Function at 0x42489d
Capabilities:
Encode data using xor
Set file attributes

Disassembly:
push 0x2c0
mov eax, 0x58349d
call fcn.00560e29
xor ebx, ebx
push ebx
push dword [ebp + 8]
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x42506a
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x69882c], 1
jne 0x4249cd
mov dword [ebp - 0x10], 0x58fa7c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42492c
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
pop ecx
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x424923
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
inc edx
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42490a
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0x224]
call fcn.00424676
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x58faa4
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x424994
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
pop ecx
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42498b
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
inc edx
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x424972
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.0042163d
push dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
call fcn.0042163d
add esp, 0x10
lea ecx, [ebp - 0x224]
call fcn.004251dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.004247cb
cmp dword [0x69883c], 1
jne 0x424c24
lea eax, [ebp - 0x24]
push eax
call fcn.005660ac
lea eax, [ebp - 0x24]
push eax
call fcn.00565e0d
mov dword [ebp - 0x10], 0x58fac8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
pop ecx
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [ebx + 0x13], 0
pop ecx
je 0x424a45
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x424a3c
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x424a21
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xd4]
call fcn.00424676
mov dword [ebp - 0x10], 0x58fae0
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 1
cmp byte [ebx + 0x13], 0
je 0x424ab2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x424aa9
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x424a8e
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.0042163d
push dword [ebp - 0x14]
call fcn.00565c00
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.0042163d
mov dword [ebp - 0x10], 0x58fb04
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x424b2b
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x424b22
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x424b07
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.0042163d
push dword [ebp + 8]
lea eax, [ebp - 0xd4]
push eax
call fcn.0042163d
mov dword [ebp - 0x10], 0x58fb28
add esp, 0x10
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x424b9e
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x424b95
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x424b7a
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.0042163d
pop ecx
pop ecx
lea ecx, [ebp - 0xd4]
call fcn.004251dc
mov dword [ebp - 0x10], 0x58fac8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x424c0c
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x424c03
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x424be8
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.004247cb
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x42506a
cmp dword [0x69882c], 1
jne 0x424dbb
mov dword [ebp - 0x10], 0x58fa7c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x424ca6
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x424c9d
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x424c82
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0x2cc]
call fcn.00424676
mov dword [ebp - 0x10], 0x58fb64
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x10]
add ebx, 0x14
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], ebx
cmp byte [edi + 0x13], 0
je 0x424d19
mov esi, dword [edi + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x424d0d
sub ebx, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + edi + 7]
xor al, byte [ebx + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [edi + 0xf]
jb 0x424cf2
mov eax, dword [edi + 0xf]
mov ebx, edx
mov dword [ebp - 0x1c], edx
mov byte [edx + eax], 0
mov dword [ebp - 0x10], 0x58faa4
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [eax + 0x13], 0
je 0x424d7e
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, dword [ebp - 0x14]
pop ecx
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
test esi, esi
je 0x424d75
mov ebx, ecx
sub edi, ebx
lea ecx, [eax + ebx]
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [edx + 0xf]
jb 0x424d54
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x2cc]
push edi
push eax
call fcn.0042163d
pop ecx
pop ecx
push eax
call fcn.0042163d
pop ecx
pop ecx
push eax
call fcn.0042163d
pop ecx
pop ecx
lea ecx, [ebp - 0x2cc]
call fcn.004251dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2cc]
call fcn.004247cb
cmp dword [0x69883c], 1
jne 0x425065
lea eax, [ebp - 0x2c]
push eax
call fcn.005660ac
lea eax, [ebp - 0x2c]
push eax
call fcn.00565e0d
mov dword [ebp - 0x14], 0x58fac8
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
pop ecx
add edi, 0x14
mov dword [ebp - 0x18], eax
cmp byte [ebx + 0x13], 0
pop ecx
je 0x424e33
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x14], eax
pop ecx
test esi, esi
je 0x424e2a
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, dword [ebx + 0xf]
jb 0x424e0f
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0x17c]
call fcn.00424676
mov dword [ebp - 0x14], 0x58fae0
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
add edi, 0x14
mov dword [ebp - 4], 3
cmp byte [ebx + 0x13], 0
je 0x424e9e
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
pop ecx
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x424e95
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
mov ecx, dword [ebp - 0x14]
cmp edx, dword [ebx + 0xf]
jb 0x424e7c
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x17c]
push edi
push eax
call fcn.0042163d
push dword [ebp - 0x18]
call fcn.00565c00
push eax
lea eax, [ebp - 0x17c]
push eax
call fcn.0042163d
mov dword [ebp - 0x14], 0x58fb64
add esp, 0x14
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x14]
add ebx, 0x14
mov dword [ebp - 0x18], ebx
cmp byte [edi + 0x13], 0
je 0x424f1b
mov esi, dword [edi + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
pop ecx
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x424f0f
sub ebx, ecx
mov eax, edx
add ecx, edx
and eax, 7
mov al, byte [eax + edi + 7]
xor al, byte [ebx + ecx]
inc edx
mov byte [ecx], al
mov ecx, dword [ebp - 0x14]
cmp edx, dword [edi + 0xf]
jb 0x424ef6
mov eax, dword [edi + 0xf]
mov ebx, ecx
mov dword [ebp - 0x18], ecx
mov byte [ecx + eax], 0
mov dword [ebp - 0x14], 0x58fb04
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
add edi, 0x14
mov dword [ebp - 0x1c], eax
cmp byte [eax + 0x13], 0
je 0x424f7b
mov esi, dword [eax + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
and dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x1c]
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x424f72
mov ebx, dword [ebp - 0x10]
sub edi, ecx
mov eax, ebx
add ecx, ebx
and eax, 7
mov al, byte [eax + edx + 7]
xor al, byte [edi + ecx]
inc ebx
mov byte [ecx], al
mov ecx, dword [ebp - 0x14]
cmp ebx, dword [edx + 0xf]
jb 0x424f56
mov ebx, dword [ebp - 0x18]
mov eax, dword [edx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x17c]
push edi
push eax
call fcn.0042163d
pop ecx
pop ecx
push eax
call fcn.0042163d
pop ecx
pop ecx
push eax
call fcn.0042163d
mov dword [ebp - 0x14], 0x58fb28
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
pop ecx
add edi, 0x14
cmp byte [ebx + 0x13], 0
pop ecx
je 0x424ff0
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
pop ecx
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x424fe7
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
mov ecx, dword [ebp - 0x14]
cmp edx, dword [ebx + 0xf]
jb 0x424fce
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x17c]
push edi
push eax
call fcn.0042163d
pop ecx
pop ecx
lea ecx, [ebp - 0x17c]
call fcn.004251dc
mov dword [ebp - 0x14], 0x58fac8
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42505c
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
pop ecx
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x425053
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
mov ecx, dword [ebp - 0x14]
cmp edx, dword [ebx + 0xf]
jb 0x42503a
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.0042480f
call fcn.00560e06
ret