Function at 0x7c81e786
Capabilities:
Access peb ldr_data
Encode data using xor
Get file attributes
Get ntdll base address
Get process heap flags
Get process heap force flags
Set file attributes

Disassembly:
push 0x9c
push 0x7c81e998
call fcn.7c8024d6
or dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x19], 0
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
je 0x7c81e7be
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
test eax, eax
jne 0x7c83d18c
mov ebx, dword [ebp + 0x18]
mov eax, ebx
and eax, 1
mov byte [ebp - 0x2d], al
lea eax, [ebp - 0x6c]
push eax
push esi
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
call edi
mov byte [ebp - 0x4d], al
test al, al
je 0x7c83d300
mov dword [ebp - 0x60], ebx
and dword [ebp - 0x60], 4
jne 0x7c83d196
mov eax, dword [ebp - 0x6c]
cmp ax, si
jne 0x7c83d1a9
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x90], 0x18
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x84], 0x40
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
mov esi, ebx
and esi, 8
or esi, 0x10080
shr esi, 2
mov dword [ebp - 0xa8], esi
mov eax, esi
or eax, 0x200000
push eax
push 7
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x90]
push eax
push 0x110080
lea eax, [ebp - 0x20]
push eax
mov ebx, dword [sym.imp.ntdll.dll_NtOpenFile]
call ebx
mov dword [ebp - 0x2c], eax
test eax, eax
jl 0x7c82ec20
push 0x23
push 8
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [ebp - 0x2c], eax
test eax, eax
jl 0x7c83d2aa
test byte [ebp - 0x57], 4
jne 0x7c83d2c5
xor eax, eax
cmp dword [ebp - 0x60], eax
jne 0x7c83d1d9
push eax
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
call edi
mov byte [ebp - 0x4d], al
test al, al
je 0x7c83d300
xor edi, edi
cmp dword [ebp - 0x60], edi
jne 0x7c83d1f2
mov eax, dword fs:[0x18]
mov dword [ebp - 0xa0], eax
movzx ecx, word [ebp - 0x28]
add ecx, 0x10
push ecx
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x98], esi
cmp esi, edi
je 0x7c83d367
movzx eax, word [ebp - 0x28]
push eax
push dword [ebp - 0x24]
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.ntdll.dll_memmove]
add esp, 0xc
mov bl, byte [ebp - 0x2d]
mov byte [esi], bl
mov dword [esi + 4], edi
movzx eax, word [ebp - 0x28]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
and eax, 0x10
or eax, 0xa0
shr eax, 4
push eax
movzx eax, word [ebp - 0x28]
add eax, 0x10
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov edi, eax
mov dword [ebp - 0x2c], edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x9c], eax
push esi
xor esi, esi
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp edi, esi
jl 0x7c836a77
mov byte [ebp - 0x19], 1
or dword [ebp - 4], 0xffffffff
call fcn.7c81e9a9
movzx eax, byte [ebp - 0x19]
call fcn.7c802511
ret 0x14
cmp dword [ebp - 0x60], 0
jne 0x7c83d1b7
cmp eax, 0xc000000d
je 0x7c83d2df
test eax, eax
jge 0x7c81e8ab
push eax
jmp 0x7c83564d
fyl2x
outsb dx, byte [esi]
pop ds
inc esi
insd dword es:[edi], dx
sahf
mov dword [ebx + 0x3c], edx
in eax, 0xdf
in al, 0xca
fisub dword [esi + 9]
out 0xed, al
int3
call 0xe1df46ee
adc dword [esi], esi
wait
jmp 0xa192c737
mov eax, 0xb1dc9236
and dword [edi + 0x3c], edi
jg 0x7c83d1d0
mov ebx, 0xf83ecfcf
pop esp
popfd
and byte [ebx - 0x5dfd9c36], bh
pop ds
iretd
cmp eax, 0xbb76ff4d
stosb byte es:[edi], al
lcall 0xb00f, 0xcc9fc966
ja 0x7c83d173
leave
lahf
int3
imul edi, dword [ebx + 0x7e], 0x3ddd5f9c
wait
in al, 0x21
cmp eax, 0xb921e49b
rol byte [edi], 1
mov ah, 0xfd
mov ecx, 0xfdb407d0
insb byte es:[edi], dx
xchg ecx, eax
invalid
mov bl, 0x9d
clc
wait
int1
xchg ebx, eax
pop es
push esp
xchg edi, eax
inc ecx
sar dh, 0x8d
ret
dec ebp
into
cmpsb byte [esi], byte es:[edi]
jbe 0x7c83d1d2
loop 0x7c83d1a2
in eax, 0xf0
inc edi
and eax, 0xf06e1f71
in eax, dx
sal byte [0xb8dcc870], 0x45
dec edi
dec esi
inc esp
jbe 0x7c83d192
mov ecx, 0x773d75f1
sti
and edi, dword [edi]
mov ecx, 0x81985730
and al, 0xc6
call dword [ebx + 0x19]
inc ebp
insd dword es:[edi], dx
cmp dword [edx], edi
sub al, 0x62
test dword [ebx - 0x423cdcc2], 0x2f65e3c8
jge 0x7c83d1bb
sbb ch, ch
adc dword [ebx - 0x27f91756], esp
leave
and eax, 0xabe670ca
ja 0x7c83d22c
sub byte [esi], al
mov dword [0x18596443], eax
fidiv dword [ebp - 0x5fd351b9]
inc ebx
pop ecx
sbb dl, bl
mov ch, 0x47
scasb al, byte es:[edi]
sub al, 0xa0
mov esp, dword [esi + 0x2cbab6ae]
push eax
cld
jmp 0x7c83d1ca
pop edx
fadd st(3)
leave
mov ch, al
mov ecx, 0x97a5b9c7
cmc
outsb dx, byte [esi]
out dx, al
push ebp
imul ebp, dword [ebp + 0x378386e1], 0x7a
mov edi, 0x92ea0989
lodsd eax, dword [esi]
mov ecx, 0xaf0f7e4c
mov ebx, dword [edi]
iretd
retf
push ss
stosd dword es:[edi], eax
push ecx
sbb ecx, edx
push ecx
clc
insd dword es:[edi], dx
jne 0x7c83d2b9
salc
mov dh, 0x92
jae 0x7c83d2c2
pop ecx
into
out 0xce, al
cld
and byte [edx], bh
arpl bx, si
test dword [ecx + 0x6b], esi
adc byte [edi + 0x5e8ac0ff], cl
inc esi
inc eax
mov bl, byte [esi + 0x46]
jnp 0x7c83d28e
salc
into
xor edx, esi
aad 0x78
into
invalid
enter 0x4e88, 0x35
adc dword [ecx + 0x4f8be5b0], eax
dec edi
mov bh, 0xdd
sahf
mov edx, 0x316c3d3f
sub ah, byte [edx - 0x2363a641]
lahf
mov esi, 0x3eb0b956
add dword [ebp + 0x1fc5ab98], esp
xor dword [ecx], eax
outsd dx, dword [esi]
or ecx, esi
jecxz 0x7c83d2f7
into
cmp al, 0x37
jl 0x7c83d2fb
mov esi, 0xe353aaa5
xchg esp, eax
pop es
jp 0x7c83d3a8
cld
xor eax, 0xee28a80b
nop
mov ds, word [ebp + 0x7f]
dec edx
fstp xword [esi + ecx*8 + 0x47699c5a]
push ds
cmc
cmc
sahf
dec ebp
mov byte [edi + ebx*2 + 0x7c7a6cff], 0x78
inc ebp
push dword [ebx + 0x73]
stc
mov word [edi], fs
rcr ecx, 1
inc ecx
invalid
pop esp
fdiv dword [eax + 0x7f]
mov dh, 0x2e
sub eax, 0x428e3c3b
pop eax
fsub qword [edx + 0x62]
in al, 0x8a
push edi
add esi, dword [ecx + ebx*8 + 0x2e1a2505]
add edx, dword [edx]
invalid
push edx
adc al, 0x8b
insb byte es:[edi], dx
comiss xmm2, xmm5
wait
sbb byte [eax - 0x36], dl
enter 0xd4b, 0x4e
and dword [ebp - 0x6f39f835], 0xd2974a5e
and al, al
xor dh, byte [edi]
fld qword [ebp + 0x2031902]
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
push ebx
in al, dx
xchg edi, eax
pop ds
mov eax, 0xa8f9489f
imul ebx, dword [ebx], 0xd142290b
inc esi
hlt