Function at 0x421010
Capabilities:
Delete file
Encode data using xor
Get file attributes
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, 4
sub esp, 0x1000
test dword [esp], esp
dec edx
jne 0x421018
sub esp, 0x1d4
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
call fcn.0045a18c
add esp, 4
mov edi, eax
cmp eax, 0x100
jae 0x421957
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
lea eax, [edx + edi]
mov ecx, dword [ecx]
sub eax, ecx
cmp eax, 0x104
jae 0x421957
sub edx, ecx
cmp edx, 0xfa
jae 0x421957
mov ebx, 0x103
sub ebx, edx
cmp ebx, 0xff
jle 0x421081
mov ebx, 0xff
cmp ebx, 0xa
jl 0x421957
mov dword [ebp - 0x4150], ebx
xor ebx, ebx
test edi, edi
je 0x4210af
lea edx, [edi + esi]
cmp byte [edx - 1], 0x2e
je 0x4210af
inc ebx
cmp ebx, edi
jae 0x4210af
lea ecx, [esi + edi - 1]
sub ecx, ebx
cmp byte [ecx], 0x2e
jne 0x42109f
cmp ebx, edi
jne 0x4210b8
mov ebx, 0xffffffff
cmp ebx, 1
jl 0x421957
cmp ebx, 0x18
jg 0x421957
mov dword [ebp + 0xc], esi
mov dx, word [ebx*4 + 0x4724a8]
push ebx
and edx, 0xffff
lea ecx, [edx + 0x4724ac]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x4148], ecx
add edx, edi
sub edx, ebx
push edx
lea ecx, [ebp - 0x120]
push ecx
call fcn.0045a4e0
xor esi, esi
add esp, 0xc
test ebx, ebx
jle 0x421123
mov dl, byte [ebp + esi - 0x120]
cmp dl, 0x41
jl 0x42111e
cmp dl, 0x5a
jg 0x42111e
add byte [ebp + esi - 0x120], 0x20
inc esi
cmp esi, ebx
jl 0x421105
mov ax, word [ebx*4 + 0x4724aa]
xor esi, esi
and eax, 0xffff
test eax, eax
mov dword [ebp - 0x413c], eax
jle 0x42118b
push ebx
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x413c]
sub edx, esi
sar edx, 1
add edx, esi
mov dword [ebp - 0x4140], edx
imul edx, ebx
add edx, dword [ebp - 0x4148]
push edx
call fcn.00459d20
add esp, 0xc
test eax, eax
jg 0x42117d
mov esi, dword [ebp - 0x4140]
inc esi
cmp esi, dword [ebp - 0x413c]
jl 0x42113c
jmp 0x42118b
mov ecx, dword [ebp - 0x4140]
mov dword [ebp - 0x413c], ecx
jmp 0x421173
test esi, esi
jle 0x421957
lea edx, [ebp - 0x120]
push ebx
lea ecx, [esi - 1]
push edx
imul ecx, ebx
add ecx, dword [ebp - 0x4148]
push ecx
call fcn.00459d20
add esp, 0xc
test eax, eax
jne 0x421957
xor edx, edx
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], dl
push esi
call fcn.0045a18c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
lea ecx, [eax + edx + 1]
mov edx, dword [ebp + 8]
sub ecx, dword [edx]
xor edx, edx
push ecx
lea ecx, [ebp - 0x4168]
mov dword [ebp - 0x4158], eax
mov dword [ebp - 0x4168], edx
mov dword [ebp - 0x4164], edx
mov dword [ebp - 0x4160], edx
call fcn.0042eac0
mov edx, dword [ebp - 0x4164]
mov ecx, dword [ebp + 8]
mov byte [edx], 0
mov edx, dword [ebp + 8]
push dword [ecx + 4]
lea ecx, [ebp - 0x4168]
push dword [edx]
call fcn.004288b0
mov edx, dword [ebp - 0x4158]
lea ecx, [esi + edx]
push ecx
lea ecx, [ebp - 0x4168]
push esi
call fcn.0042870c
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 0x4168]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x4154], eax
jne 0x421281
mov ebx, dword [ebp - 0x4160]
