Function at 0x421a38
Capabilities:
Encrypt data using rc4 ksa
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4f
push 0
push 0
dec ecx
jne 0x421a40
push ebx
push esi
push edi
lea esi, [ebp - 0x208]
mov edi, 0x4bde48
xor eax, eax
push ebp
push 0x422530
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x47abdc], 0
mov eax, 0x4bde38
mov edx, dword [0x47b5d8]
mov cl, 0xc
call fcn.00403044
lea eax, [ebp - 0x108]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x20c]
lea eax, [ebp - 0x108]
call fcn.00409400
mov edx, dword [ebp - 0x20c]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
xor eax, eax
mov al, byte [esi]
cmp byte [esi + eax], 0x5c
je 0x421ae9
lea eax, [ebp - 0x210]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x210]
mov edx, 0x422548
call fcn.00404ebc
mov edx, dword [ebp - 0x210]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [0x47b5d8]
cmp byte [eax], 8
jbe 0x421b53
lea eax, [ebp - 0x214]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x228]
push eax
mov eax, dword [0x47b5d8]
mov ecx, 8
mov edx, 1
call fcn.00402798
lea edx, [ebp - 0x228]
lea eax, [ebp - 0x218]
call fcn.00404e58
mov edx, dword [ebp - 0x218]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x214]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
jmp 0x421b96
lea eax, [ebp - 0x22c]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
mov edx, dword [0x47b5d8]
call fcn.00404e58
mov edx, dword [ebp - 0x230]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x22c]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x234]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x234]
mov edx, 0x422554
call fcn.00404ebc
mov edx, dword [ebp - 0x234]
mov eax, 0x4be014
mov ecx, 0xff
call fcn.00404e90
mov eax, 0x4be014
call fcn.004184b0
mov edx, dword [0x47b3dc]
mov dword [edx], eax
lea eax, [ebp - 0x238]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x238]
mov edx, 0x422564
call fcn.00404ebc
mov edx, dword [ebp - 0x238]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x23c]
mov edx, esi
call fcn.00404e58
mov edx, dword [ebp - 0x23c]
mov eax, 0x4bdcec
call fcn.00402e0c
mov edx, 1
mov eax, 0x4bdcec
call fcn.00403548
call fcn.00402874
test eax, eax
jne 0x4221a4
mov eax, 0x2bb
call fcn.00402688
mov dword [0x4bdcdc], eax
mov eax, dword [0x4bdcdc]
xor ecx, ecx
mov edx, 0x2bb
call fcn.004031f8
push 0
mov edx, dword [0x4bdcdc]
mov ecx, 0x2bb
mov eax, 0x4bdcec
call fcn.00402f70
call fcn.00402874
test eax, eax
jne 0x42217b
mov byte [esi], 0
mov ebx, 1
lea eax, [ebp - 0x240]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x248]
mov edx, dword [0x4bdcdc]
mov dl, byte [edx + ebx - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x248]
lea eax, [ebp - 0x244]
call fcn.00404e58
mov edx, dword [ebp - 0x244]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x240]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
inc ebx
cmp ebx, 0xb
jne 0x421c8e
mov eax, esi
mov edx, 0x47abe4
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x421d3d
mov eax, esi
mov edx, 0x47abf0
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x421d3d
mov eax, esi
mov edx, 0x47abfc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x421d3d
