Function at 0x81dd20
Capabilities:
Encode data using xor
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov eax, dword [esp + 0x74]
mov edi, edx
mov edx, 0x11
xor ebx, ebx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x44], eax
mov esi, dword [esp + 0x78]
mov ebp, dword [esp + 0x6c]
mov eax, dword [0xbd33e0]
xor eax, esp
mov dword [esp + 0x54], eax
mov dword [esp + 0x14], ecx
mov ecx, dword [ecx + 8]
mov dword [esp + 0x3c], ecx
call fcn.007f75b0
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x24], ebp
mov ebp, dword [esi + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x4c], edi
mov edi, dword [edi + 0x14]
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, edi
test eax, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], ebp
jg 0x81ddb6
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
xor esi, esi
jmp 0x81e102
mov ecx, 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp]
mov dword [esp + 8], ecx
or eax, dword [ebp + 4]
jne 0x81de31
test byte [edi + 0xa], 2
jne 0x81de31
mov esi, dword [edi]
test byte [esi + 4], 1
jne 0x81de31
mov eax, dword [esp + 0x24]
mov ecx, esi
mov edx, dword [eax + 0x2c]
call fcn.0081c7a0
test eax, eax
je 0x81de31
mov ebp, dword [esp + 0x14]
mov edx, esi
mov ecx, dword [ebp]
push 0
call fcn.007fc000
add esp, 4
mov ecx, ebp
mov ebp, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push eax
call fcn.007ea860
add esp, 4
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
mov ecx, edi
push dword [esp + 0x34]
push dword [esp + 0x48]
call fcn.00826730
add esp, 8
test eax, eax
jne 0x81de54
mov esi, dword [esp + 8]
jmp 0x81e0f3
mov ecx, dword [edi + 0x1c]
mov edx, 1
xor ebp, ebp
mov eax, 1
mov esi, 0
shld ebp, eax, cl
shl edx, cl
test cl, 0x20
mov eax, 0x80000000
cmovne ebp, edx
cmovne edx, esi
cmp ecx, 0x3f
cmovg ebp, eax
cmovg edx, esi
cmp byte [esp + 0x18], 0
jne 0x81e092
mov esi, fcn.007a6100
mov dword [esp + 0x18], ecx
mov dword [esp + 4], edx
mov edx, fcn.007a6100
or esi, 2
xor edx, 2
movzx ecx, byte [0xbb9e2f]
mov eax, esi
add eax, edx
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jb 0x81e063
mov al, byte [0xbb9e2f]
mov ecx, esi
mov ah, 1
add ecx, edx
sete cl
not cl
and cl, 5
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb9e2f], ah
jne 0x81deca
mov ecx, esi
movzx eax, al
add ecx, edx
sete cl
not cl
and cl, 5
xor cl, 7
movzx ecx, cl
bt eax, ecx
jae 0x81df22
mov eax, esi
movzx ecx, byte [0xbb9e2f]
add eax, edx
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jae 0x81df03
jmp 0x81e063
mov eax, esi
movzx ecx, byte [0xbb9e2f]
add eax, edx
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jb 0x81e04c
mov eax, esi
xor ecx, ecx
add eax, edx
mov eax, dword [0xbb9e10]
sete cl
xor ecx, 0x6a4bcadd
add ecx, 0x40
mov dword [esp + 0x2c], ecx
xor eax, ecx
mov ecx, dword [esp + 0x2c]
mov dword [0xbb9e10], eax
not eax
shr ecx, 0x1f
or ecx, dword [esp + 0x2c]
imul ecx, eax
mov eax, dword [0xbb9e14]
xor eax, ecx
mov dword [esp], eax
mov dword [0xbb9e14], eax
lea eax, [ecx + ecx]
shr ecx, 0x1e
mov dword [esp + 0xc], eax
or dword [esp + 0xc], ecx
mov ecx, dword [0xbb9e18]
mov eax, dword [esp]
not eax
imul eax, dword [esp + 0xc]
mov dword [esp], eax
xor ecx, eax
mov eax, dword [esp]
mov dword [0xbb9e18], ecx
not ecx
lea eax, [eax*4]
mov dword [esp + 0xc], eax
mov eax, dword [esp]
shr eax, 0x1d
or dword [esp + 0xc], eax
mov eax, dword [0xbb9e1c]
imul ecx, dword [esp + 0xc]
mov dword [esp + 0xc], ecx
xor eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [0xbb9e1c], eax
not eax
lea ecx, [ecx*8]
mov dword [esp], ecx
mov ecx, dword [esp + 0xc]
shr ecx, 0x1c
or dword [esp], ecx
mov ecx, dword [0xbb9e20]
imul eax, dword [esp]
xor ecx, eax
mov dword [esp], eax
shl dword [esp], 4
shr eax, 0x1b
or eax, dword [esp]
mov dword [0xbb9e20], ecx
not ecx
imul ecx, eax
mov eax, dword [0xbb9e24]
mov dword [esp], ecx
shl dword [esp], 5
xor eax, ecx
shr ecx, 0x1a
or ecx, dword [esp]
mov dword [0xbb9e24], eax
not eax
imul eax, ecx
xor dword [0xbb9e28], eax
mov al, 1
mov ecx, dword [esp + 0x2c]
and cl, 7
shl al, cl
or byte [0xbb9e2f], al
add esi, edx
mov al, 0xfe
sete cl
not cl
and cl, 5
xor cl, 7
rol al, cl
and byte [0xbb9e2f], al
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x18]
mov eax, dword [edx + 4]
lea ecx, [ecx + ecx*4]
push dword [eax + ecx*4]
push dword [edx]
push 0xbb9e10
push 0x11c
call fcn.00783470
add esp, 0x10
mov al, 1
mov dword [esp + 0x18], eax
mov edx, dword [esp + 4]
mov eax, edx
mov ecx, ebp
and eax, dword [esp + 0x20]
and ecx, dword [esp + 0x1c]
or ecx, eax
je 0x81e0ac
mov esi, dword [esp + 8]
mov ebp, dword [esp + 0x30]
jmp 0x81e0f3
mov dword [esp + 4], edx
mov dword [esp], ebp
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x30]
mov ecx, dword [eax]
lea esi, [ebx + 1]
mov edx, ebp
push esi
call fcn.008256e0
add esp, 4
test eax, eax
je 0x81e0dc
mov esi, dword [esp + 0x14]
jmp 0x81e80c
mov eax, dword [ebp + 0x30]
mov dword [eax + ebx*4], edi
mov eax, dword [esp + 4]
xor ebx, ebx
or dword [esp + 0x20], eax
mov eax, dword [esp]
or dword [esp + 0x1c], eax
add edi, 0x30
mov ecx, esi
cmp edi, dword [esp + 0x28]
jb 0x81dddb
mov edi, dword [esp + 0x1c]
mov ecx, 0x80000000
mov eax, dword [esp + 0x24]
mov edx, 0x80000000
mov word [ebp + 0x28], si
mov word [ebp + 0x18], si
mov dword [ebp + 0x24], 0x4241
or edi, ecx
xor ecx, ecx
mov ebp, dword [eax + 0x3c]
add ecx, 0xffffffff
adc edx, 0xffffffff
xor ecx, dword [esp + 0x20]
xor edx, edi
and edx, ebp
mov dword [esp + 4], ebp
mov dword [esp + 0x20], edx
and ecx, dword [eax + 0x38]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x40]
movsx ecx, word [eax + 0x2a]
mov eax, 0x3f
cmp ecx, 0x40
cmovl eax, ecx
test ecx, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ecx
jle 0x81e1a3
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
xor ebp, ebp
mov ecx, ebx
mov eax, 1
shld ebp, eax, cl
mov eax, 1
shl eax, cl
test bl, 0x20
mov ecx, 0
cmovne ebp, eax
cmovne eax, ecx
xor ecx, ecx
and eax, dword [esp + 8]
and ebp, edi
or eax, ebp
setne cl
inc ebx
add esi, ecx
cmp ebx, edx
jl 0x81e16e
mov eax, dword [esp + 0x2c]
cmp dword [esp + 4], 0
mov edi, 1
lea eax, [eax - 0x3e]
cmovs edi, eax
lea eax, [esp + 0x50]
add edi, esi
mov esi, dword [esp + 0x14]
movsx edx, di
mov ecx, dword [esi]
push eax
push 0
call fcn.0080ff30
add esp, 8
test eax, eax
je 0x81e80c
mov edx, fcn.007bc330
mov ebp, eax
xor eax, eax
mov dword [esp + 0xc], edi
imul edx, edx
movzx esi, byte [0xbb3b93]
mov edi, dword [esp + 0x30]
and edx, 3
cmp edx, 3
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt esi, eax
jb 0x81e333
mov al, byte [0xbb3b93]
xor ecx, ecx
cmp edx, 3
mov ah, 1
sete cl
mov ebx, ecx
xor ebx, 1
lea ecx, [ecx + ebx*2 + 6]
and cl, 7
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb3b93], ah
jne 0x81e219
mov ecx, fcn.007bc330
xor edx, edx
movzx eax, al
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete dl
mov ebx, edx
xor ebx, 1
lea edx, [edx + ebx*2 + 6]
and dl, 7
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x81e294
xor eax, eax
cmp ecx, 3
movzx esi, byte [0xbb3b93]
sete al
mov edx, eax
xor edx, 1
lea eax, [eax + edx*2 + 6]
and al, 7
movzx eax, al
bt esi, eax
jae 0x81e26d
jmp 0x81e333
xor eax, eax
cmp ecx, 3
movzx edx, byte [0xbb3b93]
sete al
mov ecx, eax
xor ecx, 1
lea eax, [eax + ecx*2 + 6]
and al, 7
movzx eax, al
bt edx, eax
jb 0x81e307
mov ecx, fcn.007bc330
xor eax, eax
mov esi, dword [str.2_p0]
imul ecx, ecx
and ecx, 3
cmp ecx, 3
sete al
mov ecx, eax
not ecx
and ecx, 0x101
lea ecx, [eax + ecx*2 + 0x713e5e6e]
mov edx, ecx
xor esi, ecx
shr edx, 0x1f
mov dword [str.2_p0], esi
not esi
or edx, ecx
and cl, 7
imul edx, esi
xor dword [0xbb3b8c], edx
mov dl, 1
shl dl, cl
or byte [0xbb3b93], dl
mov eax, fcn.007bc330
xor ecx, ecx
imul eax, eax
and eax, 3
cmp eax, 3
sete cl
mov eax, ecx
xor eax, 1
lea ecx, [ecx + eax*2 + 6]
mov al, 0xfe
and cl, 7
xor cl, 7
rol al, cl
and byte [0xbb3b93], al
mov eax, 0x7ffed0
mov edx, 3
movzx ecx, byte [0xbb9e3f]
sub edx, eax
mov eax, edx
xor eax, 0x7ffed0
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x81e467
mov al, byte [0xbb9e3f]
mov ecx, edx
mov ah, 1
xor ecx, 0x7ffed0
sete cl
or cl, 6
xor cl, 7
shl ah, cl
or ah, al
lock cmpxchg byte [0xbb9e3f], ah
jne 0x81e363
mov edx, 0x7ffed0
mov ecx, 3
movzx eax, al
sub ecx, edx
mov edx, ecx
xor edx, 0x7ffed0
sete dl
or dl, 6
xor dl, 7
movzx edx, dl
bt eax, edx
jae 0x81e3cc
mov eax, ecx
movzx edx, byte [0xbb9e3f]
xor eax, 0x7ffed0
sete al
or al, 6
movzx eax, al
bt edx, eax
jae 0x81e3ac
jmp 0x81e467
xor ecx, 0x7ffed0
movzx ecx, byte [0xbb9e3f]
sete al
or al, 6
movzx eax, al
bt ecx, eax
jb 0x81e442
mov eax, 0x7ffed0
mov edx, 3
xor ecx, ecx
sub edx, eax
mov eax, dword [0xbb9e30]
xor edx, 0x7ffed0
