Function at 0x402af0
Capabilities:
Create process on windows
Encode data using xor
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc8
mov eax, dword [0x5c6a7c]
xor eax, esp
mov dword [esp + 0xc4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push str.CONFIG_LOAD
call fcn.00404e70
add esp, 4
call fcn.00401220
push 0x5ce310
push str.TRAIN__s
call fcn.00404e70
add esp, 8
mov ecx, str.TRAIN
mov eax, 0x5ce310
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402b60
test dl, dl
je 0x402b5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402b60
add eax, 2
add ecx, 2
test dl, dl
jne 0x402b40
xor eax, eax
jmp 0x402b65
sbb eax, eax
or eax, 1
test eax, eax
je 0x402c10
push 0x5cd278
push str.__________CALL_NEXT_PAGE_:__s
call fcn.00404e70
add esp, 8
mov ecx, 0x5b87bf
mov eax, 0x5cd278
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402bb0
test dl, dl
je 0x402bac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402bb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x402b90
xor eax, eax
jmp 0x402bb5
sbb eax, eax
or eax, 1
test eax, eax
je 0x402bdc
push 5
push 0
push 0
push 0x5cd278
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push eax
push str.SHELL_RETURN_:__d
call fcn.00404e70
add esp, 8
push 0
push 0
push 0x10
push dword [0x5cf76c]
mov dword [0x5cf7f0], 1
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.00519008
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov eax, dword [0x5b8bb8]
movq xmm0, qword [str.BSD_DROPPER2]
mov dword [esp + 0xc4], eax
mov al, byte [0x5b8bbc]
movq qword [esp + 0xbc], xmm0
xorps xmm0, xmm0
mov byte [esp + 0xc8], al
lea eax, [esp + 0xbc]
push 0x7f00
push 0
mov dword [esp + 0x60], 0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
mov dword [esp + 0x84], eax
mov dword [esp + 0x70], esi
mov dword [esp + 0x64], 0x401fa0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0
push 0x4f
call esi
push eax
push 0x4e
call esi
push eax
push 0x4d
call esi
push eax
push 0x4c
call esi
push eax
push reloc.WS2_32.dll_htonl
lea eax, [esp + 0xe0]
push eax
push eax
push 0x40000
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x5cf76c], eax
test eax, eax
jne 0x402d05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HWND_NULL_:_ERROR____d
call fcn.00404e70
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.00519008
mov esp, ebp
pop ebp
ret 0x10
push 0x4f
call esi
push eax
push 0x4e
call esi
push eax
push 0x4d
call esi
push eax
push 0x4c
call esi
push eax
push str.WINDOW_RECT_:__d___d____d___d
call fcn.00404e70
add esp, 0x14
mov dword [0x5d03ac], 1
lea ecx, [esp + 0x80]
push 0x4058d0
call fcn.00404b60
cmp dword [0x5d03cc], 0
jne 0x4033c2
mov ecx, dword [eax]
mov dword [0x5d03c8], ecx
mov ecx, dword [eax + 4]
mov dword [0x5d03cc], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
cmp dword [esp + 0x84], 0
jne 0x4033c2
mov eax, dword [0x5d03cc]
test eax, eax
jne 0x402d92
push 1
call fcn.0051af41
mov eax, dword [0x5d03cc]
add esp, 4
push eax
push dword [0x5d03c8]
call fcn.0051b5c6
add esp, 8
test eax, eax
je 0x402dae
push eax
call fcn.0051af14
add esp, 4
push 0
push 0x404e80
push 0
push 0
mov dword [0x5d03c8], 0
mov dword [0x5d03cc], 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov esi, dword [0x5cfce0]
lea eax, [esi - 1]
mov dword [esp + 0x80], eax
test eax, eax
jle 0x402e81
mov edi, 1
mov edx, 0x5cfce8
cmp edi, esi
jge 0x402e6d
lea ecx, [edx + 0x48]
sub esi, edi
nop
mov eax, dword [edx + 4]
cmp eax, dword [ecx + 4]
jle 0x402e58
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [edx]
movups xmm2, xmmword [edx + 0x10]
movups xmm3, xmmword [edx + 0x20]
movups xmm4, xmmword [edx + 0x30]
movq xmm5, qword [edx + 0x40]
movups xmmword [edx], xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [edx + 0x30], xmm0
movq xmm0, qword [ecx + 0x40]
movq qword [edx + 0x40], xmm0
movups xmmword [ecx], xmm1
movups xmmword [ecx + 0x10], xmm2
movups xmmword [ecx + 0x20], xmm3
movups xmmword [ecx + 0x30], xmm4
movq qword [ecx + 0x40], xmm5
add ecx, 0x48
sub esi, 1
jne 0x402e00
mov esi, dword [0x5cfce0]
mov eax, dword [esp + 0x80]
inc edi
add edx, 0x48
sub eax, 1
mov dword [esp + 0x80], eax
jne 0x402df5
test esi, esi
jle 0x402ec4
mov edi, dword [0x5cfce4]
mov ecx, 0x5cfcf4
mov dword [esp + 0x80], esi
mov eax, dword [ecx]
lea ecx, [ecx + 0x48]
sub eax, dword [ecx - 0x50]
cdq
xor eax, edx
mov dword [ecx - 0x50], edi
sub eax, edx
add eax, edi
mov dword [ecx - 0x48], eax
cdq
xor eax, edx
sub eax, edx
add edi, eax
sub esi, 1
jne 0x402e97
mov esi, dword [0x5cfce0]
mov dword [0x5cfce4], edi
xor ecx, ecx
test esi, esi
jle 0x402ef1
mov eax, 0x5cfcf4
nop
push dword [eax + 4]
inc ecx
push dword [eax]
push dword [eax - 4]
push dword [eax - 8]
push ecx
push str.MONITOER__d___d___d____d___d
call fcn.00404e70
add esp, 0x18
lea eax, [eax + 0x48]
cmp ecx, esi
jl 0x402ed0
push 0x5cf7f4
push 0
push 0x5b8c24
push 0
call dword [sym.imp.d2d1.dll_Ordinal_1]
test eax, eax
jne 0x402bf8
push 0x5cf81c
push 0x5b8c34
push eax
call dword [sym.imp.DWrite.dll_DWriteCreateFactory]
push 0x5cf824
push dword [0x5cf76c]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [0x5cf830]
push dword [0x5cf82c]
push dword [0x5cf828]
push dword [0x5cf824]
push str.CLIENT_RECT_:__d___d____d___d
call fcn.00404e70
mov ecx, dword [0x5cf82c]
add esp, 0x14
mov edx, dword [0x5cf830]
mov eax, dword [0x5cf76c]
mov dword [esp + 0x88], edx
lea edx, [esp + 0x80]
mov dword [esp + 0x80], eax
mov eax, dword [0x5cf7f4]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x8c], 0
movaps xmm0, xmmword [esp + 0x80]
movaps xmmword [esp + 0x80], xmm0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
movaps xmm0, xmmword [esp + 0x10]
push 0x5cf820
movaps xmmword [esp + 0x34], xmm0
push edx
mov dword [esp + 0x28], 0
lea edx, [esp + 0x38]
mov dword [esp + 0x2c], 0
movq xmm0, qword [esp + 0x28]
movq qword [esp + 0x48], xmm0
mov dword [esp + 0x50], 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x38]
call fcn.00403530
mov ecx, 0x5c7778
mov eax, 0x5b8c18
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403030
test dl, dl
je 0x40302c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403030
add eax, 2
add ecx, 2
test dl, dl
jne 0x403010
xor eax, eax
jmp 0x403035
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403181
cmp dword [0x5cfc54], eax
je 0x403181
push 0x4048f0
lea ecx, [esp + 0x84]
mov dword [0x5cf818], 1
mov dword [0x5cfcd8], 1
call fcn.00404b60
cmp dword [0x5d03bc], 0
jne 0x4033c2
mov ecx, dword [eax]
mov dword [0x5d03b8], ecx
mov ecx, dword [eax + 4]
mov dword [0x5d03bc], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
cmp dword [esp + 0x84], 0
jne 0x4033c2
mov eax, dword [0x5d03bc]
test eax, eax
jne 0x4030bf
push 1
call fcn.0051af41
mov eax, dword [0x5d03bc]
add esp, 4
push eax
push dword [0x5d03b8]
call fcn.0051b5c6
add esp, 8
test eax, eax
je 0x4030db
push eax
call fcn.0051af14
add esp, 4
push 0x404a50
lea ecx, [esp + 0x84]
mov dword [0x5d03b8], 0
mov dword [0x5d03bc], 0
call fcn.00404b60
cmp dword [0x5d03b4], 0
jne 0x4033c2
mov ecx, dword [eax]
mov dword [0x5d03b0], ecx
mov ecx, dword [eax + 4]
mov dword [0x5d03b4], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
cmp dword [esp + 0x84], 0
jne 0x4033c2
mov eax, dword [0x5d03b4]
test eax, eax
jne 0x403151
push 1
call fcn.0051af41
mov eax, dword [0x5d03b4]
add esp, 4
push eax
push dword [0x5d03b0]
call fcn.0051b5c6
add esp, 8
test eax, eax
je 0x40316d
push eax
call fcn.0051af14
add esp, 4
mov dword [0x5d03b0], 0
mov dword [0x5d03b4], 0
mov ecx, 0x5c7778
mov eax, 0x5b8c1c
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4031b0
test dl, dl
je 0x4031ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4031b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x403190
xor eax, eax
jmp 0x4031b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40322b
cmp dword [0x5cfc50], eax
je 0x40322b
push 0x405600
lea ecx, [esp + 0x84]
mov dword [0x5cf818], 2
call fcn.00404b60
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x4031f8
push 1
call fcn.0051af41
mov eax, dword [esp + 0x88]
add esp, 4
push eax
push dword [esp + 0x84]
call fcn.0051b5c6
add esp, 8
test eax, eax
je 0x403215
push eax
call fcn.0051af14
add esp, 4
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov ecx, 0x5c7778
mov eax, 0x5b8c20
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403255
test dl, dl
je 0x403251
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403255
add eax, 2
add ecx, 2
test dl, dl
jne 0x403235
xor eax, eax
jmp 0x40325a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40327e
mov dword [0x5cf818], 3
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.00519008
mov esp, ebp
pop ebp
ret 0x10
push 5
push dword [0x5cf76c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x5cf76c]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [esp + 0x90]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
push 0
push eax
movaps xmmword [esp + 0xa0], xmm0
movq qword [esp + 0xb0], xmm0
call esi
test eax, eax
je 0x40330c
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop word [eax + eax]
lea eax, [esp + 0x90]
push eax
call edi
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x9c]
push eax
call esi
test eax, eax
jne 0x4032e0
mov ecx, dword [0x5cfc50]
mov dword [0x5d03ac], 0
test ecx, ecx
je 0x403330
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x5cfc50], 0
mov ecx, dword [0x5cfb44]
test ecx, ecx
je 0x40334a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x5cfb44], 0
mov ecx, dword [0x5cfc54]
test ecx, ecx
je 0x403364
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x5cfc54], 0
mov ecx, dword [0x5cfc4c]
test ecx, ecx
je 0x40337e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x5cfc4c], 0
mov eax, dword [0x5cf81c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [0x5cf7f4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [0x5cf820]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0xcc]
mov eax, dword [esp + 0x98]
pop edi
pop esi
xor ecx, esp
call fcn.00519008
mov esp, ebp
pop ebp
ret 0x10
call fcn.00527c4a
int3