Function at 0x10006ef0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10019c6b
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x10025018]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
push edi
mov eax, dword [0x10025018]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
xor eax, eax
mov byte [0x112832cc], 0
lea ebx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax + 0x10130538]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x10130538], cl
add eax, ebx
cmp eax, 0x500000
jb 0x10006f40
xor eax, eax
lea ecx, [ecx]
mov dl, byte [eax + 0x10130498]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x10130498], dl
add eax, ebx
cmp eax, 0xa0
jb 0x10006f60
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x10130418]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x10130418], cl
add eax, ebx
cmp eax, 0x7c
jb 0x10006f80
xor eax, eax
jmp 0x10006fa0
mov dl, byte [eax + 0x1012fee8]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012fee8], dl
add eax, ebx
cmp eax, 0x52f
jb 0x10006fa0
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x1012fe7c]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x1012fe7c], cl
add eax, ebx
cmp eax, 0x32
jb 0x10006fc0
xor eax, eax
jmp 0x10006fe0
mov dl, byte [eax + 0x1012feb0]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012feb0], dl
add eax, ebx
cmp eax, 0x32
jb 0x10006fe0
xor edi, edi
cmp edi, 0x52f
jge 0x100071c6
cmp edi, 0xa0
jge 0x10007064
mov cl, byte [edi + 0x10130498]
mov eax, edi
add eax, 0x10005590
cmp cl, byte [eax]
je 0x10007064
mov byte [0x112832cc], bl
mov ecx, 0x93
xor eax, eax
lea ecx, [ecx]
mov dl, byte [eax + 0x1001fad4]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x10], dl
add eax, ebx
and ecx, 0xff
cmp eax, 0x1f
jb 0x10007030
push edi
lea eax, [esp + 0x14]
push eax
push 0
mov ecx, 0x10125568
mov byte [esp + 0x3b], 0
call fcn.1000aff0
add esp, 0xc
cmp edi, 0x7c
jge 0x100070c4
mov dl, byte [edi + 0x10130418]
mov ecx, edi
add ecx, fcn.10004fe0
cmp dl, byte [ecx]
je 0x100070c4
mov byte [0x112832cc], bl
mov ecx, 0xca
xor eax, eax
jmp 0x10007090
mov dl, byte [eax + 0x1001faf4]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x10], dl
add eax, ebx
and ecx, 0xff
cmp eax, 0x1a
jb 0x10007090
push edi
lea eax, [esp + 0x14]
push eax
push 0
mov ecx, 0x10125568
mov byte [esp + 0x36], 0
call fcn.1000aff0
add esp, 0xc
mov dl, byte [edi + 0x1012fee8]
mov ecx, fcn.10005060
cmp dl, byte [ecx + edi]
je 0x10007115
mov byte [0x112832cc], bl
mov ecx, 0x55
xor eax, eax
mov dl, byte [eax + 0x1001fb10]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x10], dl
add eax, ebx
and ecx, 0xff
cmp eax, 0x1a
jb 0x100070e1
push edi
lea eax, [esp + 0x14]
push eax
push 0
mov ecx, 0x10125568
mov byte [esp + 0x36], 0
call fcn.1000aff0
add esp, 0xc
cmp edi, 0x32
jae 0x100071c6
mov dl, byte [edi + 0x1012fe7c]
mov ecx, 0x1000df50
cmp dl, byte [ecx + edi]
je 0x10007174
mov byte [0x112832cc], bl
mov ecx, 0xa7
xor eax, eax
jmp 0x10007140
mov dl, byte [eax + 0x1001fb2c]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x10], dl
add eax, ebx
and ecx, 0xff
cmp eax, 0x20
jb 0x10007140
push edi
lea eax, [esp + 0x14]
push eax
push 0
mov ecx, 0x10125568
mov byte [esp + 0x3c], 0
call fcn.1000aff0
add esp, 0xc
mov cl, byte [edi + 0x1012feb0]
mov edx, dword [0x1012fee4]
cmp cl, byte [edx + edi]
je 0x100071c6
mov byte [0x112832cc], bl
mov ecx, 0x7f
xor eax, eax
mov dl, byte [eax + 0x1001fb50]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x10], dl
