Function at 0x80ef30
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0xbcbae0]
mov esi, ecx
xor eax, esp
mov dword [esp + 0x50], eax
cmp dword [edx + 0x44], 0
je 0x80f1ca
mov eax, fcn.007a2690
mov edx, 3
movzx ecx, byte [0xbb2227]
sub edx, eax
mov eax, edx
xor eax, fcn.007a2690
setne al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x80f1b7
mov al, byte [0xbb2227]
mov ecx, edx
mov ah, 1
xor ecx, fcn.007a2690
setne cl
or cl, 4
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb2227], ah
jne 0x80ef7e
mov edx, fcn.007a2690
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, fcn.007a2690
setne dl
or dl, 4
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x80efe7
mov eax, ecx
movzx edx, byte [0xbb2227]
xor eax, fcn.007a2690
setne al
or al, 4
movzx eax, al
bt edx, eax
jae 0x80efc7
jmp 0x80f1b7
xor ecx, fcn.007a2690
movzx ecx, byte [0xbb2227]
setne al
or al, 4
movzx eax, al
bt ecx, eax
jb 0x80f192
mov eax, fcn.007a2690
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbb21f0]
xor edx, fcn.007a2690
sete cl
xor ecx, 0xb3d1b0a9
add ecx, 0xa2c
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb21f0], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb21f4]
lea edi, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb21f4], eax
or edx, edi
not eax
imul eax, edx
mov edx, dword [0xbb21f8]
lea edi, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb21f8], edx
or eax, edi
not edx
mov ebx, dword [0xbb21fc]
imul edx, eax
lea edi, [edx*8]
xor ebx, edx
shr edx, 0x1c
mov dword [0xbb21fc], ebx
or edx, edi
not ebx
imul ebx, edx
mov edx, dword [0xbb2200]
mov edi, ebx
shl edi, 4
xor edx, ebx
shr ebx, 0x1b
mov dword [0xbb2200], edx
or ebx, edi
not edx
mov ebp, dword [0xbb2204]
imul edx, ebx
mov edi, edx
shl edi, 5
xor ebp, edx
shr edx, 0x1a
mov dword [0xbb2204], ebp
or edx, edi
not ebp
imul ebp, edx
mov edx, dword [0xbb2208]
mov edi, ebp
shl edi, 6
xor edx, ebp
shr ebp, 0x19
mov dword [0xbb2208], edx
or ebp, edi
not edx
mov ebx, dword [0xbb220c]
imul edx, ebp
mov edi, edx
shl edi, 7
xor ebx, edx
shr edx, 0x18
mov dword [0xbb220c], ebx
or edx, edi
not ebx
imul ebx, edx
mov edx, dword [str._aBFo]
mov edi, ebx
shl edi, 8
xor edx, ebx
shr ebx, 0x17
mov dword [str._aBFo], edx
or ebx, edi
not edx
mov ebp, dword [0xbb2214]
imul edx, ebx
mov edi, edx
shl edi, 9
xor ebp, edx
shr edx, 0x16
mov dword [0xbb2214], ebp
or edx, edi
not ebp
imul ebp, edx
mov edx, dword [0xbb2218]
mov edi, ebp
shl edi, 0xa
xor edx, ebp
shr ebp, 0x15
mov dword [0xbb2218], edx
or ebp, edi
not edx
mov ebx, dword [0xbb221c]
imul edx, ebp
mov edi, edx
shl edi, 0xb
xor ebx, edx
shr edx, 0x14
mov dword [0xbb221c], ebx
or edx, edi
not ebx
imul ebx, edx
mov dl, 1
xor dword [0xbb2220], ebx
shl dl, cl
or byte [0xbb2227], dl
mov eax, fcn.007a2690
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, fcn.007a2690
setne cl
or cl, 4
xor cl, 7
rol al, cl
and byte [0xbb2227], al
push 0xbb21f0
push esi
call fcn.00782570
add esp, 8
jmp 0x80f9f7
mov eax, dword [edx + 0x1c]
mov ebp, dword [edx + 0x20]
mov ebx, dword [edx + 0x34]
mov edi, edx
mov ecx, esi
mov edx, 0x21
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x20], eax
push 0
push 0
push 0
call fcn.007f4a50
add esp, 0xc
test eax, eax
jne 0x80f9f7
mov ecx, esi
mov dword [esp + 4], ebx
call fcn.007efdc0
mov word [edi + 2], 0x140
mov ecx, esi
mov edx, edi
mov dword [esp + 0x18], eax
push eax
call fcn.00809ac0
add esp, 4
mov eax, dword [edi + 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x34], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0xc]
mov dword [edi + 0x3c], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov ebx, dword [edi + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
test eax, eax
jle 0x80f27c
xor ecx, ecx
lea edx, [ecx + ecx*8]
test byte [ebp + edx*8 + 0x30], 0x20
je 0x80f277
mov eax, dword [ebp + edx*8 + 0x34]
mov dword [esp + 0xc], eax
jmp 0x80f27c
inc ecx
cmp ecx, eax
jl 0x80f263
mov edi, dword [esi + 0x28]
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
lea ecx, [edi + 1]
mov dword [esi + 0x28], ecx
cmp byte [eax], 0x84
jne 0x80f2a8
xor eax, eax
test ebx, ebx
mov dword [esp + 0x14], ecx
lea ecx, [edi + 2]
setne al
mov dword [esi + 0x28], ecx
lea edx, [eax + eax + 6]
jmp 0x80f2bb
xor eax, eax
test ebx, ebx
mov dword [esp + 0x14], 0
setne al
lea edx, [eax + eax + 5]
lea ecx, [esp + 0x38]
push edi
call fcn.007f24c0
add esp, 4
mov eax, dword [esi + 0x2c]
mov ebx, esi
mov ebp, dword [esp + 0x10]
mov edx, 0x72
inc eax
mov dword [esi + 0x2c], eax
mov esi, dword [esp + 0x20]
mov ecx, esi
push ebp
mov dword [esp + 0x28], eax
push eax
push dword [esp + 0x14]
call fcn.007c5800
add esp, 0xc
cmp dword [esp], 0
mov dword [esp + 8], ebx
je 0x80f32e
mov edx, dword [esp + 0x1c]
mov ecx, ebx
call fcn.008108c0
mov ebp, dword [esp]
mov ecx, esi
mov edx, 0x64
mov ebx, dword [ebp]
add ebx, 2
push 0xfffffffffffffff7
push eax
push 0
push ebx
push edi
call fcn.007ebd50
add esp, 0x14
mov dword [esp + 0x4c], ebp
mov ebx, ebp
jmp 0x80f342
mov ecx, esi
mov edx, 0x64
push ebp
push edi
call fcn.007c57e0
add esp, 8
mov ebx, dword [esp]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], edi
mov ebp, dword [esp + 4]
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x80f371
mov ecx, dword [esp + 0x20]
mov edx, 0x64
push 0
push eax
call fcn.007c57e0
add esp, 8
mov dword [edi + 0x14], eax
or byte [edi + 4], 0x20
mov edx, fcn.00798df0
xor eax, eax
movzx esi, byte [0xbb2233]
imul edx, edx
and edx, 3
cmp edx, 1
seta al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt esi, eax
mov esi, dword [esp + 8]
jb 0x80f4d3
mov al, byte [0xbb2233]
mov ebp, ebx
xor ecx, ecx
cmp edx, 1
mov ah, 1
seta cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb2233], ah
jne 0x80f3ad
mov ecx, fcn.00798df0
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 6]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x80f42e
mov ebx, ebp
mov ebp, dword [esp + 4]
xor eax, eax
cmp ecx, 1
seta al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 6]
movzx edx, byte [0xbb2233]
and al, 7
movzx eax, al
bt edx, eax
jae 0x80f407
jmp 0x80f4d3
xor eax, eax
cmp ecx, 1
movzx edx, byte [0xbb2233]
seta al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x80f4a1
mov ecx, fcn.00798df0
xor eax, eax
mov ebx, dword [0xbb2228]
imul ecx, ecx
and ecx, 3
cmp ecx, 1
seta al
mov ecx, eax
not ecx
and ecx, 0x101
lea ecx, [eax + ecx*2 - 0x60e78192]
mov edx, ecx
xor ebx, ecx
shr edx, 0x1f
mov dword [0xbb2228], ebx
not ebx
or edx, ecx
and cl, 7
imul edx, ebx
xor dword [0xbb222c], edx
mov dl, 1
shl dl, cl
or byte [0xbb2233], dl
mov eax, fcn.00798df0
xor ecx, ecx
mov ebx, ebp
imul eax, eax
and eax, 3
cmp eax, 1
seta cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb2233], al
mov ebp, dword [esp + 4]
mov dword [edi + 0x30], 0
mov dword [ebp + 0x38], 0
push 0xbb2228
push 1
push esi
call fcn.007f2440
add esp, 0xc
lea eax, [esp + 0x38]
mov ecx, esi
mov edx, ebp
push eax
call fcn.007d5f00
add esp, 4
test eax, eax
mov dword [ebp + 0x38], edi
jne 0x80f9e3
mov ebp, dword [esp + 0x20]
mov edx, 0x25
mov ecx, ebp
push dword [esp + 0x18]
mov esi, dword [esp + 0x2c]
push esi
call fcn.007c57e0
add esp, 8
mov dword [esp + 0x10], eax
mov ecx, ebp
mov edx, pe_nt_image_headers32
push dword [esp + 0xc]
call fcn.007edd80
add esp, 4
test ebx, ebx
je 0x80f55e
mov eax, dword [ebx]
mov ecx, ebp
mov edx, 0x59
inc eax
push dword [esp + 0x24]
push eax
push esi
call fcn.007c5800
add esp, 0xc
jmp 0x80f572
mov ecx, ebp
mov edx, 0x7e
push dword [esp + 0x24]
push esi
call fcn.007c57e0
add esp, 8
mov ecx, ebp
mov edx, 0x7a
push esi
call fcn.007edd80
add esp, 4
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.007efdc0
mov edx, dword [esp + 0x2c]
mov ebx, eax
mov ecx, ebp
push eax
call fcn.008109a0
add esp, 4
mov ecx, esi
mov esi, dword [esp + 0x18]
mov edx, edi
push esi
push ebx
push dword [esp + 0x70]
push 0
push 0
push dword [esp + 0x20]
call fcn.0080bdc0
add esp, 0x18
mov eax, dword [esp + 0x30]
test eax, eax
je 0x80f5d5
mov ecx, ebp
mov edx, 0x3b
push esi
push eax
call fcn.007c57e0
add esp, 8
mov ecx, ebp
mov edx, ebx
call fcn.007f04f0
test byte [edi + 4], 8
je 0x80f853
mov edx, fcn.007eb520
mov eax, fcn.007eb520
movzx esi, byte [0xbb226f]
and edx, 1
xor edx, eax
xor eax, eax
cmp edx, 0xffffffff
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt esi, eax
mov esi, dword [esp + 8]
jb 0x80f83d
mov al, byte [0xbb226f]
xor ecx, ecx
cmp edx, 0xffffffff
mov ah, 1
sete cl
mov ebx, ecx
not ebx
lea ecx, [ebx + ecx*2]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb226f], ah
jne 0x80f624
mov ecx, fcn.007eb520
mov edx, fcn.007eb520
movzx eax, al
and ecx, 1
xor ecx, edx
xor edx, edx
cmp ecx, 0xffffffff
sete dl
mov ebx, edx
not ebx
lea edx, [ebx + edx*2]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x80f69d
xor eax, eax
cmp ecx, 0xffffffff
movzx ebx, byte [0xbb226f]
sete al
mov edx, eax
not edx
lea eax, [edx + eax*2]
and al, 7
movzx eax, al
bt ebx, eax
jae 0x80f678
jmp 0x80f83d
xor eax, eax
cmp ecx, 0xffffffff
movzx edx, byte [0xbb226f]
sete al
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
and al, 7
movzx eax, al
bt edx, eax
jb 0x80f80f
mov ecx, fcn.007eb520
mov eax, fcn.007eb520
and ecx, 1
xor ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
sete al
mov ecx, eax
xor ecx, 0x63c757bf
lea ecx, [ecx + eax*2 + 0x1080]
mov eax, dword [0xbb2240]
mov edx, ecx
shr edx, 0x1f
or edx, ecx
xor eax, ecx
and cl, 7
mov dword [0xbb2240], eax
not eax
imul edx, eax
mov eax, dword [0xbb2244]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb2244], eax
or ebx, edx
not eax
mov edx, dword [0xbb2248]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb2248], edx
or ebx, eax
not edx
mov eax, dword [0xbb224c]
imul edx, ebx
lea ebx, [edx*8]
xor eax, edx
shr edx, 0x1c
mov dword [0xbb224c], eax
or ebx, edx
not eax
mov edx, dword [0xbb2250]
imul eax, ebx
mov ebx, eax
shl ebx, 4
xor edx, eax
shr eax, 0x1b
mov dword [0xbb2250], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb2254]
mov ebx, edx
shl ebx, 5
xor eax, edx
shr edx, 0x1a
mov dword [0xbb2254], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb2258]
mov ebx, eax
shl ebx, 6
xor edx, eax
shr eax, 0x19
mov dword [0xbb2258], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb225c]
mov ebx, edx
shl ebx, 7
xor eax, edx
shr edx, 0x18
mov dword [0xbb225c], eax
or edx, ebx
not eax
imul eax, edx
mov edx, dword [0xbb2260]
mov ebx, eax
shl ebx, 8
xor edx, eax
shr eax, 0x17
mov dword [0xbb2260], edx
or eax, ebx
not edx
imul edx, eax
mov eax, dword [0xbb2264]
mov ebx, edx
shl ebx, 9
xor eax, edx
shr edx, 0x16
mov dword [0xbb2264], eax
or edx, ebx
not eax
imul eax, edx
mov dl, 1
xor dword [0xbb2268], eax
shl dl, cl
or byte [0xbb226f], dl
mov ecx, fcn.007eb520
mov eax, fcn.007eb520
and ecx, 1
xor ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
sete al
mov ecx, eax
not ecx
lea ecx, [ecx + eax*2]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb226f], al
push 0xbb2240
push esi
call fcn.00782570
add esp, 8
mov ebx, dword [esp]
jmp 0x80f9cd
mov edx, fcn.007bde50
movzx ecx, byte [0xbb2283]
mov eax, fcn.007bde50
mov esi, dword [esp + 8]
mov ebx, dword [esp]
and edx, 1
xor edx, eax
xor eax, eax
cmp edx, 0xffffffff
setne al
bt ecx, eax
jb 0x80f99e
mov al, byte [0xbb2283]
cmp edx, 0xffffffff
mov ah, 1
setne cl
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb2283], ah
jne 0x80f886
mov ecx, fcn.007bde50
mov edx, fcn.007bde50
movzx eax, al
and ecx, 1
xor ecx, edx
cmp ecx, 0xffffffff
setne dl
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x80f8db
movzx edx, byte [0xbb2283]
xor eax, eax
cmp ecx, 0xffffffff
setne al
bt edx, eax
jae 0x80f8c2
jmp 0x80f99e
movzx edx, byte [0xbb2283]
xor eax, eax
cmp ecx, 0xffffffff
setne al
bt edx, eax
jb 0x80f97c
mov edx, fcn.007bde50
mov eax, fcn.007bde50
xor ecx, ecx
and edx, 1
xor edx, eax
mov eax, dword [0xbb2270]
cmp edx, 0xffffffff
sete cl
xor ecx, 0xec959569
add ecx, 0x400
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbb2270], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
mov eax, dword [0xbb2274]
lea ebx, [edx + edx]
xor eax, edx
shr edx, 0x1e
mov dword [0xbb2274], eax
or ebx, edx
not eax
mov edx, dword [0xbb2278]
imul eax, ebx
lea ebx, [eax*4]
xor edx, eax
shr eax, 0x1d
mov dword [0xbb2278], edx
or ebx, eax
not edx
mov al, 1
imul edx, ebx
mov ebx, dword [esp]
shl al, cl
xor dword [0xbb227c], edx
or byte [0xbb2283], al
mov ecx, fcn.007bde50
mov eax, fcn.007bde50
and ecx, 1
xor ecx, eax
mov al, 0xfe
cmp ecx, 0xffffffff
setne cl
xor cl, 7
rol al, cl
and byte [0xbb2283], al
mov dword [edi + 0x34], 0
push 0xbb2270
push 1
push esi
call fcn.007f2440
add esp, 0xc
lea eax, [esp + 0x38]
mov ecx, esi
mov edx, edi
push eax
call fcn.007d5f00
add esp, 4
mov eax, dword [esp + 4]
mov dword [edi + 0x34], eax
mov edx, dword [esp + 0x10]
mov ecx, ebp
call fcn.007ebf10
mov edx, dword [esp + 0x18]
mov ecx, ebp
call fcn.007f04f0
mov edx, dword [edi + 0x30]
mov ecx, dword [esi]
call fcn.007c00f0
mov eax, dword [esp + 0x34]
mov dword [edi + 0x30], ebx
mov dword [edi + 0x3c], eax
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00980459
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret