Function at 0x402c40
Capabilities:
Create thread
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x424fbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.0041e39c
xor esi, esi
push 0xf
mov dword [esp + 0x150], esi
call fcn.0040be82
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x19], eax
mov ecx, dword [str.PIPE01]
mov dword [esp + 0x1d], eax
mov dx, word [0x432a40]
mov dword [esp + 0x21], eax
mov dword [esp + 0xa8], ecx
mov word [esp + 0x25], ax
mov ecx, 6
mov byte [esp + 0x27], al
mov al, byte [0x432a42]
mov byte [esp + 0xae], al
xor eax, eax
lea edi, [esp + 0xaf]
mov word [esp + 0xac], dx
rep stosd dword es:[edi], eax
mov ecx, dword [str.PIPE00]
mov dx, word [0x432a38]
stosb byte es:[edi], al
mov al, byte [0x432a3a]
mov dword [esp + 0x88], ecx
mov byte [esp + 0x8e], al
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x8f]
mov word [esp + 0x8c], dx
add esp, 4
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [esp + 0x154]
push str.DLLEXE
mov byte [esp + 0x18], 0
lea ecx, [edi + 0x8c]
and ecx, 0xffff
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, esi
je 0x403355
lea ebx, [ebp + 0x5c]
push 0x432988
mov ecx, ebx
call fcn.0041d17a
push 8
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
lea eax, [edi + 0x16]
mov ecx, ebp
push eax
mov dword [esp + 0x14], eax
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0x432a28
mov ecx, ebx
call fcn.0041d17a
push esi
mov ecx, ebp
call fcn.0041bb66
mov eax, dword [ebp + 0x74]
cmp eax, esi
je 0x402d97
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov dword [ebp + 0x74], esi
jmp 0x402d9d
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x78]
cmp eax, esi
je 0x402daa
push eax
call edi
mov dword [ebp + 0x78], esi
mov edx, dword [ebp + 0x68]
push str.open_file
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [esp + 0x84]
push eax
call esi
lea ecx, [esp + 0xa8]
mov dword [ebp + 0x74], eax
push ecx
call esi
mov ecx, dword [ebp + 0x74]
add esp, 8
test ecx, ecx
mov dword [ebp + 0x78], eax
je 0x40332f
test eax, eax
je 0x40332f
push 0
push 0x3eb
mov ecx, ebp
call fcn.0041c4d6
mov ecx, eax
call fcn.0041c6d8
xor esi, esi
call fcn.0040be60
mov byte [esp + esi + 0x40], al
inc esi
cmp esi, 0x40
jl 0x402e02
mov ecx, dword [ebp + 0x74]
lea edx, [esp + 0x38]
push 0
push edx
lea eax, [esp + 0x48]
push 0x40
push eax
push ecx
mov byte [esp + 0x54], 0x41
mov byte [esp + 0x55], 0x43
mov byte [esp + 0x56], 0x51
mov byte [esp + 0x57], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push ebp
push 0x402b00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call edi
mov ecx, dword [ebp + 0x78]
lea edx, [esp + 0x80]
push 0
push edx
lea eax, [esp + 0xcc]
push 0x40
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4032c2
xor eax, eax
mov dl, byte [esp + eax + 0xc4]
mov cl, byte [esp + eax + 0xcc]
xor cl, dl
mov byte [esp + eax + 0xcc], cl
inc eax
cmp eax, 8
jl 0x402e7c
movsx esi, byte [esp + 0x53]
xor eax, eax
mov ecx, esi
and ecx, 0xff
mov dl, byte [ecx + 0x4267b8]
mov cl, byte [esp + eax + 0xc4]
xor cl, dl
mov byte [esp + eax + 0xc4], cl
inc eax
inc esi
cmp eax, 0x10
jl 0x402ea0
mov esi, str.CN_SZ_GR296101
lea edi, [esp + 0xc4]
mov cl, byte [edi]
mov dl, byte [esi]
mov al, cl
cmp cl, dl
jne 0x402ef9
test al, al
je 0x402ef5
mov dl, byte [edi + 1]
mov cl, byte [esi + 1]
mov al, dl
cmp dl, cl
jne 0x402ef9
add edi, 2
add esi, 2
test al, al
jne 0x402ed1
xor eax, eax
jmp 0x402efe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402f37
mov edi, str.CN_SZ_GR296101
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.CN_SZ_GR2961AB
jmp 0x403017
mov edi, str.CN_SZ_GR299i23
lea esi, [esp + 0xc4]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x402f6b
test al, al
je 0x402f67
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x402f6b
add esi, 2
add edi, 2
test al, al
jne 0x402f43
xor eax, eax
jmp 0x402f70
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402fa6
mov edi, str.CN_SZ_GR299i23
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.CN_SZ_GR299iCD
jmp 0x403017
mov edi, str.CN_SZ_0V296101
lea esi, [esp + 0xc4]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x402fda
test al, al
je 0x402fd6
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x402fda
add esi, 2
add edi, 2
test al, al
jne 0x402fb2
xor eax, eax
jmp 0x402fdf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403288
mov edi, str.CN_SZ_0V296101
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.CN_SZ_0V2961AB
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x4c], ecx
xor eax, eax
mov dl, byte [esp + eax + 0x40]
mov cl, byte [esp + eax + 0x48]
xor cl, dl
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 8
jl 0x403056
xor eax, eax
mov cl, byte [esp + 0x53]
add ecx, eax
and ecx, 0xff
mov dl, byte [ecx + 0x4267b8]
mov cl, byte [esp + eax + 0x40]
xor cl, dl
mov byte [esp + eax + 0x40], cl
inc eax
cmp eax, 0x10
jl 0x40306c
mov edx, dword [ebp + 0x74]
lea eax, [esp + 0x38]
push 0
push eax
lea ecx, [esp + 0x48]
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push ecx
lea esi, [ebp + 0x70]
mov ecx, esp
mov dword [esp + 0x40], esp
push esi
mov dword [ebp + 0x78], 0
call fcn.0041cca5
mov ecx, dword [esp + 0x158]
add ecx, 0x8c
push ecx
mov ecx, ebp
call fcn.004038a0
test eax, eax
jne 0x403128
push 0xa
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0x432988
mov ecx, ebx
call fcn.0041d17a
push 0
mov ecx, ebp
call fcn.0041bb66
mov edx, dword [ebp + 0x74]
push edx
call edi
push 1
push 0x3eb
mov ecx, ebp
call fcn.0041c4d6
mov ecx, eax
call fcn.0041c6d8
jmp 0x403355
push 0
push 0x3eb
mov ecx, ebp
call fcn.0041c4d6
mov ecx, eax
call fcn.0041c6d8
push 9
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0x432988
mov ecx, ebx
call fcn.0041d17a
push 0
mov ecx, ebp
call fcn.0041bb66
mov eax, dword [esi]
push 0
push 0x8000
push eax
lea ecx, [esp + 0x34]
call fcn.0041e4ae
test eax, eax
jne 0x403195
mov eax, dword [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0xb
jmp 0x40324c
mov ecx, dword [esp + 0x24]
push 0xf
push ecx
lea ecx, [esp + 0x30]
call fcn.0041e5cb
lea ecx, [esp + 0x28]
mov edi, eax
call fcn.0041e6c9
cmp edi, 0xf
je 0x4031cd
mov edx, dword [esp + 0x10]
mov ecx, ebp
push edx
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0xc
jmp 0x40324c
mov eax, dword [esp + 0x24]
cmp byte [eax], 0x24
jne 0x403236
cmp byte [eax + 1], 1
jne 0x403236
push 0x10
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
mov eax, dword [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0x432a28
mov ecx, ebx
call fcn.0041d17a
push 0
mov ecx, ebp
call fcn.0041bb66
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push esi
call fcn.0041cca5
mov ecx, ebp
call fcn.00403390
test eax, eax
je 0x403232
push 9
jmp 0x40324c
push 0xa
jmp 0x40324c
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0xd
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0x432988
mov ecx, ebx
call fcn.0041d17a
push 0
mov ecx, ebp
call fcn.0041bb66
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403355
push 0xa
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0x432988
mov ecx, ebx
call fcn.0041d17a
push 0
mov ecx, ebp
call fcn.0041bb66
mov eax, dword [ebp + 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp + 0x78]
push ecx
call esi
jmp 0x4032fb
push 0xa
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0x432988
mov ecx, ebx
call fcn.0041d17a
push 0
mov ecx, ebp
call fcn.0041bb66
mov edx, dword [ebp + 0x74]
push edx
call edi
mov eax, dword [ebp + 0x78]
push eax
call edi
mov dword [ebp + 0x78], 0
push 1
push 0x3eb
mov ecx, ebp
call fcn.0041c4d6
mov ecx, eax
call fcn.0041c6d8
push 0x10
push 7
mov ecx, ebp
call fcn.00403a50
push eax
push 0x13
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebp
call fcn.0041b40a
jmp 0x403355
push 0xa
mov ecx, ebp
call fcn.00403a50
push eax
mov ecx, ebx
call fcn.0041d17a
push 0x432988
mov ecx, ebx
call fcn.0041d17a
push 0
mov ecx, ebp
call fcn.0041bb66
lea ecx, [esp + 0x28]
mov dword [esp + 0x14c], 0xffffffff
call fcn.0041e3f1
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x140
ret 4