add eax, ebx
and ecx, 0xff
cmp eax, 0x1d
jb 0x10007192
push edi
lea eax, [esp + 0x14]
push eax
push 0
mov ecx, 0x10125568
mov byte [esp + 0x39], 0
call fcn.1000aff0
add esp, 0xc
lea eax, [edi + 0x400000]
cmp eax, 0x400000
je 0x10007678
cmp eax, 0x4d04cd
je 0x10007678
cmp eax, 0x4d2355
je 0x10007678
cmp eax, 0x4efeb0
je 0x10007678
cmp eax, 0x51ec90
je 0x10007678
cmp eax, 0x51ee20
jl 0x10007215
cmp eax, 0x556c38
jle 0x10007678
cmp eax, 0x57491b
jl 0x10007227
cmp eax, 0x574922
jle 0x10007678
cmp eax, 0x574f2f
jl 0x10007239
cmp eax, 0x574f36
jle 0x10007678
cmp eax, 0x574ffd
jl 0x1000724b
cmp eax, 0x575004
jle 0x10007678
cmp eax, 0x57655b
jl 0x1000725d
cmp eax, 0x57655f
jle 0x10007678
cmp eax, 0x576d93
jl 0x1000726f
cmp eax, 0x576d97
jle 0x10007678
cmp eax, 0x576ddb
jl 0x10007281
cmp eax, 0x576ddf
jle 0x10007678
cmp eax, 0x57acbf
jl 0x10007293
cmp eax, 0x57acc3
jle 0x10007678
cmp eax, 0x57ad03
jl 0x100072a5
cmp eax, 0x57ad07
jle 0x10007678
cmp eax, 0x57ad47
jl 0x100072b7
cmp eax, 0x57ad4b
jle 0x10007678
cmp eax, 0x57be80
jl 0x100072c9
cmp eax, 0x57be84
jle 0x10007678
cmp eax, 0x57bf0e
jl 0x100072db
cmp eax, 0x57bf12
jle 0x10007678
cmp eax, 0x57bf78
jl 0x100072ed
cmp eax, 0x57bf7c
jle 0x10007678
cmp eax, 0x57c057
jl 0x100072ff
cmp eax, 0x57c05b
jle 0x10007678
cmp eax, 0x57c0bb
jl 0x10007311
cmp eax, 0x57c0bf
jle 0x10007678
cmp eax, 0x57c125
jl 0x10007323
cmp eax, 0x57c129
jle 0x10007678
cmp eax, 0x57d279
jl 0x10007335
cmp eax, 0x57d27a
jle 0x10007678
cmp eax, 0x5802f5
jl 0x10007347
cmp eax, 0x5802f6
jle 0x10007678
cmp eax, 0x5883bc
jl 0x10007359
cmp eax, 0x5883c0
jle 0x10007678
cmp eax, 0x5883f4
jl 0x1000736b
cmp eax, 0x5883f8
jle 0x10007678
cmp eax, 0x588661
jl 0x1000737d
cmp eax, 0x588665
jle 0x10007678
cmp eax, 0x5977e0
je 0x10007678
cmp eax, 0x59af55
je 0x10007678
cmp eax, 0x59b24a
je 0x10007678
cmp eax, 0x5b768f
jl 0x100073b0
cmp eax, 0x5b7693
jle 0x10007678
cmp eax, 0x5b770c
jl 0x100073c2
cmp eax, 0x5b7710
jle 0x10007678
cmp eax, 0x5bafac
jl 0x100073d4
cmp eax, 0x5bafaf
jle 0x10007678
cmp eax, 0x5db541
je 0x10007678
cmp eax, 0x5db55f
je 0x10007678
cmp eax, 0x5de2b4
je 0x10007678
cmp eax, 0x5edfe0
je 0x10007678
cmp eax, 0x5f8924
jl 0x10007412
cmp eax, 0x5f8928
jle 0x10007678
cmp eax, 0x608cad
jl 0x10007424
cmp eax, 0x608fb0
jle 0x10007678
cmp eax, 0x60954e
jl 0x10007436
cmp eax, 0x609550
jle 0x10007678
cmp eax, 0x6097b0
je 0x10007678
cmp eax, 0x60b36a
jl 0x10007453
cmp eax, 0x60b373
jle 0x10007678
cmp eax, 0x60f04c
jl 0x10007465
cmp eax, 0x60f052
jle 0x10007678
cmp eax, 0x6e899d
jl 0x10007477
cmp eax, 0x6e89a1
jle 0x10007678
cmp eax, 0x7126fa
jl 0x10007489
cmp eax, 0x7126fe
jle 0x10007678
cmp eax, 0x72d1bd
jl 0x1000749b
cmp eax, 0x72d1be
jle 0x10007678
cmp eax, 0x72d1cc
jl 0x100074ad
cmp eax, 0x72d1d0
jle 0x10007678
cmp eax, 0x74cd50
jl 0x100074bf
cmp eax, 0x74cd54
jle 0x10007678
cmp eax, 0x74cd82
je 0x10007678
cmp eax, 0x771328
jl 0x100074dc
cmp eax, 0x77132c
jle 0x10007678
cmp eax, 0x77135c
je 0x10007678
cmp eax, 0x789767
jl 0x100074f9
cmp eax, 0x78976b
jle 0x10007678
cmp eax, 0x789a63
jl 0x1000750b
cmp eax, 0x789a67
jle 0x10007678
cmp eax, 0x789dac
jl 0x1000751d
cmp eax, 0x789db0
jle 0x10007678
cmp eax, 0x78b0bd
jl 0x1000752f
cmp eax, 0x78b0c0
jle 0x10007678
cmp eax, 0x830d66
je 0x10007678
cmp eax, 0x830e57
je 0x10007678
cmp eax, 0x830ed5
je 0x10007678
cmp eax, 0x830fd8
je 0x10007678
cmp eax, 0x83245d
je 0x10007678
cmp eax, 0x842859
jl 0x10007578
cmp eax, 0x84285d
jle 0x10007678
cmp eax, 0x85cc37
je 0x10007678
cmp eax, 0x886b30
je 0x10007678
cmp eax, 0x8875e0
je 0x10007678
cmp eax, 0x95e9fa
je 0x10007678
cmp eax, 0x608200
je 0x10007678
cmp eax, 0x74cd30
je 0x10007678
cmp eax, 0x771310
je 0x10007678
mov dl, byte [eax]
cmp dl, byte [edi + 0x10130538]
je 0x10007678
mov byte [0x112832cc], bl
mov ecx, 0x68
xor esi, esi
mov bl, byte [esi + 0x1001fb70]
xor bl, cl
mov byte [esp + esi + 0x34], bl
inc ecx
mov ebx, 1
add esi, ebx
and ecx, 0xff
cmp esi, 0xe
jb 0x100075e0
movzx ecx, dl
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x52], 0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
mov byte [esp + 0x42], al
mov ecx, 0xbe
jmp 0x10007640
mov dl, byte [eax + 0x1001fb80]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x10], dl
add eax, ebx
and ecx, 0xff
cmp eax, 0x12
jb 0x10007640
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
mov ecx, 0x10125568
mov byte [esp + 0x2e], 0
call fcn.1000aff0
add esp, 0xc
add edi, ebx
cmp edi, 0x500000
jb 0x10006ffb
cmp byte [0x112832cc], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
je 0x10007718
mov ecx, 0x47
xor eax, eax
mov dl, byte [eax + 0x1001fb94]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x10], dl
add eax, ebx
and ecx, 0xff
cmp eax, 0x1f
jb 0x100076a0
mov byte [esp + 0x2f], 0
lea eax, [esp + 0x10]
push eax
push 2
mov eax, 0x1012f668
mov dword [esp + 0x168], 0
call fcn.10013e20
xor eax, eax
add esp, 8
push eax
mov dword [0x11282e48], eax
mov dword [0x11282e4c], eax
mov dword [0x11282e50], eax
mov dword [0x11282e54], eax
mov dword [0x11282e58], eax
mov dword [0x11282e5c], eax
mov dword [0x11282e60], eax
mov dword [0x11282e64], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0x500000
push 0
push 0x10130538
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x500000
push 0x10130538
push 0x400000
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call esi
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x10130538]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x10130538], cl
add eax, ebx
cmp eax, 0x500000
jb 0x10007750
push 0xa0
push 0
push 0x10130498
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0xa0
push 0x10130498
push 0x10005590
call edi
push eax
call esi
xor eax, eax
jmp 0x100077a0
mov dl, byte [eax + 0x10130498]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x10130498], dl
add eax, ebx
cmp eax, 0xa0
jb 0x100077a0
push 0x7c
push 0
push 0x10130418
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x7c
push 0x10130418
push fcn.10004fe0
call edi
push eax
call esi
xor eax, eax
mov cl, byte [eax + 0x10130418]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x10130418], cl
add eax, ebx
cmp eax, 0x7c
jb 0x100077e1
push 0x52f
push 0
push 0x1012fee8
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x52f
push 0x1012fee8
push fcn.10005060
call edi
push eax
call esi
xor eax, eax
jmp 0x10007830
mov dl, byte [eax + 0x1012fee8]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012fee8], dl
add eax, ebx
cmp eax, 0x52f
jb 0x10007830
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x1012fe7c]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x1012fe7c], cl
add eax, ebx
cmp eax, 0x32
jb 0x10007850
xor eax, eax
jmp 0x10007870
mov dl, byte [eax + 0x1012feb0]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012feb0], dl
add eax, ebx
cmp eax, 0x32
jb 0x10007870
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10018c88
mov esp, ebp
pop ebp
ret