Function at 0x10005278
Capabilities:
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x2000
mov dword [ebp - 4], ecx
call fcn.100129cc
pop ecx
xor ebx, ebx
mov esi, eax
push ebx
push 0x23
push esi
push ebx
mov dword [ebp - 8], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esi - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100052a3
mov ecx, dword [ebp - 4]
mov esi, str._save.dat
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, ecx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100052bc
sub esi, edx
mov edx, ebx
je 0x100052e6
mov al, byte [edx + 0x1002cf10]
add ecx, ebx
xor byte [ecx], al
inc edx
xor byte [ecx], bl
xor eax, eax
mov ecx, dword [ebp - 4]
cmp edx, 0x10
cmove edx, eax
inc ebx
cmp ebx, esi
jb 0x100052c9
push 0x1002d14c
push dword [ebp - 8]
call fcn.10013192
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10005310
push edi
push 1
push esi
push dword [ebp - 4]
call fcn.10013327
push edi
call fcn.100134a5
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005317
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
push edi
mov dword [ebp - 4], ebx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10005330
mov eax, dword [ebp + 8]
sub esi, edx
cdq
sub eax, edx
xor edx, edx
mov edi, eax
sar edi, 1
mov dword [ebp - 0xc], edi
test edi, edi
jle 0x1000537a
mov al, byte [ebx + edx*2]
mov cl, byte [ebx + edx*2 + 1]
cmp al, 0x3a
jae 0x1000535b
add al, 0xd0
jmp 0x1000535d
add al, 0xa9
cmp cl, 0x3a
jae 0x10005367
add cl, 0xd0
jmp 0x1000536a
add cl, 0xa9
shl al, 4
or al, cl
mov byte [edx + ebx], al
inc edx
cmp edx, edi
jl 0x1000534c
mov ecx, dword [ebp - 8]
xor eax, eax
mov byte [ebp + eax - 0x10c], al
inc eax
cmp eax, 0x100
jne 0x1000537c
and dword [ebp + 8], 0
xor edi, edi
xor edx, edx
mov bl, byte [ebp + edi - 0x10c]
mov eax, edi
div esi
movsx eax, byte [edx + ecx]
mov edx, 0xff
add eax, dword [ebp + 8]
movzx ecx, bl
add ecx, eax
and ecx, edx
mov dword [ebp + 8], ecx
mov al, byte [ebp + ecx - 0x10c]
mov byte [ebp + edi - 0x10c], al
inc edi
mov byte [ebp + ecx - 0x10c], bl
mov ecx, dword [ebp - 8]
cmp edi, 0x100
jne 0x10005391
and dword [ebp + 8], 0
xor esi, esi
mov edi, dword [ebp - 0xc]
xor ebx, ebx
test edi, edi
jg 0x100053f7
mov edx, dword [ebp - 4]
mov byte [edi + edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0xff
inc esi
and esi, edx
mov cl, byte [ebp + esi - 0x10c]
movzx eax, cl
add eax, dword [ebp + 8]
and eax, edx
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
mov al, byte [ebp + eax - 0x10c]
mov byte [ebp + edx - 0x10c], cl
mov ecx, edx
mov byte [ebp + esi - 0x10c], al
movzx eax, al
movzx ecx, byte [ebp + ecx - 0x10c]
add ecx, eax
and ecx, 0x800000ff
jns 0x10005443
dec ecx
or ecx, 0xffffff00
inc ecx
mov edx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x10c]
xor byte [ebx + edx], al
inc ebx
cmp ebx, edi
jl 0x100053f2
jmp 0x100053e7