Function at 0x426f00
Capabilities:
Check if file exists
Create directory
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d35e
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x477014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x250], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x294], ebx
mov edx, 7
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], edx
mov word [ebp - 0x24c], ax
cmp word [ebx], ax
jne 0x426fb6
xor esi, esi
mov edi, dword [ebp - 0x24c]
lea eax, [ebp - 0x24c]
cmp ebx, eax
jb 0x426fdc
cmp edx, 8
lea eax, [ebp - 0x24c]
cmovae eax, edi
lea eax, [eax + ecx*2]
cmp eax, ebx
jbe 0x426fdc
cmp edx, 8
lea ecx, [ebp - 0x24c]
mov eax, ebx
cmovae ecx, edi
sub eax, ecx
push esi
sar eax, 1
push eax
lea eax, [ebp - 0x24c]
push eax
mov ecx, eax
call fcn.0040189d
jmp 0x427055
push ebx
call fcn.00433d15
mov edx, dword [ebp - 0x238]
add esp, 4
mov ecx, dword [ebp - 0x23c]
mov esi, eax
cmp edx, 8
jb 0x426f6c
mov edi, dword [ebp - 0x24c]
mov eax, edi
jmp 0x426f78
cmp esi, 0x7ffffffe
jbe 0x426fee
push str.string_too_long
call fcn.0042fb42
cmp edx, esi
jae 0x42739e
push ecx
push esi
lea ecx, [ebp - 0x24c]
call fcn.00401a74
mov edx, dword [ebp - 0x238]
mov edi, dword [ebp - 0x24c]
test esi, esi
je 0x427055
cmp edx, 8
lea ecx, [ebp - 0x24c]
cmovae ecx, edi
test esi, esi
je 0x42703d
lea eax, [esi + esi]
push eax
push ebx
push ecx
call fcn.00431810
mov edx, dword [ebp - 0x238]
add esp, 0xc
mov edi, dword [ebp - 0x24c]
cmp edx, 8
mov dword [ebp - 0x23c], esi
lea eax, [ebp - 0x24c]
cmovae eax, edi
xor ecx, ecx
mov word [eax + esi*2], cx
mov dword [ebp - 4], 0
mov edx, 0x104
mov ecx, dword [ebp - 0x250]
call fcn.00401d3c
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, dword [ebp - 0x250]
call fcn.00402a4c
mov ebx, dword [ebp - 0x250]
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x288], 0x42bca0
mov dword [ebp - 0x284], 0x42bcc0
mov dword [ebp - 0x278], 0x42bca0
mov dword [ebp - 0x274], 0x42bcc0
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x288]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x378]
call fcn.00426de0
mov esi, eax
mov dword [ebp - 0x254], esi
test esi, esi
jne 0x427951
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x354]
push eax
lea edx, [ebp - 0x378]
lea ecx, [ebp - 0x340]
call fcn.0042b3c0
mov esi, eax
add esp, 8
test esi, esi
je 0x42711b
lea edx, [ebp - 0x354]
lea ecx, [ebp - 0x340]
call fcn.00428f10
mov dword [ebp - 0x254], esi
test esi, esi
jne 0x427951
xor edx, edx
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x27c], esi
cmp dword [ebp - 0x33c], edx
jbe 0x42717f
mov edi, dword [ebp - 0x31c]
mov ebx, dword [ebp - 0x320]
nop dword [eax + eax]
mov eax, dword [ebp - 0x324]
movzx ecx, byte [ebx + edx]
add ecx, dword [eax + edx*4]
inc edx
add esi, dword [edi + ecx*8]
mov eax, dword [edi + ecx*8 + 4]
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x27c], esi
cmp edx, dword [ebp - 0x33c]
jb 0x427150
mov ebx, dword [ebp - 0x264]
push 0
push 0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b8], 0
call fcn.00428690
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c0]
push 8
mov dword [ebp - 0x2c0], 0x3f800000
call fcn.004280d0
push 0x208
mov byte [ebp - 4], 6
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x290], 0xffffffff
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x28c], 0
call fcn.00432310
mov eax, dword [ebx + 0x10]
lea esi, [ebx + 0x10]
add esp, 0xc
cmp dword [ebx + 0x14], 8
jb 0x42722b
mov ebx, dword [ebx]
add eax, eax
push eax
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00431810
mov eax, dword [esi]
lea ebx, [ebp - 0x218]
xor esi, esi
add esp, 0xc
mov dword [ebp - 0x258], esi
lea ebx, [ebx + eax*2]
mov dword [ebp - 0x274], ebx
cmp dword [ebp - 0x300], esi
jbe 0x42790b
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
nop dword [eax]
mov eax, dword [ebp - 0x2cc]
mov edx, dword [eax + esi*4 + 4]
mov ecx, dword [eax + esi*4]
sub edx, ecx
test ebx, ebx
je 0x4272aa
mov eax, dword [ebp - 0x2c8]
lea esi, [eax + ecx*2]
test edx, edx
je 0x4272a4
mov ecx, ebx
sub esi, ebx
mov ax, word [esi + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
sub edx, 1
jne 0x427294
mov esi, dword [ebp - 0x258]
push 0x2f
push ebx
call fcn.004330d2
add esp, 8
test eax, eax
je 0x4272d8
mov edi, 0x5c
nop
push 0x2f
push eax
mov word [eax], di
call fcn.004330d2
add esp, 8
test eax, eax
jne 0x4272c0
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov eax, dword [ebp - 0x2f8]
mov ecx, esi
and ecx, 7
mov ebx, 0x80
sar ebx, cl
mov ecx, esi
shr ecx, 3
mov dword [ebp - 0x264], ecx
test byte [ecx + eax], bl
je 0x427529
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x220], 0
mov edx, 7
mov word [ebp - 0x230], ax
mov dword [ebp - 0x21c], edx
cmp word [ebp - 0x218], ax
jne 0x4273c2
xor esi, esi
mov edi, dword [ebp - 0x230]
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x218]
cmp ecx, eax
jb 0x4273ef
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
cmp edx, 8
cmovae ecx, edi
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x218]
cmp eax, ecx
jbe 0x4273ef
cmp edx, 8
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x218]
cmovae ecx, edi
sub eax, ecx
push esi
sar eax, 1
push eax
lea eax, [ebp - 0x230]
push eax
mov ecx, eax
call fcn.0040189d
jmp 0x42746d
test esi, esi
jne 0x427013
cmp edx, 8
mov dword [ebp - 0x23c], esi
lea eax, [ebp - 0x24c]
cmovae eax, edi
xor ecx, ecx
mov word [eax], cx
jmp 0x427055
lea eax, [ebp - 0x218]
push eax
call fcn.00433d15
mov edx, dword [ebp - 0x21c]
add esp, 4
mov esi, eax
cmp edx, 8
jb 0x42733a
mov edi, dword [ebp - 0x230]
mov eax, edi
jmp 0x427346
cmp esi, 0x7ffffffe
ja 0x426fe4
cmp edx, esi
jae 0x427505
push dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
push esi
call fcn.00401a74
mov edx, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x230]
test esi, esi
je 0x427479
cmp edx, 8
lea ecx, [ebp - 0x230]
cmovae ecx, edi
test esi, esi
je 0x427455
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
call fcn.00431810
mov edx, dword [ebp - 0x21c]
add esp, 0xc
mov edi, dword [ebp - 0x230]
cmp edx, 8
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x230]
cmovae eax, edi
xor ecx, ecx
mov word [eax + esi*2], cx
mov edx, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x230]
mov byte [ebp - 4], 7
lea esi, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
cmp edx, 8
mov edx, 0x811c9dc5
cmovae esi, edi
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x4274b1
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4274a0
mov esi, dword [ebp - 0x258]
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x380]
mov dword [ebp - 0x2a0], edx
push eax
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 0x29c], esi
call fcn.004285d0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x4278a7
mov ecx, dword [ebp - 0x230]
inc edx
push 2
call fcn.00401b8c
add esp, 4
jmp 0x4278a7
test esi, esi
jne 0x427425
cmp edx, 8
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x230]
cmovae eax, edi
xor ecx, ecx
mov word [eax], cx
jmp 0x42746d
lea eax, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x42756a
lea eax, [ebp - 0x218]
push eax
call fcn.00433d15
add esp, 4
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040192a
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x234]
cmp dword [eax + 0x14], 8
jb 0x42758f
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ecx, dword [ebp - 0x234]
call fcn.00402a4c
mov eax, dword [ebp - 0x234]
cmp dword [eax + 0x14], 8
jb 0x4275af
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4275d3
mov eax, dword [ebp - 0x234]
cmp dword [eax + 0x14], 8
jb 0x4275c8
mov eax, dword [eax]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x4275f3
mov ecx, dword [ebp - 0x230]
inc edx
push 2
call fcn.00401b8c
add esp, 4
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x270], 0
push eax
lea eax, [ebp - 0x354]
mov dword [ebp - 0x260], 0
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x290]
push eax
push esi
lea edx, [ebp - 0x378]
lea ecx, [ebp - 0x340]
call fcn.0042b7f0
add esp, 0x20
mov dword [ebp - 0x254], eax
test eax, eax
jne 0x42790b
push eax
push 0x80
push 2
push eax
push 1
push 0x40000000
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 9
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [ebp - 0x25c], esi
cmp esi, 0xffffffff
je 0x42768d
xor eax, eax
jmp 0x42768f
call edi
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x254], eax
mov ecx, dword [ecx + 0x24]
test ecx, ecx
je 0x427749
add ecx, 4
test eax, eax
jne 0x4276c0
push eax
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004067ea
jmp 0x427743
lea eax, [ebp - 0x254]
push eax
push 1
lea eax, [ebp - 0x218]
push eax
call fcn.004067ea
cmp eax, 1
jne 0x42771b
push 0
push 0x80
push 2
push 0
push eax
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [ebp - 0x25c], esi
cmp esi, 0xffffffff
je 0x427711
mov dword [ebp - 0x254], 0
jmp 0x427751
call edi
mov dword [ebp - 0x254], eax
jmp 0x427749
cmp eax, 2
jne 0x42773a
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 6
call fcn.00426e80
mov esi, dword [ebp - 0x258]
jmp 0x4278ad
cmp eax, 3
je 0x4278c7
mov eax, dword [ebp - 0x254]
test eax, eax
jne 0x4278f5
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 0x260]
mov edx, dword [ebp - 0x270]
mov edi, dword [ebp - 0x260]
push eax
mov dword [ebp - 0x260], edi
lea edx, [edx + ecx]
lea ecx, [ebp - 0x25c]
call fcn.0042bac0
add esp, 4
test eax, eax
jne 0x427795
xor ecx, ecx
mov eax, 0xb
cmp dword [ebp - 0x260], edi
cmove eax, ecx
mov dword [ebp - 0x254], eax
test eax, eax
jne 0x4278d8
mov eax, dword [ebp - 0x268]
add dword [ebp - 0x280], edi
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x4277ce
lea eax, [ebp - 0x280]
add ecx, 4
push eax
push 2
lea eax, [ebp - 0x218]
push eax
call fcn.004067ea
mov eax, dword [ebp - 0x2e4]
xor ecx, ecx
mov edi, dword [ebp - 0x264]
xor edx, edx
test eax, eax
je 0x4277f6
test byte [eax + edi], bl
je 0x4277f6
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x258]
lea ecx, [eax + ecx*8]
mov eax, dword [ebp - 0x2dc]
test eax, eax
je 0x427814
test byte [eax + edi], bl
je 0x427814
mov eax, dword [ebp - 0x2d8]
mov edx, dword [ebp - 0x258]
lea edx, [eax + edx*8]
test ecx, ecx
jne 0x42781c
test edx, edx
je 0x427827
push ecx
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
cmp esi, 0xffffffff
je 0x42784a
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x427840
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
jmp 0x42784c
mov dword [ebp - 0x25c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x254], eax
test eax, eax
jne 0x4278c7
mov eax, dword [ebp - 0x2ec]
mov esi, dword [ebp - 0x258]
test eax, eax
je 0x427898
test byte [eax + edi], bl
je 0x427898
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [eax + esi*4]
test ecx, 0xf0000000
je 0x427882
and ecx, 0x7fff
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0x14], 8
jb 0x427890
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 6
call fcn.00426e80
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
inc esi
mov dword [ebp - 0x258], esi
cmp esi, dword [ebp - 0x300]
jae 0x42790b
mov ebx, dword [ebp - 0x274]
jmp 0x427270
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 6
call fcn.00426e80
jmp 0x42790b
mov byte [ebp - 4], 6
cmp esi, 0xffffffff
je 0x42790b
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x42790b
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
jmp 0x42790b
mov byte [ebp - 4], 6
cmp esi, 0xffffffff
je 0x42790b
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x42790b
call edi
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x2c0]
push eax
push dword [ebp - 0x294]
call fcn.004279e0
push dword [ebp - 0x26c]
lea eax, [ebp - 0x288]
push eax
call dword [ebp - 0x284]
mov esi, dword [ebp - 0x254]
lea ecx, [ebp - 0x2c0]
add esp, 8
call fcn.00427ed0
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x35c]
test eax, eax
je 0x427970
push eax
lea eax, [ebp - 0x354]
push eax
call dword [ebp - 0x350]
add esp, 8
cmp dword [ebp - 0x2c8], 0
je 0x42798a
lea edx, [ebp - 0x354]
lea ecx, [ebp - 0x340]
call fcn.00428f10
mov edx, dword [ebp - 0x238]
cmp edx, 8
jb 0x4279a6
mov ecx, dword [ebp - 0x24c]
inc edx
push 2
call fcn.00401b8c
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fb8d
mov esp, ebp
pop ebp
ret 8