Function at 0x423359
Capabilities:
Encode data using xor
Get common file path
Get file size
Get program files directory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b90
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x7c8]
push esi
push edi
push 9
mov dword [ebp - 0x1b80], ecx
lea edi, [ebp - 0x7ec]
pop ecx
push 0x3c4
mov esi, str.LeapFTP_3.0usersdefault_sites.dat
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.006390b0
add esp, 0xc
push ebx
call fcn.00643470
pop ecx
cmp eax, 1
jae 0x423403
mov ecx, dword [ebp - 0x1b80]
xor ebx, ebx
push 0x26
pop eax
push 0x2a
cmp dword [ecx + 0x5b87c], ebx
lea ecx, [ebp - 0x1b74]
pop edx
push ecx
push ebx
push ebx
cmovne eax, edx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x423440
lea eax, [ebp - 0x7ec]
push eax
lea eax, [ebp - 0x1b74]
push eax
push 0x6c643c
lea eax, [ebp - 0xbd4]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
jmp 0x42341a
push ebx
lea eax, [ebp - 0xbd4]
push 0x3e8
push eax
call fcn.006494f3
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0xbd4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x1b90], ebx
cmp ebx, 0xffffffff
jne 0x42344b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42368a
xor edi, edi
push edi
push edi
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
mov dword [ebp - 0x1b88], esi
test esi, esi
jne 0x423478
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42368a
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1b84], eax
test eax, eax
jne 0x423499
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42367e
lea eax, [ebp - 0x1b7c]
mov dword [ebp - 0x1b7c], edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1b78], eax
cmp dword [ebp - 0x1b7c], edi
jne 0x42367e
mov esi, str.My_Sites
lea edi, [ebp - 0x1c]
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00643470
mov edi, dword [ebp - 0x1b84]
pop ecx
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
push 0x10
pop edx
call fcn.00417191
pop ecx
pop ecx
test eax, eax
je 0x423678
mov edx, dword [ebp - 0x1b78]
lea ecx, [edi + 0x10]
add edx, edi
mov edi, 0x3e8
mov dword [ebp - 0x1b78], edx
xor eax, eax
mov byte [ebp - 0xfbc], al
mov byte [ebp - 0x404], al
mov byte [ebp - 0x13a4], al
mov byte [ebp - 0x178c], al
cmp ecx, edx
ja 0x423651
add ecx, 2
movzx ebx, byte [ecx]
add ebx, 3
add ebx, ecx
cmp ebx, edx
ja 0x423651
movzx esi, byte [ebx]
lea eax, [ebx + 1]
push esi
push eax
lea eax, [ebp - 0x178c]
push edi
push eax
call fcn.00650b7d
inc ebx
add esp, 0x10
add ebx, esi
cmp ebx, dword [ebp - 0x1b78]
ja 0x423651
movzx esi, byte [ebx]
lea eax, [ebx + 1]
push esi
push eax
lea eax, [ebp - 0x13a4]
push edi
push eax
call fcn.00650b7d
lea eax, [esi + 1]
add esp, 0x10
add eax, ebx
mov dword [ebp - 0x1b8c], eax
cmp eax, dword [ebp - 0x1b78]
ja 0x423651
mov bl, byte [eax]
inc eax
movzx esi, bl
push esi
push eax
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.00650b7d
add esp, 0x10
test bl, bl
je 0x423608
mov dword [ebp - 0x10], 0xf0dca4eb
mov dword [ebp - 0xc], 0xab5974ee
cmp esi, 0x64
ja 0x423608
xor ecx, ecx
test bl, bl
je 0x4235de
mov eax, ecx
and eax, 7
mov al, byte [ebp + eax - 0x10]
xor byte [ebp + ecx - 0x404], al
inc ecx
cmp ecx, esi
jb 0x4235c9
movzx ecx, byte [ebp + esi - 0x405]
mov eax, esi
and eax, 0xfffffff8
add ecx, 0xfffffff8
add eax, ecx
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xfbc]
push edi
push eax
call fcn.00650b7d
add esp, 0x10
mov ecx, dword [ebp - 0x1b80]
lea eax, [ebp - 0xfbc]
push 0xffffffffffffffff
mov ebx, 0x6c5bb9
push ebx
push eax
lea eax, [ebp - 0x13a4]
push eax
lea eax, [ebp - 0x178c]
push eax
push ebx
push 0x145
push 4
call fcn.0043ee6b
mov ecx, dword [ebp - 0x1b8c]
mov edx, dword [ebp - 0x1b78]
add ecx, 0x4f
add ecx, esi
cmp ecx, edx
jbe 0x423509
push dword [ebp - 0x1b84]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x1b88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1b90]
call esi
xor eax, eax
inc eax
jmp 0x42368c
mov esi, dword [ebp - 0x1b88]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4