Function at 0x42038e
Capabilities:
Copy file
Encode data using xor
Move file

Disassembly:
mov eax, 0x47b211
call fcn.0047abb4
sub esp, 0x1e0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
pop ecx
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov dword [esp], 0x104
lea eax, [ebp - 0x1ec]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x42058f
lea ecx, [ebp - 0x2c]
call fcn.00432416
lea ecx, [ebp - 0xe0]
mov dword [ebp - 4], ebx
call fcn.00432416
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
cmova eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x42057c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00428fec
push dword [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x97]
call fcn.00429a0c
push ecx
push 9
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.00428f39
mov edx, ebx
mov cl, byte [esi + edx + 1]
lea eax, [ebp - 0x5c]
xor cl, byte [esi]
cmp dword [ebp - 0x48], 0xf
cmova eax, dword [ebp - 0x5c]
mov byte [eax + edx], cl
inc edx
cmp edx, 9
jb 0x42043b
lea eax, [ebp - 0x1ec]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xc8]
call fcn.00428fb5
mov esi, eax
lea eax, [ebp - 0x1ec]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xb0]
call fcn.00428fb5
mov edx, eax
mov byte [ebp - 4], 5
cmp dword [edx + 0x14], 0xf
mov eax, dword [edx + 0x10]
jbe 0x420494
mov edx, dword [edx]
test eax, eax
je 0x4204b3
dec eax
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
jmp 0x4204aa
cmp ecx, edx
je 0x4204b3
dec ecx
cmp byte [ecx], 0x5c
jne 0x4204a5
sub ecx, edx
jmp 0x4204b6
or ecx, 0xffffffff
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
inc ecx
cmp dword [esi + 0x10], ecx
push 0xf
cmovb ecx, dword [esi + 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
cmp dword [esi + 0x14], edi
jbe 0x4204d7
mov esi, dword [esi]
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.0042c0b2
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x74]
call fcn.0042c4bd
mov edx, dword [ebp - 0x30]
cmp edx, edi
jbe 0x420508
mov ecx, dword [ebp - 0x44]
inc edx
call fcn.0042c14d
lea ecx, [ebp - 0xb0]
call fcn.00428ee0
lea ecx, [ebp - 0xc8]
call fcn.00428ee0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
call fcn.00428ee0
cmp dword [ebp - 0x60], edi
lea ecx, [ebp - 0x74]
push ebx
cmova ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], edi
push ecx
cmova eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x420569
cmp dword [ebp - 0x18], edi
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmova eax, dword [ebp - 0x2c]
mov ecx, 0x5e9b60
push eax
call fcn.0042947c
lea ecx, [ebp - 0x74]
call fcn.00428ee0
lea ecx, [ebp - 0x8c]
call fcn.00428ee0
lea ecx, [ebp - 0xe0]
call fcn.00428ee0
lea ecx, [ebp - 0x2c]
call fcn.00428ee0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret