Function at 0x425e90
Capabilities:
Encode data using xor
Enumerate processes
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510b08
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x5723f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
cmp esi, dword [ebp + 0xc]
je 0x4264a6
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x334], esi
cmp esi, 0xffffffff
jne 0x425efd
mov esi, dword [ebp + 8]
xor bl, bl
jmp 0x4264a8
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x425f2a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
xor bl, bl
jmp 0x4264a8
mov ebx, esi
lea esp, [esp]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x330], esi
cmp esi, dword [ebp + 0xc]
je 0x426486
push 5
push str.klsdw
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.004071b0
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], 0
mov word [ebp - 0x74], ax
cmp word [ebp - 0x308], ax
jne 0x425f88
xor ecx, ecx
jmp 0x425fa0
lea ecx, [ebp - 0x308]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425f91
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x308]
push eax
lea ecx, [ebp - 0x74]
call fcn.00403630
push 0x3a8
lea edx, [ebp - 0x74]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.00423f90
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x60], 8
jb 0x425fdc
push dword [ebp - 0x74]
call fcn.0044ef7f
add esp, 4
mov ebx, dword [ebp - 0x4c]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], 0
mov word [ebp - 0x74], ax
test ebx, ebx
je 0x426039
mov edx, dword [ebp - 0x48]
mov edi, dword [ebp - 0x5c]
nop
cmp edx, 0x10
lea eax, [ebp - 0x5c]
cmovae eax, edi
cmp byte [eax + ecx], 0x41
jl 0x426034
cmp edx, 0x10
lea eax, [ebp - 0x5c]
cmovae eax, edi
cmp byte [eax + ecx], 0x5a
jg 0x426034
cmp edx, 0x10
lea eax, [ebp - 0x5c]
cmovae eax, edi
add byte [eax + ecx], 0x20
mov edx, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x5c]
inc ecx
cmp ecx, ebx
jb 0x426000
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406a30
push 0xb
push str.system.user
lea ecx, [ebp - 0x2c]
call fcn.00406940
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
je 0x426078
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
xor byte [eax + ecx], 0x49
inc ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jb 0x426061
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
push eax
cmovae edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x8c]
call fcn.0042e2f0
mov edi, eax
add esp, 4
lea eax, [ebp - 0x2c]
cmp eax, edi
je 0x426102
cmp dword [ebp - 0x18], 0x10
jb 0x4260ac
push dword [ebp - 0x2c]
call fcn.0044ef7f
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp dword [edi + 0x14], 0x10
jae 0x4260da
mov eax, dword [edi + 0x10]
inc eax
je 0x4260e5
push eax
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0044f1a0
add esp, 0xc
jmp 0x4260e5
mov eax, dword [edi]
mov dword [ebp - 0x2c], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x18], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x78], 0x10
jb 0x426116
push dword [ebp - 0x8c]
call fcn.0044ef7f
add esp, 4
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0xfc]
push eax
mov byte [ebp - 0x94], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xfc], 0x67452301
mov dword [ebp - 0xf8], 0xefcdab89
mov dword [ebp - 0xf4], 0x98badcfe
mov dword [ebp - 0xf0], 0x10325476
call fcn.00434440
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00434ec0
mov edi, eax
lea eax, [ebp - 0x2c]
cmp eax, edi
je 0x4261f5
cmp dword [ebp - 0x18], 0x10
jb 0x42619f
push dword [ebp - 0x2c]
call fcn.0044ef7f
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp dword [edi + 0x14], 0x10
jae 0x4261cd
mov eax, dword [edi + 0x10]
inc eax
je 0x4261d8
push eax
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0044f1a0
add esp, 0xc
jmp 0x4261d8
mov eax, dword [edi]
mov dword [ebp - 0x2c], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x18], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x78], 0x10
jb 0x426209
push dword [ebp - 0x8c]
call fcn.0044ef7f
add esp, 4
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
call fcn.00406dc0
mov byte [ebp - 4], 5
xor eax, eax
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
cmp dword [ebp - 0x34], eax
jbe 0x426279
mov esi, dword [ebp - 0x34]
lea esp, [esp]
cmp edi, 0x10
lea ecx, [ebp - 0x44]
cmovae ecx, edx
cmp byte [eax + ecx], 0x41
jl 0x426274
cmp edi, 0x10
lea ecx, [ebp - 0x44]
cmovae ecx, edx
cmp byte [eax + ecx], 0x5a
jg 0x426274
cmp edi, 0x10
lea ecx, [ebp - 0x44]
cmovae ecx, edx
add byte [eax + ecx], 0x20
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x34]
inc eax
cmp eax, esi
jb 0x426240
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x2c]
cmp edi, 0x10
cmovae ecx, edx
cmp dword [ebp - 0x18], 0x10
cmovae ebx, dword [ebp - 0x2c]
cmp esi, eax
cmovb eax, esi
mov esi, dword [ebp - 0x330]
test eax, eax
je 0x426318
sub eax, 4
mov dword [ebp - 0x330], eax
jb 0x4262cd
lea ecx, [ecx]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x4262d2
mov eax, dword [ebp - 0x330]
add ebx, 4
add ecx, 4
sub eax, 4
mov dword [ebp - 0x330], eax
jae 0x4262b0
cmp eax, 0xfffffffc
je 0x426312
mov al, byte [ebx]
cmp al, byte [ecx]
jne 0x42630b
cmp dword [ebp - 0x330], 0xfffffffd
je 0x426312
mov al, byte [ebx + 1]
cmp al, byte [ecx + 1]
jne 0x42630b
cmp dword [ebp - 0x330], 0xfffffffe
je 0x426312
mov al, byte [ebx + 2]
cmp al, byte [ecx + 2]
jne 0x42630b
cmp dword [ebp - 0x330], 0xffffffff
je 0x426312
mov al, byte [ebx + 3]
cmp al, byte [ecx + 3]
je 0x426312
sbb eax, eax
or eax, 1
jmp 0x426314
xor eax, eax
test eax, eax
jne 0x426330
mov ecx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x1c]
cmp ebx, ecx
jae 0x426327
or eax, 0xffffffff
jmp 0x42632e
xor eax, eax
cmp ebx, ecx
setne al
test eax, eax
sete al
test al, al
jne 0x4263a6
cmp edi, 0x10
jb 0x426345
push edx
call fcn.0044ef7f
add esp, 4
cmp dword [ebp - 0x48], 0x10
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
jb 0x426368
push dword [ebp - 0x5c]
call fcn.0044ef7f
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
jb 0x42638f
push dword [ebp - 0x2c]
call fcn.0044ef7f
add esp, 4
add esi, 0x18
mov dword [ebp - 0x330], esi
cmp esi, dword [ebp + 0xc]
jne 0x425f42
jmp 0x426480
mov ebx, dword [ebp - 0x33c]
lea ecx, [ebp - 0x338]
mov esi, dword [ebp - 0x324]
mov dword [ebp - 0x338], esi
mov eax, dword [ebx + 4]
cmp ecx, eax
jae 0x426402
mov ecx, dword [ebx]
lea edi, [ebp - 0x338]
cmp ecx, edi
mov edi, dword [ebp - 0x30]
ja 0x426402
lea esi, [ebp - 0x338]
sub esi, ecx
sar esi, 2
cmp eax, dword [ebx + 8]
jne 0x4263f2
push ecx
mov ecx, ebx
call fcn.00426510
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
test ecx, ecx
je 0x426424
mov eax, dword [eax + esi*4]
mov dword [ecx], eax
jmp 0x42641e
cmp eax, dword [ebx + 8]
jne 0x426415
push ecx
mov ecx, ebx
call fcn.00426510
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebx + 4]
test eax, eax
je 0x426424
mov dword [eax], esi
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
add dword [ebx + 4], 4
cmp edi, 0x10
jb 0x426436
push edx
call fcn.0044ef7f
add esp, 4
cmp dword [ebp - 0x48], 0x10
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
jb 0x426459
push dword [ebp - 0x5c]
call fcn.0044ef7f
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
jb 0x426480
push dword [ebp - 0x2c]
call fcn.0044ef7f
add esp, 4
mov ebx, dword [ebp - 0x334]
lea eax, [ebp - 0x32c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x425f30
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
mov bl, 1
test esi, esi
je 0x4264e7
mov edi, dword [ebp + 0xc]
cmp esi, edi
je 0x4264de
cmp dword [esi + 0x14], 0x10
jb 0x4264c3
push dword [esi]
call fcn.0044ef7f
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
add esi, 0x18
cmp esi, edi
jne 0x4264b3
mov esi, dword [ebp + 8]
push esi
call fcn.0044ef7f
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ed21
mov esp, ebp
pop ebp
ret