Function at 0x407f00
Capabilities:
Create directory
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x581e00]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
push 0x104
lea ecx, [ebp - 0x18c]
push 0
push ecx
mov dword [ebp - 0x190], esi
mov dword [ebp - 0x198], eax
call fcn.00510790
add esp, 0xc
push 0x50
lea edx, [ebp - 0x84]
push 0
push edx
call fcn.00510790
add esp, 0xc
test esi, esi
je 0x4083dc
cmp dword [ebp + 8], 0
je 0x4083dc
push 1
push 0x1a
lea eax, [ebp - 0x18c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
lea eax, [ebp - 0x18c]
jne 0x407fa4
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407f80
mov ecx, dword [str.c:moji_]
mov edx, dword [0x561428]
mov dword [eax], ecx
mov cl, byte [0x56142c]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
jmp 0x407fc9
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407fa5
mov edx, dword [str.moji_]
mov cx, word [0x561434]
mov dword [eax], edx
mov dl, byte [0x561436]
mov word [eax + 4], cx
mov byte [eax + 6], dl
push 0
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x2f
push esi
call fcn.0050dd80
add esp, 8
test eax, eax
je 0x4083dc
inc eax
lea edx, [ebp - 0x84]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407ff4
lea ecx, [ebp - 0x84]
push 0x2e
push ecx
call fcn.0050dd80
add esp, 8
test eax, eax
jne 0x408039
lea eax, [ebp - 0x84]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408020
mov edx, dword [str..exe]
mov cl, byte [0x560bb4]
mov dword [eax], edx
mov byte [eax + 4], cl
mov cl, 0xab
mov byte [ebp - 0x25], cl
mov cl, 0xf7
mov dword [ebp - 0x33], 0x8e9e8e96
mov dword [ebp - 0x2f], 0xb2b3a2b4
mov dword [ebp - 0x2b], 0x98ab98b7
mov word [ebp - 0x27], 0xb7b4
mov dword [ebp - 0x24], 0x87f3f7f7
mov word [ebp - 0x20], 0xa5ac
mov byte [ebp - 0x1e], cl
mov dword [ebp - 0x1d], 0xa2e9f6f6
mov word [ebp - 0x19], 0xa2bf
mov byte [ebp - 0x17], 0xc7
mov dword [ebp - 0x14], 0xbd98bfbe
mov dword [ebp - 0x10], 0xbfa2e9a0
mov word [ebp - 0xc], 0xc7a2
lea eax, [ebp - 0x34]
mov byte [ebp - 0x34], 0x49
inc eax
xor byte [eax], 0xc7
jne 0x408097
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x84]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4080c6
test al, al
je 0x4080c2
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4080c6
add ecx, 2
add edx, 2
test al, al
jne 0x4080a6
xor eax, eax
jmp 0x4080cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x408104
cmp byte [ebp - 0x84], 0x5f
je 0x408196
lea esi, [ebp - 0x84]
call fcn.0050dc1d
xor edx, edx
mov ecx, 0x3e
div ecx
inc esi
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi - 1], dl
cmp byte [esi], 0x5f
jne 0x4080e2
jmp 0x408196
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x79
jmp 0x408110
inc eax
xor byte [eax], 0xc7
jne 0x408110
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x84]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408140
test dl, dl
je 0x40813c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408140
add eax, 2
add ecx, 2
test dl, dl
jne 0x408120
xor eax, eax
jmp 0x408145
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x408196
lea eax, [ebp - 0x84]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408152
sub eax, edx
push eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.00513ea0
add esp, 0xc
xor esi, esi
call fcn.0050dc1d
xor edx, edx
mov ecx, 0x3e
div ecx
inc esi
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ebp + esi - 0x85], dl
cmp esi, 0x14
jl 0x408171
mov byte [ebp - 0x71], 0x5f
lea eax, [ebp - 0x84]
mov edx, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4081a0
lea edi, [ebp - 0x18c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4081b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0x10], 0
rep movsb byte es:[edi], byte [esi]
je 0x408275
lea eax, [ebp - 0x18c]
push 0x2e
push eax
call fcn.0050dd80
mov edi, eax
add esp, 8
test edi, edi
je 0x408275
mov eax, dword [ebp - 0x198]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4081f8
sub ecx, esi
sub edi, ecx
lea ecx, [ebp - 0x18c]
cmp edi, ecx
jbe 0x408275
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408212
sub ecx, esi
mov edx, eax
mov esi, edi
cmp ecx, 4
jb 0x408238
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x40825c
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x408224
test ecx, ecx
je 0x408275
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x40825c
cmp ecx, 1
jbe 0x408275
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x40825c
cmp ecx, 2
jbe 0x408275
mov dl, byte [edx + 2]
cmp dl, byte [esi + 2]
je 0x408275
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408261
sub ecx, esi
push ecx
push eax
push edi
call fcn.00513ea0
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x190]
xor edi, edi
call fcn.00408640
test eax, eax
je 0x4082a6
push 0x2710
call ebx
cmp dword [0x58b20c], 0
jne 0x4082a6
mov dword [0x58b20c], 1
xor eax, eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x18c]
push eax
lea edx, [ebp - 0x194]
mov ecx, esi
call fcn.00401640
mov ecx, dword [ebp - 0x194]
add esp, 4
cmp eax, ecx
jne 0x4082e3
mov eax, dword [ebp - 0x190]
cmp edx, eax
jne 0x4082e3
or ecx, eax
jne 0x4082f6
inc edi
cmp edi, 5
jg 0x4083dc
push 0x4e20
call ebx
jmp 0x408283
lea ecx, [ebp - 0x18c]
push str.HY_Setup_quwan
push ecx
call fcn.0050ce20
add esp, 8
test eax, eax
je 0x40832a
lea edi, [ebp - 0x18c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408315
mov edx, dword [0x560cd8]
mov dword [edi], edx
jmp 0x4083ac
lea eax, [ebp - 0x18c]
push str.qyUpdate
push eax
call fcn.0050ce20
add esp, 8
test eax, eax
je 0x408374
lea eax, [ebp - 0x18c]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408350
mov ecx, dword [str.__update]
mov edx, dword [0x560cec]
mov dword [eax], ecx
mov cl, byte [0x560cf0]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
jmp 0x4083ac
lea edx, [ebp - 0x18c]
push str.zhuye
push edx
call fcn.0050ce20
add esp, 8
test eax, eax
je 0x4083ac
lea eax, [ebp - 0x18c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408393
mov ecx, dword [str._update]
mov edx, dword [0x560d00]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov ecx, dword [0x58b22c]
lea eax, [ebp - 0x18c]
push eax
push ecx
mov ecx, 0x58b224
call fcn.004194df
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050cbf9
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0050cbf9
mov esp, ebp
pop ebp
ret 0xc