Function at 0x42b600
Capabilities:
Create thread
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x587266
push eax
mov dword fs:[0], esp
sub esp, 0x160
call fcn.0042aa40
cmp dword [0x6c0748], 1
jne 0x42b631
call fcn.0042a970
cmp dword [0x6c07ac], 0
jne 0x42b643
cmp dword [0x6c07b4], 1
jne 0x42b648
call fcn.00429d80
cmp dword [0x6c078c], 1
jne 0x42b656
call fcn.0040b220
cmp dword [0x6c07b8], 1
jne 0x42b664
call fcn.0040b2f0
cmp dword [0x6c0758], 1
jne 0x42b67f
push 0
push 0
push 0x40d500
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
cmp dword [0x6c07ac], 1
jne 0x42b68d
call fcn.004255d0
cmp dword [0x6c07b4], 0
je 0x42b6a0
call fcn.00425090
call fcn.0040af30
cmp dword [0x6c07c0], 1
jne 0x42b6ae
call fcn.0041b760
cmp dword [0x6c07c4], 1
jne 0x42b6bc
call fcn.0041bd00
cmp dword [0x6c07f8], 1
jne 0x42b6ca
call fcn.0042bd50
cmp dword [0x6c07ec], 1
jne 0x42b6d8
call fcn.00428a90
cmp dword [0x6c07e4], 1
jne 0x42b6ef
cmp dword [0x6c0754], 0
jne 0x42b6ef
call fcn.0042a080
cmp dword [0x6c0734], 1
push ebx
push esi
push edi
jne 0x42bb8b
mov dword [ebp - 0x10], 0x597970
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42b754
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42b74b
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42b732
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x41b730
push edi
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040a540
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 0x10], 0x5979c0
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42b7c5
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42b7bc
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42b7a3
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x41b730
push edi
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040a540
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp dword [0x6c0794], 1
jne 0x42b909
mov dword [ebp - 0x10], 0x590ba4
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42b843
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42b83a
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42b821
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0x16c]
call fcn.0040b9f0
mov dword [ebp - 0x10], 0x597a10
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x42b8b2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42b8a9
sub edi, ecx
nop
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42b890
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0040a540
add esp, 8
lea ecx, [ebp - 0x168]
call fcn.004096b0
test eax, eax
jne 0x42b8eb
push eax
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x16c]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040baf0
lea ecx, [ebp - 0x10c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x6c07a4], 1
jne 0x42bc6b
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
mov dword [ebp - 0x10], 0x59420c
add esp, 8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [ebx + 0x13], 0
je 0x42b985
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42b97c
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42b963
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xc4]
call fcn.0040b9f0
mov dword [ebp - 0x10], str._rwBmWjj
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 1
cmp byte [ebx + 0x13], 0
je 0x42b9f3
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42b9ea
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42b9d1
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040a540
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0040a540
mov dword [ebp - 0x10], 0x597a10
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42ba72
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42ba69
sub edi, ecx
lea esp, [esp]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42ba50
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040a540
mov dword [ebp - 0x10], 0x590c38
add esp, 8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42bad7
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42bace
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42bab5
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040a540
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.004096b0
test eax, eax
jne 0x42bb10
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov dword [ebp - 0x10], 0x59420c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42bb65
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42bb5c
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42bb43
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.0040baf0
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x42bc6b
cmp dword [0x6c0744], 1
jne 0x42bb99
call fcn.0041cd30
cmp dword [0x6c0790], 1
jne 0x42bba7
call fcn.00429a90
cmp dword [0x6c07e0], 1
jne 0x42bbb5
call fcn.0040ea90
cmp dword [0x6c074c], 1
jne 0x42bbc3
call fcn.0040c040
cmp dword [0x6c07c8], 1
jne 0x42bbd1
call fcn.0041ee80
cmp dword [0x6c0750], 1
jne 0x42bbdf
call fcn.0040c590
cmp dword [0x6c07d4], 1
jne 0x42bbed
call fcn.00415460
cmp dword [0x6c07cc], 1
jne 0x42bbfb
call fcn.0040fb40
cmp dword [0x6c07d0], 1
jne 0x42bc09
call fcn.00415cb0
cmp dword [0x6c07d8], 1
jne 0x42bc17
call fcn.00414e50
cmp dword [0x6c0788], 1
jne 0x42bc25
call fcn.0040faa0
cmp dword [0x6c07a0], 1
jne 0x42bc33
call fcn.0041da50
cmp dword [0x6c077c], 1
jne 0x42bc41
call fcn.0041ad40
cmp dword [0x6c07e8], 1
jne 0x42bc4f
call fcn.0041aaf0
cmp dword [0x6c07dc], 1
jne 0x42bc5d
call fcn.0041e290
cmp dword [0x6c079c], 1
jne 0x42bc6b
call fcn.0041e530
cmp dword [0x6c073c], 1
jne 0x42bc79
call fcn.00429ff0
cmp dword [0x6c0740], 1
jne 0x42bc87
call fcn.0041ee60
cmp dword [0x6c07f0], 1
jne 0x42bc95
call fcn.00429fc0
cmp dword [0x6c0754], 1
jne 0x42bcb1
cmp dword [0x6c0734], 0
jne 0x42bcb1
call fcn.0040e480
call fcn.0040e4a0
cmp dword [0x6c0784], 1
jne 0x42bcc6
push dword [0x6c070c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x6c0780], 1
jne 0x42bd2b
mov dword [ebp - 0x10], 0x597a94
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42bd24
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42bd1b
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42bd02
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x6c087c], 1
pop edi
pop esi
pop ebx
jne 0x42bd3c
call fcn.00429d90
mov ecx, dword [ebp - 0xc]
mov eax, 1
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret