Function at 0x422a10
Capabilities:
Copy file
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525855
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
mov dword [ebp - 0x18], 0
push esi
mov dword [ebp - 0x24], edx
mov esi, 0xf
mov byte [ebp - 0xf], 0x1c
xor edx, edx
push edi
mov byte [ebp - 0xe], 0x4c
mov edi, ecx
mov al, byte [ebp - 0xf]
mov dword [ebp - 0x1c], edx
mov al, byte [ebp + edx - 0xf]
mov ecx, edx
and ecx, esi
mov byte [ebp - 0xd], al
cmp ecx, esi
mov eax, 0xa3b47547
mov edx, 0xffe320b4
cmovae ecx, esi
shl ecx, 2
call fcn.00521900
mov edx, dword [ebp - 0x1c]
and al, 0xf
lea ecx, [edx + 0x47]
xor al, cl
xor al, byte [ebp - 0xd]
mov byte [ebp + edx - 0xf], al
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, 2
jb 0x422a51
sub esp, 0x18
lea ecx, [ebp - 0xf]
mov edx, esp
mov dword [ebp - 0x20], esp
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x422ab0
sub ecx, esi
lea eax, [ebp - 0xf]
push ecx
push eax
mov ecx, edx
call fcn.0040bb00
mov dword [ebp - 4], 0
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x28], esp
mov ecx, edi
xorps xmm0, xmm0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
lea esi, [ecx + 1]
mov dword [edx + 0x14], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x422af0
sub ecx, esi
push ecx
push edi
mov ecx, edx
call fcn.0040bb00
mov byte [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00415760
add esp, 0x30
mov dword [ebp - 4], 2
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x4c]
sub ecx, esi
imul ecx
lea ecx, [ebp - 0xb0]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, 0xc
lea eax, [eax + eax*2]
lea eax, [eax - 3]
lea eax, [esi + eax*8]
mov dword [ebp - 0x20], eax
call fcn.004159b0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 3
xor edx, edx
mov byte [ebp - 0x11], 0x1c
mov esi, 0xf
mov byte [ebp - 0x10], 0x4c
mov cl, byte [ebp - 0x11]
mov dword [ebp - 0x1c], edx
mov al, byte [ebp + edx - 0x11]
mov ecx, edx
and ecx, esi
mov byte [ebp - 0xd], al
cmp ecx, esi
mov eax, 0xa3b47547
mov edx, 0xffe320b4
cmovae ecx, esi
shl ecx, 2
call fcn.00521900
mov edx, dword [ebp - 0x1c]
and al, 0xf
lea ecx, [edx + 0x47]
xor al, cl
xor al, byte [ebp - 0xd]
mov byte [ebp + edx - 0x11], al
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, 2
jb 0x422b70
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x11]
mov edx, dword [0x56dc2c]
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x422bc0
mov eax, closesocket
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x422d9d
cmp dword [0x56dc30], 0x10
mov eax, 0x56dc1c
push ecx
cmovae eax, dword [0x56dc1c]
lea ecx, [ebp - 0x11]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x98]
call fcn.00492df0
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 5
lea eax, [ebp - 0x98]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x80]
push eax
push dword [ebp - 0x20]
call fcn.00492c20
push dword [ebp - 0x20]
lea edx, [ebp - 0x80]
mov dword [ebp - 0x18], 3
lea ecx, [ebp - 0x40]
call fcn.0048ed80
add esp, 4
mov byte [ebp - 4], 6
mov esi, 3
mov dword [ebp - 0x18], esi
and esi, 0xfffffffd
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x80]
call fcn.0040b870
and esi, 0xfffffffe
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x98]
call fcn.0040b870
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb0]
call fcn.0040b870
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x422cbb
cmp dword [ebp - 0x2c], 0x10
lea edx, [ebp - 0x40]
mov ecx, edi
cmovae edx, dword [ebp - 0x40]
call fcn.004229f0
test al, al
jne 0x422cbb
mov edx, dword [ebp - 0x24]
mov ecx, edi
call fcn.004e4190
mov esi, eax
jmp 0x422d70
push 0x56ffb8
call fcn.004e55c2
add esp, 4
test eax, eax
jne 0x422da2
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
mov edi, dword [ebp - 0x24]
mov edx, edi
cmovae ecx, dword [ebp - 0x40]
sub esp, 8
call fcn.004e41a0
add esp, 8
lea ecx, [ebp - 0x68]
mov esi, eax
lea eax, [ebp - 0x40]
push eax
call fcn.0048a660
mov byte [ebp - 4], 0xa
mov ecx, dword [edi]
mov dword [ebp - 0x50], ecx
mov byte [ebp - 4], 0xb
mov eax, dword [0x5700a4]
cmp eax, dword [0x5700a8]
je 0x422d4d
movups xmm0, xmmword [ebp - 0x68]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x68], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x58]
movq qword [eax + 0x10], xmm0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 4], 0xc
mov dword [eax + 0x18], ecx
mov byte [ebp - 4], 0xb
add dword [0x5700a4], 0x1c
jmp 0x422d57
lea ecx, [ebp - 0x68]
push ecx
push eax
call fcn.00497ba0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x68]
call fcn.0040b870
push 0x56ffb8
call fcn.004e55d3
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.0040b870
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0048c6c0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0040b180
push eax
call fcn.004e526b
int3