Function at 0x100572b0
Capabilities:
Encode data using xor
Set file attributes

Disassembly:
mov eax, 0x1850
call fcn.102244a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1864]
push edi
mov edi, dword [esp + 0x1864]
mov dword [esi], 0
mov ecx, dword [0x107ab964]
push 0
push 0x8002
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1005792e
mov ecx, dword [0x107ab964]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x20]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x5c], ebp
jg 0x1005731f
mov ecx, dword [0x107ab964]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1850
ret
mov ecx, dword [esp + 0x186c]
lea edx, [esp + 0x38]
push ecx
push edx
push ebp
push ebx
call fcn.101964d0
add esp, 0x10
test eax, eax
jne 0x10057353
mov ecx, dword [0x107ab964]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1850
ret
cmp dword [esp + 0x3c], 1
je 0x10057387
mov ecx, dword [0x107ab964]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
mov eax, dword [0x107ab964]
push esi
push edi
push eax
call fcn.1002bac0
add esp, 0xc
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x1850
ret
mov eax, dword [esp + 0x50]
mov esi, dword [esp + 0x38]
mov edi, eax
mov edx, dword [esp + 0x40]
sub edi, esi
mov esi, eax
shr esi, 2
shl esi, 2
sub eax, esi
sub edi, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
cmp eax, 0xffffffff
mov dword [esp + 0x24], edi
jne 0x100574f7
mov ecx, dword [esp + 0x54]
mov edx, dword [0x107ab964]
push ecx
push ebx
push edx
call fcn.1000fe50
mov ecx, dword [esp + 0x54]
add esp, 0xc
lea edx, [ecx + eax]
cmp edx, ebp
jge 0x10057922
cmp eax, 0x1000
jle 0x10057922
push 0
push ecx
push eax
mov eax, dword [0x107ab964]
push ebx
push eax
call fcn.1002b820
add esp, 0x14
test eax, eax
je 0x10057922
mov eax, dword [esp + 0x48]
mov ecx, dword [0x107ab964]
push 1
push 0x13a3
push eax
push ebx
push ecx
call fcn.10013800
add esp, 0x14
test eax, eax
je 0x10057922
mov eax, dword [0x107ab964]
push ebx
push eax
call fcn.1000fab0
mov ecx, dword [0x107ab964]
add esp, 8
cmp eax, 1
jne 0x10057456
mov edx, dword [ecx]
push ebx
call dword [edx + 0x18]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1850
ret
mov eax, dword [ecx]
push ebx
call dword [eax + 0x18]
mov ebx, dword [esp + 0x1864]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x460]
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x460]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x460]
or ecx, 0xffffffff
mov byte [esp + 0x85f], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 0xa]
test edx, edx
jle 0x1005792e
mov dl, byte [esp + ecx + 0x45c]
lea eax, [esp + ecx + 0x460]
mov cl, 0x2e
cmp dl, cl
jne 0x1005792e
cmp byte [eax - 8], cl
je 0x100574e1
cmp byte [eax - 9], cl
jne 0x1005792e
mov byte [eax - 4], 0
lea eax, [esp + 0x460]
push 0x80
push eax
jmp 0x100578db
mov eax, dword [esp + 0x44]
add eax, 0x14
cmp eax, 0x400
ja 0x10057922
lea ecx, [esp + 0x10]
push 0
lea edx, [esp + 0x64]
push ecx
push edx
push eax
mov eax, dword [0x107ab964]
push 0x400
push esi
push ebp
push ebx
push eax
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x10057922
mov ecx, dword [esp + 0x44]
lea edx, [ecx + 0x14]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
jne 0x10057922
lea edx, [ecx - 4]
sub esi, edi
xor eax, eax
test edx, edx
jle 0x10057593
mov ebp, dword [esp + 0x4c]
mov edi, dword [esp + 0x186c]
cmp edi, 0x2041
je 0x10057575
cmp edi, 0x21dd
je 0x10057575
cmp edi, 0x21de
jne 0x10057582
mov edi, dword [esp + eax + 0x60]
xor edi, esi
add esi, 4
mov dword [esp + eax + 0x60], edi
mov edi, dword [esp + eax + 0x60]
add eax, 4
xor edi, ebp
cmp eax, edx
mov dword [esp + eax + 0x5c], edi
jl 0x10057556
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + eax + 0x60]
xor ebp, esi
mov esi, eax
cmp esi, edx
mov dword [esp + 0x28], ebp
jge 0x100575dd
mov edi, ebp
and edi, 0xff
mov eax, dword [esp + esi + 0x60]
push edi
xor eax, ebp
push eax
mov dword [esp + esi + 0x68], eax
call fcn.100185b0
mov ecx, dword [esp + 0x18]
mov dword [esp + esi + 0x68], eax
add esi, 4
add esp, 8
lea edx, [ecx - 4]
cmp esi, edx
jl 0x100575b3
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x44]
mov word [esp + ecx + 0x5e], 0
