Function at 0x420e50
Capabilities:
Delete file
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0692
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x629a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2b8], esi
test esi, esi
je 0x4216ac
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4216ac
lea eax, [ebp - 0x254]
mov dword [ebp - 0x234], 0
push eax
xorps xmm0, xmm0
push 0
push esi
movups xmmword [ebp - 0x254], xmm0
movups xmmword [ebp - 0x244], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
setne al
test al, al
je 0x4216ac
call fcn.00437d50
test al, al
je 0x420ef3
aad 0x6f
push edx
jmp 0xc87fe0ae
call fcn.004379d0
test al, al
je 0x420f19
sub edi, ecx
stosd dword es:[edi], eax
and al, 0xba
mov byte [0xdb6cf758], al
inc edi
xchg eax, ebp
in eax, 0xc9
pop edx
das
xchg edi, eax
xchg edi, eax
aas
mov edi, 0x3a50371f
push ebx
retf
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x420f89
call fcn.00437a40
test al, al
je 0x420f46
iretd
call fcn.004380d0
test al, al
je 0x420f63
stosd dword es:[edi], eax
mov dl, 0x75
test byte [edx + ebx*8], 0x6a
into
dec eax
or byte [esp + ecx*4], al
sbb dword [ecx + 6], edi
inc esi
sub cl, byte [eax + 0x38e8c09b]
outsd dx, dword [esi]
add dword [eax], eax
call fcn.00437ea0
test al, al
je 0x4216ac
wait
stc
sbb dword [esi], ebx
mov eax, dword [0x9345c4d7]
test byte [0x1f777a9d], ch
sal dword [esp + ebp*4 + 0x23e9c6a9], cl
pop es
add byte [eax], al
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00578b50
add esp, 0xc
lea ecx, [ebp - 0x2b4]
push 0x61b488
call fcn.00403d10
mov dword [ebp - 4], 0
call fcn.00437e30
test al, al
je 0x420fd9
or al, 0x8d
lea ecx, [ebp + edi*8 - 1]
jmp [eax - 0x78]
adc byte [esi], dl
sub edx, ecx
clc
or bl, byte [esi]
jecxz 0x420fbf
shr dword [esi - 0xcd0eeba], 1
xchg edx, eax
jl 0x420f9e
xor byte [ebx], cl
outsd dx, dword [esi]
push ebx
insd dword es:[edi], dx
jo 0x420fee
call fcn.00438140
test al, al
je 0x420ff8
mov dword [edx], ebp
outsb dx, byte [esi]
pop esp
mov edx, 0xb203798d
mov ah, 0x2c
xchg edi, eax
lea edi, [ecx + 3]
mov dl, 0xb4
sub al, 0x97
push eax
xchg edi, eax
pop eax
or eax, 0xd9129067
call fcn.00438060
test al, al
je 0x421019
push 0x16
cmp al, 0xd7
cmp byte [ebp + 0x63a4cb07], dh
nop
mov esi, 0xe4d4c1f8
aad 0xb4
shl dword [ebp + 0x72e82a53], cl
imul eax, dword [ecx], 0
call fcn.00437b90
test al, al
je 0x42103c
mov bl, 0x8f
inc eax
jecxz 0x420fe7
mov ebx, 0xfd2ae1a8
daa
or al, 0xa8
aas
out 0xd6, al
lea eax, [eax + 0x2246af85]
fsubr qword [ecx]
lcall 0xfffd, 0xe8858d31
call dword [eax + 0x68]
add al, 1
add byte [eax], al
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x29c]
mov edx, esi
call fcn.00423f70
mov byte [ebp - 4], 1
call fcn.00438530
test al, al
je 0x421088
mov dh, 0x58
mov fs, esi
pop eax
test eax, 0x8baf1d3c
js 0x42100d
mov al, 0x5a
in al, 2
ret 0x1383
call fcn.00437c00
test al, al
je 0x4210a2
pop ebx
xchg ebp, eax
aaa
outsd dx, dword [esi]
out dx, al
hlt
mov edx, esi
lea ecx, [ebp - 0x284]
call fcn.004241e0
mov byte [ebp - 4], 2
call fcn.00437ce0
add dh, al
inc ebp
cld
add ch, al
sub byte [ecx + eax], ch
test al, al
je 0x4210d1
mov esi, 0x5fa0c42f
sbb bh, dl
aad 0x31
inc esp
mov esi, edx
dec edi
invalid
call fcn.00438450
test al, al
je 0x4210f6
sub ch, 0xae
dec esp
ja 0x421145
retf 0x7c84
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x26c]
call fcn.004241e0
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 3
call fcn.0042ab90
lea edi, [ebp + edi*8 - 1]
inc esi
inc ebp
cld
add ebp, eax
jp 0x4210ae
add byte [eax], al
call fcn.00438140
test al, al
je 0x421134
adc al, 0x18
iretd
lea ecx, [ebp - 0x26c]
call fcn.0042ab90
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00404db0
test eax, eax
jne 0x4211e9
call fcn.00437e30
test al, al
je 0x421180
jl 0x421108
test al, 0x80
pushfd
pop ebp
xor dword [ecx + esi - 0x21176ad4], ebp
cmpsd dword [esi], dword es:[edi]
inc edx
sbb eax, 0x698d67b3
inc esp
dec ecx
inc esi
xchg ebp, eax
test byte [edx + 0x70], ah
pop ecx
jo 0x421169
call fcn.004380d0
dec ebx
outsd dx, dword [esi]
add dword [eax], eax
test al, al
je 0x42119b
sti
invalid
cmp word [ebp - 0x218], 0
jne 0x4211bc
xor ecx, ecx
lea eax, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00404030
jmp 0x421238
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4211c5
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00404030
jmp 0x421238
call fcn.004383e0
test al, al
je 0x421210
fisubr dword [ecx + 0x21210e0e]
xchg ecx, eax
stosb byte es:[edi], al
cli
xor ebx, 0x71684e77
packssdw mm0, qword [ebx - 0x67]
and byte [edx], bl
or dword ds:[esi - 0x54ff0a33], 0x48958b50
std
invalid
mov edx, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x248]
call fcn.004243a0
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00403c90
lea ecx, [ebp - 0x248]
call fcn.00403020
sbb eax, 0xf633fffe
xor esi, esi
mov dword [ebp - 0x2bc], esi
call fcn.004379d0
test al, al
je 0x42125b
in al, 0xe5
mov bl, 0x65
imul edi, dword [ebx - 0x80], 0x92d6aa2d
scasb al, byte es:[edi]
push ss
jmp 0x421235
call fcn.00438220
test al, al
je 0x421280
dec edi
and dword [esi + 0x4560ac1], 0x22
push cs
movsd dword es:[edi], dword [esi]
sbb ebp, dword [esi + 0x4f7e3d35]
or byte [edi], 0xa2
frstor dword [edx - 0x36]
call 0x86318e
add byte [ebx], dh
rol bh, 0x85
in al, 0xfd
invalid
xor eax, eax
mov dword [ebp - 0x21c], 7
push eax
push 0x61b488
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00404030
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x230]
call fcn.00404130
call fcn.004384c0
test al, al
je 0x4212ec
xor byte [edi - 0x18c792dc], bh
dec ecx
push ebx
push 0xffffffffffffffe6
lcall 0xf371, 0xa1a2c566
pop eax
xchg dh, bh
test al, 0x49
cli
jne 0x42132b
dec ebp
outsd dx, dword [esi]
call fcn.00437f10
test al, al
je 0x421307
or al, 0x25
mov ch, 9
std
add esi, dword [eax]
cdq
cmp byte [0x5987307], dh
mov eax, dword [ebx + 0x18]
cmp dword [edx - 1], ebp
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040c7a0
push 4
push str..ccc
lea ecx, [ebp - 0x230]
call fcn.0040c670
test esi, esi
jle 0x42137c
inc ecx
mov bl, 0xfe
inc dword [ebp - 0x74b6810a]
invalid
mov eax, esi
lea ecx, [ebp - 0x248]
cdq
push edx
push eax
call fcn.00422aa0
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 5
call fcn.0040c7a0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x42137c
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.004043b0
mov ecx, dword [ebp - 0x21c]
lea esi, [ebp - 0x230]
mov edx, dword [ebp - 0x230]
cmp ecx, 8
cmovae esi, edx
test esi, esi
je 0x4214c7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4214bb
lea eax, [ebp - 0x254]
mov dword [ebp - 0x234], 0
push eax
xorps xmm0, xmm0
push 0
push esi
movups xmmword [ebp - 0x254], xmm0
movups xmmword [ebp - 0x244], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
setne al
test al, al
je 0x4214bb
std
invalid
call fcn.00437e30
test al, al
je 0x421406
mov bh, 0x62
popal
invalid
call fcn.00438370
test al, al
je 0x421420
shr byte [eax], cl
js 0x421453
or eax, 0x2c592405
mov word [esi - 0x7aa04b5c], ss
xchg byte [eax], ch
call fcn.00438450
test al, al
je 0x421440
jns 0x4213cd
outsb dx, byte es:[esi]
salc
push es
mov edx, 0x87a53da1
xchg esi, eax
cmp al, cl
push edx
arpl word [ecx], sp
push ebx
sbb al, 0xf1
adc byte [esp + esi*4 - 0x21b427d], al
invalid
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [eax - 1]
adc eax, sym.imp.KERNEL32.dll_DeleteFileW
test eax, eax
jne 0x4214bb
call fcn.00437a40
test al, al
je 0x42147a
in eax, dx
leave
hlt
sub dword [eax], eax
ror esp, 1
jecxz 0x421413
mov al, 0xa5
and al, 0x91
salc
add al, 0x92
mov esi, dword [ebp - 0x2bc]
cmp esi, 0xa
jge 0x4215bf
inc esi
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x2bc], esi
cmp eax, 8
jb 0x421280
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.004043b0
jmp 0x421280
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x230]
cmp ecx, 8
lea eax, [ebp - 0x230]
cmovae eax, edx
push eax
push dword [ebp - 0x2b8]
call fcn.00585db9
add esp, 8
call fcn.00437dc0
test al, al
je 0x421508
loopne 0x42146d
pushal
push cs
jmp 0x9a859bf4
call fcn.00438300
test al, al
je 0x42152a
pop ds
ret
call fcn.00437ff0
test al, al
je 0x42154b
fstp dword [0x3a724352]
mov esp, 0x9ab95aa2
add al, 0x90
mov eax, 0x5bddb237
jle 0x42156b
sbb al, byte [eax]
sub byte [esi - 0x7d], ch
mov ebp, 0xfffffde4
or byte [ebp - 0x22f73], cl
dec dword [edi]
inc ebx
invalid
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
call fcn.00421ed0
test al, al
je 0x421587
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 5
cmovae eax, dword [ebp - 0x230]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
std
invalid
mov ecx, dword [ebp - 0x2b8]
call fcn.00421ed0
test al, al
je 0x4215bf
call fcn.00437f80
test al, al
je 0x4215af
fild dword [ebp - 0x7a83add9]
loope 0x4215d4
push ebp
add eax, dword [edx + eax*2 + 0x1d60e96d]
push 5
push 0
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4215dd
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.004043b0
sar ch, 1
invalid
mov eax, dword [ebp - 0x258]
cmp eax, 8
jb 0x4215fb
inc eax
lea ecx, [ebp - 0x26c]
push eax
push dword [ebp - 0x26c]
call fcn.004043b0
xor eax, eax
mov dword [ebp - 0x258], 7
mov word [ebp - 0x26c], ax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x25c], 0
cmp eax, 8
jb 0x421636
inc eax
lea ecx, [ebp - 0x284]
push eax
push dword [ebp - 0x284]
call fcn.004043b0
xor eax, eax
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x274], 0
cmp eax, 8
jb 0x421671
inc eax
lea ecx, [ebp - 0x29c]
push eax
push dword [ebp - 0x29c]
call fcn.004043b0
xor eax, eax
mov dword [ebp - 0x288], 7
mov word [ebp - 0x29c], ax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x28c], 0
cmp eax, 8
jb 0x4216ac
inc eax
lea ecx, [ebp - 0x2b4]
push eax
push dword [ebp - 0x2b4]
call fcn.004043b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00572ac9
mov esp, ebp
pop ebp
ret