Function at 0x45dba0
Capabilities:
Encode data using xor
Get common file path
Read file on windows

Disassembly:
sub esp, 0x48c
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x488], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov ebx, ecx
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x45dc33
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [esp + 0x84]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x45dbf6
mov eax, dword [str.Microsoft_]
mov dword [ecx], eax
mov eax, dword [0x4a9b2c]
mov dword [ecx + 4], eax
mov eax, dword [0x4a9b30]
mov dword [ecx + 8], eax
mov eax, dword [0x4a9b34]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4a9b38]
mov dword [ecx + 0x10], eax
mov eax, dword [0x4a9b3c]
mov dword [ecx + 0x14], eax
jmp 0x45dc4b
mov eax, dword [0x4a9b40]
mov dword [esp + 0x84], eax
mov eax, dword [0x4a9b44]
mov dword [esp + 0x88], eax
xor ecx, ecx
nop dword [eax]
movzx eax, word [esp + ecx + 0x84]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x28a], ax
test ax, ax
jne 0x45dc50
mov esi, ebx
nop word [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x45dc70
lea edi, [esp + 0x28c]
sub ebx, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x45dc90
mov ecx, ebx
lea eax, [esp + 0x28c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0x4a9c90
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x45dcf5
push eax
lea eax, [esp + 0x290]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
add esp, 8
inc eax
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.00475a12
add esp, 0x48c
ret
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
add esp, 0x14
test ebx, ebx
jne 0x45dd3b
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.00475a12
add esp, 0x48c
ret
lea eax, [ebx + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
push ebx
mov edi, eax
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x14
cmp eax, ebx
je 0x45dd85
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.00475a12
add esp, 0x48c
ret
lea ecx, [esp + 0x10]
call fcn.0045d140
lea edx, [ebx - 1]
xor ecx, ecx
test edx, edx
js 0x45dda8
mov eax, ecx
and eax, 7
mov al, byte [esp + eax + 0x10]
xor byte [ecx + edi], al
inc ecx
cmp ecx, edx
jle 0x45dd97
push edi
mov byte [edi + ebx], 0
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esp + 0x49c]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00475a12
add esp, 0x48c
ret