Function at 0x41a577
Capabilities:
Encode data using xor
Terminate process
Write file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov dword [0x5071bc], eax
mov eax, 0x178f
push ebx
mov ebx, 0x2326
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x249b
mov dword [esp + 0x18], 0x21bc
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], 0x23b3
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
add eax, 0x23b3
push esi
push edi
cmp dword [esp + 0x10], eax
je 0x41a601
add dword [esp + 0x10], 0xfc2
add dword [esp + 0x14], 0xfffff469
add dword [esp + 0x14], 0xd0c
xor dword [esp + 0x20], 0x1bc
add dword [esp + 0x30], 0xfffff924
xor dword [esp + 0x18], 0x2113
xor dword [esp + 0x20], 0x378f
mov eax, dword [esp + 0xc]
add eax, 0xfffffb65
cmp dword [esp + 0x20], eax
je 0x41a62d
add dword [esp + 0x18], 0x165
add dword [esp + 0x10], 0xfffff84b
xor dword [esp + 0xc], 0x3311
jmp 0x41a815
mov eax, dword [0x5071a8]
imul eax, dword [0x5071ac]
cmp dword [0x50718c], eax
jae 0x41a815
mov eax, dword [esp + 0x14]
mov ecx, dword [0x5070bc]
sub ecx, eax
cmp dword [esp + 0x14], ecx
ja 0x41a6df
mov eax, dword [0x4b570c]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov esi, dword [eax + 0x1c]
mov eax, dword [eax + 0x10c]
add esi, dword [0x5070a8]
and eax, 0x1c63
xor edx, eax
mov eax, dword [esp + 0x20]
add ecx, eax
mov eax, dword [0x4b570c]
mov eax, dword [eax + 0x58]
or eax, ecx
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x14]
xor dword [0x5070a0], eax
mov eax, dword [0x4b570c]
mov ecx, dword [0x5070f8]
add ecx, 0xffffdbf8
mov eax, dword [eax + 0x98]
or eax, dword [0x507184]
sub dword [0x5071a8], eax
mov eax, dword [esp + 0xc]
imul eax, ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebp
mov ebp, dword [0x5071b8]
cmp ebp, dword [0x50718c]
jb 0x41a812
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
imul eax, dword [esp + 0x24]
imul ecx, dword [0x507190]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov edx, dword [0x5071a4]
imul ecx, eax
add edx, 0xffffe871
mov eax, dword [esp + 0x24]
and eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x4b570c]
mov edx, dword [0x5070ec]
sub edx, dword [0x507184]
mov ebx, dword [esp + 0x34]
sub edx, eax
mov eax, dword [ecx + 0x6c]
add ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x20]
add edi, dword [esp + 0x10]
imul eax, edx
mov edx, dword [esp + 0x20]
mov dword [ecx + 0x6c], eax
mov ecx, dword [0x4b570c]
mov eax, dword [esp + 0x34]
imul edx, dword [0x5070f8]
mov esi, dword [0x5070a0]
mov ecx, dword [ecx + 0x10c]
add esi, 0x2394
sub ecx, eax
push ecx
push edx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
add ebp, 3
add eax, dword [0x5071b8]
and eax, dword [0x5070e4]
or dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
xor ecx, eax
xor dword [esp + 0x10], ecx
mov eax, dword [esp + 0x34]
or eax, dword [0x5071a4]
mov ecx, dword [0x5071a8]
or eax, 0x1cd7
imul ecx, dword [0x5070d8]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
xor ecx, dword [0x5070b4]
imul eax, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
and eax, dword [esp + 0x24]
or eax, 0x212c
sub dword [0x5070a0], eax
cmp ebp, dword [0x50718c]
jae 0x41a6f2
mov ebx, 0x2326
xor ecx, ecx
pop ebp
mov eax, dword [esp + 0x18]
add eax, 0x4d9
cmp dword [esp + 0x30], eax
jge 0x41aa55
mov eax, dword [esp + 0xc]
add eax, 0xfc7
cmp dword [esp + 0x18], eax
jge 0x41aa55
mov eax, dword [esp + 0xc]
add eax, 0xf13
cmp dword [esp + 0x20], eax
mov eax, dword [0x4b570c]
je 0x41a9dc
mov dword [eax], ecx
xor edx, edx
mov eax, dword [0x4b570c]
inc edx
push 0x13
mov dword [eax + 4], ecx
mov eax, dword [0x4b570c]
mov dword [0x5070bc], ecx
mov dword [0x5070c8], edx
mov dword [0x5070cc], ecx
mov dword [0x5070e0], ecx
mov dword [0x5070f8], edx
mov dword [0x5070b4], 0xa
mov dword [0x5070dc], 2
mov dword [eax + 0x64], ecx
mov eax, dword [0x4b570c]
mov dword [0x507110], ecx
mov dword [0x507118], ecx
mov dword [0x50711c], 0x2a
mov dword [eax + 0x88], ecx
mov eax, dword [0x4b570c]
mov dword [0x507140], ecx
pop ecx
mov dword [eax + 0xb0], 0x54
mov eax, dword [0x4b570c]
mov dword [eax + 0xc0], edx
mov eax, dword [0x4b570c]
mov dword [eax + 0xcc], 0x62
mov eax, dword [0x4b570c]
mov dword [eax + 0xe0], edx
mov eax, dword [0x4b570c]
mov dword [0x507184], edx
mov dword [0x507188], 0xc
mov dword [eax + 0xec], ecx
mov dword [0x50719c], ecx
mov dword [0x5071a4], edx
mov dword [0x5071a8], edx
mov dword [0x5071ac], 0xe
mov dword [0x5071b8], 8
xor dword [esp + 0x18], 0x529
xor dword [esp + 0x10], 0x3b94
add dword [esp + 0x10], 0xfffffd0b
add dword [esp + 0xc], 0xfc7
xor dword [esp + 0x14], 0x3ef7
add dword [esp + 0xc], 0xfffffc62
xor dword [esp + 0xc], 0x27
add dword [esp + 0x14], 0xfffffd23
add dword [esp + 0x14], 0xb97
add dword [esp + 0x30], 0x455
add dword [esp + 0xc], 0xffffff6c
add dword [esp + 0x30], 0x625
mov edx, dword [0x5070f8]
cmp dword [0x50719c], edx
jb 0x41a9be
mov eax, dword [0x5070dc]
sub eax, dword [0x507110]
xor eax, 0x59633
mov dword [0x5071a0], eax
jmp 0x41aa55
mov eax, dword [0x4b570c]
mov ecx, dword [eax + 0xa0]
xor ecx, dword [eax + 0x28]
sub ecx, dword [0x5070cc]
or edx, ecx
mov dword [0x5070f8], edx
jmp 0x41aa55
mov ecx, dword [0x507190]
and ecx, dword [0x5070a0]
xor ecx, 0x2300
cmp dword [eax + 0xe0], ecx
jne 0x41aa55
mov eax, dword [esp + 0x20]
or eax, dword [0x507160]
xor eax, dword [0x50719c]
add dword [0x5070a0], eax
mov eax, dword [0x5071b8]
mov esi, dword [esp + 0x10]
or eax, 0x2454
mov ecx, dword [esp + 0x14]
xor eax, ebx
or dword [0x5070b4], eax
mov eax, dword [0x507104]
add eax, dword [0x5070cc]
add ecx, dword [0x50711c]
add esi, eax
mov eax, dword [0x4b570c]
mov edx, dword [eax + 0x7c]
mov eax, dword [esp + 0xc]
and edx, ecx
xor eax, 0x2408
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [esp + 0x1c]
mov edi, 0x3633
xor eax, edi
cmp dword [esp + 0x30], eax
jle 0x41ad54
mov eax, dword [esp + 0x10]
xor eax, 0x3699
cmp dword [esp + 0x30], eax
je 0x41ad54
mov eax, dword [esp + 0x18]
add eax, 0xfffffc43
cmp dword [esp + 0x10], eax
je 0x41ac43
xor dword [esp + 0x30], 0x3d93
mov ebx, 0x5070a0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, 0x343c
add dword [esp + 0x18], 0xfffff371
add dword [esp + 0x18], 0x8d2
xor dword [esp + 0x14], 0x34a9
add dword [esp + 0x1c], 0xc24
add dword [esp + 0x30], 0xffffffaa
add dword [esp + 0x10], 0xfffffb50
add dword [esp + 0x14], 0xc79
xor dword [esp + 0x1c], eax
xor dword [esp + 0x20], eax
add dword [esp + 0x30], 0x947
xor dword [esp + 0x14], 0x670
add dword [esp + 0xc], 0xffffff78
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
xor esi, 0x15e
mov ecx, dword [esp + 0x1c]
add edx, 0x39d
mov eax, dword [esp + 0x18]
xor ecx, edi
xor eax, 0x3ff7
push eax
push ebx
push ecx
push edx
push esi
call fcn.0041c020
mov dword [esp + 0x20], eax
mov edx, 0x42e0f8
add dword [esp + 0x20], 0xffffff57
add dword [esp + 0x28], 0xfffffcae
add dword [esp + 0x44], 0xa1
add dword [esp + 0x30], 0xf9b
xor dword [esp + 0x20], 0x3b7f
add dword [esp + 0x24], 0x36d
add dword [esp + 0x30], 0xfffffa02
add dword [esp + 0x28], 0xfffffb46
xor dword [esp + 0x2c], 0x287
xor dword [esp + 0x24], 0x3cf6
mov eax, dword [esp + 0x34]
mov ecx, dword [0x4b570c]
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 0x14]
cmp eax, dword [ecx + 0xc0]
cmovb edx, dword [0x507134]
mov dword [0x507134], edx
xor dword [esp + 0x20], 0x394a
add dword [esp + 0x44], 0xfffff80f
add dword [esp + 0x44], 0x615
xor dword [esp + 0x2c], 0x639
add dword [esp + 0x24], 0xfffff9b1
add dword [esp + 0x2c], 0xfffff8d6
xor dword [esp + 0x24], 0x3dfb
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
xor esi, 0x67d
mov ecx, dword [esp + 0x24]
xor edx, 0x3b3
mov eax, dword [esp + 0x34]
xor ecx, 0x29f
xor eax, 0x52e
push eax
push ecx
push ebx
push edx
push esi
call fcn.00404cb2
mov dword [esp + 0x34], eax
add esp, 0x28
add dword [esp + 0x30], 0xfffffd58
xor dword [esp + 0x20], 0x3971
add dword [esp + 0x30], 0x3c4
add dword [esp + 0xc], 0xffffffb4
add dword [esp + 0x10], 0xfffff65e
jmp 0x41ad54
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4b570c]
sub eax, dword [0x507184]
sub eax, dword [ecx + 0x58]
cmp dword [esp + 0x14], eax
ja 0x41ad04
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
sub edi, ebx
sub edx, dword [esp + 0x14]
mov ebx, 0x5070a0
mov eax, dword [0x4b570c]
and edx, 0x269d
mov ecx, dword [0x4b570c]
mov esi, dword [eax + 8]
mov eax, dword [esp + 0x1c]
mov ecx, dword [ecx + 0x64]
xor esi, dword [0x5070ec]
sub ecx, eax
imul ecx, dword [0x5071a8]
push ecx
push ebx
push edx
push esi
push edi
call fcn.004014e2
mov dword [esp + 0x2c], eax
mov edi, dword [esp + 0x30]
xor edi, dword [esp + 0x30]
mov eax, dword [0x4b570c]
mov edx, dword [esp + 0x2c]
mov esi, dword [0x5070cc]
sub edx, dword [esp + 0x20]
or esi, dword [0x5070a0]
sub esi, dword [eax + 0x64]
mov eax, dword [0x4b570c]
mov ecx, dword [esp + 0x30]
sub ecx, dword [eax + 0x40]
mov eax, dword [esp + 0x28]
add eax, ecx
push eax
push edx
push esi
push edi
push ebx
call fcn.0041ba20
mov dword [esp + 0x58], eax
add esp, 0x28
mov eax, dword [esp + 0x30]
or eax, 0x272a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
jmp 0x41ad54
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [0x4b570c]
or esi, dword [0x507104]
or edi, dword [0x507184]
mov edx, dword [eax + 0xe0]
mov eax, dword [esp + 0x30]
imul edx, ecx
add eax, 0x2326
mov ecx, dword [esp + 0x10]
or ecx, eax
push ecx
push edx
push esi
push edi
push 0x5070a0
call fcn.0041ba20
add esp, 0x14
mov dword [esp + 0x10], eax
mov eax, dword [0x4b570c]
push dword [eax + 0x100]
call dword [sym.imp.KERNEL32.dll_ExitProcess]