Function at 0x421c62
Capabilities:
Delete file
Encode data using xor
Get file attributes
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, 4
sub esp, 0x1000
test dword [esp], esp
dec edx
jne 0x421c6a
sub esp, 0x15c
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
call fcn.0045a18c
add esp, 4
mov edi, eax
cmp eax, 0x100
jae 0x422311
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
lea eax, [edx + edi]
mov ecx, dword [ecx]
sub eax, ecx
mov ebx, 0x104
cmp eax, ebx
jae 0x422311
sub edx, ecx
cmp edx, ebx
jae 0x422311
cmp edi, 6
jb 0x422311
lea edx, [esi + edi]
cmp byte [edx - 6], 0x2e
jne 0x422311
push 5
lea ecx, [edi + esi - 5]
lea edx, [ebp - 8]
push ecx
push edx
call fcn.0045a4e0
xor ebx, ebx
add esp, 0xc
mov cl, byte [ebp + ebx - 8]
cmp cl, 0x41
jl 0x421cfb
cmp cl, 0x5a
jg 0x421cfb
add byte [ebp + ebx - 8], 0x20
inc ebx
mov edx, 5
cmp ebx, edx
jb 0x421ce8
push edx
mov eax, dword [ebp + 0x10]
add eax, 0x50
push eax
lea ebx, [ebp - 8]
push ebx
call fcn.00459d20
add esp, 0xc
test eax, eax
jne 0x422311
push esi
xor ecx, ecx
mov byte [ebp - 3], cl
call fcn.0045a18c
mov edx, dword [ebp + 8]
mov edi, eax
mov ecx, dword [edx + 4]
lea edx, [edi + ecx + 1]
mov ecx, dword [ebp + 8]
sub edx, dword [ecx]
xor ecx, ecx
mov dword [ebp - 0x4128], ecx
mov dword [ebp - 0x4124], ecx
mov dword [ebp - 0x4120], ecx
lea ecx, [ebp - 0x4128]
push edx
call fcn.0042eac0
mov edx, dword [ebp - 0x4124]
mov ecx, dword [ebp + 8]
mov byte [edx], 0
mov edx, dword [ebp + 8]
push dword [ecx + 4]
lea ecx, [ebp - 0x4128]
push dword [edx]
call fcn.004288b0
lea edx, [esi + edi]
lea ecx, [ebp - 0x4128]
push edx
push esi
call fcn.0042870c
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 0x4128]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x421dd9
mov esi, dword [ebp - 0x4120]
lea ecx, [ebp - 0x4120]
sub esi, dword [ebp - 0x4128]
push esi
push dword [ebp - 0x4128]
call fcn.00428728
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x4154]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
mov dword [ebp - 0x4158], eax
cmp edx, dword [ebp - 0x4154]
jne 0x421dfd
cmp eax, dword [ebp - 0x4158]
je 0x421e03
mov byte [ebp - 3], 1
push dword [ebp - 0x4158]
call fcn.0045ae50
add esp, 4
mov esi, eax
test eax, eax
jne 0x421e1b
mov byte [ebp - 3], 1
cmp byte [ebp - 3], 0
jne 0x421e58
lea ecx, [ebp - 0x411c]
push 0
push ecx
push dword [ebp - 0x4158]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421e54
xor edx, edx
mov edi, dword [ebp - 0x411c]
cmp edx, dword [ebp - 0x4154]
jne 0x421e52
cmp edi, dword [ebp - 0x4158]
je 0x421e58
mov byte [ebp - 3], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 3], 0
jne 0x4222ea
cmp dword [ebp - 0x4154], 0
jne 0x421e7c
cmp dword [ebp - 0x4158], 0x80
jb 0x4222ea
push 0x10
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword [ebp - 0x4148], eax
mov dword [ebp - 0x4144], edx
push dword [0x4724a8]
push esi
call fcn.00459d20
add esp, 0xc
test eax, eax
jne 0x4222ea
mov eax, dword [ebp - 0x4158]
mov edx, dword [ebp - 0x4154]
add eax, 0xffffff80
adc edx, 0xffffffff
cmp dword [ebp - 0x4144], edx
jne 0x421ecd
cmp dword [ebp - 0x4148], eax
jae 0x4222ea
mov eax, dword [ebp - 0x4158]
mov edx, dword [ebp - 0x4154]
add eax, 0xffffffff
adc edx, 0xffffffff
cmp byte [eax + esi], 0
jne 0x4222ea
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx + 4]
xor edx, edx
sub ebx, dword [ecx]
add ebx, dword [ebp - 0x4158]
adc edx, dword [ebp - 0x4154]
add ebx, 0xffffff7f
adc edx, 0xffffffff
sub ebx, dword [ebp - 0x4148]
sbb edx, dword [ebp - 0x4144]
test edx, edx
jne 0x421f24
cmp ebx, 0x104
jae 0x4222ea
push 0
lea ecx, [esi + 0x50]
lea edx, [esi + 0x30]
push 0x30
push ecx
mov ecx, dword [ebp + 0x10]
add ecx, 0x10
push 0
push 0
push edx
push ecx
call fcn.0041f7f8
xor ebx, ebx
mov dword [ebp - 0x4140], 0
mov dword [ebp - 0x413c], 0
add esp, 0x1c
lea edx, [esi + ebx*8]
mov eax, dword [edx + 0x50]
mov edx, dword [edx + 0x54]
xor eax, 0x37373737
xor edx, 0x37373737
inc ebx
or dword [ebp - 0x4140], eax
or dword [ebp - 0x413c], edx
cmp ebx, 6
jb 0x421f5f
mov ebx, dword [ebp - 0x413c]
or ebx, dword [ebp - 0x4140]
jne 0x4222ea
push dword [ebp - 0x4144]
lea ecx, [esi + 0x80]
lea edx, [esi + 0x30]
push dword [ebp - 0x4148]
push ecx
mov ecx, dword [ebp + 0x10]
add ecx, 0x10
push 0
push 0x30
push edx
push ecx
call fcn.0041f7f8
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
sub ecx, edx
push ecx
lea ecx, [ebp - 0x410c]
push edx
push ecx
call fcn.0045a4e0
mov eax, dword [ebp - 0x4158]
add eax, 0xffffff80
mov edx, dword [ebp - 0x4154]
adc edx, 0xffffffff
sub eax, dword [ebp - 0x4148]
push eax
mov ecx, dword [ebp - 0x4148]
sbb edx, dword [ebp - 0x4144]
lea edx, [ecx + esi + 0x80]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0x410c]
mov edx, dword [ebp + 8]
sub ecx, dword [edx]
push ecx
call fcn.0045a4e0
add esp, 0x34
lea ecx, [ebp - 0x410c]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x42209e
lea edx, [ebp - 0x410c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
test ebx, 1
je 0x422074
mov ecx, ebx
and ecx, 0xfffffffe
lea edx, [ebp - 0x410c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [ebp - 0x410c]
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp eax, 0xffffffff
je 0x4222ea
push 0
lea edx, [ebp - 0x4130]
lea ecx, [esi + 0x80]
push edx
push dword [ebp - 0x4148]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4220cb
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4222ea
lea edx, [esi + 0x28]
lea ecx, [esi + 0x20]
push edx
lea edx, [esi + 0x18]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x410c]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov byte [ebp - 3], 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x4118], eax
je 0x4222ea
lea ebx, [ebp - 0x414c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x414c]
mov dword [ebp - 0x4150], eax
mov eax, dword [ebp - 0x4150]
cmp edx, dword [ebp - 0x4144]
jne 0x422145
cmp eax, dword [ebp - 0x4148]
je 0x42214b
mov byte [ebp - 3], 1
mov dword [ebp - 0x4114], esi
mov dword [ebp - 0x4138], 0
mov dword [ebp - 0x4134], 0
cmp byte [ebp - 3], 0
jne 0x4222aa
mov esi, dword [ebp - 0x414c]
or esi, dword [ebp - 0x4150]
je 0x4222aa
mov eax, dword [ebp - 0x4150]
mov edx, dword [ebp - 0x414c]
sub eax, dword [ebp - 0x4138]
sbb edx, dword [ebp - 0x4134]
test edx, edx
jne 0x4221a2
cmp eax, 0x4000
jbe 0x4221ad
mov ebx, 0x4000
xor ecx, ecx
jmp 0x4221b1
mov ecx, edx
mov ebx, eax
mov dword [ebp - 0x4110], ebx
cmp byte [ebp - 3], 0
jne 0x42226d
lea edi, [ebp - 0x412c]
push 0
lea esi, [ebp - 0x4008]
push edi
push dword [ebp - 0x4110]
push esi
push dword [ebp - 0x4118]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4221f5
mov eax, dword [ebp - 0x4110]
cmp eax, dword [ebp - 0x412c]
je 0x42226d
mov edi, dword [ebp - 0x4114]
mov edx, dword [ebp - 0x4110]
xor esi, esi
add edi, dword [ebp - 0x4138]
xor ebx, ebx
sar edx, 2
cmp edx, esi
jle 0x422225
mov eax, edx
mov ecx, dword [ebp + ebx*4 - 0x4008]
xor ecx, dword [edi + ebx*4]
or esi, ecx
inc ebx
cmp eax, ebx
jg 0x422214
mov edx, dword [ebp - 0x4110]
and edx, 0xfffffffc
mov ecx, dword [ebp + edx - 0x4008]
xor ecx, dword [edx + edi]
mov edx, 0xffffffff
push ecx
mov ecx, dword [ebp - 0x4110]
and ecx, 3
shl ecx, 3
shl edx, cl
not edx
pop ecx
and ecx, edx
or esi, ecx
test esi, esi
je 0x42226d
mov byte [ebp - 3], 1
mov esi, dword [ebp - 0x4114]
mov dword [ebp - 0x4114], esi
mov eax, dword [ebp - 0x4110]
mov edx, eax
sar edx, 0x1f
add dword [ebp - 0x4138], eax
adc dword [ebp - 0x4134], edx
cmp byte [ebp - 3], 0
jne 0x4222aa
mov edx, dword [ebp - 0x4134]
cmp edx, dword [ebp - 0x414c]
mov eax, dword [ebp - 0x4138]
jne 0x4222a4
cmp eax, dword [ebp - 0x4150]
jb 0x422181
push dword [ebp - 0x4118]
mov esi, dword [ebp - 0x4114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 3], 0
jne 0x4222ea
push dword [ebp - 0x4128]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x4148]
sub dword [ebx], 1
mov edx, dword [ebp - 0x4144]
sbb dword [ebx + 4], 0
sub dword [ebx + 8], eax
sbb dword [ebx + 0xc], edx
push esi
call fcn.0045ace4
mov ecx, dword [ebp - 0x4120]
sub ecx, dword [ebp - 0x4128]
push ecx
lea ecx, [ebp - 0x4120]
push dword [ebp - 0x4128]
call fcn.00428728
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret