Function at 0x100564c0
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [0x100db8d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, esp
mov dword [eax + 4], 0x10
mov dword [eax], 6
call fcn.10044210
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x218], eax
cmp dword [ebp + 0xc], 0
jne 0x10056583
lea eax, [ebp - 0x20c]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x20c]
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
sub esp, 4
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x108]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.100a3420
lea ecx, [ebp - 0x108]
lea eax, [0x100ce48a]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100a3430
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100a3430
jmp 0x1005691a
mov eax, dword [0x100dac50]
and eax, dword [0x100dac54]
xor eax, 0xfecd7c0e
mov ecx, 0x51de5222
xor edx, edx
div ecx
add eax, 0xc549b401
xor eax, 0x47afee35
add eax, 0x18e309e4
mov ecx, 0xdcdd6273
xor edx, edx
div ecx
mov ecx, 0x492b8e36
xor edx, edx
div ecx
and eax, 0xf6628535
add eax, 0xc1d49d06
or eax, 0xd2ae1a27
xor eax, 0x69a8a9e6
sub eax, 0xe0ecd188
imul eax, eax, 0xbf2a5cb5
and eax, 0xdec94e0c
sub eax, 0x64b1849a
or eax, 0x983744a4
imul eax, eax, 0xa47bb0ce
and eax, 0xdfe4c763
sub eax, 0x5c0559e2
imul eax, eax, 0x8367a3e2
xor eax, 0xe40289e8
or eax, 0xfa92cf24
sub eax, 0xe6524226
or eax, 0xe3100d52
mov ecx, 0x3506b95f
xor edx, edx
div ecx
or eax, 0x895d1a42
and eax, 0x5565f314
or eax, 0x82b03b2b
mov ecx, 0xfd2de1cd
xor edx, edx
div ecx
imul eax, eax, 0x5af4b90d
add eax, 0x86455a2a
sub eax, 0xa0118617
xor eax, 0xfdc6c2b1
and eax, 0x77e2161d
imul eax, eax, 0x1b609767
mov ecx, 0xda907042
xor edx, edx
div ecx
and eax, 0x1bcc187e
mov ecx, 0xf8b3ba8e
xor edx, edx
div ecx
imul eax, eax, 0x57a09d87
and eax, 0x39f536a0
sub eax, 0x3f453969
mov ecx, 0x2fa5708c
xor edx, edx
div ecx
mov ecx, 0x69946001
xor edx, edx
div ecx
imul eax, eax, 0x4258f0f6
imul eax, eax, 0x7c6d6aed
xor eax, 0x8e70225e
imul eax, eax, 0x7fddf532
and eax, 0xdbf1c1bc
add eax, 0xe65e990a
xor eax, 0x88ad75a3
xor eax, 0x55fd22ee
or eax, 0x29c994dd
sub eax, 0x9ab2be00
imul eax, eax, 0x1310f589
imul eax, eax, 0xd54264b9
xor eax, 0x187147af
xor eax, 0xf1dc0874
and eax, 0xeef34218
and eax, 0x4fa370d0
or eax, 0x1415ecd0
xor eax, 0xac365027
mov ecx, 0x2ad6c1fa
xor edx, edx
div ecx
or eax, 0xd34d5acf
xor eax, 0x21ceee87
sub eax, 0x41ad331d
mov ecx, 0xdc0e7b55
xor edx, edx
div ecx
add eax, 0xd614ad26
xor eax, 0x7f1be3e7
imul eax, eax, 0x89fa4142
sub eax, 0x14a3c749
add eax, 0xa5ffae94
sub eax, 0x6d16dba4
cmp eax, 0xa513c3ef
je 0x1005709c
mov eax, dword [0x100dac58]
imul eax, dword [0x100dac5c]
imul eax, eax, 0xd4381f00
mov ecx, 0xd624a9d2
xor edx, edx
div ecx
xor eax, 0xf824efd
add eax, 0xa4a0fb2d
mov ecx, 0x41ab9fc7
xor edx, edx
div ecx
add eax, 0x7634eefa
add eax, 0xe0311cea
add eax, 0x53b2a7a5
or eax, 0x4abacc1a
or eax, 0x1db02fdd
or eax, 0x88f8b8e4
imul eax, eax, 0xdce445f
and eax, 0x223634b
xor eax, 0x97cd34c
or eax, 0xfa27e642
mov ecx, 0x6860c29
xor edx, edx
div ecx
add eax, 0x5ca2396c
or eax, 0xbce6547b
or eax, 0xd17f7d9d
add eax, 0x996f5549
sub eax, 0xb6a111c
mov ecx, 0xaff747b7
xor edx, edx
div ecx
add eax, 0xdd4a36c9
add eax, 0xe0d4aecd
imul eax, eax, 0x132adfc6
mov ecx, 0x2419484f
xor edx, edx
div ecx
or eax, 0x11497523
or eax, 0x4f1eebcc
xor eax, 0x44469691
or eax, 0xe5f6dc7e
add eax, 0xe1b6db3f
imul eax, eax, 0x2e9a18a3
xor eax, 0xafd7d75e
mov ecx, 0xbaa1450
xor edx, edx
div ecx
add eax, 0xbc5d2be6
mov ecx, 0x7f3f96fd
xor edx, edx
div ecx
sub eax, 0x7a183236
and eax, 0x726694d1
sub eax, 0x5136591b
and eax, 0xce550708
add eax, 0xb4a79249
add eax, 0xa5579ec7
mov ecx, 0xb822dcbb
xor edx, edx
div ecx
mov ecx, 0x41289f0
xor edx, edx
div ecx
sub eax, 0x8229d141
sub eax, 0xb1266f61
mov ecx, 0x3330dfcb
xor edx, edx
div ecx
mov ecx, 0x44f806d8
xor edx, edx
div ecx
xor eax, 0x52cd9226
and eax, 0x5e79638f
or eax, 0xa6cc9c87
and eax, 0x4f9d920b
sub eax, 0x8e503936
mov ecx, 0xb98c7798
xor edx, edx
div ecx
xor eax, 0x751d495d
sub eax, 0x857f6a4f
or eax, 0x9dca8bec
or eax, 0x378d5b1
and eax, 0x28c5d9b8
xor eax, 0x43510ede
or eax, 0x964fe78a
and eax, 0x70e66620
xor eax, 0xbb8aba88
xor eax, 0xf02ae3a9
mov ecx, 0x5ef17938
xor edx, edx
div ecx
xor eax, 0xf0d8fcde
sub eax, 0x8943bce4
xor eax, 0x3d28ed6b
xor eax, 0x9b59bf3a
sub eax, 0x61132d62
and eax, 0x1020f396
mov ecx, 0xc886b83d
xor edx, edx
div ecx
mov dword [ebp - 0x220], eax
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x108]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.100a3420
mov eax, dword [ebp - 0x220]
cmp eax, 0xb9d35029
jae 0x10056739
jmp 0x1005691a
mov eax, dword [0x100dac60]
add eax, dword [0x100dac64]
add eax, 0x23fbc0e7
xor eax, 0xcff600ac
xor eax, 0x30789128
and eax, 0x76eaf6b5
imul eax, eax, 0x8072196f
imul eax, eax, 0xcae5059f
and eax, 0x2c234938
or eax, 0xf8b47300
and eax, 0xba2b9365
xor eax, 0x64b38895
and eax, 0x566d6148
imul eax, eax, 0x946ef063
sub eax, 0xf2e3a7e
or eax, 0x59ed99f1
xor eax, 0x50ff6e4
mov ecx, 0x626e1cfe
xor edx, edx
div ecx
xor eax, 0xcd04d431
add eax, 0xf76c69df
mov ecx, 0x5ffbb35a
xor edx, edx
div ecx
sub eax, 0xed93dfd2
or eax, 0x11e15b8e
imul eax, eax, 0x4b6471e5
sub eax, 0x56f670c7
or eax, 0x1ed21192
imul eax, eax, 0xa833171c
or eax, 0x71b3cadc
add eax, 0xaa9a83c3
and eax, 0xc6a19f0b
imul eax, eax, 0xb7433e13
xor eax, 0xf695f382
imul eax, eax, 0x64f33574
add eax, 0x12e049fb
mov ecx, 0x18b173c9
xor edx, edx
div ecx
sub eax, 0x8e17fbf
sub eax, 0xa267113d
sub eax, 0xd1aaf493
and eax, 0xc45a2c0b
xor eax, 0x96630901
xor eax, 0x9d667948
or eax, 0x9a268a43
add eax, 0xdc561963
or eax, 0x551bb322
and eax, 0xc97dbbb2
add eax, 0x2f3fe27a
and eax, 0x3cf778fa
or eax, 0xea3ac733
imul eax, eax, 0x8822f644
add eax, 0x96238aab
add eax, 0x8ae0f375
xor eax, 0xe16dd48b
sub eax, 0x72da119c
mov ecx, 0xab1fdcd
xor edx, edx
div ecx
mov ecx, 0xcdab8955
xor edx, edx
div ecx
or eax, 0x6962745d
imul eax, eax, 0x9cdb3f14
xor eax, 0xc8ba784b
or eax, 0xf0c62f16
mov ecx, 0xad83155c
xor edx, edx
div ecx
sub eax, 0x1bb10aa8
xor eax, 0x6882a224
and eax, 0x525d603e
xor eax, 0x3e8cab78
imul eax, eax, 0x802abe54
xor eax, 0x54245732
add eax, 0xcad8b14
or eax, 0x32c26d7d
mov ecx, 0xf38665a3
xor edx, edx
div ecx
xor eax, 0xb2a03dfd
and eax, 0xa3440770
or eax, 0xcb803081
or eax, 0xaad1f05d
add eax, 0x3a04b0dc
cmp eax, 0xbba1408b
jae 0x100570b6
mov eax, dword [0x100dac68]
and eax, dword [0x100dac6c]
xor eax, 0x2fe8318
or eax, 0x95aaea48
imul eax, eax, 0x60e6e95f
mov ecx, 0xc369f0c2
xor edx, edx
div ecx
and eax, 0x95ad3f0b
imul eax, eax, 0xa641673d
and eax, 0x4ccf4462
and eax, 0x8b4e93ad
xor eax, 0xefafefc2
or eax, 0xe7bbb057
add eax, 0x7295a932
add eax, 0x501d68d3
sub eax, 0xa265fda8
mov ecx, 0x39991818
xor edx, edx
div ecx
mov ecx, 0xc1e25d36
xor edx, edx
div ecx
imul eax, eax, 0xfc30a6f6
and eax, 0xb87b6238
imul eax, eax, 0x8b04c0ee
and eax, 0x6d0c5365
sub eax, 0xdf6a8e47
and eax, 0x89fcd9cd
xor eax, 0xc2a5522
add eax, 0x2caca61d
and eax, 0xb84171ef
and eax, 0x36fb280f
sub eax, 0xfd9506f0
imul eax, eax, 0xd1fce6ca
sub eax, 0x18e9ca85
xor eax, 0xf7d4673f
sub eax, 0x682ada93
or eax, 0xe066cb77
sub eax, 0xf16c5596
mov ecx, 0xa86b0c0c
xor edx, edx
div ecx
imul eax, eax, 0xd0796898
and eax, 0x3999fc58
add eax, 0x86746650
xor eax, 0x3c732f4c
mov ecx, 0xbaf6693
xor edx, edx
div ecx
imul eax, eax, 0xa0fe3293
and eax, 0xecac3e88
imul eax, eax, 0x7b6837ae
xor eax, 0xb3905435
add eax, 0xe710dfd2
imul eax, eax, 0xb1107974
sub eax, 0x56d5b6c3
mov ecx, 0x49b9d5cd
xor edx, edx
div ecx
mov ecx, 0x36be1be5
xor edx, edx
div ecx
or eax, 0xde530f90
imul eax, eax, 0x2c395426
xor eax, 0xf0ac19e5
xor eax, 0x4c2b673f
add eax, 0x7080cc8e
mov ecx, 0xccedcd8e
xor edx, edx
div ecx
or eax, 0xd2d59b91
add eax, 0x2ca55b8d
imul eax, eax, 0x4b0450a8
imul eax, eax, 0xe9db9f37
add eax, 0x794d8f25
xor eax, 0x1ca85dd2
mov ecx, 0x4fe6be61
xor edx, edx
div ecx
or eax, 0xdf620725
imul eax, eax, 0xeb7419b9
add eax, 0xad26c8b9
mov ecx, 0x5b47d67
xor edx, edx
div ecx
mov ecx, 0x9f9e9dd5
xor edx, edx
div ecx
add eax, 0x4a6848e5
xor eax, 0xdb29d969
add eax, 0x743f0431
mov ecx, 0x744d79c7
xor edx, edx
div ecx
and eax, 0x254af859
imul eax, eax, 0xda1ea2c4
and eax, 0xf4415882
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x108]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x21c], eax
mov dword [esp], 0x14
mov dword [esp + 4], 0x1a
call fcn.1000ced0
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x224], ecx
cmp eax, 0xe84794fc
je 0x10056abe
mov eax, dword [ebp - 0x224]
sub eax, 0xffffffff
je 0x10056ce6
jmp 0x10056cd2
mov eax, dword [ebp - 0x224]
sub eax, 0x10
je 0x10056cf5
jmp 0x1005706e
mov dword [ebp - 0x210], 2
jmp 0x10057078
mov eax, dword [0x100dac70]
or eax, dword [0x100dac74]
sub eax, 0xbc3ede75
and eax, 0xc7beb44f
mov ecx, 0x90f401c
xor edx, edx
div ecx
imul eax, eax, 0xbf2d7365
add eax, 0x49dcc020
and eax, 0x967fabe5
or eax, 0x4e608dd3
or eax, 0x8417a781
add eax, 0x615fbdf1
or eax, 0x8cfad9a8
and eax, 0x64aa887e
xor eax, 0xff5bdd20
and eax, 0x970d0add
xor eax, 0x23a60650
mov ecx, 0x473bc2d4
xor edx, edx
div ecx
add eax, 0x6c55737c
or eax, 0x1a32ce1b
or eax, 0x45d2b523
imul eax, eax, 0x2783cbfb
mov ecx, 0x2d134046
xor edx, edx
div ecx
xor eax, 0x56a4703a
sub eax, 0x15902a94
or eax, 0x48b03b72
add eax, 0xd68b7db7
mov ecx, 0xfb6a8715
xor edx, edx
div ecx
sub eax, 0xa76fa52c
and eax, 0x8b96dfcc
xor eax, 0xe6cd8f47
imul eax, eax, 0x35de20ef
sub eax, 0x973ebd5f
or eax, 0xe9e0c2ac
sub eax, 0x3548c40e
imul eax, eax, 0x2e6d9003
and eax, 0x46bf4722
or eax, 0x899cb176
sub eax, 0xc3f364ca
mov ecx, 0x429c2644
xor edx, edx
div ecx
sub eax, 0x781622f3
sub eax, 0xd390c30c
imul eax, eax, 0x42978652
add eax, 0x3e947a89
mov ecx, 0xb5cd1718
xor edx, edx
div ecx
xor eax, 0xc8921e3d
add eax, 0x99756d19
sub eax, 0x9e096b3
imul eax, eax, 0xaf360e7
or eax, 0x675b031a
add eax, 0x60dbcc88
imul eax, eax, 0x13ab5954
and eax, 0x77173028
sub eax, 0xba740227
or eax, 0x8bcac053
mov ecx, 0xd9c22685
xor edx, edx
div ecx
add eax, 0xa6d78a1d
sub eax, 0xe60fbf3
add eax, 0x56ceff21
mov ecx, 0xc0009412
xor edx, edx
div ecx
sub eax, 0xbf8098fd
sub eax, 0x4336955f
add eax, 0xbc30cb36
xor eax, 0x1d6ecfe0
sub eax, 0x798a4cbf
imul eax, eax, 0xbda3a500
xor eax, 0xeec62328
mov ecx, 0x8ace3dc5
xor edx, edx
div ecx
sub eax, 0xf90e2644
imul eax, eax, 0x964c483f
xor eax, 0xe7293ad
imul eax, eax, 0x8a0c4a6d
and eax, 0xd08d72e4
mov ecx, 0xdc957099
xor edx, edx
div ecx
add eax, 0x9f6a924d
cmp eax, 0xf914778f
ja 0x100570e7
mov eax, dword [0x100dac78]
imul eax, dword [0x100dac7c]
mov ecx, 0xa186322f
xor edx, edx
div ecx
or eax, 0xded221fe
mov ecx, 0xd9c6306
xor edx, edx
div ecx
imul eax, eax, 0xb8f8e1aa
and eax, 0x3b5cfe2a
imul eax, eax, 0x9ae7aa06
or eax, 0x57321e6
and eax, 0x5cb69e8a
sub eax, 0x5ec66dd8
imul eax, eax, 0xa6151795
xor eax, 0xf707c815
xor eax, 0x255d0f0e
mov ecx, 0x4f6ecf0c
xor edx, edx
div ecx
mov ecx, 0xd5fa1815
xor edx, edx
div ecx
or eax, 0xe0eea4a0
add eax, 0x3c95c0d2
imul eax, eax, 0xd987f5bd
add eax, 0xb5dd1c11
add eax, 0x6b295b0d
and eax, 0x654f8f12
xor eax, 0x70e9689f
add eax, 0x9aed8c4f
imul eax, eax, 0xfe49ead6
mov ecx, 0xe2833808
xor edx, edx
div ecx
and eax, 0xfa0178e5
add eax, 0x217519da
imul eax, eax, 0xc758ef34
imul eax, eax, 0x4490b7bb
imul eax, eax, 0x10920768
sub eax, 0xbe6759c3
and eax, 0x5d0d7831
sub eax, 0x3590f950
or eax, 0x705a1d0a
or eax, 0xd037f4d2
imul eax, eax, 0xbf223a69
xor eax, 0xef1d5b17
xor eax, 0xc22a5c5f
sub eax, 0xebd62148
and eax, 0x41c4fba7
mov ecx, 0xa7ec3961
xor edx, edx
div ecx
or eax, 0x3898bef
imul eax, eax, 0xbce188e2
mov ecx, 0xdae155bd
xor edx, edx
div ecx
or eax, 0xc5611d21
mov ecx, 0x68eb900d
xor edx, edx
div ecx
or eax, 0xd98d19f7
or eax, 0x8b97bd82
sub eax, 0x3068fc10
or eax, 0x22bc2e9f
or eax, 0x91ac13b1
imul eax, eax, 0x4185db82
and eax, 0x3e1eb20a
sub eax, 0x55ccf387
or eax, 0xc6746c2
or eax, 0xb6760ca7
xor eax, 0x4ad08dee
xor eax, 0x5a345cdf
sub eax, 0xb9122f4c
xor eax, 0xcc6db7b8
xor eax, 0x14a10bf2
imul eax, eax, 0xe34abb22
sub eax, 0x6db3ca61
imul eax, eax, 0x6ed7d1d4
add eax, 0x585869f8
xor eax, 0xa994950e
imul eax, eax, 0x92de8a78
mov ecx, 0x4b02dde5
xor edx, edx
div ecx
add eax, 0x8cc7ac62
mov ecx, 0xa548053c
xor edx, edx
div ecx
imul eax, eax, 0x5ee49f30
add eax, 0xa1cc409f
mov ecx, 0x2d360a9b
xor edx, edx
div ecx
mov dword [ebp - 0x210], 1
cmp eax, 0x81325097
ja 0x10056ea5
jmp 0x10057078
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008271f
mov eax, dword [ebp - 0x22c]
add esp, 0x238
pop ebp
ret
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x108]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.100a3420
jmp 0x10056739
lea eax, [ebp - 0x108]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x21c], eax
mov dword [esp], 0x14
mov dword [esp + 4], 0x1a
call fcn.1000ced0
jmp 0x10056abe
mov dword [ebp - 0x210], 1
jmp 0x10056ea5