Function at 0x4390d0
Capabilities:
Delete file
Encode data using xor
Encrypt data using rc4 ksa
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x378
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0045ac70
mov al, byte [0x7ea90d]
cmp al, 0xff
jne 0x43910f
xor cl, cl
call fcn.0045a9a0
and al, 7
movss xmm3, dword [0x7ea9ac]
movaps xmm2, xmm3
mov byte [0x7dbc67], al
mulss xmm2, dword [0x4fc020]
movaps xmm1, xmm3
push 0x2710
mulss xmm1, dword [0x4fc4e8]
push 0
mulss xmm3, dword [0x4fc438]
movaps xmm0, xmm2
push 0x7eafc0
addss xmm0, xmm1
movss dword [0x7d0530], xmm1
mulss xmm1, dword [0x4fc3d4]
addss xmm2, xmm3
movss dword [0x7d0524], xmm3
movss dword [0x7d052c], xmm0
movss dword [0x7d0528], xmm1
movss dword [0x7d0520], xmm2
call sub.VCRUNTIME140.dll_memset
push 0x2710
xorps xmm0, xmm0
push 0
push 0x7efde0
movq qword [0x7e8148], xmm0
call sub.VCRUNTIME140.dll_memset
push 0x2710
push 0
push 0x7ed6d0
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
xorps xmm0, xmm0
movq qword [0x7e8338], xmm0
call fcn.00438c30
mov al, byte [0x7e864a]
mov byte [0x7eab9a], al
mov al, byte [0x7e8658]
mov byte [0x7eaba8], al
mov al, byte [0x7e8659]
mov byte [0x7eaba9], al
mov dword [0x9f0610], 0
call fcn.00438520
call fcn.00487d30
call fcn.004499e0
call fcn.00419500
movzx eax, byte [0x7ea96a]
mov cx, ax
shl ax, 2
add cx, ax
movzx eax, byte [0x7ea964]
add cx, ax
mov eax, 0xf4
add cx, ax
cmp byte [0x7ea94b], 1
mov word [0x9eaea8], cx
jne 0x43925a
cmp byte [0xa88c23], 0
jne 0x43925a
lea eax, [ebp - 0x360]
push eax
push dword [0xa91984]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x360]
push eax
jmp 0x43925c
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
push 0
mov byte [0x7e803d], 0
call fcn.00434db0
add esp, 4
call fcn.004d3160
mov eax, 0x66666667
mov cl, 5
imul dword [0x9f0610]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
mov dword [0x9f0610], eax
call fcn.00433cd0
mov cl, 3
call fcn.00434140
mov cl, 0xc
call fcn.00435e50
test al, al
jne 0x4392b5
call fcn.004389b0
mov cl, 0xa
call fcn.00436000
test al, al
jne 0x4392c5
call fcn.00438af0
call fcn.004b1e60
call fcn.00439040
movzx eax, byte [0x55835c]
mov ecx, 1
cmp byte [0x7eab93], 0
push 0xb0b980
push 0xa92828
cmovne eax, ecx
push str._s_s.dat
mov byte [0x55835c], al
lea eax, [ebp - 0x108]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x14
lea eax, [ebp - 0x108]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x439497
mov ecx, dword [0xa88e4c]
mov edx, 0x6a
push esi
lea ecx, [ecx + 0x6a]
call fcn.0042d690
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0xa88e4c]
cmp byte [edi + 0x6d], 0x40
mov byte [edi + 0x6c], 0x30
jne 0x43939e
lea eax, [edi + 0x90]
push eax
lea eax, [edi + 0x6e]
push eax
push 0xb22d00
lea eax, [ebp - 0x308]
push 0x80
push eax
call fcn.0042cda0
push 0
mov dl, 2
lea ecx, [ebp - 0x308]
call fcn.004497a0
mov edi, dword [0xa88e4c]
add esp, 0x18
movaps xmm0, xmmword [0xa89060]
xor esi, esi
movaps xmmword [ebp - 0x350], xmm0
movaps xmm0, xmmword [0xa89070]
movaps xmmword [ebp - 0x340], xmm0
movaps xmm0, xmmword [0xa89080]
movaps xmmword [ebp - 0x330], xmm0
movaps xmm0, xmmword [0xa89090]
movaps xmmword [ebp - 0x320], xmm0
nop dword [eax + eax]
lea edx, [esi + 1]
and esi, 0xf
lea eax, [edx + 6]
and eax, 0xf
movzx ecx, word [edi + eax*2 + 0x90]
mov eax, edx
and eax, 0xf
movzx eax, word [edi + eax*2 + 0x6e]
add ecx, eax
add dword [ebp + esi*4 - 0x350], ecx
mov esi, edx
cmp esi, 0x100
jl 0x4393e0
lea ecx, [edi + 0x48]
mov dword [ebp - 0x368], 0xa
xor esi, esi
mov edi, ecx
mov eax, dword [ebp + esi*4 - 0x350]
lea edi, [edi + 2]
xor edx, edx
inc esi
div dword [ebp - 0x368]
add edx, 0x30
mov word [edi - 2], dx
cmp esi, 0x10
jl 0x439422
mov edi, dword [0xa88e4c]
xor edx, edx
mov ax, word [ecx]
cmp ax, word [edi + 0xb2]
jne 0x439467
inc edx
lea ecx, [ecx + 2]
cmp edx, 0x10
je 0x4394bd
mov ax, word [ecx]
cmp ax, word [ecx + 0x6a]
je 0x439455
push 0xb0b980
push 0xa92828
push str._s_s.dat
lea eax, [ebp - 0x208]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0xa88e4c]
mov byte [eax], 0x10
cmp byte [0x7ea8b0], 0xff
jne 0x439789
mov byte [0x7ea8b0], 1
mov ecx, 0x5580f0
jmp 0x43978e
lea ecx, [edi + 4]
mov byte [ebp - 0x361], 0
xor esi, esi
mov dword [ebp - 0x36c], ecx
nop
xor edx, edx
mov ax, word [ecx]
cmp ax, word [ecx + 0x6a]
jne 0x4394ec
inc edx
add ecx, 2
cmp edx, 8
jl 0x4394d2
mov al, byte [ebp - 0x361]
jmp 0x439502
mov al, byte [ebp - 0x361]
add al, 1
mov byte [ebp - 0x361], al
cmp al, 1
ja 0x439467
mov ecx, dword [ebp - 0x36c]
inc esi
add ecx, 0x10
mov dword [ebp - 0x36c], ecx
cmp esi, 2
jne 0x4394d0
mov byte [edi], 0x1f
test al, al
je 0x4396c1
push 0xb0b980
push 0xa92828
push str._s_s.dat
lea eax, [ebp - 0x108]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x14
lea eax, [ebp - 0x108]
push 0
push 0x80
push 4
push 0
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x36c], eax
cmp eax, 0xffffffff
je 0x4396c1
movaps xmm0, xmmword [0xa89060]
xor esi, esi
mov edi, dword [0xa88e4c]
movaps xmmword [ebp - 0x350], xmm0
movaps xmm0, xmmword [0xa89070]
movaps xmmword [ebp - 0x340], xmm0
movaps xmm0, xmmword [0xa89080]
movaps xmmword [ebp - 0x330], xmm0
movaps xmm0, xmmword [0xa89090]
movaps xmmword [ebp - 0x320], xmm0
lea edx, [esi + 1]
and esi, 0xf
lea eax, [edx + 6]
and eax, 0xf
movzx ecx, word [edi + eax*2 + 0x90]
mov eax, edx
and eax, 0xf
movzx eax, word [edi + eax*2 + 4]
add ecx, eax
add dword [ebp + esi*4 - 0x350], ecx
mov esi, edx
cmp esi, 0x100
jl 0x4395b2
xor ecx, ecx
lea esi, [edi + 0x48]
nop dword [eax + eax]
mov eax, dword [ebp + ecx*4 - 0x350]
lea esi, [esi + 2]
xor edx, edx
inc ecx
div dword [ebp - 0x368]
add edx, 0x30
mov word [esi - 2], dx
cmp ecx, 0x10
jl 0x4395f0
lea ecx, [edi + 0x6e]
mov edx, 0x10
nop word [eax + eax]
movzx eax, word [ecx - 0x6a]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
movzx eax, word [ecx - 0x28]
mov word [ecx + 0x42], ax
sub edx, 1
jne 0x439620
mov byte [edi + 3], 0x4f
mov edx, 0xe694a407
mov byte [edi + 0x6d], 0x4f
add edi, 0x6a
xor esi, esi
nop word [eax + eax]
mov eax, edx
mov ecx, edx
shr eax, 3
shr ecx, 1
sub ecx, eax
mov eax, edx
shr eax, 2
add edx, 0x519b2f6c
sub ecx, eax
add edx, ecx
xor dword [edi + esi*4], edx
inc esi
cmp esi, 0x1a
jb 0x439650
push 0
lea eax, [ebp - 0x368]
push eax
push 0x6a
push edi
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0xe694a407
xor esi, esi
mov eax, edx
mov ecx, edx
shr eax, 3
shr ecx, 1
sub ecx, eax
mov eax, edx
shr eax, 2
add edx, 0x519b2f6c
sub ecx, eax
add edx, ecx
xor dword [edi + esi*4], edx
inc esi
cmp esi, 0x1a
jb 0x439692
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x7d057f], 0
je 0x4396d4
mov ecx, 0x557670
jmp 0x43978e
cmp byte [0x7ea8b0], 0xff
je 0x4394ac
push 0x7ea8b2
push 0x10
push 0x7f24f0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
mov dword [ebp - 0x368], 3
mov esi, 0x7f2530
mov edi, 0xb078d8
nop word [eax + eax]
push edi
push 0x10
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
add edi, 0x20
add esi, 0x40
sub dword [ebp - 0x368], 1
jne 0x439710
movss xmm0, dword [0x7ea9ac]
mov ecx, 0x557830
mulss xmm0, dword [0x4fc020]
mov byte [0x7d124e], 0
mov byte [0x7d124b], 0
mov byte [0x7d1246], 0xff
movss dword [0x90aa34], xmm0
call fcn.00460890
xor dl, dl
mov cl, 2
call fcn.00420070
mov ecx, 0x33
call fcn.00417e70
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d66b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, 0x558010
call fcn.00460890
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d66b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret