Function at 0x401000
Capabilities:
Create thread
Encode data using xor

Disassembly:
sub esp, 0x720
push esi
mov eax, 0x19
mov edx, 0x61a800
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
dec eax
shr eax, 2
inc eax
dec edx
jne 0x401012
test eax, eax
je 0x401292
push 0xc
push 8
call dword [0x404038]
push eax
call dword [0x404034]
mov esi, eax
test esi, esi
je 0x401062
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esi + 4], eax
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x4015cc
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi], eax
lea ecx, [esp + 0x214]
push 0x104
push ecx
call fcn.0040169f
add esp, 8
test al, al
jne 0x401100
push 0x104
lea edx, [esp + 0x524]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x520]
push 0x5c
push eax
call fcn.00401c5d
add esp, 8
test eax, eax
je 0x4010af
mov word [eax], 0
push 0
call dword [sym.imp.KERNEL32.DLL_HeapDestroy]
push 0
push 0
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
push 0
push 0
call fcn.00401920
add esp, 0xc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
push 0
push 0
push 0x104
lea ecx, [esp + 0x220]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x534]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov eax, 0x404058
mov edx, 0x4030c8
mov cl, 0xa2
sub edx, eax
mov edi, edi
xor cl, 0xcb
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x401110
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push ebp
mov byte [eax], cl
push 0x404058
lea eax, [esp + 0x324]
push eax
call ebx
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x11c]
push edx
call ebx
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x4030c4
lea eax, [esp + 0x11c]
push eax
call ebp
lea eax, [esp + 0x320]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401167
lea edi, [esp + 0x118]
sub eax, ecx
mov esi, ecx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401180
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, 0x404058
mov edx, 0x4030b4
rep movsb byte es:[edi], byte [esi]
mov cl, 0x96
sub edx, eax
xor cl, 0xc9
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x4011a4
mov byte [eax], cl
push 0x404058
lea ecx, [esp + 0x428]
push ecx
call ebx
lea edx, [esp + 0x424]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov esi, eax
push str.WaitF
lea eax, [esp + 0x18]
push eax
call ebx
push str.orSi
lea ecx, [esp + 0x18]
push ecx
call ebp
push str.ngle
lea edx, [esp + 0x18]
push edx
call ebp
push str.Obje
lea eax, [esp + 0x18]
push eax
call ebp
push 0x403090
lea ecx, [esp + 0x18]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ebp
mov edi, eax
pop ebx
lea eax, [esp + 0x318]
push eax
call fcn.004017a7
add esp, 4
test eax, eax
jne 0x401254
lea ecx, [esp + 0x110]
push ecx
call fcn.0040147f
add esp, 4
push 0x12c
push esi
call edi
test eax, eax
jne 0x401230
push eax
call dword [sym.imp.KERNEL32.DLL_HeapDestroy]
push 0
push 0
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
push 0
push 0
call fcn.00401920
add esp, 0xc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
add esp, 0x720
ret