Function at 0x438640
Capabilities:
Create process on windows
Create thread
Encode data using xor
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
push esi
push 0
call fcn.00463981
add esp, 4
push eax
call fcn.0046264a
add esp, 4
mov esi, 0xa
call fcn.00436cb0
mov byte [esp + 0x90], al
mov ecx, 0x4b3278
push dword [esp + 0x90]
call fcn.00439fb0
call fcn.00436cb0
mov byte [esp + 0x94], al
mov ecx, 0x4b3150
push dword [esp + 0x94]
call fcn.00439fb0
call fcn.00436cb0
mov byte [esp + 8], al
mov ecx, 0x4b3208
push dword [esp + 8]
call fcn.00439fb0
sub esi, 1
jne 0x438665
mov dword [esp + 8], 0xe7101253
xor ecx, ecx
mov word [esp + 0xc], 0x100
nop dword [eax]
mov al, cl
add al, 0x7d
xor byte [esp + ecx + 8], al
inc ecx
cmp ecx, 4
jb 0x4386d0
lea eax, [esp + 8]
mov byte [esp + 0xd], 0
push eax
mov ecx, 0x4b3150
call fcn.00439600
cmp dword [0x4b328c], 0x10
mov eax, 0x4b3278
cmovae eax, dword [0x4b3278]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.004376c0
test al, al
jne 0x43882d
push 0
push 0
push 0
push 0x429d60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00436d90
movaps xmm0, xmmword [0x493010]
movups xmmword [esp + 0x10], xmm0
push ecx
movaps xmm0, xmmword [0x492e80]
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x54], 0xa8cbd1cf
movaps xmm0, xmmword [0x492ef0]
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x58], 0xb0a6acef
movaps xmm0, xmmword [0x492f20]
movups xmmword [esp + 0x44], xmm0
mov word [esp + 0x5c], 0x98
mov byte [esp + 0x5e], 1
call fcn.004385e0
push ecx
mov edx, eax
call fcn.0043abd0
add esp, 4
mov ecx, eax
call fcn.00439780
movaps xmm0, xmmword [0x4928a0]
mov ecx, 0x4b3278
movups xmmword [esp + 0x10], xmm0
push 0x10
movaps xmm0, xmmword [0x4928f0]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x74], 0xcfb8b9f3
movaps xmm0, xmmword [0x491fa0]
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x78], 0xb6848389
movaps xmm0, xmmword [0x492cd0]
movups xmmword [esp + 0x44], xmm0
mov dword [esp + 0x7c], 0xac82a287
movaps xmm0, xmmword [0x491f50]
movups xmmword [esp + 0x54], xmm0
mov dword [esp + 0x80], 0x100a0be
movaps xmm0, xmmword [0x492ec0]
movups xmmword [esp + 0x64], xmm0
call fcn.004395f0
push eax
lea ecx, [esp + 0x18]
call fcn.00438610
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 8], 0xf03e3c2d
xor ecx, ecx
mov word [esp + 0xc], 0xf1
mov byte [esp + 0xe], 1
mov al, cl
add al, 0x7d
xor byte [esp + ecx + 8], al
inc ecx
cmp ecx, 5
jb 0x438843
push 0
lea eax, [esp + 0xc]
mov byte [esp + 0x12], 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push 0x4b5e08
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x438911
call fcn.004392d0
mov dword [eax + 0x10], esi
lea eax, [esp + 0x80]
push eax
call fcn.004392d0
mov eax, dword [eax + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x88]
sub esi, dword [esp + 0x80]
call fcn.004392d0
mov dword [eax + 0x1c], esi
mov esi, dword [esp + 0x8c]
sub esi, dword [esp + 0x84]
call fcn.004392d0
mov dword [eax + 0x18], esi
call fcn.004392d0
mov ecx, dword [esp + 0x80]
mov dword [eax + 0x20], ecx
call fcn.004392d0
mov ecx, dword [esp + 0x88]
mov dword [eax + 0x24], ecx
call fcn.004392d0
mov ecx, dword [esp + 0x84]
mov dword [eax + 0x28], ecx
call fcn.004392d0
mov ecx, dword [esp + 0x8c]
mov dword [eax + 0x2c], ecx
call fcn.0042a750
call fcn.004377f0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x493110]
lea ecx, [esp + 0x10]
push 5
movups xmmword [esp + 0x14], xmm0
push 0
movaps xmm0, xmmword [0x492dd0]
push 0
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x3c], 0xc7cdd1ad
mov dword [esp + 0x40], 0x97f493c4
mov dword [esp + 0x44], 0xc0c5fc
mov byte [esp + 0x48], 1
mov dword [esp + 0x14], 0xee1a0e12
mov word [esp + 0x18], 0x100
call fcn.0042eaf0
push eax
lea ecx, [esp + 0x18]
call fcn.00429d30
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
push 0x429d60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [0x492880]
mov ecx, 0x4b3278
movups xmmword [esp + 0x10], xmm0
push 0x10
movaps xmm0, xmmword [str.4g_1_YA__0]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x44], 0xdfe38ec3
movaps xmm0, xmmword [0x492fc0]
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x48], 0xcad0d3
mov byte [esp + 0x4c], 1
call fcn.004395f0
push eax
lea ecx, [esp + 0x18]
call fcn.00436dd0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
push 0x64
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Beep]
push 0xa
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]