Function at 0x407c94
Capabilities:
Copy file
Encode data using xor
Move file

Disassembly:
mov eax, 0x470611
call fcn.0046ffb4
sub esp, 0x1e0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
pop ecx
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov dword [esp], 0x104
lea eax, [ebp - 0x1ec]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x407e95
lea ecx, [ebp - 0x2c]
call fcn.0041c4e2
lea ecx, [ebp - 0xe0]
mov dword [ebp - 4], ebx
call fcn.0041c4e2
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
cmova eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x407e82
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004124a4
push dword [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x97]
call fcn.00412ebc
push ecx
push 9
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.004123c9
mov edx, ebx
mov cl, byte [esi + edx + 1]
lea eax, [ebp - 0x5c]
xor cl, byte [esi]
cmp dword [ebp - 0x48], 0xf
cmova eax, dword [ebp - 0x5c]
mov byte [eax + edx], cl
inc edx
cmp edx, 9
jb 0x407d41
lea eax, [ebp - 0x1ec]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xc8]
call fcn.00412445
mov esi, eax
lea eax, [ebp - 0x1ec]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xb0]
call fcn.00412445
mov edx, eax
mov byte [ebp - 4], 5
cmp dword [edx + 0x14], 0xf
mov eax, dword [edx + 0x10]
jbe 0x407d9a
mov edx, dword [edx]
test eax, eax
je 0x407db9
dec eax
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
jmp 0x407db0
cmp ecx, edx
je 0x407db9
dec ecx
cmp byte [ecx], 0x5c
jne 0x407dab
sub ecx, edx
jmp 0x407dbc
or ecx, 0xffffffff
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
inc ecx
cmp dword [esi + 0x10], ecx
push 0xf
cmovb ecx, dword [esi + 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
cmp dword [esi + 0x14], edi
jbe 0x407ddd
mov esi, dword [esi]
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.00415ecb
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x74]
call fcn.004162d6
mov edx, dword [ebp - 0x30]
cmp edx, edi
jbe 0x407e0e
mov ecx, dword [ebp - 0x44]
inc edx
call fcn.00415f66
lea ecx, [ebp - 0xb0]
call fcn.00412370
lea ecx, [ebp - 0xc8]
call fcn.00412370
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
call fcn.00412370
cmp dword [ebp - 0x60], edi
lea ecx, [ebp - 0x74]
push ebx
cmova ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], edi
push ecx
cmova eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x407e6f
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova eax, dword [ebp - 0x2c]
mov ecx, 0x5ad460
push eax
call fcn.0041292c
lea ecx, [ebp - 0x74]
call fcn.00412370
lea ecx, [ebp - 0x8c]
call fcn.00412370
lea ecx, [ebp - 0xe0]
call fcn.00412370
lea ecx, [ebp - 0x2c]
call fcn.00412370
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret