Function at 0x442881
Capabilities:
Create thread
Encode data using xor
Set file attributes

Disassembly:
push 0x160
mov eax, 0x5808a3
call fcn.0055dd89
call fcn.00441de4
xor esi, esi
inc esi
cmp dword [0x6967e0], esi
jne 0x4428a5
call fcn.00441d45
cmp dword [0x696844], 0
jne 0x4428b6
cmp dword [0x69684c], esi
jne 0x4428bb
call fcn.004412c0
cmp dword [0x696824], esi
jne 0x4428c8
call fcn.00422724
cmp dword [0x696850], esi
jne 0x4428d5
call fcn.004227b1
cmp dword [0x6967f0], esi
jne 0x4428ee
push 0
push 0
push 0x425ae6
call fcn.0056329e
add esp, 0xc
cmp dword [0x696844], esi
jne 0x4428fb
call fcn.0043d6ff
cmp dword [0x69684c], 0
je 0x44290e
call fcn.0043d1a4
call fcn.0042247f
cmp dword [0x696858], esi
jne 0x44291b
call fcn.00432e8e
cmp dword [0x69685c], esi
jne 0x442928
call fcn.00433521
cmp dword [0x696890], esi
jne 0x442935
call fcn.00442f2c
cmp dword [0x69683c], esi
jne 0x442942
call fcn.0043ee8f
cmp dword [0x696884], esi
jne 0x44294f
call fcn.004407c2
cmp dword [0x69687c], esi
jne 0x442965
cmp dword [0x6967ec], 0
jne 0x442965
call fcn.0044159f
cmp dword [0x6967cc], esi
jne 0x442d8b
mov dword [ebp - 0x10], 0x5958f8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4429c8
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x4429bc
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x4429a1
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push edi
push 0x6bedf0
call fcn.0042141f
push eax
call fcn.00432bb8
mov dword [ebp - 0x10], 0x595948
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x442a33
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442a27
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442a0c
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push edi
push 0x6bedf0
call fcn.0042141f
push eax
call fcn.00432bb8
add esp, 0xc
cmp dword [0x69682c], esi
jne 0x442b3f
mov dword [ebp - 0x10], 0x58e78c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x442aaa
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442a9e
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442a83
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push esi
push 0x40
push 8
push edi
lea ecx, [ebp - 0x16c]
call fcn.0042443d
and dword [ebp - 4], 0
mov dword [ebp - 0x10], str.2b
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x442b16
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442b0a
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442aef
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0x16c]
call fcn.00424a62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.00424592
cmp dword [0x69683c], esi
jne 0x442e5b
lea eax, [ebp - 0x1c]
push eax
call fcn.0056300a
lea eax, [ebp - 0x1c]
push eax
call fcn.00562d6b
mov dword [ebp - 0x10], 0x591ea4
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
pop ecx
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [ebx + 0x13], 0
pop ecx
je 0x442bb9
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442bad
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442b92
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push esi
push 0x40
push 8
push edi
lea ecx, [ebp - 0xc4]
call fcn.0042443d
mov dword [ebp - 0x10], str._rwBmWjj
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], esi
cmp byte [ebx + 0x13], 0
je 0x442c21
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442c18
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442bfd
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
push dword [ebp - 0x14]
call fcn.00562b5e
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042141f
mov dword [ebp - 0x10], str.2b
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x442c9a
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442c91
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442c76
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
mov dword [ebp - 0x10], 0x58e820
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
pop ecx
add edi, 0x14
cmp byte [ebx + 0x13], 0
pop ecx
je 0x442cfd
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442cf4
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442cd9
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0xc4]
call fcn.00424a62
mov dword [ebp - 0x10], 0x591ea4
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x442d6b
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442d62
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442d47
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00424592
xor esi, esi
inc esi
jmp 0x442e5b
cmp dword [0x6967dc], esi
jne 0x442d98
call fcn.004344f4
cmp dword [0x696828], esi
jne 0x442da5
call fcn.00440ffe
cmp dword [0x696878], esi
jne 0x442db2
call fcn.00426da7
cmp dword [0x6967e4], esi
jne 0x442dbf
call fcn.0042495f
cmp dword [0x696860], esi
jne 0x442dcc
call fcn.0043751a
cmp dword [0x6967e8], esi
jne 0x442dd9
call fcn.00424db2
cmp dword [0x69686c], esi
jne 0x442de6
call fcn.0042d539
cmp dword [0x696864], esi
jne 0x442df3
call fcn.00427cab
cmp dword [0x696868], esi
jne 0x442e00
call fcn.0042dcfb
cmp dword [0x696870], esi
jne 0x442e0d
call fcn.0042d024
cmp dword [0x696820], esi
jne 0x442e1a
call fcn.00427c0a
cmp dword [0x696838], esi
jne 0x442e27
call fcn.004362d3
cmp dword [0x696814], esi
jne 0x442e34
call fcn.00432174
cmp dword [0x696880], esi
jne 0x442e41
call fcn.00431f28
cmp dword [0x696874], esi
jne 0x442e4e
call fcn.00436af0
cmp dword [0x696834], esi
jne 0x442e5b
call fcn.00436cee
cmp dword [0x6967d4], esi
jne 0x442e68
call fcn.00441548
cmp dword [0x6967d8], esi
jne 0x442e75
call fcn.00437507
cmp dword [0x696888], esi
jne 0x442e82
call fcn.00441529
cmp dword [0x6967ec], esi
jne 0x442e9d
cmp dword [0x6967cc], 0
jne 0x442e9d
call fcn.00426976
call fcn.00426989
cmp dword [0x69681c], esi
jne 0x442eb1
push dword [0x6967a4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x696818], esi
jne 0x442f17
mov dword [ebp - 0x10], 0x595a1c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x442f10
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x442f04
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x442ee9
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x696914], esi
jne 0x442f24
call fcn.004412cc
mov eax, esi
call fcn.0055dd66
ret