Function at 0x407d91
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040d670
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x2000]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x407dc7
lea edx, [ebp - 0x2000]
call fcn.00406d54
jmp 0x407dd5
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, 0x40e334
lea eax, [ebp - 0x2000]
call fcn.004054ea
mov ecx, 0x4201e0
call fcn.004054ea
cmp dword [ebp + 8], edi
push 4
pop eax
je 0x407dfa
push 3
pop eax
push edi
push 2
push eax
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov dword [0x4110a8], eax
pop esi
mov eax, ecx
leave
ret

Function at 0x407e25
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
cmp dword [0x4110a8], 0xffffffff
jne 0x407e49
push 0
call fcn.00407d91
cmp dword [0x4110a8], 0xffffffff
pop ecx
jne 0x407e49
xor eax, eax
leave
ret
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.0040544e
push dword [ebp + 0x10]
mov esi, eax
call fcn.0040544e
mov edx, dword [ebp + 0xc]
mov ebx, eax
lea eax, [ebp - 0x68]
push eax
call fcn.0040550e
add esp, 0xc
push 0xa
pop ecx
cmp esi, ecx
jae 0x407e87
sub ecx, esi
xor eax, eax
shr ecx, 1
lea edi, [ebp + esi*2 - 0x68]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
call fcn.0040550e
pop ecx
push 0x32
lea eax, [ebx + 0xa]
pop ecx
cmp eax, ecx
jae 0x407eaf
sub ecx, eax
lea edi, [ebp + eax*2 - 0x68]
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor esi, esi
xor eax, eax
xor byte [ebp + eax - 0x68], 0x78
inc eax
cmp eax, 0x64
jb 0x407eb3
mov eax, dword [ebp + 8]
imul eax, eax, 0x64
push esi
push esi
push eax
push dword [0x4110a8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 4]
push eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push dword [0x4110a8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407eef
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
cmp dword [0x4110a8], 0xffffffff
push esi
mov esi, eax
jne 0x407f12
push 1
call fcn.00407d91
cmp dword [0x4110a8], 0xffffffff
pop ecx
je 0x407f7e
imul esi, esi, 0x64
push 0
push 0
push esi
push dword [0x4110a8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 0x64
lea eax, [ebp - 0x6c]
push eax
push dword [0x4110a8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407f7e
cmp dword [ebp - 4], 0x64
jne 0x407f7e
xor eax, eax
xor byte [ebp + eax - 0x6c], 0x78
inc eax
cmp eax, 0x64
jb 0x407f4a
push dword [ebp + 8]
and word [ebp - 8], 0
lea eax, [ebp - 0x6c]
call fcn.00405490
pop ecx
lea ecx, [ebp - 0x6c]
cmp eax, ecx
jne 0x407f7e
push dword [ebp + 0xc]
lea edx, [ebp - 0x58]
call fcn.0040550e
xor eax, eax
pop ecx
inc eax
jmp 0x407f80
xor eax, eax
pop esi
leave
ret