Function at 0x7c80eb1d
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2cc
cmp dword [ebp + 0xc], 1
mov eax, dword [0x7c8856cc]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2b4], eax
jge 0x7c83cbca
cmp dword [ebp + 0x14], 2
jge 0x7c83cbca
mov esi, dword [ebp + 0x1c]
test esi, 0xfffffffe
jne 0x7c83cbca
push edi
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
movzx eax, word [ebp - 0x294]
mov ecx, dword [ebp - 0x290]
shr eax, 1
cmp word [ecx + eax*2 - 2], 0x2e
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x27c]
push eax
push edi
sete byte [ebp - 0x285]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7c83513f
mov eax, dword [ebp - 0x280]
mov edx, dword [ebp - 0x278]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x2ac], edx
je 0x7c838d80
mov ecx, edx
sub ecx, eax
add ecx, dword [ebp - 0x27c]
cmp word [ebp - 0x2a8], di
mov word [ebp - 0x284], cx
mov word [ebp - 0x282], cx
jne 0x7c838d55
cmp eax, edi
mov dword [ebp - 0x2a0], edi
je 0x7c80ec0b
sub eax, edx
mov word [ebp - 0x27c], ax
mov word [ebp - 0x27a], ax
movzx eax, word [ebp - 0x27c]
shr eax, 1
cmp word [edx + eax*2 - 4], 0x3a
je 0x7c80ec28
cmp word [edx + eax*2 - 2], 0x5c
jne 0x7c83caae
mov byte [ebp - 0x271], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x2c4], eax
mov ebx, 0x4021
push ebx
push 3
lea eax, [ebp - 0x29c]
push eax
shl esi, 6
lea eax, [ebp - 0x2cc]
push eax
not esi
mov dword [ebp - 0x2bc], edi
mov dword [ebp - 0x2b8], edi
and esi, 0x40
mov edi, 0x100001
push edi
lea eax, [ebp - 0x270]
mov dword [ebp - 0x2c0], esi
mov esi, dword [sym.imp.ntdll.dll_NtOpenFile]
push eax
mov dword [ebp - 0x2cc], 0x18
call esi
cmp eax, 0xc000000d
mov dword [ebp - 0x28c], eax
je 0x7c838d88
cmp eax, 0xc0000103
je 0x7c838d88
xor edi, edi
cmp dword [ebp - 0x28c], edi
jl 0x7c80edf1
cmp word [ebp - 0x284], di
je 0x7c83cb37
cmp word [ebp - 0x284], 6
je 0x7c830bbd
movzx ecx, word [ebp - 0x284]
mov eax, dword [ebp - 0x280]
xor edx, edx
test ecx, 0xfffffffe
jbe 0x7c80ed27
cmp edx, edi
je 0x7c80ed00
cmp word [eax], 0x2e
je 0x7c80ee62
mov cx, word [eax]
cmp cx, 0x3f
je 0x7c82033a
cmp cx, 0x2a
je 0x7c80eff2
movzx ecx, word [ebp - 0x284]
inc edx
inc eax
shr ecx, 1
inc eax
cmp edx, ecx
jb 0x7c80ecf2
cmp byte [ebp - 0x285], 0
jne 0x7c835880
push edi
lea eax, [ebp - 0x284]
push eax
push 1
push 3
push 0x268
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x29c]
push eax
push edi
push edi
push edi
push dword [ebp - 0x270]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov esi, eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x2ac]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp esi, edi
jl 0x7c80efe0
mov esi, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x234]
mov dword [esi], eax
mov eax, dword [ebp - 0x264]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x260]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x25c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x258]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x254]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x250]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x244]
mov edi, 0x206
cmp dword [ebp - 0x230], edi
mov dword [esi + 0x20], eax
jbe 0x7c83cb63
jmp 0x7c83cb69
mov eax, dword fs:[0x18]
push dword [ebp - 0x2ac]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x290]
call dword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
cmp eax, edi
jne 0x7c83caf8
cmp dword [ebp - 0x28c], 0xc0000034
mov eax, 0xc000003a
jne 0x7c80ee35
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0xc0000024
je 0x7c83cb2c
push dword [ebp - 0x28c]
call fcn.7c809419
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 0x18
cmp word [eax - 2], 0x2a
jne 0x7c80ed00
mov word [eax - 2], 0x3c
jmp 0x7c80ed00
push dword [ebp - 0x270]
call dword [sym.imp.ntdll.dll_NtClose]
push esi
jmp 0x7c80ee4b
cmp edx, edi
je 0x7c80ed17
cmp word [eax - 2], 0x2e
jne 0x7c80ed17
mov word [eax - 2], 0x22
jmp 0x7c80ed17
mov word [eax], 0x3e
jmp 0x7c80eff2
push 6
push 0x7c830be8
push dword [ebp - 0x280]
call dword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp eax, 6
jne 0x7c80ecdb
mov word [ebp - 0x284], 2
jmp 0x7c80ed34
mov ch, 0x65
mov cl, 0x3e
lodsd eax, dword [esi]
mov ch, 0x4c
dec eax
pop esp
cmp ebx, edi
invalid
arpl word [edi], dx
into
push 0x3a
and al, 0x3f
out dx, eax
mov eax, 0xe0227509
mov esp, esi
inc esi
mov esp, 0x24ec81c3
pop ds
dec edi
sub al, 0xdf
je 0x7c838d4d
ret
rcr dh, 0x39
invalid
salc
loop 0x7c838d80
pop dword [edi - 0x58]
daa
pop esi
invalid
aam 0x80
cmc
notrack call 0x7a6f493c
retf
mov ah, cl
push ebp
dec edi
pop esi
sub ch, byte [ebp - 0x6c]
inc esp
xchg bh, cl
or dword [edi + 0x6b], 0xffffff99
js 0x7c83cb08
call dword [ebp + 0x32569f32]
popal
jge 0x7c83cb7d
xchg ebp, eax
xor bl, byte [edi + 0x7d613256]
insb byte es:[edi], dx
sar ebx, 0x9e
pop edx
adc byte [eax - 0x14c50fff], cl
jle 0x7c83cb1d
pop esi
sbb eax, 0xfdaf001b
pop es
loopne 0x7c83cb2b
mov al, 0xce
scasd eax, dword es:[edi]
jg 0x7c83cb33
loopne 0x7c83cb32
add eax, 0x46a201fd
push ss
std
add dword [edx - 0x4c0fe9ba], esp
push edi
invalid
mov bl, 0x57
or dword [edx], ebp
dec esi
add ch, byte [ecx + 0x13]
push ebp
or al, 0x9f
ret
push ss
nop
xor cl, dl
in al, dx
invalid
popfd
mov byte [0x3d5405b], al
outsd dx, dword [esi]
xchg esp, eax
jo 0x7c83cbf0
mov edx, 0x278d5aab
imul esp, ebx, 0x5c879c50
pushfd
xchg dword [ebx + ebx*2 - 0x7f], ebx
lahf
lcall 0xd916, 0x6c2a2b70
stosd dword es:[edi], eax
pop esp
pop ebx
sbb dword [edi + 0x2a2b709a], 0xabd9166c
mov ch, 4
das
cli
xchg edi, eax
jne 0x7c83cb6a
add byte [ebp + 0x5b], bl
xor ebx, esp
stc
scasd eax, dword es:[edi]
mov eax, 0x305fcd93
or dword [ebp + 0x1127d741], edx
sbb ecx, ebx
test eax, 0x4def
cmp al, 0x76
fst dword [edi]
sbb dword [esp + ebx*4 - 0x327ee5c1], ebp
mov word [ebp - 0x51c2374f], es
push ebx
out 0xc6, al
mov edi, 0x8f9615f0
mov bl, cl
jecxz 0x7c83cb7b
retf 0x8bc2
in eax, 0xbe
imul edi, ecx, 0x7f
push es
xor al, byte [ecx + edx*4]
xchg byte [ebx + 0x16], al
push ss
xor al, 0xf0
sti
pop edx
jne 0x7c83cbca
mov bh, 0x5f
add byte [0xd55eb2b8], dl
xor al, 0xe6
push eax
clc
pop es
inc ebp
mov edi, eax
pop es
xchg ebx, eax
mov dword [0xfd97616f], eax
into
add al, 0xef
and bh, bl
jae 0x7c83cc28
xor dword [edi + 0x25], ebp
mov dh, 0x66
lea ecx, [esp + edx*4 + 0x1f]
ret
lodsd eax, dword [esi]
invalid