mov eax, esi
mov edx, 0x47ac08
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x422172
mov eax, dword [0x4bdcdc]
mov eax, dword [eax + 0xe]
mov edx, dword [0x47b2a8]
mov dword [edx], eax
mov eax, dword [0x47b2a8]
mov eax, dword [eax]
mov ecx, 0x64
cdq
idiv ecx
mov edx, dword [0x47b368]
mov word [edx], ax
mov eax, dword [0x4bdcdc]
mov eax, dword [eax + 0xa]
mov edx, dword [0x47b23c]
mov dword [edx], eax
mov eax, dword [0x4bdcdc]
mov al, byte [eax + 0x13]
mov edx, dword [0x47b508]
mov byte [edx], al
mov eax, dword [0x4bdcdc]
mov al, byte [eax + 0x12]
mov edx, dword [0x47b264]
mov byte [edx], al
mov edx, dword [0x47b408]
mov eax, dword [0x4bdcdc]
add eax, 0x30
call fcn.0042193c
mov edx, dword [0x47b388]
mov eax, dword [0x4bdcdc]
add eax, 0x8d
call fcn.0042193c
mov edx, dword [0x47b5e4]
mov eax, dword [0x4bdcdc]
add eax, 0xea
call fcn.0042193c
mov edx, dword [0x47b39c]
mov eax, dword [0x4bdcdc]
add eax, 0x147
call fcn.0042193c
mov edx, dword [0x47b4a4]
mov eax, dword [0x4bdcdc]
add eax, 0x1a4
call fcn.0042193c
mov edx, dword [0x47b4ac]
mov eax, dword [0x4bdcdc]
add eax, 0x201
call fcn.0042193c
mov edx, dword [0x47b25c]
mov eax, dword [0x4bdcdc]
add eax, 0x25e
call fcn.0042193c
mov eax, dword [0x4bdcdc]
mov eax, dword [eax + 0x16]
mov edx, dword [0x47b698]
mov dword [edx], eax
mov eax, dword [0x47b33c]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x47b698]
mov eax, dword [eax]
push eax
push 1
push 0
call sub.gdi32.dll_CreatePen
mov edx, dword [0x47b33c]
mov dword [edx], eax
mov eax, dword [0x4bdcdc]
mov eax, dword [eax + 0x1a]
mov edx, dword [0x47b1a8]
mov dword [edx], eax
mov eax, dword [0x4bdcdc]
mov al, byte [eax + 0x2e]
mov edx, dword [0x47b1ec]
mov byte [edx + 2], al
mov eax, dword [0x4bdcdc]
mov al, byte [eax + 0x2f]
mov edx, dword [0x47b1ec]
mov byte [edx + 3], al
mov eax, dword [0x4bdcdc]
mov al, byte [eax + 0x14]
mov edx, dword [0x47b1cc]
mov byte [edx], al
mov eax, dword [0x4bdcdc]
mov edx, dword [0x47b40c]
push esi
push edi
lea esi, [eax + 0x1e]
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x4bdcdc]
mov al, byte [eax + 0x15]
mov edx, dword [0x47b1b8]
mov byte [edx], al
mov eax, esi
mov edx, 0x47abf0
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x421f03
mov eax, esi
mov edx, 0x47abfc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x421f03
mov eax, esi
mov edx, 0x47ac08
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x421fc0
mov eax, 0xd
call fcn.00402688
mov dword [0x4bdce0], eax
mov eax, dword [0x4bdce0]
xor ecx, ecx
mov edx, 0xd
call fcn.004031f8
push 0
mov edx, dword [0x4bdce0]
mov ecx, 0xd
mov eax, 0x4bdcec
call fcn.00402f70
call fcn.00402874
test eax, eax
jne 0x421faa
mov eax, dword [0x4bdce0]
mov al, byte [eax]
mov edx, dword [0x47b2ec]
mov byte [edx], al
mov eax, dword [0x4bdce0]
mov al, byte [eax + 1]
mov edx, dword [0x47b574]
mov byte [edx], al
mov eax, dword [0x4bdce0]
mov al, byte [eax + 2]
mov edx, dword [0x47b238]
mov byte [edx], al
mov eax, dword [0x4bdce0]
mov al, byte [eax + 3]
mov edx, dword [0x47b278]
mov byte [edx], al
mov eax, dword [0x4bdce0]
mov al, byte [eax + 4]
mov edx, dword [0x47b1e4]
mov byte [edx], al
mov eax, dword [0x47b490]
mov edx, dword [0x4bdce0]
mov ecx, dword [edx + 5]
mov dword [eax], ecx
mov ecx, dword [edx + 9]
mov dword [eax + 4], ecx
jmp 0x421fb1
mov byte [0x47abdc], 1
mov edx, 0xd
mov eax, dword [0x4bdce0]
call fcn.004026a8
mov eax, esi
mov edx, 0x47abfc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x421fea
mov eax, esi
mov edx, 0x47ac08
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x4220bf
mov eax, 0x1d
call fcn.00402688
mov dword [0x4bdce4], eax
mov eax, dword [0x4bdce4]
xor ecx, ecx
mov edx, 0x1d
call fcn.004031f8
push 0
mov edx, dword [0x4bdce4]
mov ecx, 0x1d
mov eax, 0x4bdcec
call fcn.00402f70
call fcn.00402874
test eax, eax
jne 0x4220a9
mov eax, dword [0x4bdce4]
mov al, byte [eax]
mov edx, dword [0x47b58c]
mov byte [edx], al
mov eax, dword [0x4bdce4]
mov al, byte [eax + 1]
mov edx, dword [0x47b514]
mov byte [edx], al
mov eax, dword [0x4bdce4]
mov al, byte [eax + 2]
mov edx, dword [0x47b624]
mov byte [edx], al
mov eax, dword [0x4bdce4]
mov al, byte [eax + 3]
mov edx, dword [0x47b330]
mov byte [edx], al
mov eax, dword [0x4bdce4]
mov edx, dword [0x47b248]
push esi
push edi
lea esi, [eax + 4]
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x47b568]
mov edx, dword [0x4bdce4]
mov ecx, dword [edx + 0x14]
mov dword [eax], ecx
mov ecx, dword [edx + 0x18]
mov dword [eax + 4], ecx
mov eax, dword [0x4bdce4]
mov al, byte [eax + 0x1c]
mov edx, dword [0x47b598]
mov byte [edx], al
jmp 0x4220b0
mov byte [0x47abdc], 1
mov edx, 0x1d
mov eax, dword [0x4bdce4]
call fcn.004026a8
mov eax, esi
mov edx, 0x47ac08
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
jne 0x422182
mov eax, 0x60
call fcn.00402688
mov dword [0x4bdce8], eax
mov eax, dword [0x4bdce8]
xor ecx, ecx
mov edx, 0x60
call fcn.004031f8
push 0
mov edx, dword [0x4bdce8]
mov ecx, 0x60
mov eax, 0x4bdcec
call fcn.00402f70
call fcn.00402874
test eax, eax
jne 0x42215a
mov eax, dword [0x4bdce8]
mov al, byte [eax]
mov edx, dword [0x47b6a4]
mov byte [edx], al
mov eax, dword [0x4bdce8]
mov al, byte [eax + 1]
mov edx, dword [0x47b254]
mov byte [edx], al
mov eax, dword [0x4bdce8]
mov al, byte [eax + 2]
mov edx, dword [0x47b578]
mov byte [edx], al
mov edx, dword [0x47b530]
mov eax, dword [0x4bdce8]
add eax, 3
call fcn.0042193c
jmp 0x422161
mov byte [0x47abdc], 1
mov edx, 0x60
mov eax, dword [0x4bdce8]
call fcn.004026a8
jmp 0x422182
mov byte [0x47abdc], 1
jmp 0x422182
mov byte [0x47abdc], 1
mov eax, 0x4bdcec
call fcn.00402fb0
call fcn.00402874
test eax, eax
mov edx, 0x2bb
mov eax, dword [0x4bdcdc]
call fcn.004026a8
jmp 0x4221ab
mov byte [0x47abdc], 1
mov byte [0x47abe0], 0
lea eax, [ebp - 0x108]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x24c]
lea eax, [ebp - 0x108]
call fcn.00409400
mov edx, dword [ebp - 0x24c]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
xor eax, eax
mov al, byte [esi]
cmp byte [esi + eax], 0x5c
je 0x42221f
lea eax, [ebp - 0x250]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x250]
mov edx, 0x422548
call fcn.00404ebc
mov edx, dword [ebp - 0x250]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [0x47b5d8]
cmp byte [eax], 8
jbe 0x422289
lea eax, [ebp - 0x254]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x228]
push eax
mov eax, dword [0x47b5d8]
mov ecx, 8
mov edx, 1
call fcn.00402798
lea edx, [ebp - 0x228]
lea eax, [ebp - 0x258]
call fcn.00404e58
mov edx, dword [ebp - 0x258]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x254]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
jmp 0x4222cc
lea eax, [ebp - 0x25c]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
mov edx, dword [0x47b5d8]
call fcn.00404e58
mov edx, dword [ebp - 0x260]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x25c]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x264]
mov edx, esi
call fcn.00404e58
lea eax, [ebp - 0x264]
mov edx, 0x422574
call fcn.00404ebc
mov edx, dword [ebp - 0x264]
mov eax, esi
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x268]
mov edx, esi
call fcn.00404e58
mov edx, dword [ebp - 0x268]
mov eax, edi
call fcn.00402e0c
mov eax, edi
call fcn.00402b90
call fcn.00402874
test eax, eax
jne 0x4224eb
xor ebx, ebx
jmp case.0x422377.5
mov edx, esi
mov ecx, 0xff
mov eax, edi
call fcn.004033a8
mov eax, edi
call fcn.004033b4
call fcn.00402874
test eax, eax
je 0x422368
mov byte [0x47abe0], 1
mov eax, edi
call fcn.00402fb0
call fcn.00402874
test eax, eax
jmp 0x4224f2
inc ebx
mov eax, ebx
add eax, 0xfffffffc
cmp eax, 9
ja case.0x422377.5
jmp dword [eax*4 + 0x42237e]
mov eax, dword [0x47b1cc]
cmp byte [eax], 2
jae case.0x422377.5
mov al, byte [esi + 1]
sub al, 0x30
mov edx, dword [0x47b1cc]
mov byte [edx], al
jmp case.0x422377.5
mov eax, dword [0x47b1ec]
mov dl, byte [esi + 1]
mov byte [eax + 2], dl
jmp case.0x422377.5
mov eax, dword [0x47b1ec]
mov dl, byte [esi + 1]
mov byte [eax + 3], dl
jmp case.0x422377.5
lea eax, [ebp - 0x26c]
mov edx, esi
call fcn.00404e58
mov eax, dword [ebp - 0x26c]
lea edx, [ebp - 4]
call fcn.004035dc
mov edx, dword [0x47b490]
mov word [edx + 2], ax
jmp case.0x422377.5
lea eax, [ebp - 0x270]
mov edx, esi
call fcn.00404e58
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 4]
call fcn.004035dc
mov edx, dword [0x47b490]
mov word [edx], ax
mov eax, dword [0x47b490]
cmp word [eax], 1
jne case.0x422377.5
mov eax, dword [0x47b490]
mov word [eax], 0
jmp case.0x422377.5
lea eax, [ebp - 0x274]
mov edx, esi
call fcn.00404e58
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 4]
call fcn.004035dc
mov edx, dword [0x47b490]
mov word [edx + 6], ax
jmp case.0x422377.5
lea eax, [ebp - 0x278]
mov edx, esi
call fcn.00404e58
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 4]
call fcn.004035dc
mov edx, dword [0x47b490]
mov word [edx + 4], ax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov eax, dword [0x47b490]
movzx eax, word [eax + 6]
or edx, 0xffffffff
call fcn.004195c8
mov eax, dword [0x47b490]
movzx eax, word [eax + 4]
cmp eax, dword [ebp - 8]
jne case.0x422377.5
mov eax, dword [0x47b490]
mov word [eax + 4], 0
mov eax, edi
call fcn.004030ec
test al, al
je 0x422330
mov eax, edi
call fcn.00402fb0
call fcn.00402874
test eax, eax
jmp 0x4224f2
mov byte [0x47abe0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422537
lea eax, [ebp - 0x278]
mov edx, 0xc
call fcn.00404c18
lea eax, [ebp - 0x244]
mov edx, 7
call fcn.00404c18
lea eax, [ebp - 0x218]
mov edx, 4
call fcn.00404c18
ret