sete cl
or ecx, 0xf802bae
xor eax, ecx
mov dword [0xbb9e30], eax
not eax
mov edx, dword [0xbb9e34]
imul eax, ecx
and cl, 7
lea esi, [eax + eax]
xor edx, eax
shr eax, 0x1e
mov dword [0xbb9e34], edx
or esi, eax
not edx
mov al, 1
imul edx, esi
shl al, cl
xor dword [0xbb9e38], edx
or byte [0xbb9e3f], al
mov eax, 0x7ffed0
mov ecx, 3
sub ecx, eax
mov al, 0xfe
xor ecx, 0x7ffed0
sete cl
or cl, 6
xor cl, 7
rol al, cl
and byte [0xbb9e3f], al
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov dword [edi + 0x20], ebp
mov dword [ebp], 0xbb9e30
xor edi, edi
mov dword [ebp + 0xc], eax
mov ebx, dword [ecx + 0x14]
cmp ebx, dword [esp + 0x28]
mov dword [esp + 4], ebp
jae 0x81e506
xor edi, edi
mov dword [esp + 0x18], 0
mov dword [esp], 0
mov edx, dword [esp + 0x24]
mov ecx, ebx
push dword [esp + 0x34]
push dword [esp + 0x48]
call fcn.00826730
add esp, 8
test eax, eax
je 0x81e677
mov ecx, dword [ebx + 0x1c]
mov ebp, 1
xor esi, esi
mov eax, 1
mov edx, 0
shld esi, eax, cl
shl ebp, cl
test cl, 0x20
mov eax, 0x80000000
cmovne esi, ebp
cmovne ebp, edx
cmp ecx, 0x3f
cmovg esi, eax
cmovg ebp, edx
mov eax, esi
mov edx, ebp
and eax, dword [esp]
and edx, dword [esp + 0x18]
or edx, eax
je 0x81e642
mov ebp, dword [esp + 4]
jmp 0x81e677
cmp word [esp + 0x2c], 0
jle 0x81e553
xor eax, eax
mov edx, 1
xor ecx, ecx
xor esi, esi
mov ebx, 1
shld esi, edx, cl
shl ebx, cl
test cl, 0x20
cmovne esi, ebx
cmovne ebx, eax
and esi, dword [esp + 0x20]
and ebx, dword [esp + 8]
or ebx, esi
je 0x81e54a
mov esi, dword [ebp + 4]
mov word [esi + edi*2], cx
mov esi, dword [ebp + 0x20]
mov dword [esi + edi*4], str.2_p0
inc edi
mov esi, dword [esp + 0x1c]
inc ecx
cmp ecx, esi
jl 0x81e517
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x3c], 0
jns 0x81e588
mov edx, dword [esp + 0x40]
cmp word [edx + 0x2a], 0x40
jl 0x81e588
mov eax, 0x3f
mov ecx, dword [ebp + 4]
mov word [ecx + edi*2], ax
inc eax
mov ecx, dword [ebp + 0x20]
mov dword [ecx + edi*4], str.2_p0
inc edi
movsx ecx, word [edx + 0x2a]
cmp eax, ecx
jl 0x81e56d
mov eax, dword [ebp + 4]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x3c]
mov edx, 0x63
mov word [eax + edi*2], 0xffff
mov eax, dword [ebp + 0x20]
mov ebp, dword [esp + 0x38]
mov dword [eax + edi*4], str.2_p0
mov eax, dword [esi + 0x28]
lea ecx, [eax + 1]
mov dword [esi + 0x28], ecx
mov dword [ebp + 8], eax
mov ecx, ebx
push dword [esp + 0xc]
push eax
call fcn.007d10d0
add esp, 8
mov edx, dword [esp + 4]
mov ecx, esi
mov esi, ebp
call fcn.007f7980
mov eax, dword [esp + 0x4c]
mov eax, dword [eax]
mov ebp, dword [eax + 4]
movzx eax, byte [esi + 0x34]
lea eax, [eax + eax*8]
mov dword [esp + 0x28], ebp
test byte [ebp + eax*8 + 0x30], 0x10
mov dword [esp + 8], eax
je 0x81e689
mov esi, dword [ebp + eax*8 + 0x24]
mov ecx, ebx
mov edx, 0x45
push 0
push 0
call fcn.007d10d0
add esp, 8
mov dword [esp + 0x18], eax
mov ecx, ebx
mov edx, 0xd
mov eax, dword [esp + 8]
push dword [ebp + eax*8 + 0x20]
push 0
push esi
call fcn.007d10f0
add esp, 0xc
mov ecx, ebx
mov edx, 0xe
push esi
call fcn.007f9600
add esp, 4
mov dword [esp + 0x34], eax
jmp 0x81e6a7
mov eax, dword [esp + 4]
mov edx, dword [ebx]
mov eax, dword [eax + 4]
mov word [eax + edi*2], cx
mov ecx, dword [esp + 0x14]
call fcn.00792ba0
test eax, eax
jne 0x81e663
mov eax, str.2_p0
jmp 0x81e665
mov eax, dword [eax]
or dword [esp + 0x18], ebp
or dword [esp], esi
mov ebp, dword [esp + 4]
mov ecx, dword [ebp + 0x20]
mov dword [ecx + edi*4], eax
inc edi
add ebx, 0x30
cmp ebx, dword [esp + 0x28]
jb 0x81e49c
jmp 0x81e506
mov ecx, ebx
mov edx, 0x25
push dword [esi + 4]
call fcn.007f9600
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], 0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x81e6c5
mov dword [esp + 0x20], 0
mov ebp, dword [esp + 0x14]
jmp 0x81e6e5
mov ebp, dword [esp + 0x14]
mov ecx, ebp
call fcn.007fb640
push 0x10
mov dword [esp + 0x24], eax
push eax
push ebx
push ebp
call fcn.007fc0d0
add esp, 0x10
or byte [esi + 0x26], 2
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 4]
lea eax, [eax + ecx*8 + 0x30]
mov ecx, ebp
mov dword [esp + 0x24], eax
call fcn.007fcfa0
mov esi, eax
mov ecx, ebp
mov edx, ebx
push 0
push 0
push 0
push 0
push eax
mov ebp, dword [esp + 0x4c]
push dword [ebp + 4]
call fcn.008106c0
add esp, 0x18
mov dword [esp + 0x1c], eax
mov edx, 0x83
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x44], esi
mov ecx, ebx
push esi
push dword [ebp + 8]
call fcn.007d10d0
add esp, 8
mov ecx, ebx
mov edx, 0x10
call fcn.0078e010
cmp dword [esp + 0x10], 0
je 0x81e75b
mov edx, dword [esp + 0x20]
mov ecx, ebx
call fcn.007fbd70
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x34]
test byte [eax], 0x10
je 0x81e7bd
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
add esi, edi
mov edi, dword [esp + 0x3c]
mov ecx, edi
push esi
call fcn.007f77b0
add esp, 4
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
mov edx, ebp
mov ecx, esi
push dword [eax + 8]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0xc]
push dword [ebx + ebp*8 + 0x28]
mov ebp, dword [esp + 0x3c]
push dword [eax + 4]
call fcn.00827d60
add esp, 0xc
mov ecx, edi
mov edx, ebp
call fcn.007f7790
mov eax, dword [esp + 0x24]
and byte [eax], 0xef
jmp 0x81e7eb
mov edi, dword [esp + 0x3c]
lea eax, [ebp + 1]
mov edx, 5
mov ecx, edi
push eax
mov eax, dword [esp + 0x3c]
push dword [eax + 4]
call fcn.007d10d0
add esp, 8
mov ecx, edi
mov edx, 3
call fcn.0078e010
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x48]
mov ecx, edi
mov edx, ebp
call fcn.007f75c0
mov edx, dword [esp + 0x44]
mov ecx, esi
call fcn.007fc440
mov ecx, edi
mov edx, ebx
call fcn.007f75c0
mov edi, dword [esp + 0x10]
mov esi, dword [esi]
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00989fe9
mov ecx, esi
mov edx, edi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.007cb9e0