Function at 0x4013e5
Capabilities:
Create thread
Encode data using xor
Get file attributes
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x20]
push ebx
mov dword [0x72a2ec], eax
mov dword [esp + 0x24], 0x322e
mov dword [esp + 0x10], 0x3926
push ebp
mov dword [esp + 8], 0x405c
mov ebp, 0x72a1d0
push esi
mov dword [esp + 0x10], 0x394f
mov dword [esp + 0x1c], 0x374c
push edi
mov dword [esp + 0x18], 0x317e
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
xor edi, 0x7823
mov edx, dword [esp + 0x18]
add esi, 0x119
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor ecx, 0xe03
push ebp
push eax
push ecx
push edx
push esi
push edi
push ebx
call fcn.0041a3f3
mov dword [esp + 0x2c], eax
add dword [esp + 0x38], 0xfffff9d5
add dword [esp + 0x4c], 0xffffff50
xor dword [esp + 0x30], 0x69
add dword [esp + 0x2c], 0x5ce
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
xor edi, 0x129
mov edx, dword [esp + 0x3c]
add esi, 0x1a
mov ecx, dword [esp + 0x4c]
sub edx, 0x617
mov eax, dword [esp + 0x4c]
add ecx, 0x17d
xor eax, 0x831
push eax
push ecx
push edx
push esi
push ebp
push edi
call fcn.0040181c
mov dword [esp + 0x54], eax
add esp, 0x34
xor dword [esp + 0x30], 0x632
xor dword [esp + 0x10], 0xe0c
add dword [esp + 0x18], 0x7d1
add dword [esp + 0x30], 0xfffffe21
xor dword [esp + 0x30], 0x743
add dword [esp + 0x10], 0x1aa
add dword [esp + 0x1c], 0xfffffe83
mov eax, dword [esp + 0x30]
mov dword [esp + 0x30], eax
xor dword [esp + 0x30], 0xcd0
mov eax, dword [esp + 0x18]
add eax, 0xfffff9f8
cmp dword [esp + 0x20], eax
je 0x401807
mov eax, dword [esp + 0x14]
add eax, 0xffffff76
cmp dword [esp + 0x1c], eax
jge 0x4016ba
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
xor ebx, 0x81b
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub esi, 0x1f8
mov ecx, dword [esp + 0x1c]
sub edx, 0x62b
mov eax, dword [esp + 0x30]
add ecx, 0xf2
sub eax, 0xbb7
push eax
push ebp
push ecx
push edx
push esi
push edi
push ebx
call fcn.0041bd79
mov dword [esp + 0x2c], eax
add esp, 0x1c
add dword [esp + 0x14], 0xfffffe33
xor dword [esp + 0x10], 0x56a
xor edx, edx
mov esi, dword [0x70c18c]
mov eax, dword [0x72a2ac]
mov ecx, dword [0x72a2b4]
add ecx, 0xfff8b52a
add dword [0x72a25c], ecx
mov ecx, dword [edx + eax]
mov eax, dword [esi + 0xdc]
xor ecx, dword [0x72a298]
mov dword [edx + eax], ecx
add edx, 4
mov ecx, dword [0x70c18c]
mov eax, dword [0x72a2b0]
add dword [ecx + 0xc8], eax
mov ecx, dword [0x70c18c]
mov eax, dword [0x72a214]
add eax, 0xffeae1c8
add dword [ecx + 0xc0], eax
mov esi, dword [0x70c18c]
mov eax, dword [0x72a228]
add eax, 0xfff54e19
mov ecx, dword [esi + 0x8c]
sub ecx, dword [0x72a2c8]
add eax, ecx
mov dword [0x72a228], eax
cmp edx, 0x9c88
jl 0x40158f
mov esi, 0xfffffdfd
add dword [esp + 0x18], esi
add dword [esp + 0x30], 0xfffffa42
xor dword [esp + 0x10], 0xf33
mov eax, dword [0x72a29c]
cmp dword [0x72a2c8], 0x7862
cmovne eax, dword [0x72a2ac]
mov dword [0x72a29c], eax
add dword [esp + 0x20], 0xd80
add dword [esp + 0x1c], 0x5db
xor dword [esp + 0x18], 0xe03
xor dword [esp + 0x10], 0x901
xor dword [esp + 0x14], 0x9a7
push dword [0x72a2ec]
mov eax, dword [0x72a2e8]
add eax, dword [0x72a2a4]
push eax
push dword [0x72a2e4]
call dword [0x72a29c]
mov dword [0x72a2d8], eax
add dword [esp + 0x14], 0xfffff280
xor dword [esp + 0x10], 0x4b
add dword [esp + 0x10], 0xf1
add dword [esp + 0x18], esi
add dword [esp + 0x14], 0x7c2
add dword [esp + 0x18], 0x7b2
jmp 0x401807
mov eax, dword [0x72a274]
or eax, dword [0x72a2d0]
xor dword [0x72a2a8], eax
mov eax, dword [0x72a290]
imul eax, dword [0x72a2b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
imul ecx, eax
mov eax, dword [esp + 0x30]
add eax, ecx
mov ecx, dword [0x70c18c]
xor dword [0x72a2d0], eax
mov eax, dword [esp + 0x14]
xor eax, dword [ecx + 0x54]
imul eax, eax, 0x3154
xor dword [0x72a280], eax
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x10]
or eax, 0x3759
add dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add ecx, dword [0x72a2a8]
add eax, ecx
mov dword [0x72a2a8], eax
mov eax, dword [esp + 0x18]
or eax, dword [0x72a2c8]
xor dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
and ebx, 0x374c
mov esi, dword [esp + 0x20]
and edi, 0x38f2
and eax, dword [0x72a208]
mov edx, dword [esp + 0x14]
add dword [0x72a238], eax
mov eax, dword [esp + 0x30]
or esi, dword [0x72a2b4]
add ebx, dword [0x72a254]
imul edx, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [0x72a2e0]
xor ecx, dword [0x72a2b4]
sub edx, eax
mov eax, dword [esp + 0x10]
xor eax, 0x3940
push eax
push ecx
push edx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x20]
mov eax, 0xffffc6b1
and ecx, dword [esp + 0x30]
imul edx, dword [0x72a2b4], 0x322e
sub eax, ecx
add dword [0x72a290], eax
mov eax, dword [esp + 0x1c]
or eax, dword [0x72a23c]
mov ecx, dword [esp + 0x30]
imul esi, dword [0x72a1e4], 0x38f2
or ecx, eax
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x1c]
xor edx, dword [0x72a258]
push eax
or esi, dword [0x72a264]
push ecx
push edx
push esi
push ebp
call fcn.0040c240
add esp, 0x14
mov dword [esp + 0x30], eax
mov eax, dword [0x70c18c]
push dword [eax + 0x108]
call dword [sym.imp.KERNEL32.dll_ExitProcess]