Function at 0x4456a8
Capabilities:
Create thread
Encode data using xor
Set file attributes

Disassembly:
push 0x160
mov eax, 0x583a50
call fcn.00560e29
call fcn.00444c29
xor esi, esi
inc esi
cmp dword [0x6987e0], esi
jne 0x4456cc
call fcn.00444b8a
cmp dword [0x698844], 0
jne 0x4456dd
cmp dword [0x69884c], esi
jne 0x4456e2
call fcn.00443cad
cmp dword [0x698824], esi
jne 0x4456ef
call fcn.0042295c
cmp dword [0x698850], esi
jne 0x4456fc
call fcn.004229e9
cmp dword [0x6987f0], esi
jne 0x445715
push 0
push 0
push 0x428800
call fcn.005662fc
add esp, 0xc
cmp dword [0x698844], esi
jne 0x445722
call fcn.00442757
cmp dword [0x69884c], 0
je 0x445735
call fcn.004421fc
call fcn.004226b7
cmp dword [0x698858], esi
jne 0x445742
call fcn.004375e4
cmp dword [0x69885c], esi
jne 0x44574f
call fcn.00437c77
cmp dword [0x698890], esi
jne 0x44575c
call fcn.00445d39
cmp dword [0x69887c], esi
jne 0x445772
cmp dword [0x6987ec], 0
jne 0x445772
call fcn.0044408e
cmp dword [0x6987cc], esi
jne 0x445b98
mov dword [ebp - 0x10], 0x597688
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4457d5
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x4457c9
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x4457ae
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push edi
push 0x6c1d90
call fcn.0042163d
push eax
call fcn.0043730e
mov dword [ebp - 0x10], 0x5976d8
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x445840
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x445834
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x445819
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push edi
push 0x6c1d90
call fcn.0042163d
push eax
call fcn.0043730e
add esp, 0xc
cmp dword [0x69882c], esi
jne 0x44594c
mov dword [ebp - 0x10], 0x58fa7c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4458b7
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x4458ab
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x445890
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push esi
push 0x40
push 8
push edi
lea ecx, [ebp - 0x16c]
call fcn.00424676
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x597728
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x445923
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x445917
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x4458fc
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0042163d
pop ecx
pop ecx
lea ecx, [ebp - 0x16c]
call fcn.004251dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.004247cb
cmp dword [0x69883c], esi
jne 0x445c68
lea eax, [ebp - 0x1c]
push eax
call fcn.005660ac
lea eax, [ebp - 0x1c]
push eax
call fcn.00565e0d
mov dword [ebp - 0x10], 0x58fac8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
pop ecx
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [ebx + 0x13], 0
pop ecx
je 0x4459c6
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x4459ba
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x44599f
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push esi
push 0x40
push 8
push edi
lea ecx, [ebp - 0xc4]
call fcn.00424676
mov dword [ebp - 0x10], 0x58fae0
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], esi
cmp byte [ebx + 0x13], 0
je 0x445a2e
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x445a25
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x445a0a
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042163d
push dword [ebp - 0x14]
call fcn.00565c00
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0042163d
mov dword [ebp - 0x10], 0x597728
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x445aa7
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x445a9e
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x445a83
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042163d
mov dword [ebp - 0x10], 0x58fb28
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
pop ecx
add edi, 0x14
cmp byte [ebx + 0x13], 0
pop ecx
je 0x445b0a
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x445b01
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x445ae6
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0042163d
pop ecx
pop ecx
lea ecx, [ebp - 0xc4]
call fcn.004251dc
mov dword [ebp - 0x10], 0x58fac8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x445b78
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x445b6f
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x445b54
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.004247cb
xor esi, esi
inc esi
jmp 0x445c68
cmp dword [0x6987dc], esi
jne 0x445ba5
call fcn.00438c9c
cmp dword [0x698828], esi
jne 0x445bb2
call fcn.004439eb
cmp dword [0x698878], esi
jne 0x445bbf
call fcn.00429bb4
cmp dword [0x6987e4], esi
jne 0x445bcc
call fcn.004250d9
cmp dword [0x698860], esi
jne 0x445bd9
call fcn.0043c2d5
cmp dword [0x6987e8], esi
jne 0x445be6
call fcn.00425a6c
cmp dword [0x69886c], esi
jne 0x445bf3
call fcn.00430da7
cmp dword [0x698864], esi
jne 0x445c00
call fcn.0042ae87
cmp dword [0x698868], esi
jne 0x445c0d
call fcn.00431921
cmp dword [0x698870], esi
jne 0x445c1a
call fcn.004305ee
cmp dword [0x698820], esi
jne 0x445c27
call fcn.0042ade6
cmp dword [0x698838], esi
jne 0x445c34
call fcn.0043aa56
cmp dword [0x698814], esi
jne 0x445c41
call fcn.0043651e
cmp dword [0x698880], esi
jne 0x445c4e
call fcn.004362d2
cmp dword [0x698874], esi
jne 0x445c5b
call fcn.0043b1f1
cmp dword [0x698834], esi
jne 0x445c68
call fcn.0043b79b
cmp dword [0x6987d4], esi
jne 0x445c75
call fcn.00444037
cmp dword [0x6987d8], esi
jne 0x445c82
call fcn.0043c2c2
cmp dword [0x698888], esi
jne 0x445c8f
call fcn.00444018
cmp dword [0x6987ec], esi
jne 0x445caa
cmp dword [0x6987cc], 0
jne 0x445caa
call fcn.00429693
call fcn.004296a6
cmp dword [0x69881c], esi
jne 0x445cbe
push dword [0x6987a4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x698818], esi
jne 0x445d24
mov dword [ebp - 0x10], 0x5977ac
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x445d1d
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00565205
mov edx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
pop ecx
test esi, esi
je 0x445d11
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebx + 0xf]
jb 0x445cf6
mov eax, dword [ebx + 0xf]
xor esi, esi
mov edi, edx
inc esi
mov byte [edx + eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x698914], esi
jne 0x445d31
call fcn.00443cb9
mov eax, esi
call fcn.00560e06
ret