lea ecx, [esp + 0x2c]
lea esi, [esp + esi + 0x68]
push ecx
push esi
mov dword [esp + 0x34], eax
call fcn.10027d60
mov eax, dword [esp + 0x34]
lea edi, [esp + 0x68]
mov ecx, eax
mov ebp, 0xff8
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x4c]
mov byte [esp + eax + 0x68], 0
mov ecx, 2
lea eax, [esi + 8]
shr eax, 2
sub ecx, eax
lea edi, [esi + ecx*4]
mov ecx, dword [esp + 0x50]
mov eax, ecx
sub esi, edi
div ebp
mov eax, 0x804021
mov dword [esp + 0x28], edi
mov dword [esp + 0x60], edx
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [esp + 0x58]
shr ecx, 0xb
lea eax, [esi + edx + 8]
mov ebp, ecx
push eax
mov eax, dword [0x107ab964]
push ebx
push eax
mov dword [esp + 0x48], ebp
call fcn.1000fe50
mov edi, eax
xor eax, eax
add esp, 0x14
cmp ebp, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
jl 0x1005782c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov ebp, edi
mov esi, 0x1000
shr edi, 2
shl edi, 2
sub ebp, edi
cmp ecx, eax
mov dword [esp + 0x14], ebp
jne 0x100576b1
mov edx, dword [esp + 0x58]
lea esi, [edx + 8]
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x10]
push 1
lea ecx, [esp + 0x864]
push eax
mov eax, dword [0x107ab964]
push ecx
push 0x1000
push esi
push edi
push edx
push ebx
push eax
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x10057922
mov edx, dword [esp + 0x10]
cmp edx, esi
jne 0x10057922
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x10057724
mov ecx, dword [0x107ab964]
push edi
push ebx
push ecx
call fcn.10010840
add esp, 0xc
test eax, eax
jle 0x10057922
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov ecx, eax
sub ecx, esi
sub eax, edi
mov dword [esp + 0x30], eax
jmp 0x10057730
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x24]
sub ecx, esi
add ecx, edi
xor eax, eax
test edx, edx
jle 0x1005777a
mov esi, dword [esp + 0x186c]
cmp esi, 0x2041
je 0x10057755
cmp esi, 0x21dd
je 0x10057755
cmp esi, 0x21de
jne 0x10057768
mov esi, dword [esp + eax + 0x860]
xor esi, ecx
add ecx, 4
mov dword [esp + eax + 0x860], esi
mov esi, dword [esp + 0x4c]
xor dword [esp + eax + 0x860], esi
add eax, 4
cmp eax, edx
jl 0x10057736
add edx, 0xfffffffc
mov esi, ebp
cmp ebp, edx
jge 0x100577c4
mov ebp, dword [esp + 0x28]
and ebp, 0xff
mov edx, dword [esp + 0x28]
mov eax, dword [esp + esi + 0x860]
xor eax, edx
push ebp
push eax
mov dword [esp + esi + 0x868], eax
call fcn.100185b0
mov dword [esp + esi + 0x868], eax
mov eax, dword [esp + 0x18]
add esi, 4
add eax, 0xfffffffc
add esp, 8
cmp esi, eax
jl 0x1005778d
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, esi
sub ecx, eax
add eax, ebp
sub ecx, ebp
push ecx
mov ecx, dword [0x107ab964]
lea edx, [esp + eax + 0x864]
mov eax, dword [esp + 0x20]
push 0x1000
push edx
push eax
push ebx
push ecx
call fcn.10029d90
add esp, 0x18
test eax, eax
je 0x1005733a
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
add edi, esi
sub esi, ecx
mov ecx, dword [esp + 0x34]
sub esi, ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x20], 0
add ebp, esi
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], eax
jle 0x1005768b
mov eax, dword [esp + 0x48]
mov ecx, dword [0x107ab964]
push 1
push 0x13a3
push eax
push ebx
push ecx
call fcn.10013800
mov ecx, dword [0x107ab964]
add esp, 0x14
mov edx, dword [ecx]
push ebx
call dword [edx + 0x18]
mov ebx, dword [esp + 0x1864]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x460]
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x460]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x5c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x464]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x1005792e
lea edx, [eax + 1]
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x464]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x460]
push 0x180
push eax
mov edx, dword [ecx]
call dword [edx + 0x38]
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x460]
push eax
push ebx
mov edx, dword [ecx]
call dword [edx + 0x4c]
xor ecx, ecx
cmp eax, 0xffffffff
pop edi
pop esi
setne cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x1850
ret
mov ecx, dword [0x107ab964]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1850
ret