Function at 0x49dcff
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x4bf911
call fcn.004be928
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 1
push 4
pop esi
push esi
lea ecx, [ebp - 0x50]
call fcn.0043557d
mov dword [ebp - 0x18], 0x65c829e
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x28], 0x9015
push 3
lea ecx, [ebp - 0x44]
call fcn.0043557d
xor ebx, ebx
mov dword [ebp - 0x18], ebx
jmp 0x49dd63
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x49dd53
mov dword [ebp - 0x18], ebx
jmp 0x49dd7d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov dword [eax + ecx*4], 0x3624b674
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x49dd6d
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x20]
je 0x49ddad
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov dword [eax + 8], 0x82b357f0
lea ecx, [ebp - 0x44]
call fcn.0043564f
lea ecx, [ebp - 0x50]
call fcn.0043564f
mov dword [ebp - 0x20], 0x2a3f
cmp dword [ebp - 0x20], 0x2b89
jle 0x49de18
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
xor eax, esi
or eax, edi
cdq
push edx
push eax
mov ecx, 0xab56b8
call fcn.00435439
inc ebx
cmp ebx, 0x7d0e
jl 0x49dde1
inc esi
cmp esi, 0x5ad8
push 0
pop ebx
jl 0x49ddde
inc edi
cmp edi, 0x367f
jl 0x49dddc
push 4
pop esi
mov edi, dword [ebp - 0x24]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x2a29
jge 0x49de33
mov edx, str.vqzb_fsjq_lqypthwm_scxal
mov ecx, 0xab56b8
call fcn.004371ef
or dword [ebp - 4], 0xffffffff
jmp 0x49de5f
push esi
lea ecx, [ebp - 0x5c]
call fcn.0043557d
mov dword [ebp - 0x18], 0x8e9934b0
push esi
lea ecx, [ebp - 0x38]
call fcn.0043557d
mov dword [ebp - 0x18], ebx
jmp 0x49de8a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x49de7d
mov dword [ebp - 0x18], ebx
jmp 0x49dea4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov dword [eax + ecx*4], 0xa01c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x49de94
mov eax, dword [ebp - 0x5c]
mov dword [eax + 8], ebx
mov eax, dword [ebp - 0x38]
inc dword [eax + 4]
jne 0x49dedc
mov dword [ebp - 0x18], ebx
jmp 0x49ded4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x49ded1
push 0x15dd
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff9
jne 0x49debc
jmp 0x49deff
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x24], 0xfffffff8
mov eax, dword [ebp - 0x28]
mov ecx, 0xfffa
mov eax, dword [ebp - 0x38]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x38]
call fcn.0043564f
lea ecx, [ebp - 0x5c]
call fcn.0043564f
mov dword [edi], ebx
cmp dword [edi], esi
jge 0x49df29
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 1
inc dword [edi]
cmp dword [edi], esi
jl 0x49df18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret