Function at 0x4268ea
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51223c
mov eax, dword fs:[0]
push eax
mov eax, 0x5048
call fcn.004d9200
mov eax, dword [0x577014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x503c], edx
mov ebx, ecx
mov dword [ebp - 0x5028], ebx
mov dword [ebp - 0x5040], ebx
mov dword [ebp - 0x5040], ebx
xor eax, eax
mov dword [ebp - 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push eax
push 3
push eax
push 1
push ADsGetObject
push dword [ebp + 8]
call esi
mov edi, eax
mov dword [ebp - 0x5044], edi
cmp edi, 0xffffffff
je 0x426ca3
test edi, edi
je 0x426ca3
xor eax, eax
mov byte [ebp - 4], 4
push eax
push eax
push 2
push eax
push eax
push 0x40000000
push dword [ebp + 0xc]
call esi
mov esi, eax
mov dword [ebp - 0x5040], esi
cmp esi, 0xffffffff
je 0x426c63
test esi, esi
je 0x426c63
xor eax, eax
mov edx, dword [ebp - 0x503c]
lea edi, [ebp - 0x5024]
stosd dword es:[edi], eax
push ecx
lea ecx, [ebp - 0x5050]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5024]
push eax
push 0x14
pop eax
push eax
mov dword [ebp - 0x502c], eax
call fcn.00426647
add esp, 0xc
mov byte [ebp - 4], 6
cmp dword [ebp - 0x5050], 0
jge 0x426a82
cmp dword [ebp - 0x504c], 0
mov eax, 0x11f
mov ebx, dword [ebp - 0x5048]
cmovne eax, dword [ebp - 0x504c]
push eax
push dword [ebp - 0x5050]
push ecx
mov edi, esp
lea ecx, [ebx - 0x10]
mov dword [ebp - 0x502c], edi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x5038]
mov dword [edi], eax
call fcn.00406620
lea eax, [ebp - 0x5038]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x5028]
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x5030]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebx - 0x10]
call fcn.00407189
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x426a58
push esi
call ebx
mov edi, dword [ebp - 0x5044]
push edi
call ebx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00407189
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, dword [ebp - 0x5028]
jmp 0x426d22
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x5048]
lea ecx, [ecx - 0x10]
call fcn.00407189
push 0x5000
xor edi, edi
lea eax, [ebp - 0x5010]
push edi
push eax
call fcn.004d9f30
add esp, 0xc
mov dword [ebp - 0x5028], edi
push edi
mov edi, dword [ebp - 0x5044]
jmp 0x426b4e
cmp dword [ebp - 0x5028], 0
je 0x426c44
xor ecx, ecx
cmp dword [ebp - 0x5028], ecx
jbe 0x426af5
xor edx, edx
mov eax, ecx
div dword [ebp - 0x502c]
mov al, byte [ebp + edx - 0x5024]
xor byte [ebp + ecx - 0x5010], al
inc ecx
cmp ecx, dword [ebp - 0x5028]
jb 0x426ad4
and dword [ebp - 0x503c], 0
lea eax, [ebp - 0x503c]
push 0
push eax
push dword [ebp - 0x5028]
lea eax, [ebp - 0x5010]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x426c07
mov eax, dword [ebp - 0x503c]
cmp eax, dword [ebp - 0x5028]
jne 0x426bad
push 0x5000
lea eax, [ebp - 0x5010]
push 0
push eax
call fcn.004d9f30
add esp, 0xc
and dword [ebp - 0x5028], 0
push 0
lea eax, [ebp - 0x5028]
push eax
push 0x5000
lea eax, [ebp - 0x5010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426abd
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x128
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x5038]
call fcn.00406620
mov byte [ebp - 4], 8
jmp 0x426bce
push 0x15c
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x5038]
call fcn.00406620
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x5038]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x5030]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp esi, 0xffffffff
je 0x426d03
test esi, esi
je 0x426d03
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x426d03
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x15b
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x5038]
call fcn.00406620
mov byte [ebp - 4], 9
jmp 0x426bce
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
lea ecx, [ebp - 0x5040]
call fcn.00427477
jmp 0x426d03
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x116
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x5038]
call fcn.00406620
mov byte [ebp - 4], 5
jmp 0x426bce
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x112
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x5038]
call fcn.00406620
lea eax, [ebp - 0x5038]
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x5030]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp edi, 0xffffffff
je 0x426d0a
test edi, edi
je 0x426d0a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d818b
leave
ret