Function at 0x416340
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x45c3eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x4760f4]
xor eax, esp
mov dword [esp + 0x338], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4760f4]
xor eax, esp
push eax
lea eax, [esp + 0x350]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
cmp dword [ebp + 0x140], ebx
jne 0x4150e7
mov eax, dword [ebp + 0x20]
push ebx
push 0x64
push 1
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
lea ecx, [ebp + 0x55ac]
call fcn.00428b04
jmp 0x415367
push 1
push str.res_beep.wav
call dword [sym.imp.WINMM.dll_sndPlaySoundA]
mov ecx, ebp
call fcn.00412be0
test eax, eax
jne 0x415106
mov ecx, ebp
call fcn.00412d80
push 0xff
lea ecx, [esp + 0x51]
push ebx
push ecx
mov byte [esp + 0x58], bl
call fcn.0043f280
mov al, 0x34
add esp, 0xc
mov byte [esp + 0x3c], al
mov byte [esp + 0x48], al
mov byte [esp + 0x34], 0xb6
mov byte [esp + 0x35], 0x48
mov byte [esp + 0x36], 0x15
mov byte [esp + 0x37], 0xc4
mov byte [esp + 0x38], 0x7d
mov byte [esp + 0x39], 0x16
mov byte [esp + 0x3a], 0xf3
mov byte [esp + 0x3b], 0x8f
mov byte [esp + 0x40], 0xdb
mov byte [esp + 0x41], 0x29
mov byte [esp + 0x42], 0x7c
mov byte [esp + 0x43], 0xaa
mov byte [esp + 0x44], 0x53
mov byte [esp + 0x45], 0x73
mov byte [esp + 0x46], 0x8b
mov byte [esp + 0x47], 0xea
xor eax, eax
lea esp, [esp]
mov dl, byte [esp + eax + 0x40]
xor byte [esp + eax + 0x34], dl
inc eax
cmp eax, 9
jb 0x415180
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x4c]
push str.connect
push eax
call esi
add esp, 8
xor eax, eax
jmp 0x4151b0
mov cl, byte [esp + eax + 0x34]
mov byte [esp + eax + 0x24c], cl
inc eax
cmp cl, bl
jne 0x4151b0
movzx ecx, word [0x4775f4]
push ecx
push 0x4775c0
lea edx, [esp + 0x154]
push str.__u_s__p_d
push edx
call esi
lea eax, [esp + 0x15c]
add esp, 0x10
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4151e8
lea edi, [esp + 0x4c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4151f6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [0x4775f6], bl
je 0x415239
lea eax, [esp + 0x4c]
dec eax
jmp 0x415220
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x415220
mov ecx, dword [str.__bc]
mov dl, byte [0x460f94]
mov dword [eax], ecx
mov byte [eax + 4], dl
cmp dword [ebp + 0x320], ebx
je 0x415248
mov ecx, ebp
call fcn.004131d0
mov ecx, 0x477848
cmp dword [ebp + 0x31c], ebx
jne 0x41526d
mov dword [ebp + 0x31c], 1
call fcn.00417320
mov ecx, ebp
call fcn.00414fe0
jmp 0x415272
call fcn.00417320
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x358], ebx
call fcn.0041ad80
call fcn.00441ae4
cdq
mov ecx, 0xefff
idiv ecx
mov dword [esp + 0x30], edx
lea edx, [esp + 0x14]
push edx
call fcn.0041b0e0
add esp, 4
test al, al
jne 0x4152e9
push ebx
push 0x10
push 0x97
mov ecx, 0x4838c0
call dword [sym.imp.mumsg.dll_public:_char____thiscall_CMsg::Get_int_]
push eax
call fcn.0042b436
mov eax, dword [ebp + 0x20]
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x2c], 0x10
jb 0x415367
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x41535f
push 5
push ebx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x258]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0xb
ja case.0x415311.599
movzx ecx, byte [eax + 0x4153a0]
jmp dword [ecx*4 + 0x415390]
push ebx
push 0x10
push 0x83
jmp 0x415334
push ebx
push 0x10
push 0x84
jmp 0x415334
push ebx
push 0x10
push 0x85
mov ecx, 0x4838c0
call dword [sym.imp.mumsg.dll_public:_char____thiscall_CMsg::Get_int_]
push eax
call fcn.0042b436
mov edx, dword [ebp + 0x20]
push ebx
push ebx
push 0x10
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x2c], 0x10
jb 0x415367
mov eax, dword [esp + 0x18]
push eax
call fcn.0042172b
add esp, 4
mov ecx, dword [esp + 0x350]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x338]
xor ecx, esp
call fcn.0043efc3
add esp, 0x348
ret
push esi
push 1
mov esi, ecx
call fcn.00413fc0
push 1
mov ecx, esi
call fcn.00412b90
push 0x7e
mov ecx, 0x4838c0
call dword [sym.imp.mumsg.dll_public:_char____thiscall_CMsg::Get_int_]
push eax
mov ecx, esi
call fcn.00414380
push 1
lea ecx, [esi + 0x55ac]
mov dword [esi + 0x140], 1
mov dword [esi + 0x320], 1
call fcn.00428b04
push 1
mov ecx, esi
call fcn.00412a70
mov ecx, esi
call fcn.004133f0
cmp byte [0x4775f6], 0
je 0x4163aa
mov ecx, esi
pop esi
jmp 0x415080
pop esi
ret