, 4
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x108]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.10087c90
lea ecx, [ebp - 0x108]
lea eax, [0x100b248a]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10087ca0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10087ca0
mov eax, dword [ebp - 0x218]
cmp eax, 0x3b4ac5f2
je 0x1003f86c
jmp 0x1003f0d0
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x108]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.10087c90
mov eax, dword [0x100be5b4]
xor edx, edx
div dword [0x100be5b8]
and eax, 0xf2675cf6
and eax, 0xc1af0b60
mov ecx, 0xf0dd692a
xor edx, edx
div ecx
add eax, 0x8eb354e5
or eax, 0x52687307
xor eax, 0xcd0630b2
xor eax, 0xa067b6b1
xor eax, 0x536693f2
mov ecx, 0x48d8b9ff
xor edx, edx
div ecx
and eax, 0x34f1d65a
imul eax, eax, 0xf998ad5b
add eax, 0x758a4834
mov ecx, 0xe43f3bef
xor edx, edx
div ecx
imul eax, eax, 0x1b9858f1
add eax, 0xb438dd56
and eax, 0x41cfbea7
sub eax, 0x4f1ae66f
or eax, 0x75996795
xor eax, 0xaa59b21e
mov ecx, 0x2bd15db9
xor edx, edx
div ecx
xor eax, 0x92784eac
and eax, 0x5b92a9be
xor eax, 0xafa74ab5
add eax, 0x8fe8682f
and eax, 0x754891c
mov ecx, 0x9cecad16
xor edx, edx
div ecx
xor eax, 0xd0386a70
or eax, 0x9c2fa989
and eax, 0xc039a3bc
or eax, 0x367ec1f9
add eax, 0xdb81176c
imul eax, eax, 0x1acbf18c
sub eax, 0xcb3528cb
imul eax, eax, 0x660d623a
xor eax, 0x1e190c76
mov ecx, 0x93a1025d
xor edx, edx
div ecx
sub eax, 0x4a4d0067
and eax, 0x86bd7895
or eax, 0x204d4184
xor eax, 0x540b27a3
mov ecx, 0xb31e38d8
xor edx, edx
div ecx
imul eax, eax, 0x53daa0aa
imul eax, eax, 0x1363a510
and eax, 0xb543443
mov ecx, 0x3aae2be4
xor edx, edx
div ecx
imul eax, eax, 0x3d500d8c
or eax, 0x8667de6d
or eax, 0xf6fb0901
add eax, 0x7426dd9e
xor eax, 0x85c1a4a5
sub eax, 0x1b7f3d32
and eax, 0x5b17d64b
mov ecx, 0xb475cd14
xor edx, edx
div ecx
mov ecx, 0xde9af47f
xor edx, edx
div ecx
imul eax, eax, 0x21f337e1
or eax, 0x4c6ab174
mov ecx, 0x48165a3b
xor edx, edx
div ecx
or eax, 0xe0e1fcd5
imul eax, eax, 0x536e9d62
imul eax, eax, 0xef5d4f94
or eax, 0xae31bd80
or eax, 0xa40e050
imul eax, eax, 0xb799b30d
sub eax, 0xd531c92b
add eax, 0xf0cf8c5c
mov ecx, 0x3fb997ca
xor edx, edx
div ecx
imul eax, eax, 0x8dfc47f1
add eax, 0xd636a13f
add eax, 0x67537fb
mov ecx, 0x936e2bd3
xor edx, edx
div ecx
sub eax, 0x276f2475
xor eax, 0xeeb02886
cmp eax, 0xd2a5dd26
jae 0x1003f8ec
mov eax, dword [0x100be5bc]
sub eax, dword [0x100be5c0]
mov ecx, 0x30d7356d
xor edx, edx
div ecx
xor eax, 0x3cb54409
or eax, 0xe2680900
and eax, 0x861a0595
mov ecx, 0xbdc0b7e4
xor edx, edx
div ecx
mov ecx, 0x3f3d2c57
xor edx, edx
div ecx
and eax, 0xbe8901ca
or eax, 0x27b70dfa
sub eax, 0xaa8ae143
imul eax, eax, 0xc6841815
or eax, 0x4e1abe5d
imul eax, eax, 0x8d740f96
xor eax, 0x9e2cf1e
add eax, 0x75e23ff7
or eax, 0x29d5cf9c
mov ecx, 0xec99dae2
xor edx, edx
div ecx
add eax, 0xfdd29771
xor eax, 0x464ef173
mov ecx, 0x22c7dbc5
xor edx, edx
div ecx
sub eax, 0x55674ead
sub eax, 0x2d4f362a
imul eax, eax, 0x1b6ce812
or eax, 0x7a5eb129
and eax, 0x4e7dd20e
imul eax, eax, 0xcef07f41
imul eax, eax, 0x3912d233
add eax, 0xd39b4b55
xor eax, 0xcb2c7fe8
mov ecx, 0x39c3ad4f
xor edx, edx
div ecx
imul eax, eax, 0xf0a67a0e
and eax, 0xfa08b914
or eax, 0xd7638756
mov ecx, 0x32b4f6e9
xor edx, edx
div ecx
xor eax, 0x7496ce19
add eax, 0x2c070cdc
mov ecx, 0x9f7ec7e7
xor edx, edx
div ecx
mov ecx, 0x960a0679
xor edx, edx
div ecx
mov ecx, 0x8212dc30
xor edx, edx
div ecx
sub eax, 0x8e8afe4e
and eax, 0x909a6422
mov ecx, 0x45d3699
xor edx, edx
div ecx
and eax, 0xb1e3b6d2
or eax, 0xb6c671cd
xor eax, 0x9504cc20
and eax, 0xb5a6a8b0
mov ecx, 0x6881851e
xor edx, edx
div ecx
sub eax, 0xd1b6ed70
or eax, 0x310d991e
add eax, 0x77102e3d
mov ecx, 0xc01abf0b
xor edx, edx
div ecx
and eax, 0x650a57cb
sub eax, 0xc70eef4f
and eax, 0x799832f9
imul eax, eax, 0x22c26de8
sub eax, 0xdd7fdbc2
or eax, 0x4417e608
mov ecx, 0x5a7d1d0a
xor edx, edx
div ecx
and eax, 0x8e2849ca
add eax, 0x6f80f705
sub eax, 0x2877c0fc
sub eax, 0xb58d2904
or eax, 0xe2fd155a
or eax, 0xe604ff7b
sub eax, 0x752eb131
or eax, 0xeef1f923
mov ecx, 0x1467f48e
xor edx, edx
div ecx
mov ecx, 0xc4c06df4
xor edx, edx
div ecx
sub eax, 0x3d5cab83
add eax, 0x8dee8cf3
mov ecx, 0x9df37699
xor edx, edx
div ecx
or eax, 0xcb091dd7
add eax, 0xcaf1e5a5
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x108]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x214], eax
mov dword [esp], 0x14
mov dword [esp + 4], 0x1a
call fcn.1000ccc0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x21c], ecx
cmp eax, 0x334f70c5
jb 0x1003f290
mov eax, dword [ebp - 0x21c]
sub eax, 0xffffffff
je 0x1003f4c5
jmp 0x1003f4b1
mov eax, dword [ebp - 0x21c]
sub eax, 0x10
je 0x1003f4d4
jmp 0x1003f83e
mov dword [ebp - 0x210], 2
jmp 0x1003f848
mov eax, dword [0x100be5c4]
or eax, dword [0x100be5c8]
and eax, 0x68086760
and eax, 0x9cc24517
sub eax, 0x9d242ffa
add eax, 0x1e6d46ca
mov ecx, 0xd1a8b6b0
xor edx, edx
div ecx
and eax, 0xcb6e9c71
imul eax, eax, 0x73041728
or eax, 0xc5c0a4c7
imul eax, eax, 0xa45fc47a
sub eax, 0xaa8bde75
imul eax, eax, 0xd767360b
xor eax, 0x393fafd
imul eax, eax, 0xcc576b21
xor eax, 0x74fb3d63
add eax, 0x4a7f943a
sub eax, 0xedae6537
or eax, 0x31f0d29d
and eax, 0xfbb488a7
and eax, 0x4c6ff9e2
imul eax, eax, 0x89a2c079
xor eax, 0xf4202c7f
sub eax, 0xbea2e8c1
and eax, 0xf33dca97
sub eax, 0xcd568287
sub eax, 0x378c9d7c
imul eax, eax, 0x7c93519b
sub eax, 0x65e5e4fc
xor eax, 0x57a39f0b
add eax, 0x43d9b675
imul eax, eax, 0xbd268b00
sub eax, 0x821dbf25
add eax, 0x3e0cefdb
mov ecx, 0x5a434d44
xor edx, edx
div ecx
xor eax, 0x91f4462
and eax, 0xed207a0d
sub eax, 0x91692335
sub eax, 0x3aa72acf
or eax, 0x908e4737
mov ecx, 0x37fc244e
xor edx, edx
div ecx
add eax, 0xc838b019
mov ecx, 0x887e3756
xor edx, edx
div ecx
xor eax, 0x4c8396bf
mov ecx, 0x5c82b07d
xor edx, edx
div ecx
xor eax, 0x1d390787
add eax, 0x5e6277c7
add eax, 0xefae3de0
mov ecx, 0x49ab086c
xor edx, edx
div ecx
mov ecx, 0x77f3c305
xor edx, edx
div ecx
or eax, 0xb1c6fddc
add eax, 0xd008de98
xor eax, 0xdb87e3d6
add eax, 0x594db4c1
add eax, 0x33001cd1
add eax, 0x1f0ea225
and eax, 0xd0797209
imul eax, eax, 0x5ca874c2
imul eax, eax, 0x74bbda4f
sub eax, 0xf311608c
and eax, 0xfd7b017b
xor eax, 0x48c9c6b
add eax, 0x3cf22a98
mov ecx, 0xbe1dbee4
xor edx, edx
div ecx
mov ecx, 0x4a82c270
xor edx, edx
div ecx
add eax, 0xd32654e6
imul eax, eax, 0x6cee0e14
mov ecx, 0x2a285a34
xor edx, edx
div ecx
add eax, 0xbd467885
mov ecx, 0x5b0a0685
xor edx, edx
div ecx
imul eax, eax, 0x4d6fee96
sub eax, 0xb3f5c726
and eax, 0x13d08758
add eax, 0xa8d22a1b
cmp eax, 0x56512640
je 0x1003f91d
mov eax, dword [0x100be5cc]
xor eax, dword [0x100be5d0]
xor eax, 0x962d46d2
xor eax, 0xd75af2bb
xor eax, 0x86885c52
imul eax, eax, 0x3ba81dab
sub eax, 0x897075f5
imul eax, eax, 0x28e107b3
xor eax, 0xcc6fce0a
and eax, 0xb29b25ac
imul eax, eax, 0xfc54def9
or eax, 0x1e69d9bd
sub eax, 0xfe1528dc
mov ecx, 0x6e6c53af
xor edx, edx
div ecx
add eax, 0x352c85f4
xor eax, 0xb47a5d36
xor eax, 0xe3dc81fc
xor eax, 0x120a7381
or eax, 0x72d0fa1f
mov ecx, 0x4ab32813
xor edx, edx
div ecx
and eax, 0xb1b32b9a
sub eax, 0x47d26cba
add eax, 0xe7e5cbfe
imul eax, eax, 0xe76daaf3
sub eax, 0x9decb2fa
or eax, 0x48eff8f1
and eax, 0x46d35f23
add eax, 0x981630bc
or eax, 0xf3c8421b
add eax, 0x1aaca6a4
xor eax, 0xa757bb86
imul eax, eax, 0xfd487b23
xor eax, 0xbf8106d9
sub eax, 0xe66e1efd
imul eax, eax, 0xa0defa68
xor eax, 0x67be1e2e
and eax, 0x4e83e6ab
sub eax, 0x114bd846
and eax, 0xad65a6be
mov ecx, 0xbeeca35e
xor edx, edx
div ecx
imul eax, eax, 0xf65438c6
add eax, 0x4bbdb3dc
and eax, 0x958c5f8
or eax, 0xfef4225b
add eax, 0x8ece6ee5
sub eax, 0x6ddef3b3
and eax, 0x8fda58d9
or eax, 0xdca984aa
or eax, 0x2d71105a
xor eax, 0xecfd3410
and eax, 0x63870dd1
sub eax, 0x19d7a912
mov ecx, 0x10ee3a79
xor edx, edx
div ecx
or eax, 0x96fe6175
imul eax, eax, 0xedfeaec
imul eax, eax, 0xf7cb9bae
and eax, 0xf460e50e
add eax, 0x55b026cb
mov ecx, 0xcdf235cc
xor edx, edx
div ecx
mov ecx, 0x86777300
xor edx, edx
div ecx
xor eax, 0x6a6b9f95
mov ecx, 0xd0b94959
xor edx, edx
div ecx
and eax, 0x3b575293
add eax, 0x8ec8cd5c
xor eax, 0xdc24ad2c
xor eax, 0x200edf1d
sub eax, 0x51805c3c
or eax, 0xc1eb444c
imul eax, eax, 0x70506b8f
imul eax, eax, 0xbfbe11a6
or eax, 0xa6699fc5
imul eax, eax, 0x313c6f17
sub eax, 0xa1e37d1c
xor eax, 0x4b524082
mov dword [ebp - 0x210], 1
cmp eax, 0x59608798
ja 0x1003f689
jmp 0x1003f848
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066f8f
mov eax, dword [ebp - 0x224]
add esp, 0x230
pop ebp
ret
lea eax, [ebp - 0x20c]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x20c]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
sub esp, 4
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x108]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.10087c90
lea ecx, [ebp - 0x108]
lea eax, [0x100b248a]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10087ca0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10087ca0
jmp 0x1003ee94
lea eax, [ebp - 0x108]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x214], eax
mov dword [esp], 0x14
mov dword [esp + 4], 0x1a
call fcn.1000ccc0
jmp 0x1003f290
mov dword [ebp - 0x210], 1
jmp 0x1003f689