lea ecx, [ebp - 0x4160]
sub ebx, dword [ebp - 0x4168]
push ebx
push dword [ebp - 0x4168]
call fcn.00428728
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x419c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov dword [ebp - 0x41a0], eax
mov eax, edi
add eax, dword [ebp - 0x41a0]
adc ecx, dword [ebp - 0x419c]
add eax, 0x81
adc ecx, 0
mov dword [ebp - 0x4198], eax
mov dword [ebp - 0x4194], ecx
cmp ecx, dword [ebp - 0x419c]
jne 0x4212c7
cmp eax, dword [ebp - 0x41a0]
jb 0x4212dd
xor edx, edx
mov eax, dword [ebp - 0x4198]
cmp edx, ecx
jne 0x4212db
cmp eax, dword [ebp - 0x4198]
je 0x4212e1
mov byte [ebp - 4], 1
push dword [ebp - 0x4198]
call fcn.0045ae50
add esp, 4
test eax, eax
mov dword [ebp - 0x414c], eax
jne 0x4212fd
mov byte [ebp - 4], 1
cmp byte [ebp - 4], 0
jne 0x42134b
lea ecx, [ebp - 0x416c]
push 0
push ecx
mov edx, dword [ebp - 0x414c]
add edx, 0x80
push dword [ebp - 0x41a0]
push edx
push dword [ebp - 0x4154]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421347
xor ecx, ecx
mov eax, dword [ebp - 0x416c]
cmp ecx, dword [ebp - 0x419c]
jne 0x421345
cmp eax, dword [ebp - 0x41a0]
je 0x42134b
mov byte [ebp - 4], 1
lea edx, [ebp - 0x4178]
lea ecx, [ebp - 0x4180]
push edx
lea edx, [ebp - 0x4188]
push ecx
push edx
push dword [ebp - 0x4154]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push dword [ebp - 0x4154]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 4], 0
jne 0x42192b
push 0x10
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x4138], edi
push dword [0x4724a8]
push dword [ebp - 0x414c]
call fcn.0045a4e0
mov ecx, dword [ebp - 0x414c]
push 0x20
mov edx, dword [ebp - 0x419c]
mov eax, dword [ebp - 0x41a0]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
mov edx, dword [ebp - 0x4184]
mov eax, dword [ebp - 0x4188]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov edx, dword [ebp - 0x417c]
mov eax, dword [ebp - 0x4180]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
mov edx, dword [ebp - 0x4174]
mov eax, dword [ebp - 0x4178]
mov dword [ecx + 0x2c], edx
lea edx, [ecx + 0x30]
push edx
mov dword [ecx + 0x28], eax
push dword [0x49e1e8]
call dword [0x49e1ec]
push 0x30
push 0x37
mov ecx, dword [ebp - 0x414c]
lea edx, [ecx + 0x50]
push edx
mov dword [ebp - 0x41c4], edx
call fcn.00459cc8
mov eax, dword [ebp - 0x41a0]
add eax, 0x30
mov edx, dword [ebp - 0x419c]
adc edx, 0
push edx
push eax
mov ecx, dword [ebp - 0x41c4]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x414c]
lea ecx, [edx + 0x30]
push ecx
mov ecx, dword [ebp + 0x10]
add ecx, 0x10
push ecx
call fcn.0041f7f8
mov edx, dword [ebp - 0x4138]
lea ecx, [edx + 1]
push ecx
mov ecx, dword [ebp - 0x414c]
mov eax, dword [ebp - 0x41a0]
push dword [ebp + 0xc]
lea ecx, [eax + ecx + 0x80]
push ecx
call fcn.0045a4e0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
sub ecx, edx
push ecx
lea ecx, [ebp - 0x108]
push edx
push ecx
call fcn.0045a4e0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
lea edx, [ebp + ecx - 0x108]
mov ecx, dword [ebp + 8]
xor esi, esi
sub edx, dword [ecx]
xor edi, edi
mov dword [ebp - 0x412c], edx
add esp, 0x58
mov edx, dword [ebp - 0x4138]
lea ecx, [edx - 1]
sub ecx, ebx
je 0x421509
mov edx, dword [ebp - 0x4150]
add edx, 0xfffffffa
jle 0x421509
mov eax, ecx
mov ecx, dword [ebp + 0xc]
mov bl, byte [edi + ecx]
cmp bl, 0x41
jl 0x4214d9
cmp bl, 0x5a
jg 0x4214d9
add bl, 0x20
cmp bl, 0x30
jl 0x4214e3
cmp bl, 0x39
jle 0x4214ed
cmp bl, 0x61
jl 0x4214f7
cmp bl, 0x7a
jg 0x4214f7
mov edx, dword [ebp - 0x412c]
mov byte [esi + edx], bl
inc esi
inc edi
cmp edi, eax
jae 0x421509
mov ecx, dword [ebp - 0x4150]
add ecx, 0xfffffffa
cmp ecx, esi
jg 0x4214c6
push 5
mov edx, dword [ebp - 0x412c]
mov ecx, dword [ebp + 0x10]
mov byte [edx + esi], 0x2e
add ecx, 0x50
push ecx
mov edx, dword [ebp - 0x412c]
lea ecx, [esi + edx + 1]
push ecx
call fcn.0045a4e0
mov edx, dword [ebp - 0x412c]
add edx, esi
push 0
lea ecx, [ebp - 0x108]
push 0x80
push 1
push 0
push 0
push 0x40000000
mov byte [edx + 6], 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov edi, 1
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x42169d
mov ecx, dword [ebp - 0x4150]
add ecx, 0xfffffffa
sub ecx, edi
mov ebx, edi
mov edx, esi
cmp ecx, esi
jge 0x42157f
mov edx, ecx
test edx, edx
jns 0x421585
xor edx, edx
mov ecx, dword [ebp - 0x4150]
add ecx, 0xfffffffa
sub ecx, edx
cmp ecx, edi
jge 0x421596
mov ebx, ecx
push 8
lea eax, [ebp - 0x41a8]
push eax
mov dword [ebp - 0x4134], edi
mov dword [ebp - 0x4128], ebx
mov dword [ebp - 0x4124], edx
push dword [0x49e1e8]
call dword [0x49e1ec]
xor edi, edi
add esp, 0xc
cmp dword [ebp - 0x4128], 0
jle 0x421638
push esi
mov edx, dword [ebp - 0x41a4]
mov eax, dword [ebp - 0x41a8]
push edi
mov ebx, 0x24
xor ecx, ecx
call fcn.0045996a
xor ecx, ecx
pop edi
pop esi
mov esi, ebx
mov ebx, 0x24
push esi
mov edx, dword [ebp - 0x41a4]
mov eax, dword [ebp - 0x41a8]
push edi
call fcn.0045996a
pop edi
pop esi
cmp esi, 0xa
mov dword [ebp - 0x41a8], eax
mov dword [ebp - 0x41a4], edx
jge 0x42161b
lea edx, [esi + 0x30]
jmp 0x42161e
lea edx, [esi + 0x57]
mov ecx, dword [ebp - 0x4124]
add ecx, edi
mov eax, dword [ebp - 0x412c]
inc edi
mov byte [ecx + eax], dl
cmp edi, dword [ebp - 0x4128]
jl 0x4215cb
mov esi, dword [ebp - 0x4124]
mov edx, dword [ebp - 0x412c]
mov ecx, dword [ebp + 0x10]
add esi, dword [ebp - 0x4128]
add ecx, 0x50
push 5
mov byte [esi + edx], 0x2e
lea edx, [esi + edx]
push ecx
lea ecx, [edx + 1]
push ecx
mov edi, dword [ebp - 0x4134]
mov dword [ebp - 0x41b4], edx
call fcn.0045a4e0
mov edx, dword [ebp - 0x41b4]
push 0
lea ecx, [ebp - 0x108]
push 0x80
push 1
push 0
push 0
push 0x40000000
mov byte [edx + 6], 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
add esp, 0xc
inc edi
cmp edi, 0xa
jbe 0x421561
cmp ebx, 0xffffffff
je 0x42192b
push 0
lea eax, [ebp - 0x4170]
push eax
push dword [ebp - 0x4198]
push dword [ebp - 0x414c]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4216dc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42192b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x108]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov byte [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x4144], eax
je 0x42192b
lea ebx, [ebp - 0x41ac]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x41ac]
mov dword [ebp - 0x41b0], eax
mov eax, dword [ebp - 0x41b0]
cmp edx, dword [ebp - 0x4194]
jne 0x421743
cmp eax, dword [ebp - 0x4198]
je 0x421749
mov byte [ebp - 4], 1
mov dword [ebp - 0x4190], 0
mov dword [ebp - 0x418c], 0
cmp byte [ebp - 4], 0
jne 0x421896
mov ecx, dword [ebp - 0x41ac]
or ecx, dword [ebp - 0x41b0]
je 0x421896
mov eax, dword [ebp - 0x41b0]
mov edx, dword [ebp - 0x41ac]
sub eax, dword [ebp - 0x4190]
sbb edx, dword [ebp - 0x418c]
test edx, edx
jne 0x42179a
cmp eax, 0x4000
jbe 0x4217a5
mov ebx, 0x4000
xor ecx, ecx
jmp 0x4217a9
mov ecx, edx
mov ebx, eax
mov dword [ebp - 0x4130], ebx
cmp byte [ebp - 4], 0
jne 0x421859
lea esi, [ebp - 0x415c]
push 0
lea edi, [ebp - 0x4120]
push esi
push dword [ebp - 0x4130]
push edi
push dword [ebp - 0x4144]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4217ed
mov eax, dword [ebp - 0x4130]
cmp eax, dword [ebp - 0x415c]
je 0x421859
mov edi, dword [ebp - 0x414c]
mov edx, dword [ebp - 0x4130]
xor esi, esi
add edi, dword [ebp - 0x4190]
xor ebx, ebx
sar edx, 2
cmp edx, esi
jle 0x42181d
mov eax, edx
mov ecx, dword [ebp + ebx*4 - 0x4120]
xor ecx, dword [edi + ebx*4]
or esi, ecx
inc ebx
cmp eax, ebx
jg 0x42180c
mov edx, dword [ebp - 0x4130]
and edx, 0xfffffffc
mov ecx, dword [ebp + edx - 0x4120]
xor ecx, dword [edx + edi]
mov edx, 0xffffffff
push ecx
mov ecx, dword [ebp - 0x4130]
and ecx, 3
shl ecx, 3
shl edx, cl
not edx
pop ecx
and ecx, edx
or esi, ecx
test esi, esi
je 0x421859
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x4130]
mov edx, eax
sar edx, 0x1f
add dword [ebp - 0x4190], eax
adc dword [ebp - 0x418c], edx
cmp byte [ebp - 4], 0
jne 0x421896
mov edx, dword [ebp - 0x418c]
cmp edx, dword [ebp - 0x41ac]
mov eax, dword [ebp - 0x4190]
jne 0x421890
cmp eax, dword [ebp - 0x41b0]
jb 0x421779
push dword [ebp - 0x4144]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 4], 0
je 0x4218b7
lea edi, [ebp - 0x108]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x42192b
push dword [ebp - 0x4168]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42190f
push dword [ebp - 0x4168]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
test ebx, 1
je 0x4218f2
mov esi, ebx
and esi, 0xfffffffe
push esi
push dword [ebp - 0x4168]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0x4168]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42190f
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [ebp + 0x10]
add dword [ebx], 1
adc dword [ebx + 4], 0
mov edx, dword [ebp - 0x419c]
mov eax, dword [ebp - 0x41a0]
add dword [ebx + 8], eax
adc dword [ebx + 0xc], edx
push dword [ebp - 0x414c]
call fcn.0045ace4
mov esi, dword [ebp - 0x4160]
sub esi, dword [ebp - 0x4168]
lea ecx, [ebp - 0x4160]
push esi
push dword [ebp - 0x4168]
call fcn.00428728
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret